Cisco Technology, Inc.

Palo Alto Networks, Inc.

John Edward McDowall

Richard Mandfred Pruss

Jan Medved

Sharad Saha

Nilesh Bansal

Eric Albin Voit

Leonid Burakovsky

Sachin Verma

Joel Abraham Obstfeld

Charles Bransi

Apoorva Jain

Jason Pfeifer

David John Beazley

James Sugg

Marc Joseph Faggion

Yi Huang

Tula Kraiser

Larry Abrahams

Atul Bhaskarrao Patil

Xiaohui Ye

Techniques for selective intelligent enforcement for mobile networks using a security platform are disclosed. In some embodiments, a system/process/computer program product for selective intelligent enforcement for mobile networks using a security platform includes monitoring network traffic in a core mobile network using a security platform executed on a network element in the core mobile network to identify a new session that attached to the core mobile network for mobile network communications; extracting meta information associated with the new session using the security platform executed on the network element in the core mobile network; applying selective intelligent enforcement using the security platform if the extracted meta information associated with the new session matches a selective intelligent enforcement policy; and offloading the session to bypass inspection by the security platform if the extracted meta information associated with the new session does not match the selective intelligent enforcement policy.

Selective intelligent enforcement in mobile networks

Techniques for distributed traffic steering and enforcement for security solutions are disclosed. In some embodiments, a system, process, and/or computer program product for distributed traffic steering and enforcement for security solutions includes encapsulating an original traffic header for a monitored flow from/to a host or a container; rerouting the flow from the host or the container to a security platform of a security service; performing security analysis at the security platform using the original traffic header; and rerouting the flow back to the host or the container for routing to an original destination based on the original traffic header.

Distributed traffic steering and enforcement for security solutions

Techniques for distributed offload leveraging different offload devices are disclosed. In some embodiments, a system, process, and/or computer program product for distributed offload leveraging different offload devices includes receiving a flow at a firewall of a security service (e.g., a cloud-based security service); inspecting the flow at the firewall to determine meta information associated with the flow; and offloading the flow to an offload entity (e.g., a SmartNIC, software executed on a Network Interface Card (NIC), and/or a network device, such as a network router and/or network switch) based on the meta information associated with the flow (e.g., an application identification associated with the flow determined using deep packet inspection) and based on a policy.

Distributed offload leveraging different offload devices

Techniques for securing containerized applications are disclosed. In some embodiments, a system, process, and/or computer program product for securing containerized applications includes detecting a new application container (e.g., an application pod); deploying a security entity (e.g., a firewall) to the application container; and monitoring all traffic to and from the application container (e.g., all layer-7 ingress, egress, and east-west traffic associated with the application container) using the security entity to enforce a policy.

Securing containerized applications

Techniques are disclosed for using arbitrary criteria to define events occurring within a network infrastructure, as well and techniques for detecting and responding to the occurrence of such custom events. Doing so allows a collection of networking elements (switches, routers, etc.) to perform a variety of distributed functions from within the network itself to respond to custom events. Further, because custom events are published across the network, multiple network elements can communicate and respond to the same event. Thus, unlike currently available event management systems, custom events (and responding applications) can be used to create and coordinate software defined networking within a common network infrastructure.

Supporting programmability for arbitrary events in a software defined networking environment

Techniques are provided for enabling tag networking. In one example, a network device (e.g., switch, router, etc.) is configured to receive a packet of a traffic flow and to analyze the traffic flow to determine the packet belongs to a particular type of traffic. The network device can then add and/or change a tag in a data field of the packet. The tag, among other things, serves as an identifier for the particular type of traffic flow. The tag is identifiable by a downstream node that is preconfigured to recognize the tag and to carry out logic in response to recognizing the tag. Advantageously, the tag functionality of the present approach provides a generalized way of adding information to packets; the information and the associated functionalities are customizable during a runtime of the network.

Extended tag networking

Presented herein are techniques to receive configuration instructions for elements of a network topology to be simulated and tested. In response to receiving and in accordance with the configuration instructions, a plurality of software images (for a plurality of virtual network elements of the network topology) are configured via an Application Programming Interface (API). The plurality of software images run in a cloud host. In response to receiving and in accordance with the configuration instructions, data is configured via the API, which represents one or more connections between the virtual network elements. A plurality of software images for the plurality of virtual network elements is then executed in accordance with the data representing the connections, for development and testing of the network topology.

Network development and testing as a cloud service

System, method, and computer program product to represent a network using a programmable graph model, by generating a directed graph to represent a topology of the network, wherein each of a plurality of network elements in the network are represented, in the directed graph, by one of the plurality of nodes, identifying, through the directed graph, a subset of network elements, of the plurality of network elements, upon which to apply a requested operation, and applying the requested operation to the subset of network elements in a distributed manner through the directed graph.

Representing software defined networks using a programmable graph model

A method is provided in one example embodiment and includes compiling a schema definition file associated with a non-native application into a command file, the non-native application being executable in connection with a network element; creating at least one parse chain for the non-native application; storing the at least one parse chain in a database; and receiving a first command associated with the non-native application from a network administrator. The method further includes parsing the received first command as specified by the at least one parse chain to extract data therefrom; and presenting the extracted data to the non-native application, in which the extracted data is formatted as specified in the associated schema definition file prior to the presenting.

Growing community of inventors

Redwood City, CA, United States of America

John Edward McDowall