公开(公告)号：US11063903B2

公开(公告)日：2021-07-13

申请号：US15950983

申请日：2018-04-11

Applicant: VMWARE, INC.

Inventor： Daniel G. Wing ,  Dexiang Wang ,  Nidheesh Dubey

IPC: H04L29/12 ,  H04L29/06 ,  H04L9/08 ,  G06F9/455 ,  H04L29/08 ,  H04L12/46

Abstract: The method for a virtual machine to use a port and loopback IP addresses allocation scheme for full-mesh communications with transparent transport layer security tunnels is presented. In an embodiment, the method comprises detecting, at a redirect agent implemented in a first machine, a packet that is sent from a client application executing on the first machine toward a server application executing on a second machine; and determining, by the redirect agent, whether a first redirect rule matches the packet. In response to determining that the first redirect rule matches the packet, the redirect agent applies the first redirect rule to the packet to translate the packet into a translated packet, and provides the translated packet to a client agent implemented in the first machine to cause the client agent to transmit the translated packet to a server agent implemented in the second machine.

公开(公告)号：US11677713B2

公开(公告)日：2023-06-13

申请号：US16253238

申请日：2019-01-22

Applicant: VMWARE, INC.

Inventor： Kanika Nema ,  Daniel G. Wing ,  Goresh Musalay

IPC: H04L61/4511 ,  H04L61/2514 ,  H04L61/10 ,  H04L61/58 ,  H04L61/5007

CPC classification number: H04L61/4511 ,  H04L61/10 ,  H04L61/2514 ,  H04L61/5007 ,  H04L61/58

Abstract: A domain-name-based network-connection attestation system provides for more user friendly and less error prone (compared to IP-address-based attestation systems) updating of a whitelist used to determine whether or not to allow a requested network connection. A guest agent extracts from a DNS reply a domain name, and an IP address mapped to a domain name. The agent enters these values in an agent DNS cache. When a process requests a connection to an IP address, the agent uses the IP address to determine the domain name from the agent DNS cache. The agent then determines whether the IP address is mapped to the process identity in a domain-name-based whitelist. If it is, the connection is attested to and allowed; if it is not, a secondary IP address whitelist can be checked.

公开(公告)号：US11936613B2

公开(公告)日：2024-03-19

申请号：US17371490

申请日：2021-07-09

Applicant: VMware, Inc.

Inventor： Daniel G. Wing ,  Dexiang Wang ,  Nidheesh Dubey

IPC: H04L61/256 ,  G06F9/455 ,  H04L9/08 ,  H04L9/40 ,  H04L12/46 ,  H04L61/2557 ,  H04L61/2592 ,  H04L67/563

CPC classification number: H04L61/256 ,  G06F9/45558 ,  H04L9/0861 ,  H04L12/4633 ,  H04L61/2557 ,  H04L61/2592 ,  H04L63/029 ,  H04L63/0428 ,  H04L63/061 ,  H04L67/563 ,  G06F2009/45595

Abstract: The method for a virtual machine to use a port and loopback IP addresses allocation scheme for full-mesh communications with transparent transport layer security tunnels is presented. In an embodiment, the method comprises detecting, at a redirect agent implemented in a first machine, a packet that is sent from a client application executing on the first machine toward a server application executing on a second machine; and determining, by the redirect agent, whether a first redirect rule matches the packet. In response to determining that the first redirect rule matches the packet, the redirect agent applies the first redirect rule to the packet to translate the packet into a translated packet, and provides the translated packet to a client agent implemented in the first machine to cause the client agent to transmit the translated packet to a server agent implemented in the second machine.