Cisco Technology, Inc.

Bruce F Wong

Edward Curt Kersey

Richard A Howes

James A Jordan

William Monte LeBlanc

Shaheed Bacchus

Bradley Dale Dike

Chris O'Rourke

Louis F Menditto

Mark Albert

Pranav Kumar Tiwari

Edward A Kersey

Patrick Darrell Tate

Larry David Bisel

Eric A Fritzges

Andre Justin Pecqueur

James W O'Toole, Jr

Tzu-Ming Tsang

Hema M Prasad

Andrew L Foss

William M Leblanc

Jacob Mark McGuire

A data security device for providing a network transport connection via a transparent network proxy that employs different encryption security mediums along a communications session between two endpoints by emulating one of the endpoints at an intermediate node such that the communication session appears as an atomic, secure connection to the endpoints yet provides appropriate security over the end-to-end connection. A sender node sends a connection request to establish a secure communication session with an intended receiver node. A transparent proxy on an intermediate node receives the request and establishes the link employing an encryption mechanism. The transparent proxy establishes a second link with the intended receiver, and applies a second, less expensive encryption mechanism. The transparent proxy combines the two links to form the trusted, secure connection but incurring only the mitigated expense over the second link.

Methods and apparatus for network communications via a transparent security proxy

A method, apparatus and computer program product for providing failover capability of cached secure sessions is presented. A cached secure session involving a first device and a second device is identified. The cached secure session is encrypted and replicated to a failover device. The encrypted session is then decrypted on the failover to device. An occurrence of a hot failover involving the second device is detected, and processing resumes between the first device and the failover device.

Method and apparatus to provide failover capability of cached secure sessions

A method, apparatus and computer program product for providing failover capability of cached secure sessions is presented. A cached secure session involving a first device and a second device is identified. The cached secure session is encrypted and replicated to a failover device. The encrypted session is then decrypted on the failover device. An occurrence of a hot failover involving the second device is detected, and processing resumes between the first device and the failover device.

A system and method are disclosed for providing a network service. A first criteria specifying a first set of flows from a first service manager is received at a forwarding agent. The first criteria specifies an expiration time interval. The first criteria is stored on the forwarding agent. A second criteria is received that specifies a second set of flows from a second service manager at the forwarding agent. The second set of flows includes flows that are in the first set of flows and the second criteria is designated as a lower priority criteria. The second criteria is stored on the forwarding agent. The first criteria is deleted from the forwarding agent upon the expiration of the expiration time interval. A packet is received that belongs to a flow that is included in the first set and the second set. It is determined that the packet matches the second set ant the packet is forwarded to the second service manager.

Backup service managers for providing reliable network services in a distributed environment

A system and method are disclosed for providing a fault tolerant network service. A packet is received that corresponds to a flow from a forwarding agent at a primary service manager and instructions are determined at the primary service manager for handling packets corresponding to the flow. The instructions are sent to the forwarding agent and the instructions are stored at the primary service manager. A replication packet is sent to a backup service manager. The replication packet includes the instructions for handling packets corresponding to the flow.

Stateful failover of service managers

A method and apparatus are disclosed for providing data from a service to a client based on the encryption capabilities of the client. Cipher suite lists are exchanged between a client and an endpoint. On the endpoint, the cipher suite list incorporates a mapping of cipher suite names to services. The endpoint uses the client's list of cipher suites in conjunction with the mapping of cipher suite names to services to determine a cipher suite match. A service is selected based on the cipher suite match. A server farm is selected based on the service. The client is informed of this cipher suite match and the endpoint retains knowledge of the cipher suite match throughout the session. Therefore, the encrypted connection between the client and the endpoint can be disconnected and later reestablished to provide data from the particular server.

Method and apparatus for providing data from a service to a client based on encryption capabilities of the client

A system and method are disclosed for maintaining the state of a virtual connection supported by an active connection manager on a standby connection manager. The method includes configuring the standby connection manager to include a physical machine object that stores a physical IP address of a physical machine that is available to the active connection manager and a virtual machine object that stores a virtual IP address of a virtual machine that is implemented on the connection manager. A replication packet is received at the standby connection manager from the active connection manager wherein the replication packet includes a foreign IP address, the virtual IP address and the physical IP address. A standby connection object is stored in the connection manager. The standby connection object includes the foreign IP address, the virtual IP address and the physical IP address from the replication packet on the standby connection manager.

Method and apparatus for maintaining connection state between a connection manager and a failover device

A funnel in fan out network device includes a fast uplink port operating at a first data rate. A plurality of slow ports operate at a second data rate. The second data rate is slower than the first data rate. A processor is configured to direct a packet received on one of the slower ports directly to the fast uplink port without looking up the destination address of the packet.

Layer 2 funnel in fan out network device

A system and method are disclosed for controlling access to a server. Instructions are sent to a forwarding agent that instruct the forwarding agent to forward packets to a service manager from clients attempting to establish a client connection to the server. A client connection is established with the client. A server connection is established from the service manager to the server and data is transferred from the server connection to the client connection.

Proxying and unproxying a connection using a forwarding agent

A network appliance is configured to store and retrieve instructions for handling a packet corresponding to a connection. The network appliance includes a connection storing processor configured to hash an incoming flow identifier for incoming packets to obtain an incoming hash; to hash an outgoing flow identifier for outgoing packets to obtain an outgoing hash; to insert an incoming entry corresponding to the incoming hash in a bidirectional hash table; and to insert an outgoing entry corresponding to the outgoing hash in a bidirectional hash table. A connection finding processor is configured to hash a packet identifier to obtain a packet hash; and to determine a matching entry in the bidirectional hash table that corresponds to the packet hash. A memory is configured to store the bidirectional hash table.

Growing community of inventors

Athens, GA, United States of America

Bruce F Wong