Todd A Sabin, Age 56170 Deerfield Rd, Morganville, NJ 07751

2021003, Feb 4, 2021

Oct 5, 2020

17/063415

- Palo Alto CA, US
Subrahmanyam Manuguri - San Jose CA, US
Mitchell T. Christensen - Livermore CA, US
Azeem Feroz - San Jose CA, US
Todd Sabin - Morganville NJ, US

H04L 29/06
H04L 29/08
G06F 9/455

Systems and techniques are described for monitoring network communications using a distributed firewall. One of the techniques includes receiving, at a driver executing in a guest operating system of a virtual machine, a request to open a network connection from a process associated with a user, wherein the driver performs operations comprising: obtaining identity information for the user; providing the identity information and data identifying the network connection to an identity module external to the driver; and receiving, by a distributed firewall, data associating the identity information with the data identifying the network connection from the identity module, wherein the distributed firewall performs operations comprising: receiving an outgoing packet from the virtual machine; determining that the identity information corresponds to the outgoing packet; and evaluating one or more routing rules based at least in part on the identity information.

2021002, Jan 28, 2021

Jul 26, 2019

16/523938

- Palo Alto CA, US
Sergii STEPANENKO - Sunnyvale CA, US
Todd SABIN - Morganville NJ, US
Gabe ROSAS - Euless TX, US

H04L 29/08
H04L 29/12

System and computer-implemented method in a cloud architecture including a mixed network having local objects in a local network and external objects in an external network, wherein the external objects are accessed through proxy communications, uses a proxy inventory to determine whether a connection from a first computing object to a second computing object should be excluded from a proxy. The connection from the first computing object to the second computing object is performed based on the determination.

2020036, Nov 19, 2020

Jul 31, 2020

16/945748

- Palo Alto CA, US
Subrahmanyam Manuguri - San Jose CA, US
Todd Sabin - Morganville NJ, US

H04L 29/06
G06F 9/455

For a host that executes one or more guest virtual machines (GVMs), some embodiments provide a novel virtualization architecture for utilizing a firewall service virtual machine (SVM) on the host to check the packets sent by and/or received for the GVMs. In some embodiments, the GVMs connect to a software forwarding element (e.g., a software switch) that executes on the host to connect to each other and to other devices operating outside of the host. Instead of connecting the firewall SVM to the host's software forwarding element that connects its GVMs, the virtualization architecture of some embodiments provides an SVM interface (SVMI) through which the firewall SVM can be accessed to check the packets sent by and/or received for the GVMs.

2020002, Jan 23, 2020

Jul 19, 2018

16/040272

- Palo Alto CA, US
Siddharth EKBOTE - San Jose CA, US
Weiqing WU - Cupertino CA, US
Todd SABIN - Morganville NJ, US

G06F 9/455
G06F 11/34
G06N 3/02
G06K 9/62
G06N 7/00
G06F 11/20

The disclosure provides an approach for preventing the failure of virtual computing instance transfers across data centers. In one embodiment, a flow control module collects performance information primarily from components in a local site, as opposed to components in a remote site, during the transfer of a virtual machine (VM) from the local site to the remote site. The performance information that is collected may include various performance metrics, each of which is considered a feature. The flow control module performs feature preparation by normalizing feature data and imputing missing feature data, if any. The flow control module then inputs the prepared feature data into machine learning model(s) which have been trained to predict whether a VM transfer will succeed or fail, given the input feature data. If the prediction is that the VM transfer will fail, then remediation actions may be taken, such as slowing down the VM transfer.

2019007, Mar 14, 2019

Sep 11, 2017

15/701387

- Palo Alto CA, US
Todd SABIN - Morganville NJ, US
Serge MASKALIK - Los Gatos CA, US

G06F 3/06
H04L 12/24

A method of transferring data between local and remote computing systems includes the step of transferring data between the local and remote computing systems via a local buffer in the local computing system and a series of steps carried out during transferring of data from the local to the remote computing system. The steps include receiving a statistic from the remote computing system, computing an average transfer rate of the data transfer between the local and remote computing systems based on the statistic, determining whether or not a throttle condition is in effect based on the computed average transfer rate, and upon determining that the throttle condition is in effect, throttling the transferring of data into the local buffer.

2019008, Mar 14, 2019

Sep 11, 2017

15/701396

- Palo Alto CA, US
Siddharth EKBOTE - San Jose CA, US
Todd SABIN - Morganville NJ, US
Weiqing WU - Cupertino CA, US
Uday MASUREKAR - Sunnyvale CA, US

H04L 12/931
G06F 11/00
G06F 21/62
G06F 9/455

The disclosure provides an approach for managing and diagnosing middleboxes in a cloud computing system. In one embodiment, a network operations center, that is located remote to a virtualized cloud computing system and communicates with the cloud computing system via a wide area network, controls network middleboxes in the cloud computing system through a secure routing module inside a gateway of the cloud computing system. The secure routing module is configured to receive, from an authenticated management application and via a secure communication channel, packets intended for managing network middleboxes. In turn, the secure routing module establishes secure communication channels with the target middleboxes, translates the identified packets to protocols and/or application programming interfaces (APIs) of the target middleboxes, and transmits the translated packets to the target middleboxes.

2018035, Dec 6, 2018

Jul 20, 2018

16/041698

- Palo Alto CA, US
Subrahmanyam Manuguri - San Jose CA, US
Mitchell T. Christensen - Livermore CA, US
Azeem Feroz - Palo Alto CA, US
Todd Sabin - Morganville NJ, US

H04L 29/06
H04L 29/08
G06F 9/455

Systems and techniques are described for monitoring network communications using a distributed firewall. One of the techniques includes receiving, at a driver executing in a guest operating system of a virtual machine, a request to open a network connection from a process associated with a user, wherein the driver performs operations comprising: obtaining identity information for the user; providing the identity information and data identifying the network connection to an identity module external to the driver; and receiving, by a distributed firewall, data associating the identity information with the data identifying the network connection from the identity module, wherein the distributed firewall performs operations comprising: receiving an outgoing packet from the virtual machine; determining that the identity information corresponds to the outgoing packet; and evaluating one or more routing rules based at least in part on the identity information.

2018017, Jun 21, 2018

Feb 19, 2018

15/899329

- Palo Alto CA, US
Subrahmanyam Manuguri - San Jose CA, US
Todd Sabin - Morganville NJ, US

H04L 29/06
G06F 9/455

For a host that executes one or more guest virtual machines (GVMs), some embodiments provide a novel virtualization architecture for utilizing a firewall service virtual machine (SVM) on the host to check the packets sent by and/or received for the GVMs. In some embodiments, the GVMs connect to a software forwarding element (e.g., a software switch) that executes on the host to connect to each other and to other devices operating outside of the host. Instead of connecting the firewall SVM to the host's software forwarding element that connects its GVMs, the virtualization architecture of some embodiments provides an SVM interface (SVMI) through which the firewall SVM can be accessed to check the packets sent by and/or received for the GVMs.