3com Corporation

Attivo Networks Inc.

Hewlett Packard Enterprise Development LP

Albert Young

BoFu Chen

Danny M Nessett

Bob O'Hara

Joe Tsai

Seema Nayek

Tim Schardt

Song Ci

Mano Murthy

Harihara Mahesh

John F Wakerly

Victor A Chang

Hamid Sharif

Atul Shrivastava

Marc Feghali

Victor Chang

A system is disclosed for protecting a network against malicious attacks or attempts for unauthorized access. A network is connected to an external network by a number of firewalls. Inspectors detect packets blocked by the firewalls and some or all of the packets are detected to a labyrinth configured to emulated an operational network and response to the packets in order to engage an attacker. Blocked packets may be detected by comparing packets entering and exiting a firewall. Packets for which a corresponding packets are not received within a transit delay may be identified as blocked. Entering and exiting packets may be compared by comparing only header information. A central module may receive information from the inspectors and generate statistical information and generate instructions for the inspectors, such as blacklists of addresses known to be used by attackers.

Methods and apparatus for redirecting attacks on a network

A method and system for using a key lease in a secondary authentication protocol after a primary authentication protocol has been performed is described. In one embodiment, the primary authentication protocol comprises a strong, secure, computationally complex authentication protocol. Moreover, the secondary authentication protocol comprises a less complex (compared to the primary authentication protocol) and less secure (compared to the primary authentication protocol) authentication protocol which can be performed in a length of time that is shorter than a length of time required to perform the primary authentication protocol. In an embodiment, the key lease includes context information. Moreover, a new session encryption key is computed after each time a quick re-authentication is performed by executing the secondary authentication protocol using the key lease, whereas the session encryption key is used for encrypting communication traffic, providing a solution to the potential communication traffic replay threat.

Enhancement to authentication protocol that uses a key lease

In a computer network, a method of mutually authenticating a client device and a network interface, authenticating a user to the network and exchanging encryption keys. In one embodiment, the method comprises authenticating the client device at the local network device point, with which the client device exchanges an encryption key and then the user is authenticated by a central authentication server. In another embodiment, the method comprises authenticating the client device at the central authentication server, with which the client device exchanges a key which is passed to the network device with a secret shared between the central authentication server and the network device. In this embodiment, the user is also authenticated at the central authentication server.

Scheme for device and user authentication with key distribution in a wireless network

The present invention relates to a method for predicting an optimum transmission frame size in a wireless computer network. The method comprises assessing transmission channel quality in the network, calculating an optimum length for the transmission frame, adjusting the length of the transmission frame to the predicted optimum length, transmitting the frame at its adjusted length and assessing the quality of the transmission of the frame. Prediction of the optimum frame size employs a Kalman filter which employs the parameters of bit error rate and random processing noise in the calculation of the predicted optimum frame length.

Optimum frame size predictor for wireless Local Area Network

A process for mutual authentication of users and networks over an unsecured wireless communication channel. In one embodiment, sensitive information (e.g., passwords) is not communicated over the unsecured channel. Rather, hashed representations of user identifiers, passwords, etc., and randomly generated numbers are communicated between the client and the network during the log-in process. The representations may be encrypted with a one-way hash function such that it is not computationally feasible for an eavesdropper to decrypt. In one embodiment, the representation may be generated based on the user identifier, password and/or MAC address of a wireless LAN card.

Protected mutual authentication over an unsecured wireless communication channel

A method and system for providing network connectivity and mobility for a roaming client. Specifically, in one embodiment of the present invention, an access point (AP) is enabled with a smart agent and associated protocol. The smart agent is capable of monitoring the AP link status to the backbone network and where applicable the capability to capture the TCP/IP information. Further, the smart agent located at the AP has the capability of sending the AP connection and network status information to a client when that client associates with the AP, or when the AP's network status or configuration changes. The effect of the invention is to provide a radically simple user experience in networking connectivity and mobility in both wired and wireless network infrastructures.

Method and system for providing network connectivity and mobility while roaming

A method and system for increasing the overall network throughput over a wireless local area network (WLAN). Specifically, in one embodiment of the present invention, the dynamic switching between the Distributed Coordination Function (DCF) and Point Coordination Function IEEE 802.11 access modes is determined according to the load conditions over the WLAN in a method and system. Stations and access points within a WLAN monitor conditions within the network to determine which access mechanism is most optimum for the current load conditions. Some factors to consider in determining the load conditions include but are not limited to the number of transmissions, number of receptions, and number of collisions.

Method and system for improving throughput over wireless local area networks with mode switching

A method and system for increasing the overall network throughput over a wireless local area network (WLAN). Specifically, in one embodiment of the present invention, the dynamic selection of an initial value for a contention window in the Distributed Coordinated Function (DCF) mode is determined according to the load conditions over the WLAN in a method and system. Stations and access points within a WLAN monitor conditions within the network to establish an initial value for the contention window, also called a minimum contention window value, which is lower than that set by the IEEE 802.11 communication standard. Some factors to consider in determining the load conditions include but are not limited to the following: number of transmissions; number of receptions; and number of collisions.

Method and system for improving throughput over wireless local area networks with a dynamic contention window

The present invention provides a method and system for using a key lease in a secondary authentication protocol after a primary authentication protocol has been performed. In one embodiment, the primary authentication protocol comprises a strong, secure, computationally complex authentication protocol. Moreover, the secondary authentication protocol comprises a less complex (compared to the primary authentication protocol) and less secure (compared to the primary authentication protocol) authentication protocol which can be performed in a length of time that is shorter than a length of time required to perform the primary authentication protocol. In one embodiment, a wireless client electronic system (WC) completes the primary authentication protocol with a wireless network access point electronic system of a wireless network (AP). When the WC is required to authenticate with another AP, the WC authenticates itself with another AP by using the secondary authentication protocol. However, the WC is required to periodically complete the primary authentication protocol, guarding against the possibility that the secondary authentication protocol may be exploited by an unauthorized intruder to attack the wireless network. In one embodiment, a third party technique is implemented to store a key necessary to perform the secondary authentication protocol.

Using a key lease in a secondary authentication protocol after a primary authentication protocol has been performed

The present invention provides a method and system for performing an authenticated Diffie-Hellman key agreement protocol over a network where the communicating parties share a secret key with a third party. In one embodiment, the network is a wireless network, wherein a wireless client electronic system (WC) and a network access point electronic system (AP) are the parties executing the authenticated Diffie-Hellman key agreement protocol. In this embodiment, the WC and the AP exchange a shared secret key for encrypting wireless communications between the wireless client electronic system and the network access point electronic system. In one embodiment, the WC shares a first secret key with a RADIUS server of the network. Similarly, the AP shares a second secret key with the RADIUS server of the network. The first and second secret keys are utilized for performing an authentication protocol.

Growing community of inventors

Cupertino, CA, United States of America

Albert Young