Skyport Systems, Inc.

Juniper Networks, Inc.

Cisco Technology, Inc.

Keith Eric Holleman

Philippe Lacroute

William Norman Eatherton

Stefan Alexander Dyckerhoff

Thomas John Giuli

Robert Stephen Rodgers

Srivatsan Rajagopal

Edward Ronald Swierk

Michael John Beesley

Keith Anthony Low

Neil Vincent Geraghty

Paul Edward Fraley

Vijay Krishnaji Tapaskar

Daniel Sergeevich Selifonov

Nischal Sheth

Manoj Leelanivas

Der-Hwa Gan

Ping Pan

Arun Vaidyanathan

Michael Freed

Sankar Ramamoorthi

Robert M Krohn

Meenakshi S Subramanian

DeviPrasad Natesan

Philip Kruzinski

Murthy Garikiparthi

In general, embodiments of the invention relate managing the interaction of applications with one or more file systems and/or data managed by the file systems. More specifically, embodiments of the invention relate to providing applications with access to an overlay file system (OFS) and then servicing OFS operations using a file system module and one or more underlay file systems (UFSes) that are not directly accessible to the applications.

Method and system for managing file system access and interaction

A method and system for deploying applications. The method includes deploying an application image of an application to a computing device, where the application is accessible using a first uniform resource locator (URL). The method also includes sending an application creation message to an authoritative domain name system (DNS) server to create a record mapping the first URL to a second URL. The first URL is in a first domain and the second URL is in a second domain. The method further includes providing, to the computing device, a digital certificate associated with the application. The method further includes generating certificate data using the digital certificate and sending, to a remote application server, the second URL and certificate data. A client software module may establish a connection to the application on the computing device using the second URL and the certificate data.

Method and system for software application deployment

A method and system for verifying integrity of computing devices. The method includes providing a first integrity associated with a server executing on a computing device to a management service, and receiving, in response to providing the first integrity measurement, a first mutual attestation value from the management service. The method further includes providing a second integrity associated with a network adaptor executing on a computing device to a management service, and receiving, in response to providing the second integrity measurement, a second mutual attestation value from the management service. The method further includes performing a mutual attestation between the server and the network adaptor using the first mutual attestation value and the second mutual attestation value, and notifying the management service that the mutual attestation has been successfully completed.

Method and system for verifying the integrity of computing devices

A method and system for configuring computing devices. The method includes receiving, by a computing device, a first cache list object from a management service. The method also includes comparing the first cache list object to a second cache list object on the computing device, and based on the comparing, identifying a first object fingerprint that is present in the first cache list object and that is not present in the second cache list object. The method further includes obtaining, from a location that is external to the computing device, a first object corresponding to the first object fingerprint; and updating a configuration of the computing device using the first object.

Method and system for configuring computing devices

A method and system for authenticating applications. The method includes receiving, by a service virtual machine (SVM), a secret from a management service. The SVM is executing on a computing device. The method also includes providing, by the SVM, the secret to an application executing on an application virtual machine (AVM). The AVM is executing on the computing device. The method further includes providing, by the application, the secret to a remote application server in order for the remote application server to authenticate the application.

Method and system for authentication by intermediaries

A method and system for key management. The method includes receiving, by a control domain on a server, a request for a tenant key, and obtaining an authorization secret from a management service, where the management service is external to the server. The method further includes, in response to the request, decrypting, after obtaining the authorization secret, an encrypted platform master key to obtain a platform master key, decrypting an encrypted tenant key to obtain the tenant key using the platform master key, and providing the tenant key to an entity that issued the request.

Method and system for key management

In general, embodiments of the invention relate to a method and system for managing network access for applications. More specifically, embodiments of the invention provide mock Internet Protocol (IP) addresses to the applications, where the applications may use the mock IP addresses to communicate with other systems (e.g., other computing devices, the management service, or any other system that is accessible via the network). Each mock IP address may be associated with one or more policies, where the policies dictate how packets that includes the mock IP address are processed. In one or more embodiments of the invention, the mock IP addresses may be used to maintain a class of service (CoS) between applications executing on the computing devices and an application service provider (ASP).

Method and system for managing class of service in a network

In general, embodiments of the invention relate to a method and system for managing network access for applications. More specifically, embodiments of the invention provide mock Internet Protocol (IP) addresses to the applications, where the applications may use the mock IP address to communicate with other systems. Each mock IP address may be associated with one or more policies, where the policies dictate how packets that include the mock IP address is processed.

Method and system for managing network access

A method and system for accessing local resources. The method includes intercepting, by a proxy, a request from an application to access a local resource, where the application is executing in an application virtual machine (AVM) on a computing device and where the proxy is executing on a service virtual machine (SVM) on the computing device. The method further includes replacing, by the proxy, a placeholder credential in the request with a local resource credential to obtain a second request. The method also includes sending, by the proxy, the second request to the local resource, receiving, by the proxy, a response to the second request from the local resource, and providing the response to the application.

Method and system for protecting credentials

In one example, network device includes a control unit having one or more hardware-based microprocessors and an interface. The interface can receive a first time synchronization message from a master device that comprises a first TTL value. The first TTL value can be indicative of a number of hops traversed by the first time synchronization message. The interface can subsequently receive a second time synchronization message from the master device that comprises a second TTL value that is is indicative of a number of hops traversed by the second time synchronization message. The network device can also include a timing module that determines a time adjustment based at least in part on the determination that the first and second TTL values are different, and applies the time adjustment to update the time of the network device.

Time adjustment using time-to-live values

A connection between network nodes in a communication network is backed up. A failover switched path such as a label-switched path (LSP) is created starting at a first network node of a connection and ending at the second node of the connection, while bypassing the protected connection. In the event of connection failure, data is transmitted through the failover switched path (e.g., LSP). A network operator can selectively protect different types of data by using filters that bind one or more types of traffic received over one or more interfaces to different failover switched paths (LSPs).

Protecting connection traffic using filters

A connection between network nodes in a communication network is backed up. A failover label-switched path (LSP) is created starting at a first network node of a connection and endingat the second node of the connection, while bypassing the protected connection. In the event of connection failure, data is transmitted through the failover LSP. A network operator can selectively protect different types of data by using filters that bind one or more types of traffic received over one or more interfaces to different failover LSPs.

A network device receives control plane packets and data plane packets from a network. The network device includes a forwarding component that forwards the data plane packets in accordance with routing information maintained by a routing component. The forwarding component directs the control plane packets to a firewall component that processes the control plane packets to apply firewall services and detect network attacks. After processing, the firewall component loops the control plane packets back to the forwarding components for forwarding to the routing component. The firewall component may be a security service card.

Stateful firewall protection for control plane traffic within a network device

A connection between network nodes in a communication network is backed up. A failover label-switched path (LSP) is created starting at a first network node of a connection and ending at the second node of the connection, while bypassing the protected connection. In the event of connection failure, data is transmitted through the failover LSP. A network operator can selectively protect different types of data by using filters that bind one or more types of traffic received over one or more interfaces to different failover LSPs.

Growing community of inventors

Campbell, CA, United States of America

Keith Eric Holleman