Fortinet, Inc.

Fortinct, Inc.

Michael Xie

Xu Zhou

Lin Huang

Robert A May

Shaohong Wei

Hongwei Li

Jinhai Yang

Yu Fang

Kunhua Lin

Michael D Nelson

Bing Xie

Zhi Guo

Hongbin Lu

Wenping Luo

Anthony James

Stephen John Bevan

Jun Li

Yixin Pan

Jin Shang

Kunal Marwah

Kai Xu

Jingyu Liu

Xianfeng Deng

Wei Wang

Jordan E Thompson

Joseph W Wells

Koroush Akhavan-Saraf

Ihab Khalil

Yong Wang

Shenghe Wang

Langtian Du

Yong Zhang

Michael Yu Fang

Xin Gu

Xiaodong Xu

Langtain Du

Jing Shang

Junyin Li

Guangwen Li

Reuben Stanley Wilson

Ling Clarke

Xiadong Xu

Various systems, devices, storage media, and methods are discussed for performing secured access service edge (SASE) processing in a network potentially having multiple SASE processing capable devices.

Systems and methods for multiple point SASE access control

Some embodiments provide a method for mobile device based user authentication. The method includes registering a session between a browser and a web application. The method also includes receiving a data object associated with the session and receiving a QR code from a mobile device that is captured from the browser. The method also provides for identifying the data object and sending the data object to the mobile device to retrieve user credentials. The method then receives an encrypted message comprising the user credentials from the mobile device. The encrypted message is then forwarded to the web application for authentication.

Mobile device based credential authentication

Methods and systems are provided for an improved cluster-based network architecture. According to one embodiment, an active connection is established between a first interface of a network device and an enabled interface of a first cluster unit of an HA cluster of network security devices. The HA cluster is configured to provide connectivity between network devices of an internal and external network. A backup connection is established between a second interface of the network device and a disabled interface of a second cluster unit. While the first cluster unit is operational and has connectivity, it receives and processes all network traffic from the network device that is destined for the external network. Upon determining the first cluster unit has failed or has lost connectivity, then all subsequent network traffic originated by the network device that is destined for the external network is directed to the second cluster unit.

High-availability cluster architecture and protocol

Systems and methods for implementing a cooperative security fabric (CSF) protocol are provided. According to one embodiment, an NSD of multiple NSDs participates in the dynamic construction of a CSF interconnecting the NSDs in a form of a tree, having multiple nodes each representing one of the NSDs, based on hierarchical interconnections between the NSD and directly connected upstream and downstream NSDs. A communication channel is established by a backend daemon of the NSD with a directly connected upstream node of the NSD within the CSF through which queries and replies are communicated and through which periodic keep-alive messages and responses are exchanged between the upstream node and the NSD. A CSF protocol is enforced by a forward daemon of the NSD that limits issuance of query messages to those originated by a source NSD representing an upstream node and directed to a destination NSD representing a downstream node.

Building a cooperative security fabric of hierarchically interconnected network security devices

Systems and methods for monitoring compliance with security goals by a network or part thereof are provided. According to one embodiment, a topology of a network segment of a private network is discovered by a network security device associated with the private network. Security policies implemented by one or more network security devices that form part of the network segment are learned by the network security device. Compliance with a security goal associated with the network segment is then determined by the network security device by: (i) analyzing traffic passing through the network segment; (ii) analyzing respective system configurations of the one or more network security devices; and (iii) evaluating performance of the security policies based on the traffic.

Learning network topology and monitoring compliance with security goals

Systems and methods are described for analysing, sharing and comparing security configurations. According to one embodiment, a security metric for a network segment of a private network is generated based on determination and analysis of network assets, network topology, and one or more defined security criteria representing security features being implemented by one or more network security devices that form part of the network segment, wherein the scoring metric is a quantitative representation of protection level and/or exposure level of the network segment. In an embodiment, the security metric can be shared and compared with security metrics of other network segments.

Network security framework based scoring metric generation and sharing

Systems and methods are provided for notifying users within a protected network about various events and information. According to one embodiment, a method includes receiving, by a filtering device, a request originated by an application running on a client device. The method further includes making a determination, by the filtering device, whether the request is to be blocked or allowed, based on the one or more policies. If the request is to be blocked, a notification is provided to a user of the client device regarding the determination by causing the application to display a predefined message.

Notifying users within a protected network regarding events and information

Systems and methods for implementing a cooperative security fabric (CSF) protocol are provided. According to one embodiment, a CSF of multiple network security devices (NSDs) deployed within a protected network is constructed in a form of a tree, having a root node, one or more intermediate nodes and one or more leaf nodes, based on hierarchical interconnections among the NSDs by determining a relative upstream or downstream relationship among each NSD. Backend daemons of the NSDs establish and maintain a bi-directional tunnel between each parent node within the CSF and its respective child nodes through which queries and replies are communicated and through which periodic keep-alive messages and responses are exchanged. Forward daemons of the NSDs enforce a CSF protocol that limits the issuance of query messages to those originated by an upstream node within the CSF and directed to a downstream node within the CSF.

A device for detecting network traffic content is provided. The device includes a first input port configured to receive one or more signatures, each of the one or more signatures associated with content desired to be detected, a second input port configured to receive data associated with network traffic content. The device also includes a processor configured to process the one or more signatures and the data to determine whether the network traffic content matches the content desired to be detected, and an output port configured to couple the device to a computer system of an intended recipient of the network traffic content. The output port passes the network traffic content to the computer system when it is determined that the network traffic content does not match the content desired to be detected.

Hardware-based detection devices for detecting unsafe network traffic content and methods of using the same

Process, equipment, and computer program product code for configuring a network security device using a hand-held computing device are provided. Default initial settings for a network security device are received by a mobile application running on a hand-held computing device. The default initial settings represent settings that allow the network security device to be remotely managed via a network to which the network security device is coupled. The default initial settings are presented to a network administrator via a touch-screen display of the hand-held computing device. Revisions to or acceptance of the default initial settings are received by the mobile application. The mobile application causes the network security device to be configured with the revised or accepted default initial settings by delivering the settings to the network security device via a management interface to which the hand-held computing device is coupled via a connecting cable.

Configuring initial settings of a network security device via a hand-held computing device

A device for detecting network traffic content is provided. The device includes a memory configured for storing one or more signatures, each of the one or more signatures associated with content desired to be detected, and 5 defined by one or more predicates. The device also includes a processor configured to receive data associated with network traffic content, execute one or more instructions based on the one or more signatures and the data, and determine whether the network traffic content matches the content desired to be detected.

Detecting network traffic content

A telecommunication terminal that integrated with a wireless access point is provided. According to one embodiment, a telecommunication terminal includes a local area network (LAN) port, a processor, an Internet Protocol (IP) phone unit, a wireless access point unit and a housing. The LAN port is connectable to an enterprise computer network via an Ethernet cable. The processor runs a host operating system (OS). The IP phone unit is implemented as an application that is loaded and run within the host OS. The wireless access point unit facilitates access to the enterprise computer network by wireless devices within a coverage area of the wireless access point unit by providing wireless connections to the wireless devices and is implemented as an application that is loaded and run within the host OS. The housing encloses the processor and the LAN port.

Telecommunication terminal

Systems and methods for automatically installing CA certificates received from a network security appliance by a client security manager to make the CA certificate become a trusted CA certificate to a client machine are provided. In one embodiment, a client security manager establishes a connection with a network security appliance through a network, wherein the client security manager is configured for managing security of a client at the client side and the network security appliance is configured for managing the security of traffic pass through the network. The client security manager downloads from the network security appliance a certificate authority (CA) certificate to be used for signing a server certificate of a secure connection between the network security appliance and the client and automatically installs the CA certificate into a certificate store of the client.

Management of certificate authority (CA) certificates

Methods and systems for Data Leak Prevention (DLP) in an enterprise network are provided. According to one embodiment, a network security device maintains a filter database containing multiple filtering rules. Each filtering rule specifies a watermark value, a set of network services for which the filtering rule is active and an action to be taken. Network traffic directed to a destination residing outside of an enterprise network, associated with a particular network service and containing a file is received. A watermark value embedded within the file is identified. When there exists a filtering rule specifying a matching watermark value and for which the filtering rule is active for the particular network service, the action specified by the filtering rule is performed.

Data leak protection

Methods and systems are provided for implementing application layer security. According to one embodiment, security rules applicable to end users of a private IP network and particular resources accessible within the network are maintained by a network appliance. A packet originated within the network is received by the network appliance. An application type associated with the packet is determined based on layer 7 information within the packet. Layer 7 information fields are extracted from the packet that are indicative of an identity of an end user associated with the packet. An SSO process is performed including receiving and authenticating credentials of the end user on behalf of multiple resources within the network based on the identity of the end user. One or more security rules are identified and applied to the packet based on the identity of the end user and the determined application type.

Growing community of inventors

Palo Alto, CA, United States of America

Michael Xie