Cisco Technology, Inc.

Michael Zayats

Rajan Goyal

Daniel George Wing

Dan Touitou

Nir Ben-Dvora

Saravanan Agasaveeran

Jaideep Padhye

Eitan Ben-Nun

Ranjana Rao

Manohar B Hungund

Kirtesh Patil

Chanoh Haim

An interposer is provided that is configured to interpose into an application security protocol exchange by obtaining application session security state. The interposer does this without holding any private keying material of client or server. An out-of-band Security Assistant Key Escrow service (SAS/SAKE) is also provided. The SAKE resides in the secure physical network perimeter and holds the private keying material required to derive session keys for interposing into application security protocol. During a security protocol handshake, the interposer sends SAKE security protocol handshake messages and in return receives from the SAKE session security state that allows it to participate in application security protocol.

Interposer with security assistant key escrow

System and methods for identifying and managing applications over compressed or encrypted traffic in a network are described. The first and second embodiments, which provides a method for managing applications over compressed or encrypted traffic respectively, comprise identifying applications on the traffic, saving the application classification per connection, and propagating the application classification to the network. A method for providing application identification over compressed or encrypted traffic is also disclosed, which includes an application recognition module configured to, among other functions, determine an application classifier for compressed or encrypted traffic without applying an application classification process, and utilize the application classification for previous packets originating from the connection for the current packets from the same connection.

System and method for classifying and managing applications over compressed or encrypted traffic

A defender operable to support options in a communication session intercepts a connection request packet sent from a client to a server. The defender identifies a client option combination associated with the client from the connection request packet. The defender establishes a client option index corresponding to the client option combination, and encodes the client option index into a cookie of an acknowledgment packet. The defender then sends the acknowledgment packet to the client.

Supporting options in a communication session using a TCP cookie

Growing community of inventors

Sunnyvale, CA, United States of America

Michael Zayats