Symantec Corporation

Nortonlifelock Inc.

Blue Coat Systems, Inc.

Prosimo Inc

Howard Chen

Qing Li

Preety Mordani

Yusheng Huang

Samir Kapuria

Wenjing Wang

Arunabha Saha

Prashanth Prabhu

An HTTP connection between a client computing device and an application is established through a reverse proxy. A response to the client computing device includes a payload instructing initiation of a non-HTTP connection (e.g., TCP, UDP). The response is modified to replace references to an original port with a dynamic port allocated to the non-HTTP connection and a temporary ACL entry is created. A subsequent connection request addressed to the dynamic port is authorized per the ACL, modified to replace the dynamic port with the original port, and forwarded to the application. Subsequent packets for the non-HTTP connection have port numbers translated between the original and dynamic ports.

Protocol switching for connections to zero-trust proxy

The disclosed computer-implemented method for protecting users may include (i) intercepting, through a cloud-based security proxy service, network traffic originating from a mobile application at a mobile device connected to a local area network protected by the cloud-based security proxy service, (ii) detecting, by the cloud-based security proxy service, a threat indicator indicated by the mobile application, and (iii) modifying the network traffic originating from the mobile application at the mobile device by applying, by the cloud-based security proxy service based on detecting the threat indicator indicated by the mobile application, a security policy to protect the local area network from a candidate threat corresponding to the threat indicator. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for protecting users

The disclosed computer-implemented method for protecting users may include (i) intercepting an attempt to login to a user account of an application using a login credential, (ii) preventing a user corresponding to the user account from revealing personally identifiable information by populating a field for the login credential with a value for an identity-masking persona as a substitute for the personally identifiable information, and (iii) enabling a completion of the attempt to login to the user account of the application using the value for the identity-masking persona, rather than the personally identifiable information, to provide the user with access to an online resource through the application. Various other methods, systems, and computer-readable media are also disclosed.

A peering relationship among two or more network appliances is established through an exchange of control messages among the network appliances. The peering relationship defines a cluster of peered network appliances, and at each network appliance of the cluster traffic flow state information for all the network appliances of the cluster is maintained. Network traffic associated with traffic flows of the network appliances of the cluster is managed according to the state information for the traffic flows. This managing of the network traffic may include forwarding among the network appliances of the cluster (i.e., to those of the appliances handling the respective flows) at least some of the network traffic associated with one or more of the traffic flows according to the state information for the one or more traffic flows. The traffic flows may be TCP connections or UDP flows.

System and method of traffic inspection and stateful connection forwarding among geographically dispersed network appliances organized as clusters

System and method of traffic inspection and stateful connection forwarding among geographically dispersed network alliances organized as clusters

Growing community of inventors

Milpitas, CA, United States of America

Howard Chen