Trend Micro Inc.

International Business Machines Corporation

Hewlett-packard Development Company, L.p.

James Michael Rolette, Jr

Stanley Alan Smith

David Paul Dutcher

Scott Alan Lenharth

Damon E Fleury

Courtney Joseph Spooner

Matthew Laswell

Stephen G Low

Daniel Wayne Bertram

Wei Lu

Brian Smith

Jonathan Edward Andersson

Gerald Stellenberg

Edward A Wartha

William Harold Gengler

Troy Gary Reish

Richard Campbell Foltz

John Vincent Meegan

Joseph Christopher Lucas, Jr

Edward Ross

Example embodiments disclosed herein relate to perform a security action, (e.g., filtering) based on reputation and a signature match. A reputation is determined of a devices associated with a network packet or network packet stream. It is determined whether a signature matches the network packet or an associated flow of the network packet. The security action is determined based on the reputation and the match.

Security action of network packet based on signature and reputation

According to an example, configurable workload optimization may include selecting a performance optimized application workload from available performance optimized application workloads. A predetermined combination of removable workload optimized modules may be selected to implement the selected performance optimized application workload. Different combinations of the removable workload optimized modules may be usable to implement different ones of the available performance optimized application workloads. The predetermined combination of the removable workload optimized modules may be managed to implement the selected performance optimized application workload. Data flows directed to the predetermined combination of the removable workload optimized modules may be received. The data flows may be analyzed based on attributes of the data flows, and redirected for processing by one of the removable workload optimized modules of the predetermined combination of the removable workload optimized modules based on the analysis.

Combinations of removable workload optimized modules for implementing different application workloads

According to an example, configurable network security may include receiving data flows directed to end node modules of a server, and selecting data flows from the received data flows based on an analysis of attributes of the received data flows. The selected data flows may be less than the received data flows. A number of IPS data plane modules of the server that are available for inspection of the selected data flows may be determined. The selected data flows may be distributed between the IPS data plane modules based on the determined number of the IPS data plane modules. The distributed data flows may be inspected using the IPS data plane modules to identify malicious and benign data flows, and to determine whether to drop the malicious data flows, direct the malicious data flows to a predetermined destination, or forward the benign data flows to the end node modules.

Configurable network security

Example embodiments disclosed herein relate to a network security system. The network security system intercepts inline DNS requests. It is determined whether a domain name associated with one of the inline DNS requests corresponds with one or more domain names. A security action is performed based on the determination.

Network security system to intercept inline domain name system requests

A load distribution for data units received by a particular packet inspection device that is part of a collection of packet inspection devices is determined, where the packet inspection devices in the collection are to examine content of corresponding received data units. For corresponding data units received by the particular packet inspection device, the determined load distribution favors keeping the corresponding data units at the particular packet inspection device. Based on metric information regarding utilization of at least the particular packet inspection device, the load distribution is dynamically modified.

Determining a load distribution for data units at a packet inspection device

A system for processing network traffic includes a hardware-accelerated inspection unit to process network traffic in hardware-accelerated inspection mode, and a software inspection unit to process the network traffic in software inspection mode. The software inspection unit processes a connection in in the software inspection mode at least for a consecutive predetermined number of bytes of the connection. The connection may be transitioned to the hardware-accelerated inspection mode if the connection is determined to be clean.

Network traffic processing system

Securing a virtual environment includes: in a host device, intercepting a packet addressed to a virtual machine implemented by the host device; redirecting the packet to a security device external to the host device through an egress tunnel; and delivering the packet to the virtual machine if the host device receives an indication from the security device that the packet is approved.

Securing a virtual environment

A method for load balancing selects one of a set of distribution formulas to associate packets of each of multiple communications sessions traversing a link to one of a plurality of output links and assigns the associated packets of at least one of the communications sessions to a different output link.

System and method for traffic load balancing to multiple processors

A method of discovering native or non-native authentication server domains and managing information about such domains in a computer network. The various domains are &ldquo;discovered&rdquo; by issuing requests from the client to one or more of the servers in the network. Each response is then characterized as being from a native or non-native server, and a list of each such server type is then compiled at the client. The administrator may modify the list, for example, by adding or removing server domains, or may apply a discovery &ldquo;policy&rdquo; to tailor the way in which a user may access and interact with the discovered information.

Management of authentication discovery policy in a computer network

A user is authenticated at a client machine running a native operating system. Authentication may be effected from one or more non-native server domains including, without limitation, a Server Message Block (SMB) server domain, a DCE Cell, or some other non-Windows NT server domain. Following successful authentication, a user account is dynamically established or updated at the client by retrieving from the server user information and a set of 'group' privileges associated with the authenticated user. A local representation of these privileges is then dynamically created on the client, after which the privileges are linked to the user account to make the user a member of the local representation. In this manner, the group information is saved on the local machine and the authenticated user is afforded appropriate access rights to the client and the server.

Dynamic creation of a user account in a client following authentication

A user is authenticated at a client machine running a native operating system. Authentication may be effected from one or more non-native server domains including, without limitation, a Server Message Block (SMB) server domain, a DCE Cell, or some other non-Windows NT server domain. Following successful authentication, a user account is dynamically established or updated at the client by retrieving from the server user information and a set of 'group' privileges associated with the authenticated user. A 'user profile' is retrieved from the non-native server domain and used to establish at the client a user desktop and any preferences associated with the user.

User profile storage on and retrieval from a non-native server domain

A method of authenticating a user of a Windows NT client normally configured against an account held at a Windows NT server. The method begins in response to a logon request at the client. In particular, the user is provided with an option to select a server domain from a set of one or more native Windows NT server domains and/or non-native server domains for authentication. The list of native and/or non-native server domains is compiled by an administrator (e.g., during installation) or by the user (at logon). In response to user selection of the server domain, a connection is then established between the Windows NT client and the server domain. The user is then authenticated at the server domain. Following successful authentication of the Windows NT client at the server domain, a Windows NT user account is then established and maintained at the client.

User authentication from non-native server domains in a computer network

A method of discovering native or non-native authentication server domains in a computer network. The various domains are 'discovered' by issuing requests from the client to one or more of the servers in the network. Each response is then characterized as being from a native or non-native server, and a list of each such server type is then compiled at the client. If desired, the administrator may then apply a discovery 'policy' to tailor the way in which a user may access and interact with the discovered information.

Discovery of authentication server domains in a computer network

A method and architecture for the administration of large cells in an Open System Foundation/Distributed Computing Environment (OSF/DCE). The architecture organizes the Cell Directory Service (CDS) name space of the OSF/DCE to allow a network administrator to easily determine network resources under their control, and work with a subset of the network resources. The OSF/DCE name space is organized as resource realms having a CDS component and a registry component. The CDS component of the resource realms has a fixed portion containing at least two roots describing sub-systems and realm resources (e.g., printer, serial devices, etc.). The CDS component also contains individual realms defined directly below the fixed portions. The registry component has a root consisting of the security, group and realm portions. Individual realms are defined as directories below the root. The resulting resource manager which allows the OSF/DCE name space to be organized/partitioned into separate, administrable name spaces which allows easy determination as to what resources are controlled by the administrator, and easily administrable subsets of network resources.

Growing community of inventors

Round Rock, TX, United States of America

James Michael Rolette, Jr