Symantec Corporation

Cisco Technology, Inc.

Other

Nacho Cove Inc.

Thomas Jeffrey Enderwick

Christopher Edward Perret

Ashwath Nagaraj

Stephen Scalpone

Bruce McCorkendale

Henry Kin-Chuen Kwok

Azim Ozakil

Christopher Perret

Navindra Yadav

William E Sobel

Nicolas Popp

Atul Mahamuni

Robert Koeten

Michael S Adler

Shashi Kumar

Bora A Akyol

Aji Joseph

Dario Meluzzi

Ramakrishna Rao

Peirong Feng

Sambasivam Valliappan

Benjamin Tseng

Surya Prakash Jonnavithula

Jiing-Yang Twu

Michael Adler

Bruce Mccorkendale

Digital communication messages processed by each specific one of a plurality of client computers are tracked and indexed. A query made by a first client computer against a base of digital communication messages of the organization is received by the client computers. The indexed communication messages are searched based on the query, and a search result is obtained. Relevance between the query and the search result is determined. Users operating client computers are prompted to indicate whether to respond to the query responsive to determining that the relevance meets a criterion. An indication to respond to the query is received by one or more client computers of the plurality. One or more responses are generated by the one or more client computers and transmitted to the first client computer.

Privacy-protecting inter-user digital communication message search

A computer-implemented method for remotely configuring applications may include (1) identifying a centrally administered application that includes a configuration specification that defines at least one setting available for the centrally administered application and that is prepared to provide the configuration specification, (2) identifying, by extracting the configuration specification for the centrally administered application, a settings field of the configuration specification, (3) creating a settings configuration policy that specifies a value for the settings field, (4) detecting an instance of the centrally administered application that includes the configuration specification, and (5) pushing the value for the settings field to the instance of the centrally administered application in accordance with the settings configuration policy. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for remotely configuring applications

A system and method are disclosed for deploying applications to end point devices. The applications are obtained from a marketplace that checks the applications and packages them for endpoint use according to certain policies. Packaging an application includes compiling or assembling and linking the application, possibly with a framework and possibly with a binding token, which can be a device binding token and/or a user binding token. The application is loaded onto an endpoint device and if the application is bound to the device and the user is allowed to use the application, the application is enabled to be used on the endpoint device. A gateway between the endpoint device and an authentication server helps to authenticate the user. The gateway also manages data transfers between the endpoint device and a data server according to a selected protocol.

System for the distribution and deployment of applications, with provisions for security and policy conformance

A computer system receives, from a user device, a request to access a resource within a network of an organization and receives access credentials associated with an application, a user and the user device. The computer system identifies an application identifier, a user identifier and a device identifier and determines whether the combination of these identifiers satisfies an access policy. If the combination of application identifier, user identifier and device identifier satisfies the access policy, then the computer system grants the application access to the resource within the network of the organization.

Systems and methods for identifying a secure application when connecting to a network

Multiple apps of an ecosystem on a computer securely exchange encrypted data according to an information control policy of an enterprise, without allowing unauthorized access from outside of the ecosystem. An ecosystem agent creates an ecosystem directory, which contains policy information and identification information concerning each specific app in the ecosystem, including the ecosystem agent. Each ecosystem app generates an asymmetric key pair, the public key of which it shares only with apps in the ecosystem through the directory. The ecosystem agent's private key is used to encrypt the directory. Data is securely communicated between apps in the ecosystem, by encrypting and decrypting messages and data objects with the appropriate ecosystem app keys. Each specific app in the ecosystem complies with enterprise information control policy. Ecosystem apps can read a policy from the directory, and receive policy updates from the enterprise.

Secure app ecosystem with key and data exchange according to enterprise information control policy

A computer-implemented method for providing secure mobile email communications is described. At least one application programming interface (API) of a native email client is hooked in order to transmit data securely via email. The native email client is native to an operating system of the mobile device. An email originating from a registered application is detected, via the hooked API. The email includes the data to transmit securely. The registered application is registered in a registry according to a mobile application authentication procedure. The registry includes a plurality of registered applications authenticated according to the mobile application authentication procedure.

Systems and methods for securing email in mobile devices

In one embodiment, a method includes receiving a communication from an endpoint device at a network access device located within a data path between the endpoint device and a network, identifying a network admission control policy for the endpoint device, enforcing at the network access device, the network admission control policy for traffic received from the endpoint device, and forwarding at the network access device, traffic from the endpoint device to the network in accordance with the network admission control policy. An apparatus is also disclosed.

Integration of network admission control functions in network access devices

A web browser that includes a network policy enforcement unit, a storage policy enforcement unit, and an ancillary policy enforcement unit is disclosed. The network policy enforcement unit controls communications between application logic of a web application and data communication APIs. The storage policy enforcement unit controls access between the web application logic and persistent storage APIs. The ancillary policy enforcement unit controls user authentication of the web application logic.

Policy enforcing browser

A computer-implemented method to revoke an application is described. The processor monitors for a revocation condition. Upon detection of the revocation condition, the process also generates a command for a framework of a managed application to revoke the managed application.

Systems and methods to manage an application

A computer-implemented method for establishing secure mobile communications is described. A virtual private network (VPN) between a mobile device and a server is established. A transmission of at least a portion of data between a first application and the server is blocked. It is determined whether the first application on the mobile device is a trusted application. Upon determining the first application is an untrusted application, a transmission of at least a portion of data between the untrusted application and the server continues to be blocked.

Systems and methods for application-policing a VPN

System for the distribution and deployment of applications with provisions for security and policy conformance

Mechanisms for storing and searching a hierarchy of policies and associations thereof are disclosed which may be particularly useful for implementing security protocols, such as, but not limited to Internet Protocol security (IPsec). For example, a hierarchy of policies is stored in a search priority order in an associative memory, with each association of a particular policy stored higher in the search priority than its associated policy and after any other policy. Therefore, a lookup operation on the associative memory will identify a matching association, if one, else its matching policy. A match of a policy instead of an association may result in a corresponding association being added in the appropriate location. For IPsec implementations, the lookup word is typically derived from the packet, with this packet being typically processed based on the identified policy or association.

Storing and searching a hierarchy of policies and associations thereof of particular use with IP security policies and security associations

Processes are disclosed in which an index value is generated for locating a security association in a security association database, such as an inbound SAD associated with the IPsec set of protocols. The index value is specified for insertion into a Security Parameter Index (SPI) field of a packet header, such as an IPsec header. For packets that are to be secured according to the policies and protocols identified in the header and the security association and that are transmitted to a particular network device or host, the index value is inserted into the SPI field of the packets by a packet sender. The packet is then parsed by a packet receiver, the index value determined from the SPI and used to identify the security association in the SAD, based solely on the index value determined from the SPI. Hence, a simple and efficient mechanism is provided for fast inbound security association lookups.

Growing community of inventors

La Jolla, CA, United States of America

Thomas Jeffrey Enderwick