Infoblox Inc.

Cisco Technology, Inc.

Morteza Ansari

Stuart M Bailey

Etienne M Liu

Ivan W Pulleyn

Srinath Gutti

Nancy Cam-Winget

Joseph Salowey

Nathan Sowatskey

Susan Elizabeth Thomson

Klaas Wierenga

David Jones

Ulf P Eckberg

Jayaraman R Iyer

Prashanth Patil

Samir Dilipkumar Saklikar

Syam Sundar V Appala

Robin Edgard Martherus

Barry Arlen Frew

Jyoti Verma

Eric Duchene

Steven Richard Stites

Ulf P Ekberg

One or more lower-level attributes of a first network policy are translated to one or more higher-level attributes of the first network policy, and one or more lower-level attributes of a second network policy are translated to one or more higher-level attributes of the second network policy. The first network policy controls how first network traffic is handled, and the second network policy controls how second network traffic is handled. The one or more higher-level attributes of the first network policy are compared with the one or more higher-level attributes of the second network policy. Based on the comparing, it is determined whether the first network traffic and the second network traffic are handled in a functionally equivalent manner. If not, the first network policy is dynamically updated to generate an updated first network policy that causes the first network traffic to be handled in the functionally equivalent manner.

Network policy architecture

A device obtains access to an application resource from a remote application server based on an authenticated device identifier. The device sends a request to access the application resource provided by the remote application server. The device receives a first message from the remote application server directing the device to send an authentication message to a device identity server. The authentication message requests an authenticated device identity for the device. The device attaches metadata associated with the device to the authentication message and sends the authentication message with the attached metadata to the device identity server. The device receives the authenticated device identity from the device identity server and sends the authenticated device identity to the remote application. The device obtains access to the application resource from the remote application server based on the authenticated device identity.

Verified device identity providing context to application

Techniques are provided for authenticating a subject of a client device to access a software-as-a-service (SaaS) server. A network access device receives a request from a client device to establish a network session and transfers identity information of the subject, the client device and the network session to a session directory database. A request is sent to access an application on a SaaS server. If it does not contain an identity assertion that identifies the subject, the request is redirected to an identity provider device, to provide identity assertion services to the subject. A network session identifier is inserted into the request by a network access device and the request is forwarded to the identity provider device. The identity provider device uses the network session identifier to query the session directory database for the identity information to be used for a security assertion of the subject to the SaaS server.

Mechanisms to use network session identifiers for software-as-a-service authentication

Managing network event information from a plurality of network appliances is disclosed. Each network appliance provides a network service and each has a version of a common database. Managing includes detecting network event information at a first network appliance, updating a version of the common database on the first network appliance with the network event information, and propagating the network event information to other versions of the database on other network appliances.

Event management

A method is disclosed. A graphical representation is displayed of a network map of a network. A context indication is received for a network information specification for a first network segment of the network displayed on the graphical representation of the network map of the network. A first information is displayed on the graphical representation for the first network segment in response to the context indication. An action indication is received for a network management specification for the first network segment based at least in part on an interaction with the graphical representation of the network. The first network segment is modified based at least in part on the network management specification in response to the action indication.

Graphical visualization and management of networks

Maintaining consistent DNS information is disclosed. Information associated with a resource is received. A resource record is populated with the information. View information is derived from the resource record.

Maintaining consistency in a database

Techniques are provided for authenticating a subject of a client device to access a software-as-a-service (SaaS) server. A network access device receives a request from a client device to establish a network session and transfers identity information of the subject, the client device and the network session to a session directory database. A request is sent to access an application on a SaaS server. If it does not contain an identity assertion that identifies the subject, the request is redirected to an identity provider device (IdP), to provide identity assertion services to the subject. A network session identifier is inserted into the request by a network access device and the request is forwarded to the IdP. The IdP uses the network session identifier to query the session directory database for the identity information to be used for a security assertion of the subject to the SaaS server.

Growing community of inventors

Newark, CA, United States of America

Morteza Ansari