Zentera Systems, Inc.

Wei-Chin Chu

Jaushin Lee

Hung Chuen Jason Lee

Quan Li

Junwei Wu

A controller connects to endpoints. Profiles specify valid flows between groups of endpoints. Endpoints are provisioned according to the profiles. Provisioning includes the controller generating static routing tables. A static routing table includes an IP subnet that an endpoint will be allowed to connect to. The static routing table is programmed into a network kernel table of an OS at the endpoint. The network kernel table includes other routing information not provided by the controller. A copy is made of the network kernel table, maintained at the endpoint, and another copy is sent to the controller. The table in the OS is periodically compared with the copy of the table to detect tampering of the table in the OS. Upon detection of tampering, the tampered table in the OS is replaced with the copy of the table maintained at the endpoint and an alert is issued to the controller.

Cloud over IP session layer network

A system and technique for securing communications between endpoints in a local area network (LAN) includes receiving at a first endpoint in the LAN, a request from an application to connect to a second endpoint in the LAN. Approval from a controller to establish a Secure Socket Layer (SSL) tunnel to the second endpoint is requested. Upon receiving approval from the controller, the first endpoint receives from the controller a session identifier for the SSL tunnel. The controller also distributes a copy of the session identifier to the second endpoint. After receipt of the session identifier at the first endpoint, the session identifier is forwarded from the first endpoint to the second endpoint for security authorization, and the SSL tunnel is established. The SSL tunnel extends from the first endpoint in the LAN to the second endpoint in the LAN.

Cloud over IP for enterprise hybrid cloud network and security

Cloud endpoints are secured using agents and a controller connected to the agents. A whitelist identifies components and processes of an authorized multi-tiered application for the cloud. An application profile for the application specifies valid computing flows between components of a tier and components of another tier, where components of the tier are executed at an endpoint and the other components of the other tier are executed at another endpoint. Endpoints are provisioned with static routing tables identifying at least one subnet destination. A request is received at a first endpoint to connect to a second endpoint. If the second endpoint falls within the at least one subnet destination, the controller performs one or more further security checks including checking the application profile flow, whitelist, and endpoint quarantine list. A network kernel table at an endpoint that includes the static routing table may be periodically checked to detect tampering.

A data transfer profile defines the transfer of data among different domains. The data transfer profile is processed to generate data transfer rules. Subsets of the rules are distributed to the different domains. A rule can specify a folder in a particular domain in which files stored in the folder will be transferred to another domain.

Secure data transfer platform for hybrid computing environment

A file system monitoring layer is positioned between a virtual file system (VFS) encryption layer and a lower level file system layer. The file system monitoring layer stores a list of applications that are allowed to access encrypted files stored in the lower level file system. The monitoring layer receives from the VFS encryption layer a request by an application to access an encrypted file. If the application is not listed on the list, the VFS encryption layer is instructed to provide the application a denial of service. If the application is listed, the VFS encryption layer is instructed to decrypt the encrypted file for the application.

Growing community of inventors

Taipei, Taiwan

Wei-Chin Chu