Abstract: A computer system is provided. The computer system includes a memory and at least one processor coupled to the memory and configured to deploy public key enumeration code and private key enumeration code to a plurality of endpoint devices for execution on the endpoint devices. The at least one processor is further configured to collect public keys and associated public key metadata from the endpoint devices, and to collect private key metadata from the endpoint devices. The public keys and associated public key metadata are generated by the public key enumeration code and the private key metadata is generated by the private key enumeration code. The at least one processor is further configured to generate a graph illustrating trust relationships between user accounts on the endpoint devices. The graph is based on the collected public keys, the collected public key metadata, and the collected private key metadata.

Abstract: A technique for performing authentication to a hybrid-cloud service includes selectively applying varying authentication requirements based on whether a client device can be confirmed to be connected to a private intranet. The technique includes operating a set of local agents on one or more computing machines on the intranet. When a client device requests access to the hybrid-cloud service, the client device attempts to contact one or more of the local agents. If the client device succeeds in contacting a local agent, then the client device is confirmed to be connected to the private intranet and receives relatively trusting treatment during authentication. However, if the client device fails to contact at least one local agent, the client device is not confirmed to be connected to the private intranet and receives relatively less trusting treatment.

Abstract: Methods and systems for securing a data connection for communicating between two end-points are described herein. One of the end-points may be a server and the other of the end-points may be a client that wants to communicate with the server. The data connection may be secured based on a previously-established secure connection and/or a self-signed or self-issued certificate. In some variations, by using the previously-established secure connection and/or a self-signed or self-issued certificate, the secure communication between the server and the client may be conducted without using a third-party authentication service and without requiring a third-party CA to issue a certificate for the server.

Abstract: A technique for performing authentication to a hybrid-cloud service includes selectively applying varying authentication requirements based on whether a client device can be confirmed to be connected to a private intranet. The technique includes operating a set of local agents on one or more computing machines on the intranet. When a client device requests access to the hybrid-cloud service, the client device attempts to contact one or more of the local agents. If the client device succeeds in contacting a local agent, then the client device is confirmed to be connected to the private intranet and receives relatively trusting treatment during authentication. However, if the client device fails to contact at least one local agent, the client device is not confirmed to be connected to the private intranet and receives relatively less trusting treatment.

Abstract: A technique for performing authentication to a hybrid-cloud service includes selectively applying varying authentication requirements based on whether a client device can be confirmed to be connected to a private intranet. The technique includes operating a set of local agents on one or more computing machines on the intranet. When a client device requests access to the hybrid-cloud service, the client device attempts to contact one or more of the local agents. If the client device succeeds in contacting a local agent, then the client device is confirmed to be connected to the private intranet and receives relatively trusting treatment during authentication. However, if the client device fails to contact at least one local agent, the client device is not confirmed to be connected to the private intranet and receives relatively less trusting treatment.

Abstract: Methods and systems for securing a data connection for communicating between two end-points are described herein. One of the end-points may be a server and the other of the end-points may be a client that wants to communicate with the server. The data connection may be secured based on a previously-established secure connection and/or a self-signed or self-issued certificate. In some variations, by using the previously-established secure connection and/or a self-signed or self-issued certificate, the secure communication between the server and the client may be conducted without using a third-party authentication service and without requiring a third-party CA to issue a certificate for the server.

Abstract: Methods and systems for securing a data connection for communicating between two end-points are described herein. One of the end-points may be a server and the other of the end-points may be a client that wants to communicate with the server. The data connection may be secured based on a previously-established secure connection and/or a self-signed or self-issued certificate. In some variations, by using the previously-established secure connection and/or a self-signed or self-issued certificate, the secure communication between the server and the client may be conducted without using a third-party authentication service and without requiring a third-party CA to issue a certificate for the server.

Abstract: Methods and systems for securing a data connection for communicating between two end-points are described herein. One of the end-points may be a server and the other of the end-points may be a client that wants to communicate with the server. The data connection may be secured based on a previously-established secure connection and/or a self-signed or self-issued certificate. In some variations, by using the previously-established secure connection and/or a self-signed or self-issued certificate, the secure communication between the server and the client may be conducted without using a third-party authentication service and without requiring a third-party CA to issue a certificate for the server.

Abstract: A computer in an untrusted cloud network functions as a cloud-based enterprise application store via which a client computer (client) establishes a connection to an enterprise application in a trusted enterprise network. User authentications are performed in both a login phase and subsequent application launch phase, each authentication receiving from the client and transmitting to the enterprise network an encrypted password and encrypted key, the encrypted password being a user password encrypted under a first one-use symmetric key, the encrypted key being the first symmetric key encrypted under a public key of a private/public key pair of the enterprise network. The enterprise network decrypts the encrypted key and encrypted password to obtain the user password for authenticating the user. The launch-phase authentication includes use of a login ticket including a second one-use symmetric key under which the user password is encrypted and stored in encrypted form in the enterprise network.

Abstract: A computer in an untrusted cloud network functions as a cloud-based enterprise application store via which a client computer (client) establishes a connection to an enterprise application in a trusted enterprise network. User authentications are performed in both a login phase and subsequent application launch phase, each authentication receiving from the client and transmitting to the enterprise network an encrypted password and encrypted key, the encrypted password being a user password encrypted under a first one-use symmetric key, the encrypted key being the first symmetric key encrypted under a public key of a private/public key pair of the enterprise network. The enterprise network decrypts the encrypted key and encrypted password to obtain the user password for authenticating the user. The launch-phase authentication includes use of a login ticket including a second one-use symmetric key under which the user password is encrypted and stored in encrypted form in the enterprise network.