Juniper Networks, Inc.

Palo Alto Networks, Inc.

Anil Kumar Reddy Sirigiri

Suresh Vishwanathan

Venkata Sarat Kumar Vajrapu

Nagaraj Bagepalli

Arivu Mani Ramasamy

Gong Cheng

Arun Kumar Palani

Srinivas Koripella

Arunkumar Mutharasanallur Desigan

Vamsidhar Valluri

Madhusudhan Donthi Nagaraju

Bala Gautama

Nagendra Singh Yadav

Increasing use of web-based applications or Software-as-a-Service and IoT devices within enterprise networks increases the variety of network traffic and variables for consideration in managing security posture, which includes policy management. A security posture management system as disclosed herein leverages application identification and device discovery from ongoing collection and analysis of network traffic data to manage policies at device granularity allowing tailored security posture management. The system can tailor policies to handle network traffic depending on identified application and device type inputs obtained from the ongoing collection and analysis. The security posture management system can configure SD-WAN construct based parameters of a policy to tailor policies for different application traffic from different types of devices.

SD-WAN IOT security posture management

A network controller in an overlay network maintains collective sets of identity-based policies and identity mappings for onboarded users of the network for informed distribution to network elements across the network. As new users are onboarded, the controller identifies a site of the network at which the user was onboarded and determines identity mappings of the user and applicable policies for distribution to a network element at the identified site. The controller assigns index values to each identity and communicates the indices to network elements with the corresponding identity mappings and policies. The network elements encapsulate cross-site traffic with the index values corresponding to senders so recipient network elements can obtain the index value from encapsulation header formats, query the controller for the corresponding identity mappings, and apply policies to the traffic that are determined to be pertinent based on the sender's identity mappings obtained from the controller.

Scalable distribution of identity information in overlay networks with identity-based policies

A first device may include one or more processors. The first device may receive a network address request to obtain a network address that is associated with an application. The network address request may include application information that identifies the application. The first device may determine that the application is associated with a rule. The first device may store the application information and information identifying the network address request. The first device may obtain the network address based on the network address request. The first device may determine that the network address is associated with the rule. The first device may provide the network address, the rule, and/or the application information to a second device, to permit the second device to enforce the rule, based on determining that the application is associated with the rule and determining that the network address is associated with the rule.

Rule enforcement based on network address requests

A network device may determine a plurality of reputation indicators that indicate a measure of reputation associated with the flow. A first reputation indicator, of the plurality of reputation indicators, may be determined based on applying a first reputation analysis technique in association with the flow. A second reputation indicator, of the plurality of reputation indicators, may be determined based on applying a second reputation analysis technique in association with the flow. The second reputation analysis technique may be different from the first reputation analysis technique. The network device may determine a reputation score for the flow based on the plurality of reputation indicators. The network device may prioritize the flow based on the reputation score.

Dynamic prioritization of network traffic based on reputation

A device may determine that a received transmission control protocol (TCP) segment includes data for a hypertext transfer protocol (HTTP) version N stream, where N is greater than or equal to 2. The device may identify, from the received TCP segment, a stream identifier for the HTTP version N stream. The device may determine that a condition is satisfied for releasing one or more TCP segments, associated with the stream identifier, from a TCP reassembly queue. The device may release the one or more TCP segments from the TCP reassembly queue based on determining that the condition is satisfied.

Efficient transmission control protocol (TCP) reassembly for HTTP/2 streams

In general, techniques for sharing of network session data are described. The techniques may enable security devices to leverage application classification information in a federated manner. An example security device includes a memory and one or more processors. The processor(s) are configured to receive data representative of an application classification for a first packet flow from a second security device, to receive data of a second packet flow, and, when the second packet flow corresponds to the first packet flow, to monitor the data of the second packet flow based on the application classification for the first packet flow without determining an application classification for the second packet flow.

Growing community of inventors

Bengaluru, India

Anil Kumar Reddy Sirigiri