Juniper Networks, Inc.

Funk Software, Inc.

Paul Funk

Roger Allen Chickering

Paul James Kirner

Stephen R Hanna

Oliver Kourosh Tavakoli

Panagiotis Kougiouris

Derek Brown

Panagiotis Kouriouris

An endpoint integrity system controls access to resources of a protected network for endpoint devices attempting to access the protected network. The system may include a number of evaluation modules that communicate with an endpoint device. The evaluation modules generate policy results for the endpoint device, in which each of the policy results assume one of three or more states, called a multi-state policy result. The multi-state policy results are combined to produce a combined Boolean policy result.

Combining network endpoint policy results

A method may include authenticating a device to a first server, where the device includes an agent; receiving a request, in the first server from a second server, to verify the authenticity of the device, where the device is not authenticated to the second server; sending a browser plug-in to the device to communicate with the agent for verifying the authenticity of the device; receiving, in the first server, a message from the agent verifying the authenticity of the device; and sending a message from the first server to the second server to authenticate the device to the second server.

Single sign-on for network applications

A method may include authenticating a node over layer 2 in a network based on authentication rules; sending a node authentication code to the node; and providing layer 3 network access based on the node authentication code.

Authentication and authorization in network layer two and network layer three

Communicating keys between network devices on a network using asymmetric cryptographic techniques, for which asymmetric keys may be derived from a single (same) password. Knowledge or partial knowledge of the password may be the only information shared between parties prior to execution of a key exchange, and may be the only criteria by which one party will base trust in the other. A first network device may encrypt a key using a password-based key derived from a password, and authenticate a second device based on the second network device's ability to decrypt the encrypted key using a key derived from the same password. Knowledge of the password may be conveyed by the second device to the first device&#x2014;a session key may be generated as a function of the decrypted key, and a function of this session key may be communicated from the second device to the first device.

Password-authenticated asymmetric key exchange

A controller may receive a request from an endpoint and determine whether the endpoint connects via a first network or a second network. The controller may download first software to the endpoint when the endpoint connects via the first network, where the first software facilitates authentication of the endpoint via another device and instructs the endpoint to not store information regarding the controller. The controller may download second software to the endpoint when the endpoint connects via the second network, where the second software facilitates authentication of the endpoint by the device and instructs the endpoint to store information regarding the controller.

Selective persistent storage of controller information

In general, techniques are described for managing multiple access policies in a network access control system. An endpoint device may send, to a policy decision point ('PDP'), a request to communicate on a network. When the PDP receives such an access request, the PDP typically identifies a set of access policies to be enforced with regard to the endpoint device and causes the identified access policies to be enforced with regard to the endpoint device. These access policies may specify rights to communicate on networks and/or rights to communicate with server resources and/or endpoint configuration requirements. However, because the endpoint device may issue multiple access requests, conflicting sets of access policies may potentially be enforced with regard to the endpoint device. The techniques described herein ensure that only a consistent set of access policies are enforced with regard to the endpoint device when accessing the network.

Reconciliation of multiple sets of network access control policies

Systems and methods for preventing a Man-in-the-Middle attack on a communications network, without combining encryption keys of an inner authentication protocol and a tunneling protocol encapsulating the inner authentication protocol. The performance of a hash function may be split between two network devices on the communications network. For example, in response to a challenge issued by a tunnel server, a client may initiate performance of a hash function using only a first part only of the challenge and generate an intermediate result of the hash function (i.e., a preliminary hash). The client then may transmit the preliminary hash to the tunnel server as part of a response to the challenge. The tunnel server then may complete the hash function using the preliminary hash and the remaining part of the challenge to produce a final hash. The final hash then may be used to authenticate a user.

Tunneled authentication protocol for preventing man-in-the-middle attacks

Apparatus for verifying the identity of a party are disclosed, the apparatus including a database memory that stores a password signal encrypted by operation of a one-way commutative function; a number generator that generates an non-repeating number or signal representative thereof; and a processor element that can generate a challenge signal as a function of the number signal and a selected one-way commutative function and that can further generate a key signal as a function of the encrypted password signal and the number. The system includes a communication port for transmitting the generated challenge signal to a party requesting access to the secure system and for receiving a response from the party; and further includes a comparator element for comparing the received response with the generated key signal and for generating a match signal that indicates whether the response signal received from the party is substantially identical to the encrypted password signal stored in the database memory.

Growing community of inventors

Cambridge, MA, United States of America

Paul Funk