Cisco Technology, Inc.

Hema M Prasad

Eric A Fritzges

James W O'Toole, Jr

Edward Curt Kersey

Bruce F Wong

Shaheed Bacchus

Patrick Darrell Tate

Larry David Bisel

Bradley Dale Dike

Andre Justin Pecqueur

Martin Grimm

Brad Barfield

Robert R Branum, Jr

A data security device for providing a network transport connection via a transparent network proxy that employs different encryption security mediums along a communications session between two endpoints by emulating one of the endpoints at an intermediate node such that the communication session appears as an atomic, secure connection to the endpoints yet provides appropriate security over the end-to-end connection. A sender node sends a connection request to establish a secure communication session with an intended receiver node. A transparent proxy on an intermediate node receives the request and establishes the link employing an encryption mechanism. The transparent proxy establishes a second link with the intended receiver, and applies a second, less expensive encryption mechanism. The transparent proxy combines the two links to form the trusted, secure connection but incurring only the mitigated expense over the second link.

Methods and apparatus for network communications via a transparent security proxy

An approach for preventing denial-of-service attacks on Secure Sockets Layer ('SSL') protocol is described. Queues are generated for handshake state connections and data transmission connections. A connection object representing a new SSL connection is time-stamped as it enters the handshake portion of the SSL protocol. A connection pointer to the connection object is placed at the head of the handshake queue. As new SSL messages are transferred between client and SSL server, the time-stamp is updated when the entire message is received, the connection pointer is repositioned to the head of the queue. A timer event periodically surveys the queues. If connection packet transmission gaps remain below a specified maximum handshake gap time, a connection is allowed to progress to the data transmission state. If any connection exceeds the specified gap time, the SSL connection is dropped.

Method and system for prevention of network denial-of-service attacks

Growing community of inventors

Alpharetta, GA, United States of America

Hema M Prasad