Microsoft Technology Licensing, LLC

Other

Brian D Swander

Daniel Ron Simon

Paul G Mayfield

Pascal Francis Menezes

William H Dixon

Christian F Huitema

Gabriel E Montenegro

Bernard D Aboba

Avnish Kumar Chhabra

Sara Bitan

Abolade Gbadegesin

Gurdeep Singh Pall

Narasimha Rao S S Nagampalli

Ashish Bhargava

Lee Walker

Christopher J Engdahl

Eduard Guzovsky

Randy Joseph Miller

Richard H Lamb

Sumeet Mittal

Poornananda Gaddehosur Ramachandra

Sourav Das

Policy-based network transmission routing is provided by accessing routing metadata in a wrapper of the transmission packet, the routing metadata representing a feature of the source or the destination, comparing the routing metadata to routing policy data associated with each of multiple routing policies defined within a routing policy structure, identifying, based on the comparing, one or more routing policies applicable to the transmission packet, identifying, based on the routing policy data, a highest priority routing policy from the one or more routing policies, the highest priority routing policy defining a route constraint usable to limit a selection of available routes to the destination, and selecting the route from the available routes based on the route constraint.

Policy-based network transmission routing

A hierarchical key generation and distribution mechanism for a computer system in which devices are organized into secure enclaves. The mechanism enables network access to be tailored to approximate minimum needed privileges for each device. At the lowest level of the hierarchy, keys are used to form security associations between devices. Keys at each level of the hierarchy are generated from keys at a higher level of the hierarchy and key derivation information. Key derivation information is readily ascertainable, either from identifiers for devices or from within messages, supporting hardware offload of cryptographic functions. Because keys may be generated based on the enclaves in which the hosts participating in a security association are located, the system includes a mechanism by which devices can discover the enclave in which they are located.

Key management in secure network enclaves

Discovery of secure network enclaves

A method and system are provided for adding, removing, and managing a plurality of network policy filters in a network device. Filters are installed in a framework and designated as active or disabled. Each filter has a priority. When a new filter is to be installed into the framework, it is compared to installed filters to determine if a conflict exists. If no conflict exists, the new filter is added as an active filter. If a conflict exists, a higher priority conflicting filter is added as active and a lower priority filter is added as inactive.

Method for managing network filter based policies

A system and method for failure recognition is disclosed. The technology initially establishes a security association (SA) between a client and a first server on a network. In addition, an active reference count of a number of connections in the SA between the client and the first server is maintained. The SA is evaluated when the active reference count returns less than two connections within the SA between the client and the first server.

Failure recognition

Enhanced network data transmission security and individualized data transmission processing can be implemented by intermediaries in a communication path between two endpoint peers individually having the capability to identify and authenticate one or both of the endpoint peers. Communication session establishment, endpoint peer identity processing and authentication and data traffic encryption protocols are modified to allow intermediaries to track the communications between endpoint peers for a particular communication session and obtain information to authenticate the endpoint peers and identify data traffic transmitted between them. Intermediaries can use the identities of one or both of the endpoint peers to enforce identity based rules for processing data traffic between the endpoint peers for a communication session.

Identity based network policy enablement

Described are embodiments directed to negotiating an encapsulation mode between an initiator and a responder. As part of the negotiation of the security association, an encapsulation mode is negotiated that allows packets to be sent between the initiator and responder without encapsulation. The ability to send packets without encapsulation allows intermediaries, such as a firewall, at the responder to easily inspect the packets and implement additional features such as security filtering.

IPSec encapsulation mode

A method for authenticating and negotiating security parameters among two or more network devices is disclosed. The method has a plurality of modes including a plurality of messages exchanged between the two or more network devices. In a main mode, the two or more network devices establish a secure channel and select security parameters to be used during a quick mode and a user mode. In the quick mode, the two or more computers derive a set of keys to secure data sent according to a security protocol. The optional user mode provides a means of authenticating one or more users associated with the two or more network devices. A portion of the quick mode is conducted during the main mode thereby minimizing the plurality of messages that need to be exchanged between the initiator and the responder.

Method of negotiating security parameters and authenticating users interconnected to a network

A network firewall may apply policies to packets based on a security classification. Packets with an authenticated and established security connection may be handled at a high throughput while packets with unauthenticated connections may be handed at a low throughput or even discarded. In some embodiments, three or more levels of security classifications may be used to process packets at different speeds or priorities. In some embodiments, one device may classify and tag each packet, while another device within the network may process the packets according to the tags.

Security state aware firewall

An architecture that can provide for improved network content filtering is described herein. In particular, access to remote resources can be controlled by a remote mechanism. In accordance therewith, a gateway can seamlessly and/or transparently redirect packets from a client that are meant for an intended destination to an access control component. The access control component can determine whether the client has access to the resources requested. In addition, the gateway can provide IPSec features on behalf to the client.

NAT access control with IPSec

A system is provided for establishing a secure link among multiple users on a single machine with a remote machine. The system includes a subsystem to filter traffic so that traffic from each user is separate. The subsystem generates and associates a Security Association (SA) with at least one filter corresponding to the user and the traffic, and employs the SA to establish the secure link. An Internet Key Exchange module and a policy module may be included to generate and associate the security association, wherein the policy module is configured via Internet Protocol Security (IPSEC).

System and method for improved network security

A method and system is disclosed for managing and implementing a plurality of network policies in a network device. Each of the plurality of policies are defined by one or more filters. The filters are installed in a policy engine. A layer identifies the network policy to be applied to a packet by sending a request to the policy engine. The policy engine then returns the policy to the requesting layer. The method and system may be used to implement a programmable, host-based, distributed, authenticating firewall that enables security and other policies to be applied at several protocol layers.

Growing community of inventors

Bellevue, WA, United States of America

Brian D Swander