Akamai Technologies, Inc.

Soha Systems, Inc.

Seetharama Sarma Ayyadevara

Stephan Benny

Seemant Choudhary

Haseeb Siddique Budhani

Hanumantharao Kavuluru

Punit Kandoi

Pravin Tatti

Venukrishna Prasad

Charles E Gero

Shravan Kumar Mettu

Robert Lauro Quiros

Poornima Venkatesha, Sr

Sumeet Gupta

Rupinder Gill

Rohit Verma

Manoj Kumar

Rupinder Singh Gill

Priyatham Phani Srinath Adigopula

Benny Stephen

A method of traffic forwarding and disambiguation through the use of local proxies and addresses. The technique leverages DNS to on-ramp traffic to a local proxy. The local proxy runs on the end user's device. According to a first embodiment, DNS is used to remap what would normally be a wide range of IP addresses to localhost based on 127.0.0.0/8 listening sockets, where the system can then listen for connections and data. In a second embodiment, a localhost proxy based on a TUN/TAP interface (or other packet interception method) with a user-defined CIDR range to which the local DNS server drives traffic is used. Requests on that local proxy are annotated (by adding data to the upstream connection).

Traffic forwarding and disambiguation by using local proxies and addresses

A method of enabling single sign-on (SSO) access to an application executing in an enterprise, wherein authorized, secure access to specific enterprise applications are facilitated via an enterprise-based connector. In response to successful authentication of an end user via a first authentication method, a credential associated with the successful authentication is encrypted to generate an encrypted user token. The encrypted user token is then forwarded for storage in a database accessible by the enterprise-based connector. Following a redirect (e.g., from a login server instance) that returns the end user to the enterprise-based connector, the encrypted user token is fetched and decrypted to recover the credential. The credential so recovered is then used to attempt to authenticate the user to an application via a second authentication method distinct from the first authentication method. Typically, the first authentication method is an HTML form-based authentication initiated from a client browser, and the second authentication method is one of: NTLM, and Kerberos.

Providing single sign-on (SSO) in disjoint networks with non-overlapping authentication protocols

A mechanism to share cryptographic material across entities that may not have a direct trust relationship between or among each other, or no network connectivity, or some combination thereof, but where participating entities do share a trust relationship (or trusted connection(s)) with a common entity, sometimes referred to herein as a 'conduit' entity. This technique enables such entities to leverage their trust relationship with a common 'conduit' entity to share cryptographic material between or among themselves.

Cryptographic material sharing among entities with no direct trust relationship or connectivity

A service consumer that utilizes a cloud-based access service provided by a service provider has associated therewith a network that is not capable of being controlled by the service provider. An enterprise connector is supported in this uncontrolled network, preferably as an appliance-based solution. According to this disclosure, the enterprise configures an appliance and then deploys it in the uncontrolled network. To this end, an appliance is required to proceed through a multi-stage approval protocol before it is accepted as a 'connector' and is thus enabled for secure communication with the service provider. The multiple stages include a 'first contact' (back to the service) stage, an undergoing approval stage, a re-generating identity material stage, and a final approved and configured stage. Unless the appliance passes through these stages, the appliance is not permitted to interact with the service as a connector. As an additional aspect, the service provides various protections for addressing scenarios wherein entities masquerade as approved appliances.

Uniquely identifying and securely communicating with an appliance in an uncontrolled network

A system is provided to deliver an application, hosted by a private application provider system, over a network to a user device, comprising: an application delivery system that includes a first network interface, a network security interface and a second network interface; wherein the network security interface is configured to determine whether a user or device request for access to an application is valid, and in response to determining that the user or device request for access to the first application is valid, to send the user or device request to the application agent.

Secure application delivery system with dial out and associated method

A system to deliver an application, hosted by a private application provider, over a network to a user device comprising: an application delivery system that includes, a frontend network interface that includes at least one first traffic director (FTD) instance; a network security interface that includes a plurality of traffic processing server (TPS) instances; a backend network interface that includes at least one backend traffic director (BTD) instance; and at least one agent that is associated with the application and that is disposed within the private application provider system; wherein a federated TLS ticket is used to filter TLS connection requests received by an FTD instance; and wherein a TLS extension is used to filter TLS connection requests received by a BTD instance.

Filtering TLS connection requests using TLS extension and federated TLS  tickets

A system to deliver an application, hosted by a private application provider, over a network to a user device comprising: an application delivery system that includes, a frontend network interface that includes at least one first traffic director (FTD) instance; a network security interface that includes a plurality of traffic processing server (TPS) instances; a backend network interface that includes at least one backend traffic director (BTD) instance; and at least one agent that is associated with the application and that is disposed within the private application provider system; wherein a federated TLS ticket is used to filter TLS connection requests received by an FTD instance; and wherein a TLS extension is used to filter TLS connection requests received by a BTD instance

Filtering TLS connection requests using TLS extension and federated TLS tickets

A system is provided to deliver an application, hosted by a private application provider, over a network to a user device comprising: an application delivery system that includes a first network interface, a network security interface, and a second network interface; an application agent is disposed within the private application provider system. wherein the first network interface receives an encrypted user or device request for access to the hosted application sent over the network and to send the user or device request to the network security interface; wherein the network security interface is configured to decrypt the request, to validate request, to re-encrypt the request and to send the encrypted request to the second network interface; wherein the second network interface is configured to send the encrypted request over the network to the agent; and wherein the agent is configured to send the request to the hosted application.

Secure application delivery system with security services interface in the cloud

A system is provided comprising: an application delivery system that includes, a first network interface, a network security interface, and a second network interface; an agent is disposed within one or more private application provider systems; a security network interface instance determines whether a received request is valid, and in response to determining that the received user or device request is valid, to send the received request to a respective second network interface instance for delivery to the agent.

Growing community of inventors

San Jose, CA, United States of America

Seetharama Sarma Ayyadevara