Vmware, Inc.

Nicira, Inc.

Vaibhav Diwakar Kulkarni

Akshay Katrekar

Ganesan Chandrashekhar

Mukesh Hira

Su Wang

Aditya Anil Gokhale

Vivek Agarwal

Navaneeth Krishnan Ramaswamy

Laxmikant Vithal Gunda

Rayanagouda Bheemanagouda Patil

Clemens Kolbitsch

Tanmay Ajit Dalvi

Kedar Bhalchandra Chaudhari

Anand Jaysingh Bhalerao

Suyash Vishwas Gogte

Saqib Raza

Nikolay Semenov

Prashant Mane

Sachin Kalkur

Narendra Sharma

Amey Borkar

Rompicherla Sai Pavan Kumar

Prem Shankar Sharma

Some embodiments of the invention provide a method for micro-segmenting traffic flows in a software defined wide area network (SD-WAN). At a first edge forwarding node of a first multi-machine site in the SD-WAN, the method receives, from a particular forwarding element, a first packet of a packet flow originating from a second multi-machine site that is external to the SD-WAN, the packet flow destined for a particular machine at the first multi-machine site. The method uses deep packet inspection (DPI) on the first packet to identify contextual information not provided by the particular forwarding element about the first packet and the packet flow. Based on the identified contextual information, the method applies one or more policies to the first packet before forwarding the first packet to the particular machine.

Methods for micro-segmentation in SD-WAN for virtual networks

The disclosure herein describes executing unknown processes while preventing sandbox-evading malware therein from performing malicious behavior. A process execution event associated with an executable is detected, wherein the executable is to be executed in a production environment. The executable is determined to be an unknown executable (e.g., an executable that has not been analyzed for malware) using signature data in the process execution event. A function call hook interface of a sandbox simulator is activated, and a process of the executable is executed in the production environment. Any function calls from the executing process are intercepted by the activated function call hook interface, and sandbox-style responses to the intercepted function call are generated using sandbox response data of the sandbox simulator. The generated sandbox responses are provided to the executing process, whereby malware included in the executable behaves as if the executing process is executing in a sandbox environment.

Preventing activation of malware by exhibiting sandbox behavior in a non-sandbox environment

A system and method for using private native security groups and private native firewall policy rules for a private cloud computing environment and a public cloud computing environment uses a public cloud gateway for routing data traffic between at least a cloud network created in the public cloud computing environment and the private cloud computing environment. For each of some private native firewall policy rules that has any of newly created private native security groups as one of source and destination, a cloud native security group (CNSG) rule object with an CNSG outbound rule object and an CNSG inbound rule object for the public cloud is created and at least one of the CNSG outbound rule object and the CNSG inbound rule object is updated so that the private native firewall policy rule can be used in the cloud network.

System and method for using private native security groups and private native firewall policy rules in a public cloud

System and computer-implemented method for secure hybrid cloud connectivity between an application in a public cloud service and an on-premises service supported by an on-premises appliance includes launching a public cloud gateway appliance in the public cloud service. The public cloud gateway appliance is configured with security information associated with the on-premises appliance. The on-premises appliance is provided with contact information associated with the public cloud gateway appliance. A communication channel is established, using an outbound port, from the on-premises appliance to the public cloud gateway appliance that is secured based on the security information associated with the on-premises appliance and the contact information associated with the public cloud gateway appliance.

Method and apparatus for secure hybrid cloud connectivity

An application downloaded from the network onto a target (production) machine can be validated in a sandbox environment. An execution report can be generated during the validation. When the validated application is executed on the target machine, operations performed by the application are limited based on the execution report.

Countering malware detection evasion techniques

A system and method for managing a trusted connection within a public cloud comprises transmitting a first token and a second token from a cloud service manager to a public cloud controller, initializing a public cloud manager in response to receipt of the first token and the second token, and generate a cloud certificate, and transmitting the cloud certificate and the second token from the public cloud manager to a management plane. The method further comprises establishing a trusted connection between the public cloud controller and the management plane in response to receipt of the cloud certificate and the second token by the management plane.

System and method for authentication in a public cloud

Syncing compliance policies on a private cloud network and a public cloud network is disclosed. The technology accesses a hybrid cloud environment including: at least one private cloud network and at least one public cloud network. A private policy gateway appliance is coupled with the private cloud network and a public policy gateway appliance, in communication with the private policy gateway appliance, is coupled with the public cloud network. One or more policy rules for the hybrid cloud environment are provided to the private policy gateway appliance which then disseminates the one or more policy rules to the public policy gateway appliance, such that the one or more policy rules are synced for the at least one private cloud network and the at least one public cloud network.

Method and system for applying compliance policies on private and public cloud

Some embodiments provide a method for a public cloud manager that interacts with a management system of a public datacenter. The method receives a notification from a network controller that a second data compute node is compromised. The second data compute node operates on a host machine in the public datacenter and executes a forwarding element managed by network controller. The method interacts with application programming interfaces (APIs) of the public datacenter to quarantine the data compute node.

Identifying and handling threats to data compute nodes in public cloud

Some embodiments provide a method for a public cloud manager operating within a first data compute node of a public cloud. The method receives, through a set of public cloud provider APIs, information regarding a new second data compute node created within the public cloud. The information includes a set of tags entered by a user when creating the data compute node. Based on the tags, the method notifies a network control system that manages a forwarding element operating in the data compute node regarding (i) the creation of the data compute node, (ii) a logical switch to which to attach the data compute node and (iii) a security group to which the data compute node belongs.

Growing community of inventors

Pune, India

Vaibhav Diwakar Kulkarni