Abstract: Systems and methods are provided for facilitating a discreet connection between a user and a service. A system includes a service for a user to connect to without any detectable direct contact with the service. A first reverse proxy connection is configured to receive a connection from the user to set up the discreet connection, where an invitation indicating a mechanism for accessing the first reverse proxy connection is provided to the user. Access credentials are transmitted to the user over the first reverse proxy connection, the access credentials including an address for accessing a second reverse proxy connection, the first reverse proxy connection being deleted following delivery of the access credentials. The second reverse proxy connection facilitates the discreet connection between the user and the service without any detectable direct contact with the service.

Abstract: Systems and methods for automatically disseminating a private key are presented. A first message requesting a key proxy instance is received from a first user device. The first message comprises a first symmetric key. A key proxy server is directed to allocate a key proxy instance for communication with the first user device based on a device public key that corresponds to the first user device. A unique URL corresponding to the key proxy instance is received from the key proxy server. A second message comprising the unique URL is sent to the first user device. The second message is encrypted using the first symmetric key and signed using a server private key. A third message comprising the URL of the key proxy instance is received from the first user device and forwarded to a second user device.

Abstract: A network packet can be received at a host and it can be determined if such packet has a valid cryptographic public key for a destination host. If there is no known valid cryptographic public key, it is determined whether the network packet is a first network packet sent to the destination host, and if so, a queue is designated for network packets addressed to the destination host and a key management server is queried for a valid cryptographic public key associated with the destination host. Otherwise, the network packet is placed in a queue designated for the destination host until a valid cryptographic public key associated with the destination host becomes available. Upon a valid cryptographic public key associated with the destination host becoming available, the network packet is processed, encrypted and sent to the destination host.

Abstract: Secure communications can be established in which a request is received from a client computing device to instantiate a virtual key store (VKS) node. In response to the request, a cryptographically calculated uniform resource locator (URL) is generated. In addition, a crytopgraphic identity certificate is received from a certification authority server. Subsequently, a virtual desktop infrastructure (VDI) instance is instantiated and configured with the cryptographic identity certificate. Communications are then established between the client computing device and the VDI instance using the generated cryptographically calculated URL such that the VDI instance acts as a cryptographic proxy with at least one remote computing device.

Abstract: Systems and methods for managing non-associative communications between devices is provided. A first call chain that indicates a routing between phone numbers is stored. A first phone call or a first SMS text is received from a first session initiation protocol (SIP) provider. Based on information provided by the first SIP provider, (i) a sender identity of the first phone call or the first SMS text; (ii) a receiver identity of the first phone call or the first SMS text; and (iii) an access mode of the call chain are determined. If the receiver identity corresponds to a first phone number in the first call chain, a second phone call or a second SMS text is initiated via a second SIP provider, from a second phone number in the first call chain, based on the sender identity and the access mode.

Abstract: Systems and methods for facilitating communication between users of a collaboration service on a private network are presented. A first server is configured to host the collaboration service. A first client device corresponds to a registered user of the collaboration service. The first client device is in direct communication with the first server to use the collaboration service. An application portal instance is configured and deployed by a second server. The application portal instance is configured to directly connect to the first server. The application portal instance provides an indirect connection to the first server. The indirect connection is hidden from users of the system. A second client device corresponds to a non-registered user of the collaboration service. The second client device connects directly to the application portal instance. The first client device and the second client device communicate over the private network using the collaboration service.

Abstract: Systems and methods are provided for providing access to data on a personalized basis. A service operating on a server is identified, where data at the service is associated with a first user and other users. Data associated with the first user is extracted. A network location is spawned for the first user. The extracted data is transferred to the spawned network location to make the extracted data available to the first user in a read-only fashion by accessing the spawned network location. Additional network locations are spawned for second and third users, respectively, wherein data associated with the second and third users is transferred such that they are available to the second and third users by accessing their respective additional network locations.

Abstract: Systems and methods for altering the character of data originating from a Virtual Private Network (VPN) are provided. First data is received from the VPN by a first network interface. The first data comprises a first plurality of packets. A message is generated by combining the first plurality of packets. Second data is generated by segmenting the message into a second plurality of packets. A third plurality of packets in the second plurality of packets is equal to the network maximum transfer unit allowed by the Internet and the last packet in the second plurality of packets is less than the network maximum transfer unit allowed by the Internet. The second data is forwarded to the second network interface. The second network interface sends the data to a webserver.

Abstract: Systems and methods are provided for a computer-implemented method of implementing an on-demand computing network environment. A network specification is received from a user. Resources from one or more resource providers are provisioned. The on-demand computing network is configured, where configuring comprises assigning a first provisioned resource as an interior device and assigning one or more second provisioned resources as rim devices.

Abstract: Systems and methods are provided for a computer-implemented method of implementing an on-demand computing network environment. A network specification is received from a user. Resources from one or more resource providers are provisioned. The on-demand computing network is configured, where configuring comprises assigning a first provisioned resource as a hub device and assigning one or more second provisioned resources as rim devices, where a particular rim device comprises a bridge device, where the bridge device repackages data received from the on-demand computing network prior to forwarding that data such that the data received from the on-demand computing network appears to terminate at the bridge device to an observer viewing the data between the hub device and the bridge device.

Abstract: Systems and methods are provided for a computer-implemented method of implementing an on-demand computing network environment. A network specification is received from a user. Resources from one or more resource providers are provisioned including an audio server resource. The on-demand computing network is configured, where configuring includes assigning a first provisioned resource as a hub device. One or more second provisioned resources are assigned as rim devices, where rim devices are configured to communicate with one another only via the hub device. One rim device is a proxy server to which the user connects using a device having an address, where the audio server transmits audio data to the user via the proxy server without knowledge of the address of the user device.

Abstract: Systems and methods are provided for a network appliance comprising a plurality of virtual private network nodes operating on the network appliance, each virtual private network node being configurable to connect to selectable virtual private network end points in an on-demand computing network. A web interface is configured to connect a client device to the network appliance and to identify a selected virtual private network end point, where the client device is connected to a particular one of the virtual private network nodes and the particular virtual private network node is connected to the selected virtual private network end point based on interactions with the web interface.

Abstract: A request is received by a videoconference instantiation server to initiate a videoconference among a plurality of participants. Thereafter, the videoconference instantiation server requests provision of an on-demand computing network. The videoconference server is then instantiated in the on-demand computing network. A plurality of inbound proxies are generated which are configured to communicate with the videoconference server. The inbound proxies obfuscate administrative data passing therethrough. In addition, a plurality of portal proxies are generated that each are configured to communicate with a different one of the inbound proxies. The videoconference instantiation server then generates a unique access path to a different one of the portal proxies for each of the participants. The portal proxies, when accessed, allow the corresponding participant to access a videoconference being executed by the videoconference server.

Abstract: Systems and methods for protecting access to network ports on a server are provided herein. A system comprises a server configured to receive a data packet comprising a cryptoken corresponding to a network port address. The server is further configured to generate a plurality of cryptokens based on a plurality of timecodes, a network port configuration, and the destination address. The server generates a plurality of hashes based on the plurality of cryptokens. The server generates, based on a comparison of each of the plurality of cryptokens to the cryptoken, a rule to allow inbound connections to a first network port corresponding to the network port address.

Abstract: Secure communications can be established in which a request is received from a client computing device to instantiate a virtual key store (VKS) node. In response to the request, a cryptographically calculated uniform resource locator (URL) is generated. In addition, a crytopgraphic identity certificate is received from a certification authority server. Subsequently, a virtual desktop infrastructure (VDI) instance is instantiated and configured with the cryptographic identity certificate. Communications are then established between the client computing device and the VDI instance using the generated cryptographically calculated URL such that the VDI instance acts as a cryptographic proxy with at least one remote computing device.

Abstract: Systems and methods for managing non-associative communications between devices is provided. A first call chain that indicates a routing between phone numbers is stored. A first phone call or a first SMS text is received from a first session initiation protocol (SIP) provider. Based on information provided by the first SIP provider, (i) a sender identity of the first phone call or the first SMS text; (ii) a receiver identity of the first phone call or the first SMS text; and (iii) an access mode of the call chain are determined. If the receiver identity corresponds to a first phone number in the first call chain, a second phone call or a second SMS text is initiated via a second SIP provider, from a second phone number in the first call chain, based on the sender identity and the access mode.

Abstract: Systems and methods are provided for providing access to data on a personalized basis. A service operating on a server is identified, where data at the service is associated with a first user and other users. Data associated with the first user is extracted. A network location is spawned for the first user. The extracted data is transferred to the spawned network location to make the extracted data available to the first user in a read-only fashion by accessing the spawned network location. Additional network locations are spawned for second and third users, respectively, wherein data associated with the second and third users is transferred such that they are available to the second and third users by accessing their respective additional network locations.

Abstract: A bridge application receives a request from a remote device to access a support server. Subsequently, the bridge application established a secure connection between the bridge application and the support server and establishes a secure connection between the bridge application and the remote device. Once these secure connections are both established, communications are relayed between the remote device and the support server to effect a software change to network device. The secure connections are later terminated upon completion of the software change to the remote device. Related apparatus, systems, techniques and articles are also described.

Abstract: A system for obscuring a source IP address of a source network device from a destination network device comprises a proxy manager and first and second disposable network proxies. Credentials for a plurality of disposable network proxies are provided to the source network device. A proxy disposal trigger is generated for each disposable network proxy in the plurality of disposable network proxies based on usage of the disposable network proxy. A connection request comprising the credentials and a destination IP address of the destination network device is received from the source network device. First traffic from the source network device to the destination network device is forwarded over a first connection with the destination network device that uses an IP address of the disposable network proxy. Second traffic from the destination network device to the source network device is forwarded over a second network connection with the source network device.

Abstract: Systems and methods are provided for connecting a client to a desired network endpoint. Example systems and methods include receiving, at a server, a request identifying a network endpoint to be accessed, configuring a proxy instance, the proxy instance being configured to receive a connection from a client to forward that client connection to the identified network endpoint, and deleting the proxy instance upon occurrence of a session end criteria. In some embodiments, the request identifying a network endpoint to the server is received from the network endpoint. In some embodiments, the request identifying a network endpoint to the server is received from the client. In some embodiments, a platform as a service is used to configure the proxy instance. In some embodiments, the request identifying a network endpoint is made to the platform as a service rather than to the server, which is not included in the embodiment.