Nokia Corporation

Nokia Siemens Networks Oy

Microsoft Technology Licensing, LLC

Adam Cain

Craig R Watkins

Jeremey Barrett

David Kashtan

Eric Kenneth Rescorla

Daniel Myers

Brian E Korver

Tom Kroeger

Brian Lichtenwalter

Steven Schall

Thomas Kroeger

Methods and devices are directed to authorizing a network device to a resource over a network. An access server determines based, in part, on an attribute of the network device associated with the attribute certificate, whether the network device may be authorized access to the resource over the network. The attribute may be associated with a capability granted to the network device, a condition to be satisfied for the attribute to be valid, and the like. The attribute may belong to a group of network devices, or one or more users accessing the network through the network device. In one embodiment, the attribute certificate may be provided based on an automated security scan of the network device. In another embodiment, the access server may make the attribute available to a network resource associated with the access server.

System and method for enabling authorization of a network device using attribute certificates

Apparatus, system, method and computer program product for verifying the integrity of remote network devices that request access to network services and resources. Unintended computer programs such as viruses, worms, or Trojan horses, may compromise remote devices. The invention involves downloading verification software over the web into the web browser of a client for the purpose of performing checks to verify the integrity and security of the client's device or system. The results of such checks are returned over the web to be used in security decisions involving authentication and the grant of authorization to access services and resources.

Apparatus, and method for implementing remote client integrity verification

Method and apparatus for fault tolerant TCP handshaking that includes a first node and a second node both connected in a network where the second node is one of at least two nodes in a cluster of nodes. The second node receives a first message from the first node where the first message includes a sequence number. The second node generates a fingerprint and replaces a portion of the sequence number with the fingerprint to form a cryptographic sequence number. The cryptographic sequence number is sent from the second node to the first node. A second message that includes the cryptographic sequence number is received from the first node at the second node. Any node in the cluster can verify that the cryptographic sequence number sent by the first node was created by one of the nodes in the cluster thereby providing fault tolerant TCP handshaking.

Method and apparatus for fault tolerant TCP handshaking

Methods and systems are directed to authenticating a client over a network. The client generates a certificate and sends it to a server through a trusted mechanism. The server is configured to store the received certificate. When the client requests authentication over the network, it provides the certificate again, along with a parameter associated with a secure session. The server verifies the parameter associated with the secure session and determines if the certificate is substantially the same as the stored certificate. The server authenticates the client over the network, if the certificate is determined to be stored. In another embodiment, the client transmits the certificate that is generated by a third party Certificate Authority (CA) based, in part, on the client's public key.

Method and system for authentication using infrastructureless certificates

Method and apparatus for clustered Secure Sockets Layer (SSL) acceleration where two or more SSL relays are connected in a cluster. Information is transferred between a first node (typically, the client) and one of the SSL relays where the transferred information is related to communication between the first node and a second node (typically, the server). The state information of an SSL connection between the first node and the one SSL relay is clustered. The clustering includes sharing the state information between the one SSL relay and each of the one or more SSL relays. Any of the SSL relays can take over all connections of another of the clustered SSL relays therefore, providing no interruption in the communication should any of the SSL relays fail.

Growing community of inventors

Madison, WI, United States of America

Adam Cain