Cisco Technology, Inc.

Edward Curt Kersey

Richard A Howes

Bruce F Wong

Shaheed Bacchus

Brantley W Coile

Bradley Dale Dike

Patrick Darrell Tate

Eric A Fritzges

Larry David Bisel

Andre Justin Pecqueur

James A Jordan

Peter A Tenereillo

James W O'Toole, Jr

Andrew L Foss

Hema M Prasad

William M Leblanc

Chris O'Rourke

Louis F Menditto

Mark Albert

Tzu-Ming Tsang

Pranav Kumar Tiwari

Derek L Huckaby

A data security device for providing a network transport connection via a transparent network proxy that employs different encryption security mediums along a communications session between two endpoints by emulating one of the endpoints at an intermediate node such that the communication session appears as an atomic, secure connection to the endpoints yet provides appropriate security over the end-to-end connection. A sender node sends a connection request to establish a secure communication session with an intended receiver node. A transparent proxy on an intermediate node receives the request and establishes the link employing an encryption mechanism. The transparent proxy establishes a second link with the intended receiver, and applies a second, less expensive encryption mechanism. The transparent proxy combines the two links to form the trusted, secure connection but incurring only the mitigated expense over the second link.

Methods and apparatus for network communications via a transparent security proxy

A method, apparatus and computer program product for providing failover capability of cached secure sessions is presented. A cached secure session involving a first device and a second device is identified. The cached secure session is encrypted and replicated to a failover device. The encrypted session is then decrypted on the failover to device. An occurrence of a hot failover involving the second device is detected, and processing resumes between the first device and the failover device.

Method and apparatus to provide failover capability of cached secure sessions

A method, apparatus and computer program product for providing failover capability of cached secure sessions is presented. A cached secure session involving a first device and a second device is identified. The cached secure session is encrypted and replicated to a failover device. The encrypted session is then decrypted on the failover device. An occurrence of a hot failover involving the second device is detected, and processing resumes between the first device and the failover device.

Disclosed is a system and method for distributing connections among a plurality of servers at an Internet site. All connections are made to a single IP address and a local director selects the server from among the plurality of servers which is to receive the connection. Thus, the DNS server is not relied upon to distribute connections, and the connection distribution scheme is not avoided when DNS is bypassed. In one embodiment, a session distribution scheme is implemented such that connections are distributed to the server in the group of servers which has the fewest connections of the group. In other embodiments, other session distribution schemes which route connections based on the predicted response times of the servers or according to a round robin scheme are used.

System for distributing load over multiple servers at an internet site

Conventional SSL termination devices support secure connections only to a predetermined destination address. An SSL termination device accepts a plaintext connection and associate it to a secure connection to an arbitrary destination endpoint by intercepting a connection request from the local subnetwork, identifying the intended destination of the connection, and establishing a secure connection to the destination, bridges the local connection and the secure connection to provide a connection through the gateway device. The SSL termination device identifies an outgoing secure connection request from a client, and intercepts the connection request to identify the recipient destination. The SSL termination device establishes a secure connection using the identified destination, and associates the connections by mapping the intercepted connection to the recipient. The identified recipient allows the secure connection to the destination, and the mapping allows message traffic received from the client over the local connection to be mapped to the destination.

System and methods for transparent encryption

A method and apparatus are disclosed for providing data from a service to a client based on the encryption capabilities of the client. Cipher suite lists are exchanged between a client and an endpoint. On the endpoint, the cipher suite list incorporates a mapping of cipher suite names to services. The endpoint uses the client's list of cipher suites in conjunction with the mapping of cipher suite names to services to determine a cipher suite match. A service is selected based on the cipher suite match. A server farm is selected based on the service. The client is informed of this cipher suite match and the endpoint retains knowledge of the cipher suite match throughout the session. Therefore, the encrypted connection between the client and the endpoint can be disconnected and later reestablished to provide data from the particular server.

Method and apparatus for providing data from a service to a client based on encryption capabilities of the client

A method and system for providing a connection between a client and a server with load balancing between servers are disclosed. A computer-implemented method of the present invention generally includes binding a primary virtual server to a set of URLs, each URL having an associated real server and receiving a request from a client for connection to the primary virtual server. One of the real servers are selected for connection with the client and a redirect message is sent to the client specifying the URL associated with the selected real server. The method further includes receiving a new connection request from the client for connection with the selected real server.

Server load balancing method and system

A system and method are disclosed for maintaining the state of a virtual connection supported by an active connection manager on a standby connection manager. The method includes configuring the standby connection manager to include a physical machine object that stores a physical IP address of a physical machine that is available to the active connection manager and a virtual machine object that stores a virtual IP address of a virtual machine that is implemented on the connection manager. A replication packet is received at the standby connection manager from the active connection manager wherein the replication packet includes a foreign IP address, the virtual IP address and the physical IP address. A standby connection object is stored in the connection manager. The standby connection object includes the foreign IP address, the virtual IP address and the physical IP address from the replication packet on the standby connection manager.

Method and apparatus for maintaining connection state between a connection manager and a failover device

A method of obtaining instructions for routing a packet is described that includes receiving a packet having a packet flow identifier that includes a packet source IP address, a packet destination IP address, a packet source port, and a packet destination port and checking whether the packet flow identifier matches a stored instruction. If the packet flow identifier does not match a stored instruction, whether the packet flow identifier matches a stored criteria is checked and if the packet matches a stored criteria, the packet is forwarded to a service manager.

Synchronizing service instructions among forwarding agents using a service manager

A system and method are disclosed for virtualizing locally initiated outbound connections from a physical machine used to implement a virtual machine. The method includes providing a virtual machine object having a virtual IP address that corresponds to the virtual machine. Inbound connections directed to the virtual machine are handled by the physical machine having a physical machine IP address. A static physical machine object is also provided. The static physical machine object contains the virtual IP address and the physical machine IP address. When a SYN packet is intercepted for an outbound connection having a SYN packet source IP address that corresponds to the physical machine IP address and a packet destination address that corresponds to a foreign IP address, it is determined whether the packet source IP address matches the physical machine IP address. If the packet source IP address matches the physical machine IP address, then a connection object is created for handling outbound connections from the physical machine IP address. A counter in a physical machine object is incremented when the connection object is created so that the locally generated connection may be considered for the purpose of load balancing new remotely generated connections.

Method and apparatus for virtualizing a locally initiated outbound connection from a connection manager

A system and method are disclosed for assigning an incoming connection to a server. The method includes defining a client specific virtual machine object instance that is associated with a designated client IP address. An incoming packet is received that is associated with a new connection. The incoming packet has a packet source IP address, a packet source port number, a packet destination IP address, and a packet destination port number. A client specific virtual machine object instance is selected that is associated with the designated client IP address when the packet source IP address matches the designated client IP address. The packet destination IP address is translated to a physical machine IP address that is designated by the client specific virtual machine instance when the packet source IP address matches the designated client IP address so that the client specific virtual machine instance is selected when the designated client IP address matches the packet source IP address and the packet is routed to the physical machine that is designated by the client specific virtual machine instance.

Growing community of inventors

Alpharetta, GA, United States of America

Edward Curt Kersey