Cisco Technology, Inc.

Ionic Security Inc.

Nortel Networks Corporation

James A Jordan

Richard A Howes

Chris O'Rourke

Louis F Menditto

Mark Albert

Pranav Kumar Tiwari

Edward A Kersey

Tzu-Ming Tsang

William Monte LeBlanc

Bruce F Wong

Adam Ghetti

Ryan Mark Speers

Jeremy Michael Eckman

Edward Curt Kersey

Jeffrey Howard

Jacob Mark McGuire

Sohaib Bhatti

Nicholas Smith

Brantley W Coile

Andrew L Foss

Peter Tenereillo

Robert McColl

Kenneth Silva

William M Leblanc

Shaheed Bacchus

Peter A Tenereillo

Thomas A Bohannon

Bill Leblanc

Systems and methods are discussed for performing multi-key cryptographic operations. Policies can be received that define whether to perform a cryptographic operation with respect to various data items generated by one or more computing devices. The data items can be identified and compared to the policies to determine whether to perform the cryptographic operation on subsets of data items. The cryptographic operation can be performed with respect to a first subset of the data items using a first key, while the cryptographic operation can be performed with respect to a second subset of the data items using a second key.

Systems and methods for encryption and provision of information security using platform services

Systems and methods for securing or encrypting data or other information arising from a user's interaction with software and/or hardware, resulting in transformation of original data into ciphertext. Generally, the ciphertext is generated using context-based keys that depend on the environment in which the original data originated and/or was accessed. The ciphertext can be stored in a user's storage device or in an enterprise database (e.g., at-rest encryption) or shared with other users (e.g., cryptographic communication). The system generally allows for secure federation across organizations, including mechanisms to ensure that the system itself and any other actor with pervasive access to the network cannot compromise the confidentially of the protected data.

A system and method are disclosed for providing a network service. A first criteria specifying a first set of flows from a first service manager is received at a forwarding agent. The first criteria specifies an expiration time interval. The first criteria is stored on the forwarding agent. A second criteria is received that specifies a second set of flows from a second service manager at the forwarding agent. The second set of flows includes flows that are in the first set of flows and the second criteria is designated as a lower priority criteria. The second criteria is stored on the forwarding agent. The first criteria is deleted from the forwarding agent upon the expiration of the expiration time interval. A packet is received that belongs to a flow that is included in the first set and the second set. It is determined that the packet matches the second set ant the packet is forwarded to the second service manager.

Backup service managers for providing reliable network services in a distributed environment

A system and method are disclosed for providing a fault tolerant network service. A packet is received that corresponds to a flow from a forwarding agent at a primary service manager and instructions are determined at the primary service manager for handling packets corresponding to the flow. The instructions are sent to the forwarding agent and the instructions are stored at the primary service manager. A replication packet is sent to a backup service manager. The replication packet includes the instructions for handling packets corresponding to the flow.

Stateful failover of service managers

A system and method for determining a chronometrically optimal web site location for access by a client based on proximity measurements on established connections that are a result of requests for actual content. In one embodiment, the technique involves a race condition between local domains each transmitting TCP packets loaded with a HyperText Markup Language (HTML) Base tag identifying that local domain. The earliest received TCP packet is incorporated into the TCP stream. In another embodiment, the technique involves a race condition between local domains each transmitting files having links to streaming media translated to point to its own local domain. The earliest received file is incorporated into the TCP stream while the others are discarded as TCP resends. In yet another embodiment, HTTP redirect operations are performed once for each grouping of links only the earliest redirect packet to reach the client is incorporated into the existing TCP stream.

Method and apparatus for discovering client proximity using race type translations

A method and a system are described for directing a client to the most optimal, most available Web site or to the most optimal content in a distributed content environment, using an Internet Site Selector, which is an Internet appliance that optimizes the performance of domains hosted on mirrored, geographically distributed Web sites. The system includes various components including the Internet Site Selectors which co-locate with each Web site. The method comprises a number of steps including sending client requests to a primary or main site, redirecting by an Internet Site Selector coupled to the primary or main site the modified client requests to all other participating Internet Site Selectors. Several modes and deployments of the Internet Site Selectors, including geographic site selection, multiple Internet Site Selectors at each Web site, Internet Site Selector grouping, Internet Site Selectors in content routing are described.

Method and apparatus for discovering client proximity network sites

A method and system for providing a connection between a client and a server with load balancing between servers are disclosed. A computer-implemented method of the present invention generally includes binding a primary virtual server to a set of URLs, each URL having an associated real server and receiving a request from a client for connection to the primary virtual server. One of the real servers are selected for connection with the client and a redirect message is sent to the client specifying the URL associated with the selected real server. The method further includes receiving a new connection request from the client for connection with the selected real server.

Server load balancing method and system

A method of providing a network service is disclosed. The method includes implementing a forwarding agent on a router. The forwarding agent is operative to receive instructions from a service manager. Packets are forwarded from the forwarding agent to the service manager, and the forwarding agent receives instructions from the service manager detailing how to handle the forwarded packets.

Integrating service managers into a routing infrastructure using forwarding agents

A system and method are described for providing instructions for forwarding packets. The method includes broadcasting a general instruction specifying a plurality of flows to a plurality of forwarding agents and receiving at a service manager a first message responsive to the general instruction indicating that a packet for a specific flow has been received by a specific forwarding agent. A specific instruction is generated at the service manager for handling the specific flow and the specific instruction for handling the specific flow is sent to the specific forwarding agent.

Sending instructions from a service manager to forwarding agents on a need to know basis

A system and method are disclosed for maintaining the state of a virtual connection supported by an active connection manager on a standby connection manager. The method includes configuring the standby connection manager to include a physical machine object that stores a physical IP address of a physical machine that is available to the active connection manager and a virtual machine object that stores a virtual IP address of a virtual machine that is implemented on the connection manager. A replication packet is received at the standby connection manager from the active connection manager wherein the replication packet includes a foreign IP address, the virtual IP address and the physical IP address. A standby connection object is stored in the connection manager. The standby connection object includes the foreign IP address, the virtual IP address and the physical IP address from the replication packet on the standby connection manager.

Method and apparatus for maintaining connection state between a connection manager and a failover device

A system and method are disclosed for specifying network address translation for a set of packets. A first set of instructions is sent to a forwarding agent specifying criteria for designated packets that are designated to undergo network address translation. A matching packet is received from the forwarding agent that matches the specified criteria. A network address translation scheme is determined for the matching packet. A second set of instructions are sent specifying the network address translation scheme for packets associated with the matching packet.

Growing community of inventors

Lawrenceville, GA, United States of America

James A Jordan