Varmour Networks, Inc.

Shieldx Networks, Inc.

Lee Chik Cheung

Yi Sun

Meng Xu

Ratinder Paul Singh Ahuja

Manuel Nedbal

Choung-Yaw Shieh

John Richard Guzik

Sumanth Gangashanaiah

Hsisheng Wang

Elanthiraiyan Ammoor Anbalagan

Chuong-Yaw Michael Shieh

Systems and methods are described herein generally relating to network security, and in particular, embodiments described generally relate to systems and methods for selecting microservices to process protocol data streams. For example, a method is disclosed, which calls for receiving a protocol packet, the protocol packet comprising a sequence number, generating a difference by subtracting a protocol message base from the sequence number, generating a first quotient by dividing the difference by a protocol common message length, generating a second value using the first quotient, determining a Transmission Control Protocol (TCP) reassembly resource using the generated second value, and transmitting the protocol packet to the determined TCP reassembly resource.

Systems and methods for selecting microservices to process protocol data streams

A method and apparatus is disclosed herein for TCP SYN flood protection. In one embodiment, a TCP SYN flood protection arrangement comprises a first device operable to process packet input and output functions, including performing sender verification with respect to a connection initiation from a sender for a first TCP connection between the sender and a destination server and a second device, separate from the first device, to perform one or more security processing operations on packets of the first TCP connection from the sender after the first device verifies the sender is legitimate.

Distributed TCP SYN flood protection

A method and apparatus is disclosed herein for distributed zone-based security. In one embodiment, the method comprises: determining an ingress security zone associated with an ingress of a first network device based on a first key and a media access control (MAC) address of a source of a packet; determining an egress security zone of a second network device based on a MAC address of a destination for the packet and a second key; performing a policy lookup based on the ingress security zone and the egress security zone to identify a policy to apply to the packet; and applying the policy to the packet.

Distributed computer network zone based security architecture

Growing community of inventors

Foster City, CA, United States of America

Lee Chik Cheung