Abstract: Techniques and architecture are described for protecting non-http and TCP/UDP applications in a zero trust network access (ZTNA)/web virtual private network (VPN) environment by establishing a secure communication channel between a native application and an application server providing an application service. More particularly, the present disclosure describes techniques and architecture that leverage the firewall wherein a thin client on a client device enables a client desktop, establishes a secure channel from a native application, e.g., the client desktop, to the firewall, and acts as a proxy.

Abstract: An apparatus can comprise a processor and a memory. The memory can store instructions that, when executed by the processor, cause the processor to associate a plurality of consumer containers with a data container. The plurality of consumer containers can host workloads that access a data segment hosted by the data container. The plurality of consumer containers and the data container can be scheduled on different nodes of a horizontally scalable cluster. A node of the horizontally scalable cluster that hosts the data container can be identified. The plurality of consumer containers can be scheduled to execute on the node based on the association between the plurality of consumer containers and the data container.

Abstract: A container management system and device that includes a hibernator deployment to determine a semantic defined for applications generated to perform deployments in the container management system, determine whether the applications are active during a corresponding time period included within the semantic, and transfer the applications from an active state to an inactive state in response to the application not being inactive during the corresponding time period included within the semantic defined for the application.

Abstract: A container management system and device that includes a hibernator deployment to determine a semantic defined for applications generated to perform deployments in the container management system, determine whether the applications are active during a corresponding time period included within the semantic, and transfer the applications from an active state to an inactive state in response to the application not being inactive during the corresponding time period included within the semantic defined for the application.

Abstract: An apparatus comprising: a processing resource; a memory resource to store instructions executable by the processing resource to: associate a plurality of consumer containers with a data container, wherein the plurality of consumer containers accesses the data container; identify a node of a cloud computing system that hosts the data container; and schedule the plurality of consumer containers to execute on the node based on the association between the plurality of consumer containers and the data container.

Abstract: Domains can also be used to control access to physical memory space. Data in a physical memory space that has been used by a process sometimes endures after the process stops using the physical memory space (e.g., the process terminates). In addition, a virtual memory manager may allow processes of different applications to access a same memory space. To prevent exposure of sensitive/confidential data, physical memory spaces can be designated for a specific domain or domains when the physical memory spaces are allocated.

Abstract: When an operating system process evaluates a rule for an operation being attempted on a logical network port, the operating system process determines whether the target logical port falls within a range of logical ports, and then determines whether the operation is associated with a permitted domain of the range of logical ports. If the operation is a bind operation, then the process attempting to bind to the target port will be allowed to bind if the target port falls within the range and the operation/process is associated with a permitted domain. Otherwise, the binding operation will not be allowed to proceed.

Abstract: A network based installation management system that dynamically manages secure software installation on a client. The server is configured to determine the software required and prepare an appropriated response containing the list of software and an information file containing the respective attributes of the list of software. The server encoded this response and the encoded response is transmitted to the client. The client on receiving the response is configured to authenticate the response and install the encoded response after authentication. Highly accurate and reliable software installation using the network based installation management system may be achieved using a respective hardware element on the client and the server, which is configured to encode and decode a request and/or response suitably thereby providing a high level of security and trust in an un-trusted network environment.

Abstract: Domains can be used to secure resources of a cluster. An administrator can configure a node of a cluster as a member of a particular domain. Membership in a cluster can be restricted to nodes that are members of the particular domain. When a node generates a cluster message, a kernel process or operating system process of the node will indicate the domain(s) of the node in the cluster message. The cluster message can be a command message to read or write to a storage resource of the cluster. When the cluster storage resource node or node that controls the storage resource receives the command message, the node will examine the command message to ensure the message indicates a domain that aligns with the cluster. If the proper domain is indicated in the command message, then the command message is processed. Otherwise, the command message is denied.

Abstract: Functionality can be implemented in an operating system to increase the granularity of isolation for objects. A domain can be defined to represent each of different entities (e.g., different departments or work groups). User identifiers and/or user credentials can be associated with the appropriate domain or domains. An administrator can then define a set of rules that govern operation(s) that can be performed on the objects based on the domains. Processes running on a system will inherit the domains of a user account logged into the system. When a process running on the system attempts to perform an operation on an object, an operating system process evaluates the domain isolation rules with an identifier of the object and a domain identifier to determine whether the operation is permitted to proceed.

Abstract: Methods (100), systems (300) and computer program products are disclosed for uninterrupted execution of an application program (110). The method (100) comprises: receiving a write operation call to a native file system from an application program (110) being executed on an operating system; and dynamically allocating (120, 122) free data blocks to the native file system from at least one other file system in a group of file systems until completion of execution of the application program (110) thereby completing the write operation call. The group of file systems is configured to allow sharing of free data blocks amongst the group of file systems.

Abstract: Functionality can be implemented in an operating system to increase the granularity of isolation for objects. A domain can be defined to represent each of different entities (e.g., different departments or work groups). User identifiers and/or user credentials can be associated with the appropriate domain or domains. An administrator can then define a set of rules that govern operation(s) that can be performed on the objects based on the domains. Processes running on a system will inherit the domains of a user account logged into the system. When a process running on the system attempts to perform an operation on an object, an operating system process evaluates the domain isolation rules with an identifier of the object and a domain identifier to determine whether the operation is permitted to proceed.

Abstract: When an operating system process evaluates a rule for an operation being attempted on a logical network port, the operating system process determines whether the target logical port falls within a range of logical ports, and then determines whether the operation is associated with a permitted domain of the range of logical ports. If the operation is a bind operation, then the process attempting to bind to the target port will be allowed to bind if the target port falls within the range and the operation/process is associated with a permitted domain. Otherwise, the binding operation will not be allowed to proceed.

Abstract: Domains can also be used to control access to physical memory space. Data in a physical memory space that has been used by a process sometimes endures after the process stops using the physical memory space (e.g., the process terminates). In addition, a virtual memory manager may allow processes of different applications to access a same memory space. To prevent exposure of sensitive/confidential data, physical memory spaces can be designated for a specific domain or domains when the physical memory spaces are allocated.

Abstract: Methods (100), systems (300) and computer program products are disclosed for uninterrupted execution of an application program (110). The method (100) comprises: receiving a write operation call to a native file system from an application program (110) being executed on an operating system; and dynamically allocating (120, 122) free data blocks to the native file system from at least one other file system in a group of file systems until completion of execution of the application program (110) thereby completing the write operation call. The group of file systems is configured to allow sharing of free data blocks amongst the group of file systems.

Abstract: Methods (100), systems (300) and computer program products are disclosed for uninterrupted execution of an application program (110). The method (100) comprises: receiving a write operation call to a native file system from an application program (110) being executed on an operating system; and dynamically allocating (120, 122) free data blocks to the native file system from at least one other file system in a group of file systems until completion of execution of the application program (110) thereby completing the write operation call. The group of file systems is configured to allow sharing of free data blocks amongst the group of file systems.

Abstract: A computer implemented method, apparatus, and computer program product for using a virtual file system to encrypt files. The process registers a plurality of file systems on a data processing system with the virtual file system. The virtual file system is enabled to encrypt files without intervention from any file system in the plurality of file systems. The virtual file system identifies whether a file on a given file system is an encrypted file using a map file associated with the given file system. In response to identifying the file as an encrypted file, the virtual file system encrypts all data written to the file in accordance with encryption specifications in the map file.

Abstract: Methods (100), systems (300) and computer program products are disclosed for uninterrupted execution of an application program (110). The method (100) comprises: receiving a write operation call to a native file system from an application program (110) being executed on an operating system; and dynamically allocating (120, 122) free data blocks to the native file system from at least one other file system in a group of file systems until completion of execution of the application program (110) thereby completing the write operation call. The group of file systems is configured to allow sharing of free data blocks amongst the group of file systems.

Abstract: Methods (100), systems (300) and computer program products are disclosed for uninterrupted execution of an application program (110). The method (100) comprises: receiving a write operation call to a native file system from an application program (110) being executed on an operating system; and dynamically allocating (120, 122) free data blocks to the native file system from at least one other file system in a group of file systems until completion of execution of the application program (110) thereby completing the write operation call. The group of file systems is configured to allow sharing of free data blocks amongst the group of file systems.

Abstract: A network based installation management system that dynamically manages secure software installation on a client. The server is configured to determine the software required and prepare an appropriated response containing the list of software and an information file containing the respective attributes of the list of software. The server encoded this response and the encoded response is transmitted to the client. The client on receiving the response is configured to authenticate the response and install the encoded response after authentication. Highly accurate and reliable software installation using the network based installation management system may be achieved using a respective hardware element on the client and the server, which is configured to encode and decode a request and/or response suitably thereby providing a high level of security and trust in an un-trusted network environment.