Skyport Systems, Inc.

Cisco Technology, Inc.

Iotium, Inc.

Juniper Networks, Inc.

Palo Alto Networks, Inc.

Srivatsan Rajagopal

Robert Stephen Rodgers

Philippe Lacroute

William Norman Eatherton

Stefan Alexander Dyckerhoff

Thomas John Giuli

Keith Eric Holleman

Edward Ronald Swierk

Michael John Beesley

Vijay Krishnaji Tapaskar

Daniel Sergeevich Selifonov

Keith Anthony Low

Paul Edward Fraley

Neil Vincent Geraghty

Dhruva Narasimhan

Dhawal Tyagi

Ron Victor

Jayant Jain

Brian Russell Kean

Pramod Srinivasan

Srinath Bayareddy

Mingfei Peng

Aditya Thakur

Harieasswar Lakshmidevi

Techniques for wildcard based private application access are disclosed. In some embodiments, a system, a process, and/or a computer program product for wildcard based private application access includes receiving a request for access to an application over a secure access service edge (SASE) network for a user associated with an enterprise; determining if the request for access to the application matches a wildcard (e.g., the wildcard can be configured by an administrator of the enterprise for matching a fully qualified domain name (FQDN) for the application); and automatically configuring access information (e.g., IP address, protocol, and destination port) for the application that matches the wildcard.

Wildcard based private application access

In one aspect, a computerized method for implementing edge web services includes the step of providing an edge device. The edge device is provided for free to a customer. The method includes the step of monitoring a usage on the edge device by the customer. The method includes the step of charging an edge-device entity based on the usage of the edge device and an application in the edge device. An orchestrator communicates the edge device usage statistics to an enterprise system that provided the edge device to the customer.

Methods and systems for managing edge web services

Disclosed herein are various systems, apparatuses, software, and methods relating to data diode-TCP proxy with a User Datagram Protocol (UDP) across a wide area network (WAN) comprising providing a WAN data diode using a uni-directional semantics protocol, providing a set of data diode proxies in either end of a point-to-point WAN link, providing a symmetric key encryption semantics to extend the WAN data diode securely across a WAN that is specified, wherein the symmetric key encryption semantics are implemented through the set of data diode proxies on either end of the point-to-point WAN link, employing a unidirectional protocol in communication transmitted using the WAN, and, with data diode proxies, terminating one or more data channels on either end of the point-to-point WAN link or transporting a requisite information across the WAN over the uni-directional protocol.

Methods and systems of a software data diode-TCP proxy with UDP across a WAN

In general, embodiments of the invention relate managing the interaction of applications with one or more file systems and/or data managed by the file systems. More specifically, embodiments of the invention relate to providing applications with access to an overlay file system (OFS) and then servicing OFS operations using a file system module and one or more underlay file systems (UFSes) that are not directly accessible to the applications.

Method and system for managing file system access and interaction

A method and system for deploying applications. The method includes deploying an application image of an application to a computing device, where the application is accessible using a first uniform resource locator (URL). The method also includes sending an application creation message to an authoritative domain name system (DNS) server to create a record mapping the first URL to a second URL. The first URL is in a first domain and the second URL is in a second domain. The method further includes providing, to the computing device, a digital certificate associated with the application. The method further includes generating certificate data using the digital certificate and sending, to a remote application server, the second URL and certificate data. A client software module may establish a connection to the application on the computing device using the second URL and the certificate data.

Method and system for software application deployment

A method and system for verifying integrity of computing devices. The method includes providing a first integrity associated with a server executing on a computing device to a management service, and receiving, in response to providing the first integrity measurement, a first mutual attestation value from the management service. The method further includes providing a second integrity associated with a network adaptor executing on a computing device to a management service, and receiving, in response to providing the second integrity measurement, a second mutual attestation value from the management service. The method further includes performing a mutual attestation between the server and the network adaptor using the first mutual attestation value and the second mutual attestation value, and notifying the management service that the mutual attestation has been successfully completed.

Method and system for verifying the integrity of computing devices

A method and system for configuring computing devices. The method includes receiving, by a computing device, a first cache list object from a management service. The method also includes comparing the first cache list object to a second cache list object on the computing device, and based on the comparing, identifying a first object fingerprint that is present in the first cache list object and that is not present in the second cache list object. The method further includes obtaining, from a location that is external to the computing device, a first object corresponding to the first object fingerprint; and updating a configuration of the computing device using the first object.

Method and system for configuring computing devices

A method and system for authenticating applications. The method includes receiving, by a service virtual machine (SVM), a secret from a management service. The SVM is executing on a computing device. The method also includes providing, by the SVM, the secret to an application executing on an application virtual machine (AVM). The AVM is executing on the computing device. The method further includes providing, by the application, the secret to a remote application server in order for the remote application server to authenticate the application.

Method and system for authentication by intermediaries

A method and system for key management. The method includes receiving, by a control domain on a server, a request for a tenant key, and obtaining an authorization secret from a management service, where the management service is external to the server. The method further includes, in response to the request, decrypting, after obtaining the authorization secret, an encrypted platform master key to obtain a platform master key, decrypting an encrypted tenant key to obtain the tenant key using the platform master key, and providing the tenant key to an entity that issued the request.

Method and system for key management

In general, embodiments of the invention relate to a method and system for managing network access for applications. More specifically, embodiments of the invention provide mock Internet Protocol (IP) addresses to the applications, where the applications may use the mock IP addresses to communicate with other systems (e.g., other computing devices, the management service, or any other system that is accessible via the network). Each mock IP address may be associated with one or more policies, where the policies dictate how packets that includes the mock IP address are processed. In one or more embodiments of the invention, the mock IP addresses may be used to maintain a class of service (CoS) between applications executing on the computing devices and an application service provider (ASP).

Method and system for managing class of service in a network

In general, embodiments of the invention relate to a method and system for managing network access for applications. More specifically, embodiments of the invention provide mock Internet Protocol (IP) addresses to the applications, where the applications may use the mock IP address to communicate with other systems. Each mock IP address may be associated with one or more policies, where the policies dictate how packets that include the mock IP address is processed.

Method and system for managing network access

A method and system for accessing local resources. The method includes intercepting, by a proxy, a request from an application to access a local resource, where the application is executing in an application virtual machine (AVM) on a computing device and where the proxy is executing on a service virtual machine (SVM) on the computing device. The method further includes replacing, by the proxy, a placeholder credential in the request with a local resource credential to obtain a second request. The method also includes sending, by the proxy, the second request to the local resource, receiving, by the proxy, a response to the second request from the local resource, and providing the response to the application.

Method and system for protecting credentials

The disclosed computer-implemented method for facilitating dependency-ordered delivery of data sets to applications within distributed systems may include (1) receiving, at a queue of an application running within a distributed system, a data set from at least one other application running within the distributed system, (2) determining that the data set has a dependency on at least one other data set that has yet to arrive, (3) gating the data set at the queue due at least in part to the dependency, (4) receiving, at the queue, the other data set from the other application, (5) determining that the dependency has been satisfied, and then (6) delivering the data set and the other data set to the application to enable the application to process the data set and the other data set in accordance with the dependency. Various other methods, systems, and computer-readable media are also disclosed.

Growing community of inventors

Cupertino, CA, United States of America

Srivatsan Rajagopal