Fortinet, Inc.

Yannick Dubuc

David A Redberg

Carl M Windsor

Weining Wu

GangGang Zhang

Hai Liu

Ronald Foo

Heng Du

Ruben S Wilson

Yugang Du

Jonathan K Seanor

A secure connection is established between an IAM server on a data communication network and an on-premises active directory using a zero trust tunnel based on TCP forwarding. An authentication request is received from a gateway device, for the user to access a service provider hosting applications, responsive to a user request for access to the service provider hosting applications. Responsive to recognizing the user of the authentication request being associated with the established SSO session, an assertion is returned to the gateway that the user is authenticated to access the service provider. An authentication request is received from the service provider, for access to a specific application. Responsive to the group information associated with the user, an assertion is returned to the service provider that user is authenticated for use of the specific application.

Cryptographic proofs for seamless single sign-on (SSO) to cloud services based on on-premises authentication

Systems and methods for authenticating client devices accessing a wireless communication network through an access point communicatively coupled with an authentication server are provided. The authentication server receives an authentication request, including a first message integrity code (MIC) of a client-specific pre-shared key, from the access point or a wireless local area network (LAN) controller that manages the access point, to establish an encrypted communication channel between a client and the access point. In response to receipt of the authentication request, the authentication server validates the first MIC by receiving various attributes from the access point or the wireless LAN controller and determining a second MIC based on the client-specific pre-shared key of the client known to the authentication server and the received attributes so that the client-specific pre-shared key is validated to be authentic when the first MIC matches with the second MIC.

Authenticating client devices in a wireless communication network with client-specific pre-shared keys

Methods and systems for integrating a sandboxing service and distributed threat intelligence within an endpoint security application are provided. According to one embodiment, The method includes file system or operating system activity relating to a file accessible to an endpoint system is monitored by an endpoint security application running on the endpoint system. The endpoint security application determines whether the file has been previously analyzed for a threat status. When a result of the determining is negative, then the endpoint security application requests the threat status by submitting the file to a remote threat analysis engine with a request to perform a threat analysis on the file. Based on the determined threat status, the endpoint security application selectively allows or disallows performance of the file system or operating system activity.

Sandboxing protection for endpoints

Growing community of inventors

Coquitlam, Canada

Yannick Dubuc