A 10 Networks, Incorporated

Cisco Technology, Inc.

Ali Golshan

Yang Yang

Michael R Smith

Xuyang Jiang

Jeffrey Ym Wang

Venkataraman Natham

Venkatesh Janakiraman

Neelima Mehta

Douglas Alan Gourlay

Swaminathan Sankar

Madhuri Kolli

Pags Krishnamoorthy

Faisal Mushtaq

Shreeram Bhide

Pagalavan Krishnamoorthy

Devi Prasad Ivaturi

Yichao He

Jeffrey Y M Wang

Ramesh M Santhanakrishnan

Venky Natham

Martin Grimm

Sitaram Dontu

Daniel Gilbert Moen

Devendra Mohan Badhani

Sitaram Dontn

Michael Smith

Sheeram Bhide

Provided are methods and systems for intercepting encrypted data packets. A system for intercepting encrypted data packets includes a first device and a second device. The first device serves a client-side data traffic associated with a client device and the second device serves a server-side data traffic associated with a server. The first device is configured to intercept at least one encrypted data packet. The first device is further configured to decrypt the encrypted packet to produce at least one decrypted data packet. The first device provides the decrypted data packet to one or more monitoring devices for inspection of the decrypted data packet. The second device is configured to receive, from the one or more monitoring devices, the at least one decrypted data packet. The second device is further operable to re-encrypt the decrypted data packet to produce the at least one encrypted data packet.

Implementing and optimizing secure socket layer intercept

System and method for mobile network access load balancing. In accordance with a first method embodiment, a method includes receiving, at a network access load balancing controller, performance status information from a mobile network access gateway. The method also includes calculating, at the network access load balancing controller, a dynamic performance score for the mobile network access gateway utilizing the performance status information and calculating, at the network access load balancing controller, a weighted ranking of dynamic performance scores of a plurality of mobile network access gateways. The method further includes assigning, based on the weighted ranking of dynamic performance scores, one of the plurality of mobile network access gateways to serve as a mobile network access gateway for a user element.

System and method for mobile network access load balancing

Provided are methods and systems for caching network generated security certificates. An example system may include a security gateway node and a storage module. The security gateway node may be operable to receive, from a client, a session request to establish a secure connection with a server. Based on the session request, the security gateway node may establish a first secure session between the client and the security gateway node and a second secure session between the security gateway node and the server. The security gateway node may receive a server certificate from the server. The security gateway node may match the server certificate against a gateway certificate table. Based on the matching, the security gateway node may receive a gateway certificate associated with the gateway certificate entry that matches the server certificate. The gateway certificate may be used for performing the first secure session.

Caching network generated security certificates

Techniques are provided for implementing clustering services in a virtual data center or other virtualized infrastructure in a manner that allows packets to be directed to a particular service engine of a service engine cluster.

Directing data flows in data centers with clustering services

A method and system for selecting a server load balancer (SLB) for processing requests associated with a client are provided. The method may commence with receiving a Domain Name System (DNS) request from a client DNS server associated with the client. The method may include determining a geolocation of the client. The method may continue with receiving a time delay record including a round trip time (RTT) between the client and each of pluralities of SLBs and a geolocation of each SLB. The method may include matching the geolocation of the client and the geolocation of each of the pluralities of SLBs. The method may include selecting SLBs having the geolocation that matches the geolocation of the client. The method may further include selecting, from the SLBs, an SLB having a lowest RTT and sending a DNS response comprising network data of the selected SLB to the client DNS server.

Distributed global server load balancing controllers sharing service delay time

Provided are a method and a system for exchanging control information between secure socket layer (SSL) gateways. The method may commence with intercepting, by a client facing node, a client request including session-specific information and a session request to establish an SSL communication session between a client and a server. The method may continue with generating an SSL extension based on the session-specific information and adding the SSL extension to the session request to obtain an extended session request. The extended session request may be sent to a server facing node in communication with the client facing node. The method may further include identifying the session-specific information contained in the SSL extension of the extended session request and generating a further session request for establishing the SSL communication session between the server facing node and the server. The method may further include sending the further session request to the server.

Exchange of control information between secure socket layer gateways

Provided are methods and systems for inspecting secure data. A system for inspecting secure data comprises a server facing module, and a client facing module in communication with the server facing module. The client facing module is operable to intercept a client request associated with the secure data to establish a secure connection with a server, establish a data traffic channel via the server facing module, and provide a control message to the server facing module via the data traffic channel. The control message includes an instruction to the server facing module to obtain a security certificate from the server. The security certificate is received from the server facing module via the data traffic channel. The security certificate is forged to establish the secure connection between the client and the client facing module. The client facing module sends unencrypted data to the server facing module via the data traffic channel.

Implementation of secure socket layer intercept

Provided are methods and systems for enabling a planned upgrade or a planned downgrade of a first network device. A method may commence with receiving a request for a virtual service via a Transmission Control Protocol (TCP) session between the first network device and the client device. The method may further include creating, by a second network device being a standby device for the first network device, a redirect network session for the TCP session. The method may continue with delivering, by the first network device, the request for the virtual service to a server. Upon a change designating the second network device as an active device for the virtual service, the second network device may receive, from the server, a server response associated with the virtual service and redirect the server response to the first network device for further sending of the server response to the client device.

Enabling planned upgrade/downgrade of network devices without impacting network sessions

Disclosed herein are systems and methods for a security gateway to process secure network sessions where there is a server certificate validation error. In various embodiments, varying security policies can be applied to the secure network sessions, including intercepting of network data, bypass of the security gateway, or termination of the secure sessions.

Processing a security policy for certificate validation error

Described are systems and methods for verifying server security certificates using hash codes. The system may include a client secure socket layer (SSL) node, a service gateway node, and a storage node. The client SSL node may receive a session request from a client. The service gateway node may forward the session request to a server to receive a server security certificate. The service gateway node may query a server domain name system module to receive a hash code. The hash code may include a first hash value and a hash function to obtain the server security certificate based on the first hash value. The service gateway node may calculate a second hash value by applying the hash function to the server security certificate and match the second hash value and the first hash value to determine whether the server security certificate is valid.

Verification of server certificates using hash codes

A security network system may include a security gateway operable to establish a client session between the security gateway and a client device. The security gateway is operable to receive client session information from the client session. The client session information includes an identification of a server with which the client device needs to exchange data. The security network system may also include a Hardware Security Module (HSM) in communication with the security gateway. The HSM is operable to establish, in concert with the security gateway, a secure session between the security gateway and the server based on the client session data, a public key, a secret key, and context attributed to the secure session.

SSL gateway with integrated hardware security module

Provided are methods and systems for load balancing client requests between sites associated with a domain name. A method comprises determining a first active response delay time between a Domain Name System server and a first site. The method further comprises determining a first application response delay time between the first site and one or more first servers associated with the first site. According to the method, the first active response delay time and the first application response delay time are compounded to produce a first compounded response delay time. The method further comprises determining a second active response delay time and a second application response delay for a second site to produce a second compounded response delay time. The first compounded response delay time and the second compounded response delay time are compared to perform load balancing between the first site and the second site.

Active application response delay time

A method and system for measuring application response delay is described. The method may commence with receiving a Domain Name System (DNS) request from a client DNS server. The method may include measuring round trip time between the client DNS server and a first Global Server Load Balancing (GSLB) controller, between the first GSLB controller and a server load balancer (SLB) collocated with the first GSLB controller, and between the SLB and an application server. The method may further include receiving measurements of round trip time between the client DNS server and a second GSLB controller, between the second GSLB controller and an SLB collocated with the second GSLB controller, and between the second GSLB controller and a further application server. A cumulative response time associated with the application servers may be calculated based on the measurements to select an application server having a lowest cumulative response time.

Measurement of application response delay time

A method for intercepting, by a security gateway, a secure data session comprises the steps of establishing a first secure data session between a client device and a server device, intercepting the first secure data session by the security gateway, establishing a second secure data session between the server device and the security gateway, receiving a first secure session request from the client device, generating a second secure session request based on the first secure session request, receiving a server certificate from the server device, sending the second secure session request to the server device, receiving first secure content from the client device over the first secure data session, creating first encrypted secure content using the first secure content and the server certificate, and sending the first encrypted secure content to the server device over the second secure data session.

Growing community of inventors

Palo Alto, CA, United States of America

Ali Golshan