Brocade Communications Systems, Inc.

Certes Networks, Inc.

Ganesh Kumar Murugesan

Sathish Kumar Gnanasekaran

Badrinath Kollu

Vinodh Ravindran

Vidya Sagar Ravipati

Nhan Trong Pham

Vidya Renganarayanan Vineet

Srikara Subramanyan

Blayne Rawsky

Nadeem Kattangere

Todd Lawrence Cignetti

Chao Zhang

Miles S Krivoshia

Venkatesh Puvvada

Timothy J Megela

Amit Kumar Tyagi

Sean D Everson

Hor-May Chan

Sharanappa Ijeri

Pushpanathan Chidambaram

Srikanth Rayas

Vijay Mohan Guvva

A method of establishing one or more secure channels between network devices comprises exchanging a base key pair between a first network device and a second network device, and for each of a plurality of policies, providing a nonce corresponding to that policy to the first and second devices. The method further comprises generating, for each of the plurality of policies, a session key that is a function of the base key pair and the policy nonce. The method comprises determining, at the first device, that a data packet matches a rule associated with a policy, encrypting the data with a session key that corresponds to the policy to produce an encrypted packet, and conveying the encrypted packet to the second device. At the second device, determining that the encrypted packet matches the rule associated with the policy, and decrypting the encrypted packet with the session key.

Cryptographic micro-segmentation using IKEv2

An analytics and diagnostic node according to the present disclosure monitors oversubscription and determines flow metrics by receiving mirror command frames from one or more switching nodes. The mirror command frames could correspond to a multiple flows traversing over a connection within a network. The analytics and diagnostic node collects at least one latency metric for each of the flows using timestamps found within the mirror command frames. Based on the latency metrics and timestamps, the analytic diagnostic node determines an average data rate for each of the flows. The analytics and diagnostic node also computes the cumulative data rates corresponding to different bucket intervals based on the average data rates. To detect oversubscription, the analytics and diagnostic node compares the cumulative data rates with one or more oversubscription rules.

Command response and completion determination

In many secure communication systems, group keys are updated on a regular basis in order to maintain high security level. Decryption and encryption keys are typically updated simultaneously in policy enforcement points (PEPs). Such approach makes the respective communication system prone to dropping of network traffic. According to at least one embodiment, re-keying is performed by installing, at a first phase, a new decryption key at the PEPs without removing an old decryption key previously installed in the PEPs. At a second phase, a new encryption corresponding to the new decryption key is installed and an old encryption key corresponding to the old decryption is removed. At a third stage, the old decryption key and any other old decryption keys are removed from the PEPs.

Method and apparatus for enhanced distribution of security keys

A buffer to buffer credit recovery mechanism is disclosed in which the ports involved in the credit recovery operation are synchronized while credit recovery is being enabled and during a credit recovery operation when credit recovery parameters are being reset. Buffer to buffer credit recovery involves exchanging primitive control signals and parameters during the login sequence to enable credit recovery. Once credit is lost; there may be a need for resetting a link to reset the credit recovery counters and BB credits. Both of these processes require synchronization between the ports involved in the credit recovery mechanism. This synchronization is achieved by enabling credit recovery during the Link Reset protocol negotiation and ensuring that no frames or R_RDYs are exchanged during the procedure.

Mechanism to enable buffer to buffer credit recovery using link reset protocol

A network switch allows defining a virtual port worldwide name (VPWWN) and associating the VPWWN with an F_port of the network switch, for use by a host bus adaptor (HBA) connecting to the network switch. Both a default and a user VPWWN may be defined, with the user VPWWN typically taking precedence over the default VPWWN. A database of VPWWN associations may be used to ensure uniqueness of the user VPWWN. Where the HBA allows dynamic assignment of WWNs, the VPWWN may be pushed to the HBA. The VPWWNs may be deleted, and moved to another port as desired.

Virtual port world wide names

Growing community of inventors

Bengaluru, India

Ganesh Kumar Murugesan