International Business Machines Corporation

Cisco Technology, Inc.

Hewlett Packard Enterprise Development LP

Pruthvi Panyam Nataraj

George Mathew Koikara

Vidya Ranganathan

Madhusudanan Kandasamy

Saurabh Desai

Guha Prasad Venkataraman

Ranganathan Vidya

Sangeeth Keeriyadath

Naveen Gujje

Sanket Rathi

Amit Kumar Gupta

Mallesh K Lepakshaiah

Ajay Vishwanath Bhande

Pranav Balakumar

Sujith Rs

Bipin Tomar

Eduardo Reyes

Arun P Anbalagan

Arun Prasath Anbalagan

Techniques and architecture are described for eliminating double encryption in zero-trust network access authenticated sessions. The techniques include an endpoint client-based proxy of a network receiving, from a browser, a request to access a protected private service. The endpoint client-based proxy pauses access of the browser to the protected private service and establishes a transport layer security (TLS) connection between the endpoint client-based proxy and a zero-trust network access (ZTNA) gateway. The ZTNA gateway determines whether the protected private service uses a secure transport mechanism and establishes either a null cipher encrypted tunnel between at least the endpoint client-based proxy and the ZTNA gateway or a non-null cipher encrypted tunnel between at least the endpoint client-based proxy and the ZTNA gateway. The endpoint client-based proxy resumes access of the browser to the protected private service.

Eliminating double encryption in zero-trust network access authenticated sessions

Techniques and architecture are described for protecting non-http and TCP/UDP applications in a zero trust network access (ZTNA)/web virtual private network (VPN) environment by establishing a secure communication channel between a native application and an application server providing an application service. More particularly, the present disclosure describes techniques and architecture that leverage the firewall wherein a thin client on a client device enables a client desktop, establishes a secure channel from a native application, e.g., the client desktop, to the firewall, and acts as a proxy.

Protecting non-HTTP and TCP/UDP applications in a ZTNA/webVPN environment

An apparatus can comprise a processor and a memory. The memory can store instructions that, when executed by the processor, cause the processor to associate a plurality of consumer containers with a data container. The plurality of consumer containers can host workloads that access a data segment hosted by the data container. The plurality of consumer containers and the data container can be scheduled on different nodes of a horizontally scalable cluster. A node of the horizontally scalable cluster that hosts the data container can be identified. The plurality of consumer containers can be scheduled to execute on the node based on the association between the plurality of consumer containers and the data container.

Data based scheduling for horizontally scalable clusters

A container management system and device that includes a hibernator deployment to determine a semantic defined for applications generated to perform deployments in the container management system, determine whether the applications are active during a corresponding time period included within the semantic, and transfer the applications from an active state to an inactive state in response to the application not being inactive during the corresponding time period included within the semantic defined for the application.

Application deployment in a container management system

Embodiments of the present invention provide a system, method, and program product for domain based resource isolation in multi-core systems. A computing device determines an operation being attempted on a workload request identified with a first domain identifier. The computing device determines a processor core identified with a second domain identifier. In response to determining that processor cores identified with the second domain identifier can service workload requests identified with the first domain identifier, the computing device deploys the workload request to the processor core for servicing.

Domain based resource isolation in multi-core systems

According to one exemplary embodiment, a method for VIOS failover in an environment with a physical storage adapter is provided. The method may include assigning the physical storage adapter to a first VIOS, wherein the physical storage adapter has I/O connectivity to at least one storage device. The method may include configuring a first I/O path between the first VIOS and a second VIOS. The method may include configuring a second I/O path from a client partition to the first VIOS, wherein the second I/O path is set as a primary I/O path. The method may include configuring a third I/O path from the client partition to the second VIOS. The method may include determining the first VIOS is inaccessible. The method may include unassigning the physical storage adapter from the first VIOS. The method may include assigning the physical storage adapter to the second VIOS.

Managing VIOS failover in a single storage adapter environment

Dynamically sharing information among a plurality of adapters in a multipath input/output (MPIO) system, selecting one of the adapters to receive an input/output request based on the shared information, and sending the input/output request to that adapter.

Inter-adapter cooperation for multipath input/output systems

A trusted device having virtualized registers provides an extensible amount of storage for hash values and other information stored within a trusted device. The trusted device includes a buffer to which registers are virtualized to and from external storage, by encrypting the register values using a private device key. The registers may be platform control registers (PCRs) or other storage of the trusted device, which may be a trusted platform module (TPM). The registers are accessed in accordance with a register number. When the externally stored values are retrieved, they are decrypted and placed in the buffer. The buffer may implement a cache mechanism, such as a most recently used algorithm, so that encryption/decryption and fetch overhead is reduced. A register shadowing technique may be employed at boot time, to ensure that the trusted device is not compromised by tampering with the externally stored virtualized registers.

Trusted device having virtualized registers

Domains can also be used to control access to physical memory space. Data in a physical memory space that has been used by a process sometimes endures after the process stops using the physical memory space (e.g., the process terminates). In addition, a virtual memory manager may allow processes of different applications to access a same memory space. To prevent exposure of sensitive/confidential data, physical memory spaces can be designated for a specific domain or domains when the physical memory spaces are allocated.

Domain based access control of physical memory space

When an operating system process evaluates a rule for an operation being attempted on a logical network port, the operating system process determines whether the target logical port falls within a range of logical ports, and then determines whether the operation is associated with a permitted domain of the range of logical ports. If the operation is a bind operation, then the process attempting to bind to the target port will be allowed to bind if the target port falls within the range and the operation/process is associated with a permitted domain. Otherwise, the binding operation will not be allowed to proceed.

Domain based isolation of network ports

A network based installation management system that dynamically manages secure software installation on a client. The server is configured to determine the software required and prepare an appropriated response containing the list of software and an information file containing the respective attributes of the list of software. The server encoded this response and the encoded response is transmitted to the client. The client on receiving the response is configured to authenticate the response and install the encoded response after authentication. Highly accurate and reliable software installation using the network based installation management system may be achieved using a respective hardware element on the client and the server, which is configured to encode and decode a request and/or response suitably thereby providing a high level of security and trust in an un-trusted network environment.

Method and system for software installation

Domains can be used to secure resources of a cluster. An administrator can configure a node of a cluster as a member of a particular domain. Membership in a cluster can be restricted to nodes that are members of the particular domain. When a node generates a cluster message, a kernel process or operating system process of the node will indicate the domain(s) of the node in the cluster message. The cluster message can be a command message to read or write to a storage resource of the cluster. When the cluster storage resource node or node that controls the storage resource receives the command message, the node will examine the command message to ensure the message indicates a domain that aligns with the cluster. If the proper domain is indicated in the command message, then the command message is processed. Otherwise, the command message is denied.

Domains based security for clusters

Functionality can be implemented in an operating system to increase the granularity of isolation for objects. A domain can be defined to represent each of different entities (e.g., different departments or work groups). User identifiers and/or user credentials can be associated with the appropriate domain or domains. An administrator can then define a set of rules that govern operation(s) that can be performed on the objects based on the domains. Processes running on a system will inherit the domains of a user account logged into the system. When a process running on the system attempts to perform an operation on an object, an operating system process evaluates the domain isolation rules with an identifier of the object and a domain identifier to determine whether the operation is permitted to proceed.

Growing community of inventors

Bengaluru, India

Pruthvi Panyam Nataraj