Kenneth E Bell

US Patent:

20210377294, Dec 2, 2021

Filed:

Oct 5, 2020

Appl. No.:

17/063230

Inventors:

- Fort Lauderdale FL, US
Sandilya Sangabathula - Santa Clara CA, US
Kenneth Bell - Sunnyvale CA, US

Assignee:

Citrix Systems, Inc. - Fort Lauderdale FL

International Classification:

H04L 29/06
H04L 12/26

Abstract:

Implementations of the systems and methods discussed herein provide for distributed HTTP proxy services with synchronization of per-server or per-tenant resource allocation counters amongst the proxy devices, allowing devices to quickly identify denial of service attacks or other malicious or erroneous behavior. In some implementations, a database server may receive resource consumption notifications from each of a plurality of proxy devices and may aggregate the notifications or increment a counter on a per-server or per-tenant basis, and provide updated counter values to proxy devices via callbacks. Each proxy device may check the counter value before utilizing resources, and may disable or block proxy processing responsive to the counter exceeding a threshold.

US Patent:

20210058470, Feb 25, 2021

Filed:

Oct 21, 2020

Appl. No.:

17/076321

Inventors:

- Ft. Lauderdale FL, US
Kenneth Bell - Sunnyvale CA, US
Jitendra Deshpande - Parkland FL, US

Assignee:

Citrix Systems, Inc. - Ft. Lauderdale FL

International Classification:

H04L 29/08
H04L 12/46
H04L 29/06

Abstract:

A method may include establishing a first direct route to a gateway appliance from session clients each associated with a respective Desktop as a Service (DaaS) session run by a virtual session controller within a computing network, and establishing a second direct route from the gateway appliance to a virtual session connector within at least one private enterprise computing network. The method may also include relaying private enterprise network data between the session clients and the virtual session connector through the gateway appliance via the first direct route to each session client and the second direct route to the virtual session connector.

US Patent:

20210029197, Jan 28, 2021

Filed:

Jul 25, 2019

Appl. No.:

16/522244

Inventors:

- Burlington MA, US
Kenneth Bell - Sunnyvale CA, US

International Classification:

H04L 29/08
H04L 29/06

Abstract:

A method may include generating a proxy auto-configuration file including a function and a hash value associated with a resource. The hash value may be determined based on an identifier of the resource. The proxy auto-configuration file may include the hash value instead of a plaintext value of the identifier to obscure the plaintext value of the identifier. The proxy auto-configuration file including the function and the hash value may be sent to at least enable the function to be invoked by a web browser at one or more clients. The function may be configured to respond to being invoked by the web browser by determining, based on the hash value, whether to bypass a proxy server when accessing the resource. Related systems and computer program products are also provided.

US Patent:

20200389526, Dec 10, 2020

Filed:

Jun 4, 2019

Appl. No.:

16/430726

Inventors:

- Fort Lauderdale FL, US
Kenneth Bell - Sunnyvale CA, US
Jitendra Deshpande - Parkland FL, US

International Classification:

H04L 29/08
H04L 29/06
H04L 12/46

Abstract:

A method may include establishing a first direct route to a gateway appliance from session clients each associated with a respective Desktop as a Service (DaaS) session run by a virtual session controller within a computing network, and establishing a second direct route from the gateway appliance to a virtual session connector within at least one private enterprise computing network. The method may also include relaying private enterprise network data between the session clients and the virtual session connector through the gateway appliance via the first direct route to each session client and the second direct route to the virtual session connector.

US Patent:

20190342314, Nov 7, 2019

Filed:

May 3, 2019

Appl. No.:

16/402819

Inventors:

- Fort Lauderdale FL, US
Kenneth Bell - Santa Clara CA, US

International Classification:

H04L 29/06
H04L 29/08

Abstract:

The present disclosure is related to systems and methods of monitoring data of a network application. An embedded browser of a client application on a client device may initiate a request to access a network application hosted on a server. The client application may, responsive to the request, establish a secure session to communicate data of the network application to the client application for rendering in a display region of the embedded browser. The client application may decrypt the data communicated via the established secure session to monitor the network application.

US Patent:

20190260801, Aug 22, 2019

Filed:

May 2, 2019

Appl. No.:

16/401860

Inventors:

- Fort Lauderdale FL, US
Kenneth Bell - Sunnyvale CA, US
Georgios Oikonomou - Patras, GR
Kurt Roemer - Grayslake IL, US

International Classification:

H04L 29/06

Abstract:

The present disclosure is directed towards systems and methods for evaluating or mitigating a network attack. A device determines one or more client internet protocol addresses associated with the attack on the service. The device assigns a severity score to the attack based on a type of the attack. The device identifies a probability of a user account accessing the service during an attack window based on the type of attack. The device generates an impact score for the user account based on the severity score and the probability of the user account accessing the service during the attack window. The device selects a mitigation policy for the user account based on the impact score.

US Patent:

20190182288, Jun 13, 2019

Filed:

Feb 4, 2019

Appl. No.:

16/266931

Inventors:

- Fort Lauderdale FL, US
Kenneth Bell - Sunnyvale CA, US
Georgios Oikonomou - Patras, GR
Kurt Roemer - Grayslake IL, US

International Classification:

H04L 29/06
H04L 9/00
G06F 9/455
H04L 29/12
H04L 9/32

Abstract:

The disclosure is directed to a system for improving security of SSL communications. The system can include an device intermediary between one or more servers, one or more clients, a plurality of agents, and a web service. The servers can be configured to receive SSL connections and issue SSL certificates. The device can include a virtual server associated with a respective one of the servers, such that the SSL certificate of the respective server is transmitted through the device. The device can generate service fingerprints for the one or more servers. Each service fingerprint can include information corresponding to an SSL certificate of the virtual server, one or more DNS aliases for a virtual IP address of the respective virtual server, one or more port numbers serving the SSL certificate, and an IP address serviced by the device. The device also can transmit the service fingerprints to a web service.

US Patent:

20190058768, Feb 21, 2019

Filed:

Jan 19, 2018

Appl. No.:

15/875730

Inventors:

- Fort Lauderdale FL, US
Kenneth Bell - Sunnyvale CA, US
Mark Howell - Charlotte NC, US
Manbir Chauhan - Boca Raton FL, US

International Classification:

H04L 29/08
H04L 12/46
H04L 29/06

Abstract:

Technology for providing communication connectivity between network entities located in different isolated communication networks through a centralized cloud service. A cloud service connector in a source communication network receives an initial connection request from a source end point device in the source communication network, and determines a customer name and requested service associated with the port number indicated in the request. Mappings are established between the source end point device and a destination end point device that provides the requested service from within a destination communication network that is associated with the customer name. Network traffic is conveyed between the source end point device and the destination end point device through the cloud service by tunneling packets over connections between the cloud service connector in the source communication network and the cloud service and between a cloud service connector in the destination communication network and the cloud service.