Citrix Systems, Inc.

Other

Kenneth Bell

Anoop Reddy

Georgios Oikonomou

Kurt Roemer

Leo C Singleton, Iv

Jong Kann

Ricardo Fernando Feijoo

Christopher M Fleck

Mukesh Garg

Jitendra Deshpande

Vikramjeet Singh Sandhu

Himanshu Agarwal

Vivek Koni Raghuveer

Mark D Howell

Balasubramanian Swaminathan

Manbir Chauhan

Aditya Ranjan

George Oikonomou

A computer system configured to identify errors in a session launch initiated by a client application is provided. The computer system includes a memory and at least one processor coupled to the memory. The at least one processor is configured to receive one or more events from one or more applications or devices involved in the session launch, wherein an event of the one or more events comprises information from an application or device call (e.g., an application programming interface (API) call) communicated during the session launch, the information comprising destination information; build a primary Directed Acyclic Graph (DAG) based on the information from the API call; determine an error identifier based on the primary DAG; retrieve a troubleshooting recommendation from a library based on the error identifier; and send the troubleshooting recommendation to the client application.

System and methods to detect faulty components during session launch

A method may include generating a proxy auto-configuration file including a function and a hash value associated with a resource. The hash value may be determined based on an identifier of the resource. The proxy auto-configuration file may include the hash value instead of a plaintext value of the identifier to obscure the plaintext value of the identifier. The proxy auto-configuration file including the function and the hash value may be sent to at least enable the function to be invoked by a web browser at one or more clients. The function may be configured to respond to being invoked by the web browser by determining, based on the hash value, whether to bypass a proxy server when accessing the resource. Related systems and computer program products are also provided.

Privacy protection for proxy auto-configuration files

The present disclosure is related to systems and methods of monitoring data of a network application. An embedded browser of a client application on a client device may initiate a request to access a network application hosted on a server. The client application may, responsive to the request, establish a secure session to communicate data of the network application to the client application for rendering in a display region of the embedded browser. The client application may decrypt the data communicated via the established secure session to monitor the network application.

Systems and methods for an embedded browser

A method may include establishing a first direct route to a gateway appliance from session clients each associated with a respective Desktop as a Service (DaaS) session run by a virtual session controller within a computing network, and establishing a second direct route from the gateway appliance to a virtual session connector within at least one private enterprise computing network. The method may also include relaying private enterprise network data between the session clients and the virtual session connector through the gateway appliance via the first direct route to each session client and the second direct route to the virtual session connector.

Computing system providing direct routing for desktop as a service (DaaS) sessions to a private network and related methods

The disclosure is directed to a system for improving security of SSL communications. The system can include an device intermediary between one or more servers, one or more clients, a plurality of agents, and a web service. The servers can be configured to receive SSL connections and issue SSL certificates. The device can include a virtual server associated with a respective one of the servers, such that the SSL certificate of the respective server is transmitted through the device. The device can generate service fingerprints for the one or more servers. Each service fingerprint can include information corresponding to an SSL certificate of the virtual server, one or more DNS aliases for a virtual IP address of the respective virtual server, one or more port numbers serving the SSL certificate, and an IP address serviced by the device. The device also can transmit the service fingerprints to a web service.

Systems and methods for improving security of secure socket layer (SSL) communications

The present disclosure is directed towards systems and methods for evaluating or mitigating a network attack. A device determines one or more client internet protocol addresses associated with the attack on the service. The device assigns a severity score to the attack based on a type of the attack. The device identifies a probability of a user account accessing the service during an attack window based on the type of attack. The device generates an impact score for the user account based on the severity score and the probability of the user account accessing the service during the attack window. The device selects a mitigation policy for the user account based on the impact score.

Combining internet routing information with access logs to assess risk of user exposure

The present disclosure is directed towards systems and methods for scanning of a target range of IP addresses to verify security certificates associated with the target range of IP addresses. Network traffic may be monitored between a plurality of clients and a plurality of servers over an IP address space. Traffic monitors positioned intermediary to the plurality of client and the plurality of servers can identify a target range of IP addresses in the address space for targeted scanning. The target range of IP address may be grouped into a priority queue and a scan can be performed of the target range of IP addresses to verify a security certificate associated with each IP address in the target range of IP addresses. In some embodiments, a rogue security certificate is detected that is associated with at least one IP address in the target range of IP addresses.

Systems and methods for performing targeted scanning of a target range of IP addresses to verify security certificates

Technology for providing communication connectivity between network entities located in different isolated communication networks through a centralized cloud service. A cloud service connector in a source communication network receives an initial connection request from a source end point device in the source communication network, and determines a customer name and requested service associated with the port number indicated in the request. Mappings are established between the source end point device and a destination end point device that provides the requested service from within a destination communication network that is associated with the customer name. Network traffic is conveyed between the source end point device and the destination end point device through the cloud service by tunneling packets over connections between the cloud service connector in the source communication network and the cloud service and between a cloud service connector in the destination communication network and the cloud service.

Providing communication connectivity between disparate network entities located in isolated communication networks through a centralized cloud service

Aspects herein describe techniques for brokering hosted resources in a virtual desktop infrastructure (VDI) using connection leases to reduce demand on connection brokers and to allow hosted services to be maintained even in the event of a broker outage. When a client device desires to connect to a hosted resource (e.g., a hosted desktop or a hosted application), the client device may present a lease token to the session host. The lease token is a self-sustaining package of data from which a session host can determine whether the requesting client device is authorized to access one or more resources hosted by that session host. The lease token may be cryptographically signed to ensure its contents have not been altered, and further that the lease token originated from a trusted source. Lease tokens may be stored independently from a connection broker, thereby still being usable if the connection broker goes offline.

Growing community of inventors

Sunnyvale, CA, United States of America

Kenneth Bell