Palo Alto Networks, Inc.

Appaegis Inc.

Yonghui Cheng

Wilson Xu

Nir Zuk

Monty Sher Gill

Choung-Yaw Michael Shieh

Siu-Wang Leung

Liang Li

Krishnan Shankar Narayan

A system and method for managing a user access to cloud-based applications in an enterprise environment is disclosed. The system generates a surrogate email account for a user profile linked to one or more cloud-based applications. This surrogate email account is separate from the user's workspace email account and its associated credentials are stored in a database. When a user accesses a cloud-based application through a webpage URL, the system detects the access and retrieves the surrogate email account credentials from the database. Using these credentials, the system dynamically authenticates the user profile and grants the user access to the cloud-based applications.

System and method for managing user access to cloud-based applications in an enterprise environment

A system and method for federated browser security in an enterprise environment is disclosed. The system monitors user browsing activities and enterprise contexts on local web browser hosted on user device, and device attributes corresponding to user device. Further, the system detects pre-defined enterprise identifier. Furthermore, the system initiates execution of secure web browser hosted on user device or virtual private cloud associated with enterprise environment. Additionally, the system routes login/web page URL, user login credentials, and information corresponding to login web page URL, from local web browser to secure web browser. Further, the system manages, in response to routing login web page URL, user login credentials, and information associated with login webpage, list of enterprise URL, federated identity of user in secure web browser, for managing federated browser security in enterprise environment. The federated browser security is managed for visibility and control of enterprise security in enterprise environment.

System and method for managing a federated browser security in an enterprise environment

A system retrieves from cloud storage a packet(s) sampled from network traffic detected for software deployed on a cloud instance within a cloud environment. Each packet is inspected with deep packet inspection (DPI) to determine characteristics of the packet from which the identity/type of the corresponding software are determined. The system correlates the data/metadata generated from DPI with data/metadata of other cloud resources of the cloud environment based on determining the cloud resources to which the cloud instance is related or which also support deployment/execution of the software. The correlated data/metadata are evaluated based on security policies which include criteria for characteristics of software running on the cloud infrastructure rather than criteria for cloud infrastructure configuration alone. The system thus determines whether a cloud resource complies with the security policies based at least partly on the types/characteristics of software with which it is correlated.

Enhanced cloud infrastructure security through runtime visibility into deployed software

A system and method for managing security credentials of a user are disclosed. The method includes establishing a connection with a local web browser hosted on a user device. The method also includes receiving a request for accessing a web application on the local web browser hosted on the user device. The method also includes determining whether current web page associated with the web application on the local web browser requires authentication of the user. Further, the method includes determining a password policy. Furthermore, the method includes authenticating the user on the web page using pre-stored user credentials based on the determined password policy. Additionally, the method includes routing the web page of the local web browser to the web application via an intermediate web browser. Also, the method includes providing access of the web application to the local web browser based on privileges associated with the user.

System and method for managing security credentials of a user in a computing environment

Enforcing a policy based at least in part on URL information is disclosed. A uniform resource locator (URL) is received. A portion of the URL, or a transformation thereof, is matched against a bloom filter. Based on a result of the match, a first query is performed. A policy is enforced based at least in part on a category received as a result of a second query. In some cases, the first and second query are the same.

Using cache and bloom filters for URL lookups

Methods, systems, and apparatus, including computer program products, featuring receiving at a network device a plurality of packets associated with a flow, one or more of the plurality of packets having associated header data and content. Based on the content of one or more first packets in the plurality of packets, the network device identifies an application associated with the flow, where none of the first packets is addressed to the network device. For one or more second packets associated with the flow, the network device determines a forwarding destination for the second packets based on the application associated with the flow and forwards the packet according to the determined forwarding destination.

Growing community of inventors

Cupertino, CA, United States of America

Yonghui Cheng