Citrix Systems, Inc.

Other

Thomas Michael Kludy

Ricardo Fernando Feijoo

Steven A Keller

Ayush Jain

Thomas J Hammond

Felipe Leon

Ashish Gujarathi

Michael Paul Wehniainen

Juliano Maldaner

Andrew John Ogle

Leo C Singleton, Iv

Jose Reyes

Luis Garcia Menchaca

Alejandro Carrasquilla

Joel Kevin Lawrence Cardoza

Thierry Duchastel

Christopher Lawrence

Andrew Ogle

A principal database is described in which each entry includes one principal identity, and one or more alias identities that may each have an authorization scope. Principal identity attributes include a principal identifier and login credentials, and alias identity attributes include an authorization scope and login credentials. Responsive to successfully authenticating the user for a first application (a multiple-identity application), based on the alias identity login credentials, an access token containing both the alias identity attributes and the principal identity attributes is transmitted to the first application, causing the first application to grant a scope of access based on the authorization scope. Responsive to a request to authenticate the user for a second application (a single-identity application), the access token is transmitted to the second application without re-authenticating the user, causing the second application to grant a scope of access based on the principal identifier.

Identity management connecting principal identities to alias identities having authorization scopes

Aspects of the disclosure relate to cloud service automation of common image management. An image update orchestrator may receive a request to upgrade a virtual machine image. The image update orchestrator may spin up an instance of a virtual machine and provision the instance of the virtual machine with a virtual machine image and cause to install a plurality of software updates to the instance of the virtual machine. The image update orchestrator may take a snapshot of the instance of the virtual machine and generate a sealed master image. Finally, the image update orchestrator may cause to deploy, to one or more policy managed devices, the sealed master image.

Cloud service automation of common image management

Aspects of the disclosure relate to extending single-sign-on to relying parties for federated logon providers. An enterprise identity provider server may receive a first authentication token previously issued to an enterprise server by the enterprise identity provider server. Subsequently, the enterprise identity provider server may retrieve, from a token store, a second authentication token associated with a federated identity service provided by a federated identity provider server. The enterprise identity provider server may refresh the second authentication token with the federated identity service provided by the federated identity provider server to obtain a refreshed authentication token. Finally, the enterprise identity provider server may send the refreshed authentication token to the enterprise server, which may enable user devices managed by the enterprise server to access one or more resources provided by a third party system using the federated identity service.

Extending single-sign-on to relying parties of federated logon providers

Methods and systems for coordinating migration for a database of a service are described herein. Multiple releases of the service may be simultaneously implemented, and these multiple releases may access a shared database. As new releases of the service are activated, the database may be incrementally migrated to a new data schema version. The new data schema version may be compatible with each release of the service that is in use. After a migration has begun, instances of the service may be instructed to perform database operations using methods compatible with the new data schema version. Continuation tokens may be returned during the migration, which indicate portions of the shared database that have not yet been migrated. If an error occurs during the migration, the continuation tokens may be discarded, and the migration may be restarted.

Data migration for a shared database

Embodiments of the disclosure include systems and methods for secure storage and/or retrieval of customer secrets by, e.g., a cloud services provider. According to methods, secret data that is to be securely stored may be transmitted, along with an initialization vector, to an encryption service for encryption using a private key stored on in a remote key vault. The encrypted data can be returned and stored, in its encrypted form, in a secure storage along with the initialization vector data. To retrieve the securely stored data, embodiments disclose retrieving the encrypted form of the data and transmitting it, along with its related initialization vector data, to the encryption service for decryption using the private key stored in the remote key vault. The decrypted data can then be made available to a requesting product service.

Secure information storage

Methods and systems for routing a user request for a service to a version of the service in a geographical region associated with the user are described herein. The service may be deployed in multiple geographical regions, and the service may have multiple versions in each of the geographical regions. A user device may send a request for a service to a first server in a geographical region. The first server may determine whether the user is associated with the geographical region. Responsive to determining that the user is not associated with the geographical region, the first server may ask one or more servers in other geographical regions whether the user is associated with any of the other geographical regions.

Multiple geography service routing

Systems and methods for operating a system including a plurality of directories. The methods comprises: receiving, by a computing device, a first search request for identity information associated with an individual user of the system that is in a common request format supported by a common Application Programming Interface ('API'); performing first operations by the computing device to generate second search requests by transforming a format of the first search request from the common request format to a plurality of directory search request formats respectively supported by the plurality of directories; and respectively communicating the second search requests to the plurality of directories for retrieving the identity information associated with an individual user of the system.

Normalizing API calls for a suite of multi-tenant products across disparate multi-tenant and single-tenant identity directories

A method of performing operations involving accessing a set of protected computing resources of a computing device includes (a) receiving, by a frontend service, an instruction via a network connection, the instruction directing the computing device to perform an operation involving accessing the set of protected resources, the set of protected computing resources being configured to refuse access to the frontend service, (b) in response to receiving the instruction, sending a request from the frontend service to a backend service, the request instructing the backend service to access the set of protected resources, the backend service being configured to not communicate via the network connection, the set of protected computing resources being configured to permit access to the backend service, and (c) in response to the backend service receiving the request from the frontend service, the backend service accessing the set of protected resources in fulfillment of the operation.

Segregation of protected resources from network frontend

Described embodiments provide systems and methods for stateless modification of operating system registry data across network boundaries. The system includes a processor coupled to memory and configured to execute instructions to receive, within a first network, a request to apply a modification to an operating system registry of a second device within a second network different from the first network. The processor queues data describing the requested modification, receives a polling request from the second device, and transmits, to the second device responsive to the polling request, the queued data describing the requested modification for the second device to apply to the operating system registry of the second device. For example, the requested modification may be to create a key, to create a value, to delete a key, or to delete a value.

Cloud to on-premises windows registry settings

Secure communications between services or components of a cloud computing system, are facilitated by generating at a first service provided by a first computing entity of a cloud computing system, a request for computing resources, generating at the first computing entity a digital data signature based at least on the request, using a private key associated with the first service; and inserting the digital data signature within an HTTP header associated with the request. A computer data network is used to communicate the request to a second service. The second service extracts the digital data signature and uses a public key to validate the digital data signature.

Secure inter-service communications in a cloud computing system

Methods and systems for sharing data among multiple services are described herein. Multiple services may access data from a shared data source. The services may subscribe to data sharing events. A data sharing service may iterate through the shared data source and transmit data retrieved from the shared data source in data sharing events. When the data sharing service reaches the end of the shared data source, the data sharing service may begin iterating through the shared data source again from the beginning. The data sharing events may be transmitted at a predetermined frequency. The services may subscribe to or unsubscribe from the data sharing events.

Data sharing events

Systems and methods for normalizing cloud resource interactions across disparate objects and actions provided by a plurality of different cloud services. The methods comprise: obtaining information that identifies the objects and indicates what actions can be performed for the objects; processing the information to consolidate at least two of the actions supported by different ones of the objects into a single action; causing a unified view to be presented in a User Interface ('UI') that allows an initiation of the single action whereby the at least two actions supported by different ones of the objects are concurrently selected; receiving a standardized command for initiating the single action; transforming a first protocol format of the standardized command into a second different protocol format to generate at least one non-standardized command; and using the non-standardized command to cause performance of the at least two actions by said different ones of the objects.

Normalizing cloud resource interaction for a suite of multi-tenant products across disparate objects and actions coming from different cloud services

A technique increases capacity in a topic-subscription messaging system. The technique involves, during a first time period, operating a first topic structure of the system. The first topic structure includes a first topic and a plurality of first subscriptions coupled with the first topic. The technique further involves, during a second time period, providing a second topic structure which includes a second topic and a plurality of second subscriptions coupled with the second topic. The technique further involves, during a third time period, providing a link from the second topic structure to the first topic structure making (i) the second topic structure a parent to the first topic structure and (ii) the first topic structure a child to the second topic structure, the link conveying messages from a particular second subscription of the second topic structure to the first topic of the first topic structure.

Growing community of inventors

Cooper City, FL, United States of America

Thomas Michael Kludy