Ipolicy Networks Inc.

Colortokens, Inc.

Pankaj S Parekh

Sandeep Gupta

Vijay Mamtani

Ashish Trivedi

Ravi Voleti

Deepak Kumar Mohanty

Harish Magganmane

Anoop Singh Kapoor

Charles Kuta

Himanshu Deoskar

Vimal Vaidya

Satyam Tyagi

Yashodhan R Deshpande

Puneet Tutliani

Naveen Kulshreshtha

Proneet Biswas

Sarraju N Rao

Saurabh Sarpal

Ryan Farjadi

Pranav Shah

Atul Jain

Sanjay K Aggarwal

Described herein are systems, methods, and software to enhance secure communications between computing systems. In one implementation, a private domain name system (DNS) receives a DNS lookup request from a computing system of a plurality of computing systems associated with a private communication group, and forwards the DNS lookup request to a public DNS. The private DNS further receives a public address associated with the DNS lookup request from the public DNS, translates the public address to a private address, and transfers the private address to the requesting computing system.

Secure domain name system to support a private communication service

Described herein are systems, methods, and software to enhance secure communications between computing systems. In one implementation, a communication service identifies a communication request from an application on the computing system to transfer data to a second application on a second computing system. In response to the communication request, the communication service identifies a communication group of a plurality of communication groups associated with the application and the second application. Once the communication group is identified, the communication service identifies a communication quality of service based on the identified communication group, and transfers the data associated with the communication request to the second computing system in accordance with the communication quality of service.

Enhanced quality of service management for inter-computing system communication

To obviate the possibility of a data packet requesting for a communication between a source computer and a destination computer being blocked either by a source firewall or a destination firewall or both, the source computer is configured to transmit the data packet to an intermediary sever, bypassing the source firewall and the destination firewall. The intermediary server is configured to analyze the data packet transmitted from the source computer and is further configured to acknowledge the need to establish a communication between the source computer and the destination computer. The intermediary server subsequently generates a notification notifying the destination computer to establish a communication with the source computer. The intermediary server transmits a notification to the destination computer and triggers the destination computer to respond to the notification and establish a communication session with the source computer.

System and method for managing the data packets exchanged across a computer network

The present disclosure envisages establishing a virtual overlay network between the source computer and the destination computer (in addition to a typical, unsecured, public computer network already connecting the source computer and the destination computer), and designating the source computer and destination computer to be identified on the virtual overlay network only by the corresponding source private IP address and destination private IP address. The present disclosure envisages an intermediary server for creating and subsequently managing the virtual overlay network. The intermediary server renders the virtual overlay network accessible only to the source computer and the destination computer to communicate with one another and to exchange data packets using the source private IP address and destination private address and the corresponding private ports, while ensuring that the virtual overlay network remains inaccessible to any other computer on the underlying public computer network.

System and method for enhancing the security of data packets exchanged across a computer network

Described herein are systems, methods, and software to enhance secure communications between computing systems. In one implementation, a communication service identifies a communication request for a first application on a first computing system to transfer data to a second application on a second computing system. In response to the request, the communication service generates a packet, wherein the packet includes an encrypted portion for the data and private addressing associated with the first and second applications, and an unencrypted portion for group identifier information and public addressing information. Once the packet is generated, the packet is transferred to the second computing system.

Enhanced packet formating for security inter-computing system communication

Described herein are systems, methods, and software to enhance gateway security for multiple communication groups. In one implementation, a method of operating a gateway service includes identifying a data packet received from a first computing system, wherein the data packet comprises a first destination port value. The method further includes, identifying a group identifier within the data packet, wherein the group identifier associated with a communication group of the plurality of communication groups, translating the first destination port value to a second destination port value based on the group identifier, and forwarding the data packet with the translated second destination port value.

Port translation for network segmentation

The present invention essentially comprises a Packet Receiver and a Stream Manager for a computer network. When a stream of packets passes through the present invention, they are received by the Packet Receiver. The Packet Receiver identifies the session to which the packet stream belongs, and passes the packet to the Stream Manager. The Stream Manager identifies the application generating the packet stream by scanning an Application ID Hash Table, which is a table that contains a mapping of destination ports to corresponding applications. Thereafter, it uses a State Machine Execution Engine to execute application decode instructions on the packet stream. The application decode instructions are stored in a table called Expression Action Table, and are generated based on a decode script created by the user for each application. The application decode instructions are chosen by the State Machine Execution Engine based on the current state of an Application Decode State Machine, which is a state machine that keeps track of the application decode process. The results of the State Machine Execution Engine are passed to the Stream Manager, and are stored in tables called Session Cache Table and Application Instance Table. Once the Stream Manager has decoded all the transactions and parameters of the application, the decoded information is sent with the packets in the packet stream.

Application decoding engine for computer networks

A system and method for enforcing policies on data packets in a computer network is disclosed. The enforcement of policies is done by prioritizing and regulating the flow of data packets. The regulation of prioritized data packets includes a determination of: service level agreement violations, flow control of data packets of a predefined priority and session resettings. For determination of service level agreements the policy engine carries out a response time calculation and finds if it is in consonance with the response time agreed upon in the service level agreement. Flow control in case of a service level agreement violation is implemented either by reducing the server side window size or by delaying acknowledgement packets sent by the client.

Application prioritization policy engine

Enforcing a plurality of different policies on a stream of packets is disclosed. In lieu of running separate algorithms for each policy, the system exploits the commonalities of all of the policies. The conditions corresponding to the compiled rules are arranged in a condition tree and processed in a pipelined architecture that allows the results of the various stages to be carried forward into subsequent stages of processing. The rules for which all conditions have been satisfied can be identified by one stage of processing in one pass of condition tree traversal and are passed to subsequent stages. A rule table corresponding to an individual policy type can then be readily examined to determine partial or complete satisfaction of the rule of that policy type, without requiring a re-examination of the conditions underlying the rule. Additionally, corresponding actions can be taken where rule satisfaction is determined. This approach allows extremely high-speed policy enforcement performance.

Architecture for an integrated policy enforcement system

The present invention is a system and method for allowing an administrator of a computer network higher up in a hierarchical arrangement to define the scope of policies for the services offered, and users lower in the hierarchical arrangement to customize policies within the scope defined by the administrator. While defining policy rules, administrators classify them as scoping or non-scoping. Users lower in the hierarchical arrangement can then customize scoping rules by defining sub-rules. Policy rules have a condition part and an action part, and the sub-rules can be used to change the scope of the condition and action parts. The present invention adds all the non-scoping policy rules, all the scoping policy rules, and all the sub-rules (with their scope limited by the scoping rules) to a rules database. This rules database is then used by any policy enforcement engine to enforce policy rules.

Scoping of policies in a hierarchical customer service management system

An integrated policy enforcement system for a computer network implements several policies on the network traffic. A rule compiler compiles these policies and converts them into a rule tree-graph, which is then used to provide desired behavior to the network traffic comprising data packets. The rule compiler comprises three sub-modules namely&#x2014;a rule input module, a rule tree generator module and a rule output module. The rule input module receives the input for the rule compiler and prepares the input for the rule tree generator module. The rule tree generator module generates the rule tree-graph. The rule tree-graph is a data structure comprising tree data structure and graph data structure. Such a data structure combines the properties of tree data structure and graph data structure, and enhances the performance of the policy enforcement systems by striking a balance between the memory requirement for storing the data structure and the processing capabilities of the system required to process the network traffic. The Output module converts the rule tree-graph to policy files, which can be downloaded to various modules of the policy enforcement systems.

Rule compiler for computer network policy enforcement systems

A rule engine for a computer network traverses a rule mesh having path nodes and path edges in form of a tree part and a graph part. The rule engine evaluates data packets flowing through a network to determine rules matched for every packet. Subsequent packets having same expression values as an already checked packet are not rechecked against the same nodes in the rule mesh through the use of a session entry. The rule engine performs a search on every path node of rule mesh to determine the next path edge to traverse. A Tree-Id and Rule Confirmation Bitmap that are indicative of path traversed and rules matched by a packet are generated at the end of rule mesh traversal. These are appended in the packet extension for subsequent modules of Policy Agent.

Rule engine

A universal application decode engine that can be programmed to decode packet streams and identify the application which is generating the packet streams is disclosed. The universal application decode engine comprises a packet receiver, a state machine execution engine for executing application decode instructions, and a session correlation lookup engine for correlating a new session to an existing session.

Universal application decode engine

An intrusion detection system detects and takes appropriate action against intrusion attacks on packets transmitted on a network. Various conditions for the intrusion attacks are described in the form of a rule tree. The intrusion detection system employs a pipelined structure including a plurality of modules, and parts of the rule are assigned to the modules. The modules determine in a pipelined manner whether the conditions of an intrusion attack are satisfied. In an intrusion attack on the packet is detected, the intrusion detection system takes appropriate action against the determined intrusion attack.

System and method for detection of intrusion attacks on packets transmitted on a network

A system, method and computer program product for ensuring the quality of services being provided by a protected network of computers during an ongoing security breach is provided. The quality of the services is ensured by performing secure Quality of Service actions on data packets on the network. The sQoS actions depend on whether the data packets correspond to an attack on the computer to which they are directed, called the destination computer. If the data packet corresponds to an attack, then the actions also depend on the type of attack. In case there is no attack, the actions depend on the history of attacks by data packets that had originated from the same source computer and were directed towards the same destination computer. Supported actions include HardenFW, ControlBW and ConnectionLimit.

Growing community of inventors

San Jose, CA, United States of America

Pankaj S Parekh