Extreme Networks, Inc.

Other

Enterasys Networks, Inc.

Michael B Rash

Richard W Graham

Markus Nispel

Patrick A Bosa

David L Kjendal

Jamie R Woodhead

Jeffrey W Haskell

Ernie Eaton

Steve W Schroder

Damien S Stuart

Ramanuja Chaitanya Chakravarthula

Kristopher F Orjada

Albert Tao

Bagavath Singh Swamynatha Pillai

Disclosed herein are system, method, and computer program product embodiments for verifying the integrity of a boot process without relying on a boot aggregate value. An embodiment operates by cryptographically validating, by a hardware root of trust, a first code module associated with a digital signature. The embodiment determines that the first code module was cryptographically validated and cryptographically measures the first code module thereby generating a first measurement. The embodiment stores a representation of the first measurement in a first platform configuration register (PCR) of a trusted platform module. The embodiment configures a remote attestation agent to instruct a remote attestation server to attest the value stored in the first PCR. The embodiment transmits a TPM attestation quote to the remote attestation server. The embodiment receives an acknowledgment from the remote attestation server indicating a match between the value stored in the first PCR and an allowed cryptographic measurement.

Trust chain preservation for remote attestation

A function is provided in a network system for adjusting network policies associated with the operation of network infrastructure devices of the network system. Network policies are established on network devices including packet forwarding devices. The network has a capability to identify computer applications associated with traffic running on the network. A network policy controller of the network is arranged to change one or more policies of one or more network devices based on computer application information acquired. The policies changed may be network policies as well as mirroring policies. An example policy to change is direct a network device to mirror traffic to an application identification appliance for the purpose of identifying applications running on the network through a plurality of mechanisms. The function may be provided in one or more devices of the network.

Device and related method for establishing network policy based on applications

A function is provided for identifying computer applications running on a network. Information obtained from frames having content associated with computer applications is examined and compared to information stored on the network. The stored information is obtained from a plurality of mechanisms including computer application signatures. An application identification engine of the function compares examined content with the known application information and determines an indication of the likely computer application associated with the examined frames. The determination output may include a level of confidence in the accuracy of the determination. The function includes an application programming interface to allow the introduction into the engine of custom mechanisms for application identification. The different mechanisms may be weighted. The function may be provided in one or more devices of the network including a standalone appliance.

Device and related method for application identification

A function is provided for effectively identifying computer applications running on a network. The function receives information related to frames of packets moving through the network. The information is compared to known information about computer applications. The known information is obtained from a plurality of mechanisms, including the option of obtaining it through custom mechanisms. The comparison information is scored for each of the plurality of mechanisms and those scores are combined to establish a single score indicative of the likely computer application associated with the received frames. One or more mathematical operations can be used to combine the scores. The mechanisms may be weighted for likely accuracy and the score that is established may include with it an indication of the level of confidence in that score. One or more of the plurality of mechanisms may be used to weight others of the types of mechanisms.

Device and related method for scoring applications running on a network

A method for secure single-packet authorization and secure transparent access to software services residing on cloud-based servers other than the host system where the SPA server itself is running. A single packet authorization (SPA) server running on a host system passively monitors a network for a valid SPA packet while maintaining a default deny stance on a gateway packet filter. The SPA server stores the MD5 sum of every valid SPA packet that it monitors and flags any duplicate access attempts. This way, if any SPA packet has the same MD5 hash as a previously monitored packet the SPA server treats the packet as malicious. After a valid SPA packet is sent, the SPA host server provides a Network Address Translation (NAT) which essentially creates an 'SPA gateway' within a Cloud network independent of any other border gateway devices that already exist within the Cloud. The client system may then request access via the SPA gateway to services that are on other Cloud systems besides the one where the SPA server is running.

Method for secure single-packet authorization within cloud computing networks

A network architecture system that expands the control network administrators have on existing networks. The system provides application identification and usage data by user, by device and network location. Dynamic traffic mirroring of the system allows for the efficient use of a tool to identify computer applications running on the network. The system includes the ability to embed the tool where needed rather than pervasively based on the use of the dynamic mirroring to bring the packets to the tool. The architecture implemented functions allow the ability to start small with a single application identification tool added to a network management server, examine flows from throughout the network (via mirroring) and upgrade policy control based on real application identification data and usage, then grow to pervasive deployment where virtually all new flows could be identified and controlled via policy. This architecture enables substantially complete application visibility and control.

System and related method for network monitoring and control based on applications

A method for secure single-packet remote authorization using a single packet authorization (SPA) server on a host system that passively monitors the network for connection attempts and anonymously accept or rejects said attempts depending on whether a valid SPA packet is detected, an SPA client on a client system that is responsible for generating the appropriately encrypted SPA packet in order to gain access to services on the host, and a particular packet format sent from the client to the host to gain access. The packet format is encrypted and non-replayable by virtue of 16 bytes of random data in every message, and an MD5 sum that is a hash function of the random data (made via any known hashing function). The SPA server stores the MD5 sum of every valid SPA packet that it monitors and flags any duplicate access attempts using the same MD5 hash as a previously monitored packet, in which case the SPA server treats the packet as being generated by a malicious attempt to replay the original packet.

Growing community of inventors

Gambrills, MD, United States of America

Michael B Rash