Patents

Provides secure communications by allocating a key proxy instance for a user device and using encrypted, signed messages to pass private-key access information between authorized devices.

Instantiates a VDI-backed virtual key store with a cryptographic identity certificate so the VDI instance can proxy secure communications with remote computing devices.

Provides secure ad hoc collaboration by connecting outside users through an application portal instance rather than directly exposing the private collaboration service.

Uses a cryptographically calculated URL and VDI-based virtual key store to let a client communicate securely through a VDI instance acting as a cryptographic proxy.

Establishes secure communications by creating a virtual key store node, instantiating a VDI instance with a cryptographic identity certificate, and using the VDI as a cryptographic proxy.

Automatically disseminates private keys by creating a key proxy instance, sending its unique URL to a user device, and forwarding that proxy URL to another user device for secure communication.

Enables registered and non-registered users to communicate through a private collaboration service by deploying an application portal instance that hides the indirect connection.

Lets a user access resources across multiple secure private network enclaves by forwarding traffic to and from those enclave resources as if they were local to the user’s virtualized network domain.

Extends conflicting-IP private network communication by using shadow IP blocks, bridge devices, and destination-address translation between networks.

Connects a client to selectable VPN endpoints through a network appliance with multiple configurable VPN nodes in an on-demand computing network.

Routes traffic between private networks with overlapping IP ranges by sending packets through a virtual computing device and translating destination addresses at the receiving bridge.

Uses a network appliance with configurable VPN nodes so a client can connect through a web interface to a selected VPN endpoint in an on-demand computing network.

Provides simultaneous access to multiple secure private network enclaves by using credential data and enclave access services to make remote enclave resources appear locally available in a user virtualized network domain.

Uses shadow IP address blocks and bridge devices to allow private networks with conflicting IP address spaces to communicate without changing native addresses.

Provides a network appliance with multiple VPN nodes and a web interface that lets a client select and connect to configurable VPN endpoints in an on-demand network.

Provides disposable proxy credentials, forwards source traffic through a selected proxy, and returns destination traffic through a separate network connection.

Alters VPN-originated packet data by reassembling and re-segmenting packets before forwarding them to a web server through a second network interface.

Uses a pool of disposable proxies to forward traffic between a source and destination while hiding the source IP address from the destination device.

Repackages VPN-originated traffic into standard internet packet sizing so outside servers are less able to detect that the traffic came through a VPN or RRN.

Obscures a source device from a destination device by routing traffic through disposable network proxies managed with credentials and usage-based disposal triggers.

Alters VPN-originated network traffic by reassembling VPN packet data and re-segmenting it into standard internet packet sizes before forwarding it to a web server.

Implements an on-demand computing network by provisioning resources from one or more providers and assigning interior and rim devices based on a submitted network specification.

Extends the bridge-device model for an on-demand computing network by making forwarded traffic appear to terminate at the bridge device rather than the underlying network.

Moves a node within an on-demand computing network by replacing it with a newly provisioned node that preserves the old node’s network role through a tunnel.

Provisions an on-demand computing network with a bridge-device rim node that forwards repackaged data while masking where the traffic continues beyond the bridge.

Configures an on-demand computing network by assigning an interior device and rim devices from provisioned resources based on a submitted network specification.

Provisions an on-demand network with an audio server resource and proxy rim device so audio data can be sent to the user without the audio server knowing the user device address.

Migrates an on-demand network node by provisioning a replacement node, establishing a tunnel to a neighboring node, and deprovisioning the original node.

Configures a hub-and-rim on-demand network where a rim bridge device repackages forwarded data to obscure the underlying network path.

Implements an on-demand network environment by provisioning provider resources and assigning an interior device with rim devices for controlled network communication.

Uses an audio server and proxy rim device inside an on-demand network to transmit audio to a user without exposing the user device address.

Uses a bridge device inside an on-demand network to forward and repackage data so an observer sees the traffic as ending at the bridge device.

Provisions and configures an on-demand computing network where rim devices communicate with one another only through a hub device.

Provides audio delivery through an on-demand network by routing audio from an audio server to a user through a proxy rim device.

Builds an on-demand computing network from user specifications by provisioning resources and organizing them into hub and rim devices with controlled hub-based communication.

Implements an on-demand computing network with a bridge device that repackages traffic so network data appears to terminate at the bridge device.

Adds audio-server support to an on-demand computing network so audio can be delivered through a proxy without exposing the user device address.

Creates an on-demand computing network by receiving a user-defined network specification, provisioning provider resources, and assigning hub and rim devices that communicate through the hub.

Manages non-associative communications by using call-chain rules to decide whether to relay a phone call or SMS through a second SIP provider or block the connection.

Provides non-associative telephony and SMS by receiving a call or text from one SIP provider, checking it against a call chain, and forwarding it through another SIP provider when authorized.

Routes calls or SMS messages through a call chain that determines sender, receiver, and access mode before initiating the next communication leg through a second SIP provider.

Manages non-associative phone and SMS communications by routing calls or texts through a stored call chain and initiating a second communication through another SIP provider.

Provides videoconference access through participant-specific portal proxies and inbound proxies that obscure administrative data and participant association.

Obscures videoconference participants by creating an on-demand videoconference server, inbound proxies, and unique portal-proxy access paths for each participant.

Provides role-based access control by extracting user-specific service data, spawning separate network locations, and making each user’s data available through that user’s secluded instance.

Uses a bridge application to connect a remote device and support server long enough to perform a software change, then closes the secure connections.

Sets up a temporary proxy for a requested network endpoint, routes the client connection through that proxy, and removes the proxy after session-end criteria are met.

Protects service access by setting up a first reverse proxy for onboarding, transmitting second proxy credentials, and deleting the first proxy after the user receives them.

Creates a discreet online-service connection by using a temporary first reverse proxy to provide credentials for a second reverse proxy that handles the actual service access.

Controls access to web-service data by placing each user’s data in a separate spawned network location rather than allowing users to access the source service directly.

Establishes secure connections from a bridge application to both the remote device and support server, relays maintenance traffic, and terminates the connections afterward.

Creates individualized, secluded web instances so each user can access only their extracted service data without exposing the main service or other users’ data.

Establishes a discrete connection between a client and a network endpoint through a proxy instance that forwards the session and is deleted when the session ends.

Establishes a discreet service connection by issuing first proxy credentials, deleting the first reverse proxy after credential delivery, and continuing access through a second reverse proxy.

Relays communications between a remote device and support server through a bridge application so software changes can be made without exposing either endpoint directly.

Uses sequential reverse-proxy connections to let a user reach a service without exposing a direct connection between the user and the service.

Provides personalized access to service data by extracting data for each user, spawning separate network locations, and transferring each user’s data to their own read-only instance.

Provides a hidden access path to an online service by giving the user temporary reverse-proxy access credentials and then moving the connection to a second reverse proxy.

Facilitates discreet access to an online service by using a first reverse proxy to deliver access credentials, then routing the user through a second reverse proxy without direct detectable contact with the service.

Verifies cryptographic token data against timecode-based hashes before allowing inbound access to a protected network port.

Uses generated cryptographic tokens and hashes to decide whether an inbound packet should be allowed to reach a protected server port.

Protects server network ports by requiring a time-based cryptographic token before creating a rule that allows inbound access to the target port.