Cisco Technology, Inc.

Nathan Sowatskey

Nancy Cam-Winget

Joseph Salowey

Chen Yehezkel Burshan

Morteza Ansari

John A Joyce

Klaas Wierenga

Susan Elizabeth Thomson

Stephen E Jerman

Michael Manning

Ian Michael Cotton

Douglas Roger Banks

Gregory John Wilkins

Greg Wilkins

Mark Paul Andrews

Mike Manning

Ritesh Kumar

Julie Oehler Schott

David Jones

Ken Jarrad

Shridhar Saurin Shah

The disclosure relates to a system and method of optimizing one or more paths between an Application Programing Interface (API) gateway and one or more endpoints. Properties associated with each of a plurality of paths between at least one device and an API gateway are collected, and the properties associated with each of the plurality of paths are monitored to determine a current level of performance for each of the paths. Using gathered data, the API gateway can then analyze, using machine learning, the current level of performance for each of the paths and the current load of the at least one device to determine if a corrective action is needed to maintain an optimal performance of the API gateway, the plurality of paths, and the at least one device.

Predictive system for optimizing API behaviors

Techniques for an Application Programming Interface (API) gateway to workload placement and load balancing in a distributed system. The API gateway may route API requests, responses, and so forth, via a plurality of paths between the API gateway, API endpoint devices and API client devices. The API gateway may collect the path properties for the plurality of paths between itself, and the client devices and API endpoints. Additionally, or alternatively, the API gateway may collect process properties indicating the statistics of specific processes. Using this data, the API gateway may determine that a particular path, a particular process, etc., has experienced performance degradation. The API gateway may further determine, and perform, a remedial action to take to remedy the performance degradation of the path or processes.

Using an application programming interface (API) gateway to manage communications in a distributed system

A Software-as-a-Service (SaaS) access control application on a client device is configured with a certificate that identifies a user, and with configuration information for one or more SaaS applications to access, and including an IDP identifier for the SaaS application. The SaaS access control application includes software to be inserted into a network software stack of the client device and software configured to serve as an identity provider for assertions. A request, made by an application on the client device to a SaaS service provider identified by a Universal Resource Locator (URL) provided during configuration of the SaaS access control application, is intercepted within the network software stack of the client device. The SaaS access control application generates an assertion based on the certificate and configuration information. The requesting application is caused to make a request to the SaaS service provider with the assertion embedded in the request.

Secure mobile client with assertions for access to service provider applications

Techniques are provided for authenticating a subject of a client device to access a software-as-a-service (SaaS) server. A network access device receives a request from a client device to establish a network session and transfers identity information of the subject, the client device and the network session to a session directory database. A request is sent to access an application on a SaaS server. If it does not contain an identity assertion that identifies the subject, the request is redirected to an identity provider device, to provide identity assertion services to the subject. A network session identifier is inserted into the request by a network access device and the request is forwarded to the identity provider device. The identity provider device uses the network session identifier to query the session directory database for the identity information to be used for a security assertion of the subject to the SaaS server.

Mechanisms to use network session identifiers for software-as-a-service authentication

Techniques are provided for authenticating a subject of a client device to access a software-as-a-service (SaaS) server. A network access device receives a request from a client device to establish a network session and transfers identity information of the subject, the client device and the network session to a session directory database. A request is sent to access an application on a SaaS server. If it does not contain an identity assertion that identifies the subject, the request is redirected to an identity provider device (IdP), to provide identity assertion services to the subject. A network session identifier is inserted into the request by a network access device and the request is forwarded to the IdP. The IdP uses the network session identifier to query the session directory database for the identity information to be used for a security assertion of the subject to the SaaS server.

A method is disclosed for determining attributes of a client connection configured for use with a telecommunications network; comparing determined attributes with location definition information stored in a configuration file; determining at least one user-defined location in the location definition information associated with the client connection based on the comparison; wherein the method is performed by one or more computing devices.

Method and apparatus for managing proxy and non-proxy requests in a telecommunications network

An example embodiment of the present invention provides a process for abstracting an implementation-independent model to an implementation-specific model during transformation in a MDA system. In the example embodiment, the MDA system comprises a transformation engine whose components might include software tools such as AndroMDA and Muse. The transformation engine accepts as input an implementation-independent model written in a modeling language such as UML that provides graphical notation to describe inheritable classes and their attributes and relationships. The transformation engine also accepts a configuration file which allows the designation of a class in the model as a manageable resource. From these inputs, the transformation engine creates a manageable resource corresponding to the class, which resource includes any subclasses by inheritance from the designated class unless the subclass is specifically excluded in the configuration file. In one embodiment, the manageable resources created by the transformation engine are WSMD manageable resources.

Abstracting transformation for model driven architecture

A method is disclosed for determining a location of a client session in a telecommunications network by comparing attributes of the client session connection to location definition information stored in a configuration file. A method of handling requests from proxy and non-proxy client connections in a telecommunications network by redirecting requests from unauthenticated proxy clients to a transparent proxy port on a captive portal such that the captive portal proxies the requests is also disclosed. The request may be directed to a service, such as a destination IP address and optional port number. A method for a proxy server to identify an edge session through an out-of-band request containing proxy metadata to a web portal for secure (HTTPS) requests is also disclosed. The edge session is identified for the web portal through a hostkey determined by the proxy server.

Method and apparatus for managing proxy and non-proxy requests in telecommunications network

A method for managing contents of a web site. A request to access a web site is received from a requestor, wherein the web site comprises a sparse tree directory comprising elements used to build the web site. The sparse tree directory comprises a web site page hierarchy located at the root directory of a shape hierarchy, wherein the web site page hierarchy comprises a directory structure of the web application and the shape hierarchy defines user shapes accommodated by the web application. The sparse tree directory also comprises a first subdirectory corresponding to a first value of a dimension and a second subdirectory corresponding to a second value of the dimension, wherein the first subdirectory comprises a first element and the second subdirectory comprises a second element. A shape of the requestor is generated, wherein the shape defines elements that can be accommodated by the requestor. The sparse tree directory is cached. The sparse tree directory is searched for elements defined by the shape. A response to the request is created based on the shape.

Growing community of inventors

Madrid, Spain

Nathan Sowatskey