Abstract: Systems and methods for a dynamically reconfigurable traffic inspection pipeline in zero trust networks. Methods include steps of intercepting traffic traversing through a zero trust network to a destination; determining one or more traffic inspection stages to utilize for inspecting the traffic based on the characteristics of the traffic; creating a traffic inspection pipeline including the one or more traffic inspection stages; and performing the one or more traffic inspection stages on the traffic through the traffic inspection pipeline. The steps can include dynamically adding or removing traffic inspection stages in the traffic inspection pipeline after performing a traffic inspection stage.

Abstract: Systems and methods for policy based traffic inspection in zero trust private networks. Various embodiments include receiving a request for a workload; analyzing one or more criteria associated with the request; determining an inspection profile to utilize for the request based on the analyzing of the one or more criteria; applying the inspection profile to the request; and inspecting traffic associated with the request based on the inspection profile.

Abstract: Systems and methods are directed to secure hybrid data transfer through connection and request direction decoupling. Initially, a controller server in a source on-premise cluster establishes a persistent connection to a controller server in a destination cloud cluster. The connection is then reversed, which enables destination servers to request additional connections between any pair of source and destination servers dynamically from the source cluster. Each of these connections is established by a source server, which authenticates to a cloud (destination) server and then requests to reverse the connection. The reversed connections can be used to transfer data securely between the on-premise and cloud servers. The source server can be a broker in a source cluster located on-premise and the destination server can be a broker in a destination cluster in the cloud.

Abstract: Systems and methods include responsive to a user initiating a session with a resource, determining a master fingerprint of a device associated with the user; collecting, at predefined time intervals, one or more additional fingerprints during the session; comparing the one or more additional fingerprints with the master fingerprint; and performing one or more actions based on the comparing.

Abstract: In some aspects, a non-transitory computer-readable storage medium having computer-executable instructions stored thereon that, upon execution by a processor, causes the processor to receive an indicator of a functionality; map the indicator to a first service and a second service dependent on the first service; identify a policy based on the first service and the second service; and determine, based on the policy, locations of deployment for the first service and the second service.

Abstract: Systems and methods for browser fingerprinting and control for private application protection include monitoring access to one or more private applications; performing one or more compliance checks on any of the user and the browser used to access the one or more private applications; and performing one or more actions based on a result of the one or more compliance checks. These steps are performed in order to prevent users from accessing private applications via compromised or vulnerable browsers.

Abstract: In some aspects, a non-transitory computer-readable storage medium having computer-executable instructions stored thereon that, upon execution by a processor, causes the processor to receive an indicator of a functionality; map the indicator to a first service and a second service dependent on the first service; identify a policy based on the first service and the second service; and determine, based on the policy, locations of deployment for the first service and the second service.

Abstract: In some aspects, a non-transitory computer-readable storage medium having computer-executable instructions stored thereon that, upon execution by a processor, causes the processor to receive an indicator of a functionality; map the indicator to a first service and a second service dependent on the first service; identify a policy based on the first service and the second service; and determine, based on the policy, locations of deployment for the first service and the second service.

Abstract: Examples of systems described herein may include virtualized computing environments having one or more upgrade management agents. An upgrade management agent may detect current versions of multiple components in a computing system, including at least one software component and at least one firmware component, obtain a group of updates based on the current versions of the multiple components, and schedule installation of the group of updates including grouping together installation of selected ones of the group of updates for a particular computing node of the computing system, wherein the selected ones each utilize a particular state change of the computing node during the installation. The schedule may also be selected to accommodate dependencies between multiple components which are resolved by the upgrade management agent to obtain the schedule.

Abstract: In some aspects, a non-transitory computer-readable storage medium having computer-executable instructions stored thereon that, upon execution by a processor, causes the processor to receive an indicator of a functionality; map the indicator to a first service and a second service dependent on the first service; identify a policy based on the first service and the second service; and determine, based on the policy, locations of deployment for the first service and the second service.

Abstract: A system may include a service deployment system configured to receive user indicators, map the user indicators to a plurality of services, determine an order of deployment associated with the plurality of services, and determine deployment locations associated with the plurality of services. The service deployment system may be configured to generate a plurality of actions, responsive to the plurality of services, the order of deployment, and the deployment locations.

Abstract: Examples of systems described herein may include virtualized computing environments having one or more upgrade management agents. An upgrade management agent may detect current versions of multiple components in a computing system, including at least one software component and at least one firmware component, obtain a group of updates based on the current versions of the multiple components, and schedule installation of the group of updates including grouping together installation of selected ones of the group of updates for a particular computing node of the computing system, wherein the selected ones each utilize a particular state change of the computing node during the installation. The schedule may also be selected to accommodate dependencies between multiple components which are resolved by the upgrade management agent to obtain the schedule.

Abstract: Examples of systems described herein may advantageously facilitate a software upgrade of one or more computing nodes of a distributed system without requiring a reboot of the node or otherwise rendering the node completely unavailable during upgrade. Upgrade portals described herein may provide each computing node with only the differential data needed to upgrade the node. Upgrade managers at each computing node may upgrade software at the computing node based on the differential data and restart services effected by the upgrade using the differential data. Other services may remain available during the restart of the effected services.

Abstract: Examples of systems described herein may include virtualized computing environments having one or more upgrade management agents. An upgrade management agent may detect current versions of multiple components in a computing system, including at least one software component and at least one firmware component, obtain a group of updates based on the current versions of the multiple components, and schedule installation of the group of updates including grouping together installation of selected ones of the group of updates for a particular computing node of the computing system, wherein the selected ones each utilize a particular state change of the computing node during the installation. The schedule may also be selected to accommodate dependencies between multiple components which are resolved by the upgrade management agent to obtain the schedule.

Abstract: A system may include a service deployment system configured to receive user indicators, map the user indicators to a plurality of services, determine an order of deployment associated with the plurality of services, and determine deployment locations associated with the plurality of services. The service deployment system may be configured to generate a plurality of actions, responsive to the plurality of services, the order of deployment, and the deployment locations.

Abstract: Examples described herein may include migration of services of infrastructure management virtual machines to a container. An example method includes creating an infrastructure management virtual machine configured to manage and monitor a cluster of nodes of a computing system. The infrastructure management virtual machine including a plurality of services and an associated virtual disk storing data associated with running the plurality of services. The example method further includes extracting a service of the plurality of services running on the infrastructure management virtual machine, and creating a container on a controller virtual machine running on a node of a computing system. The container includes the extracted service. The example method further includes retrieving data associated with the extracted service from the virtual disk, and after retrieved the data, starting the extracted service in the container.

Abstract: Examples of systems described herein may include virtualized computing environments having one or more upgrade management agents. An upgrade management agent may detect current versions of multiple components in a computing system, including at least one software component and at least one firmware component, obtain a group of updates based on the current versions of the multiple components, and schedule installation of the group of updates including grouping together installation of selected ones of the group of updates for a particular computing node of the computing system, wherein the selected ones each utilize a particular state change of the computing node during the installation. The schedule may also be selected to accommodate dependencies between multiple components which are resolved by the upgrade management agent to obtain the schedule.

Abstract: A computer implemented method receives a request to run a group of instruction sets. Each instruction set is associated with a sequence of common instructions. The method executes the sequence of common instructions in a first virtual machine (VM) to generate a result which is stored in a first memory associated with the first VM. The method then clones a second VM that shares the first memory with the first VM. The method continues by executing a first instruction set in the second VM. Since the second VM shares memory with the first VM, the second VM can use the result stored in the first memory and the sequence of common instructions does not need to be executed on the second VM. In one example, the result is a run-time model of a circuit and the second VM runs the first instruction set on the run-time model.

Abstract: Examples of systems described herein may advantageously facilitate a software upgrade of one or more computing nodes of a distributed system without requiring a reboot of the node or otherwise rendering the node completely unavailable during upgrade. Upgrade portals described herein may provide each computing node with only the differential data needed to upgrade the node. Upgrade managers at each computing node may upgrade software at the computing node based on the differential data and restart services effected by the upgrade using the differential data. Other services may remain available during the restart of the effected services.

Abstract: Memory performance in a computer system that implements large page mapping is improved even when memory is scarce by identifying page sharing opportunities within the large pages at the granularity of small pages and breaking up the large pages so that small pages within the large page can be freed up through page sharing. In addition, the number of small page sharing opportunities within the large pages can be used to estimate the total amount of memory that could be reclaimed through page sharing.