Cyral Inc.

Srinivas Nageswarrao Vadlamani

Manav Ratan Mital

Pramod Chandraiah

Hugo Araújo De Sousa

Kaizen Navid Towfiq

Timothy Do Nguyen

Pedro Henrique Bragioni Las-Casas

Hugo ARAÚJO De Sousa

A method and system for performing at least one service are disclosed. The method and system include receiving a communication for a data source at a wrapper. The wrapper includes a dispatcher and at least one service. The dispatcher receives the communication and is data agnostic. The method and system also include providing the communication from the dispatcher to the data source and to the at least one service. The at least one service inspects the communication and may perform additional functions.

Architecture having a protective layer at the data source

A method and system for performing federated identity management are described. The method and system include receiving a communication for a data source at a wrapper. The wrapper includes a dispatcher and a service. The dispatcher receives the communication and is data agnostic. The communication corresponds to end user credentials for an end user. The method and system include providing the communication from the dispatcher to the data source and to the service. The method and system also use the service to authenticate the end user based on the end user credentials and utilizing federated identity management.

Federated identity management for data repositories

A method for accessing a data repository by a service is described. The method includes requesting an authenticator for credentials using a role-based identity. The services receives, from the authenticator, temporary data repository access credentials that are based on the role-based identity. The temporary data repository access credentials are abstracted from the credentials. The service accesses the data repository using the temporary data repository access credentials.

Credential management service

A technique for intruder detection is described. Communications for a data source in an organization are intercepted and analyzed to identify an intruder detection signature. An intrusion is determined based on the intruder detection signature and an alarm generated based on the intrusion.

Intruder detection for a network

A method and system are disclosed. The method and system include receiving, at a wrapper, a communication and a context associated with the communication from a client. The communication is for a data source. The wrapper includes a dispatcher and a service. The dispatcher receives the communication and is data agnostic. The method and system also include providing the context from the dispatcher to the service. In some embodiments, the method and system use the service to compare the context to a behavioral baseline for the client. The behavioral baseline incorporates a plurality of contexts previously received from the client.

Behavioral baselining from a data source perspective for detection of compromised users

A method and system for performing query analysis are described. The method and system include receiving a query for a data source at a wrapper. The wrapper includes a dispatcher and a service. The dispatcher receives the query and is data agnostic. The method and system also include providing the query from the dispatcher to the data source and to the service as well as analyzing the query using the service.

Query analysis using a protective layer at the data source

A mechanism for providing connection to a database is described. A connection to the database is intercepted. The connection is assigned to an instance of the database. A sidecar is configured to proxy the connection to the database. The sidecar is stateless and passes all communications for the connection to the instance of the database.

Sidecar architecture for stateless proxying to databases

A method for providing connection between applications and a data repository is described. The method includes receiving a communication from an application for the data repository. The application is authenticated. In response to the application being authenticated, the credentials for the data repository are obtained from a data vault. The credentials are used to access the data repository while the application is free of the credentials.

Centralized applications credentials management

A method for accessing a data source is described. A communication for the data source is received from a proxy at a sidecar. The proxy mirrors the communication so that the communication is provided to the data source and the sidecar. The sidecar includes a dispatcher and service(s). The dispatcher receives the communication, is data agnostic, and provides the communication to the data source and service(s). The service(s) inspect the communication. In some embodiments, the dispatcher is an open systems interconnection (OSI) Layer 4 dispatcher and the service(s) include OSI Layer 7 service(s). The service(s) perform function(s) based on the communication.

Non-in line data monitoring and security services

A method and system for performing authentication are described. The method and system include receiving, from a client, a communication for a data source at a wrapper. The wrapper includes a dispatcher and a service. The dispatcher receives the communication and is data agnostic. The communication is provided from the dispatcher to the service. The service determines whether the client is authorized to access the data source utilizing multi-factor authentication.

Multifactor authentication at a data source

A system for adapting to topology changes in a proxy is described. The system includes a processor and a memory coupled to the processor and configured to provide the processor with instructions. The processor is configured to intercept a plurality of communications and match a communication signature for a topology update in a communication. The processor is further configured to identify topology update information in the communication and update listener(s) based on the topology update information. The processor also translates the topology update information and sends the translated topology information to a client.

Techniques for in-band topology connections in a proxy

A method and system for anonymizing data are disclosed. The method and system include receiving, at the wrapper, a request to store data in a data source. The wrapper includes a dispatcher and at least one service. The dispatcher receives the communication and is data agnostic. The method and system also include providing the request from the dispatcher to the at least one service and anonymizing, at the service(s), the data to provide anonymized data.

Growing community of inventors

San Jose, CA, United States of America

Srinivas Nageswarrao Vadlamani