Juniper Networks, Inc.

Corner Venture Partners, LLC

Prismo Systems Inc.

Jumiper Networks, Inc.

Anjan Venkatramani

Pradeep S Sindhu

Gunes Aybay

Jean-Marc Frailong

Quaizar Vohra

John Keen

Srinivas Perla

Jayabharat Boddu

Krishna Narayanaswamy

Philippe Lacroute

Stefan Alexander Dyckerhoff

Matthew A Tucker

Kannan Varadhan

John D Weisbloom

Chihwei Chao

James Michael Murphy

Abhijit Kumar Choudhury

Philip A Thomas

Amit Shukla

Raghavendra Mallya

Pranay Pogde

Srinivasan Jagannadhan

Jaya Bandyopadhyay

Phalguni Nanda

Sankar Ramamoorthi

Chih-Wei Chao

Anand S Athreya

Sanjay Gupta

Linda Sun

Shuhua Ge

Ramesh Mani

Abhishek Singh

In one embodiment, edge devices can be configured to be coupled to a multi-stage switch fabric and peripheral processing devices. The edge devices and the multi-stage switch fabric can collectively define a single logical entity. A first edge device from the edge devices can be configured to be coupled to a first peripheral processing device from the peripheral processing devices. The second edge device from the edge devices can be configured to be coupled to a second peripheral processing device from the peripheral processing devices. The first edge device can be configured such that virtual resources including a first virtual resource can be defined at the first peripheral processing device. A network management module coupled to the edge devices and configured to provision the virtual resources such that the first virtual resource can be migrated from the first peripheral processing device to the second peripheral processing device.

Methods and apparatus related to a flexible data center security architecture

Systems and methods for detecting injection exploits in a networked computing environment are disclosed. In one embodiment, a method for detection includes monitoring web applications that are executing and detecting when an execution function is received over a network and invoked, where an execution function is a function that accepts external free-form data values, detecting malicious code by generating a model of legitimate behavior subsequent to invocation of the execution function, comparing actual behavior to the model of legitimate behavior, and generating an alert when the actual behavior deviates from the model of legitimate behavior and validating whether the deviation of the actual behavior is due to one or more functions that accept external input.

Systems and methods for detecting injection exploits

Systems and methods for detecting security threats using application execution and connection lineage tracing with embodiments of the invention are disclosed. In one embodiment, detecting suspicious activity in a network includes receiving at a collector server a first activity data including a first set of attributes, combining a first set of context information with the activity data to generate a first activity record, comparing the first activity record to a set of baseline signatures, incrementing a count of a first matching baseline signature when the first activity record has the same values for all attributes, receiving from a second activity data including a third set of attributes, combining a second set of context information with the second activity data to generate a second activity record, and generating an alert when the attributes of the second activity record differ from all baseline signatures.

Systems and methods for detecting and responding to security threats using application execution and connection lineage tracing

In one embodiment, an apparatus includes a switch core that has a multi-stage switch fabric. A first set of peripheral processing devices coupled to the multi-stage switch fabric by a set of connections that have a protocol. Each peripheral processing device from the first set of peripheral processing devices is a storage node that has virtualized resources. The virtualized resources of the first set of peripheral processing devices collectively define a virtual storage resource interconnected by the switch core. A second set of peripheral processing devices coupled to the multi-stage switch fabric by a set of connections that have the protocol. Each peripheral processing device from the first set of peripheral processing devices is a compute node that has virtualized resources. The virtualized resources of the second set of peripheral processing devices collectively define a virtual compute resource interconnected by the switch core.

Methods and apparatus related to virtualization of data center resources

Systems and methods for detecting security threats using application execution and connection lineage tracing with embodiments of the invention are disclosed. In one embodiment, detecting suspicious activity in a network includes receiving at a collector server a first activity data including a first set of attributes, combining a first set of context information with the first activity data to generate a first activity record, comparing the first activity record to a set of baseline signatures, incrementing a count of a first matching baseline signature when the first activity record has the same values for all attributes, receiving a second activity data including a third set of attributes, combining a second set of context information with the second activity data to generate a second activity record, and generating an alert when the attributes of the second activity record differ from all baseline signatures.

An apparatus comprises a routing module configured to receive a data unit having a code indicator. The routing module is configured to identify a virtual destination address based on the code indicator. The routing module is also configured to replace a destination address of the data unit with the virtual destination address to define a modified data unit. The routing module is further configured to send the modified data unit.

Method and apparatus for routing in transaction management systems

In some embodiments, a non-transitory processor-readable medium stores code representing instructions to be executed by a processor. The code causes the processor to receive, at an edge device, a first data unit having a characteristic. The code causes the processor to identify, at a first time, an identifier of a service module associated with the characteristic in response to each entry from a set of entries within a flow table not being associated with the characteristic. The code causes the processor to define an entry in the flow table associated with the characteristic and the identifier of the service module. The code causes the processor to send the first data unit to the service module. The code causes the processor to receive, at the edge device, a second data unit having the characteristic, and send the second data unit to the service module based on the entry.

Methods and apparatus for providing services in distributed switch

In some embodiments, a non-transitory processor-readable medium stores code representing instructions to be executed by a processor. The code causes the processor to receive, from a source peripheral processing device, a portion of a data packet having a destination address associated with a destination peripheral processing device. The code causes the processor to identify, based on the destination address, a service to be performed on the portion of the data packet. The code causes the processor to select, based on the service, an identifier of a service module associated with the service. The code further causes the processor to send the portion of the data packet to the service module via a distributed switch fabric such that the service module performs the service on the portion of the data packet and sends the portion of the data packet to the destination peripheral processing device via the distributed switch fabric.

In some embodiments, an apparatus comprises a processing module, disposed within a first switch fabric element, configured to detect a second switch fabric element having a routing module when the second switch fabric element is operatively coupled to the first switch fabric element. The processing module is configured to define a virtual processing module configured to be operatively coupled to the second switch fabric element. The virtual processing module is configured to receive a request from the second switch fabric element for forwarding information and the virtual processing module is configured to send the forwarding information to the routing module.

Methods and apparatus for selecting a master virtual processor within a switch fabric element

In one embodiment, a method includes sending a configuration signal to a virtual network switch module within a control plane of a communications network. The configuration signal is configured to define a first network rule at the virtual network switch module. The method also includes configuring a packet forwarding module such that the packet forwarding module implements a second network rule, and receiving status information from the virtual network switch module and status information from the packet forwarding module. The status information is received via the control plane.

Methods and apparatus for configuring a virtual network switch

Growing community of inventors

Los Altos, CA, United States of America

Anjan Venkatramani