Other

Nxp Usa, Inc.

Anchorfree Inc.

Vamsi Ambati

Jayant Shukla

Chaitanya Pemmaraju

Eugene Lapidous

Maxim Molchanov

Srinivasa Rao Addepalli

Artem Arsitov

In one aspect, a method for defining a group-based policy for access to computing resources by an application/container or a group of application/container, includes the step of with a credential server: specifying a computing resource; specifying a group name and a strong cryptographic identity associated with the group name. The method includes the step of specifying a policy for an application/container belonging to a specific group to access the set of resources belonging to another group. The method includes the step of with a handler process: reading a list of subnets for which authentication is to be enforced. The method includes the step of processing an initiate authentication request with an initiator of a new network connection or initiating a new authentication request with the initiator of the network connection. Upon successful authentication, extracting the group identity of the remote application, checking the group security policy for permitting access, and based on the rule permitting or denying access.

Identity-based segmentation of applications and containers in a dynamic environment

The disclosed invention is a new method and apparatus for the management of application/container process identity for authentication and enforcing group-based security policies. Identities and security policies are managed in the cloud. Strong cryptographic identities or digital certificates are provided to each application/container or group of applications/containers. Applications/containers use these digital certificates to mutually authenticate each other before providing access to their resources.

Cloud-based identity management and authentication system for containers and applications

This disclosure describes an approach to detect replay attacks while having multiple cores in a multi-core processor manage an established tunneling session. The tunneling session includes a number of flows. One of the cores is assigned to manage one of the flows, and another core is assigned to manage another of the flows. A replay attack over the tunneling session is inhibited by maintaining a flow-based sequence context at each of the flows, and the flow-based sequence context is maintained by the core that is managing the respective flow.

Flow-based anti-replay checking

A provider computer announces content to the provider computer and establishes a secure connection to a VPN server. Requests for the content are received in one protocol (HTTPS) from the consumer computer and forwarded to the VPN server in a less secure protocol (HTTP) by a protocol conversion proxy, which then forwards the request to the provider computer. A public URL and secure URL may be associated with the same content. The public URL is announced to a consumer computer. A public server receives the public URL and returns the secure URL, which consumer computer uses to establish a secure connection to the provider computer. Upon the secure URL being compromised, a new secure URL is associated with the public URL. The source IP addresses of requests for the public and secure URLs may be compared to determine whether the secure URL is compromised.

Growing community of inventors

Fremont, CA, United States of America

Vamsi Ambati