Cisco Technology, Inc.

Paul Harry Gleichauf

Mark Alan Bakke

Xiaoxue Ma

David P Thompson

Timothy J Kuik

Michael R Smith

Saravanakumar Rajendran

Ganesh Sadasivan

Sunil Khaunte

Paul J Aitken

Paul Fazzone

Paul Atkins

Shriram Velaga

Paul Anthony Fazzone

David Thompson

A method and system to exchange information between computer applications are provided. The system may include a source operating system, a destination operating system and an offload stack, all residing on the device. The source operating system and the destination operating system appear to users as distinct network entities. The offload stack may be configured to function as an intermediate network device for the source operating system. The offload stack, in one embodiment, comprises a back end to receive a message from the source operating system to the destination operating system, an analyzer to determine that the destination operating system resides on the device and a cut though socket module to process the message such that a network layer of the offload stack is bypassed.

Method and system to transfer data utilizing cut-through sockets

Techniques for dynamically configuring security mechanisms in a network can construct security perimeters that satisfy security needs at any given time while also efficiently spreading security functions among network elements and systems. In one technique, a network element comprises security function modules. Systems toward which the network element forwards data packets also comprise security function modules. A particular security function module on the network element begins in a state of deactivation. The network element determines whether a corresponding security function module on one of the systems is functioning in a satisfactory manner. If not, then the network element activates the particular security function module. While activated, the particular security function module may perform at least some of the security function operations that the corresponding security function module would have performed if the corresponding security function module was satisfactory.

Dynamic authenticated perimeter defense

An apparatus for offloading network, block and file functions from an operating system comprises a network interface coupled to a network for receiving packet flows; one or more processors each having one or more processor cores; a computer-readable medium carrying one or more operating systems and an input/output networking stack which are hosted in one or more of the processor cores. The networking stack is shared among the operating systems. The networking stack comprises instructions which when executed cause receiving a request for data transfer from one of the operating systems at internal network, block and file system interfaces, and permitting data to be transferred between the internal interfaces and a plurality of external interfaces by preventing the operating systems from performing the data transfer and performing the data transfer on behalf of the operating systems.

Offload stack for network, block and file input and output

A computer system, comprising at least one controlled execution space hosting an operating system and an application program; a vulnerability monitoring agent coupled to the controlled execution space; one or more vulnerability profiles coupled to the vulnerability monitoring agent, wherein each of the vulnerability profiles comprises an application program identifier, an operating system identifier, a vulnerability specification describing a vulnerability of an application program that the application program identifier indicates when executed with an operating system that the operating system identifier indicates, and a remedial action which when executed will remediate the vulnerability; wherein the vulnerability monitoring agent is configured to monitor execution of the operating system and the application program in the controlled execution space, to detect an anomaly associated with the vulnerability, to determine the remedial action for the operating system and application program based on one of the vulnerability profiles, and to cause the remedial action.

Network context triggers for activating virtualized computer applications

An approach for managing the consumption of resources uses adaptive random sampling to decrease the collection of flow statistical data as the consumption of resources increases. When a packet is received from a network, a determination is made whether the packet belongs to an existing flow, for which flow statistical data is being collected, or to a new flow. If the packet belongs to an existing flow, then the flow statistical data for the existing flow is updated to reflect the packet. If the packet belongs to the new flow, then a sampling probability is used to determine whether the new flow is to be sampled. The sampling probability is determined, at least in part, upon a current usage of resources.

Approach for managing the consumption of resources using adaptive random sampling

In a virtual infrastructure, a single appliance is provided that hosts a centralized virtual machine monitor (VMM) control plane to effectively establish a single virtual switch across all virtual machines within one or more clusters of servers, thereby reducing the number of management points for the network administrator and facilitating easier VM migration.

Centralized control plane appliance for virtual infrastructure

A broadband network device is configured, in a broadband network, for dynamically controlling an upstream link bandwidth of a user node configured for downloading content via a downstream link having a prescribed bandwidth and uploading content through the broadband network via an upstream link according to the upstream link bandwidth. The broadband network device sets the upstream link bandwidth to a bandwidth value optimized for minimal-size data (e.g., message-based) transfers and that substantially restricts transfers of media-based (e.g., digital video or audio) data transfers to substantially long time intervals. The broadband network device is configured for dynamically increasing the upstream link bandwidth to an increased bandwidth value optimized for media-based data transfers, based on an identified authorization. The authorization may be supplied externally, for example, by a content provider, or based on a verification supplied by an authorization server that the user node is authorized to redistribute the content. Hence, content distribution can be controlled based on dynamically controlling the upstream link bandwidth according to content authorization, substantially minimizing the occurrences of unauthorized content redistribution.

Arrangement for controlling content distribution by dynamically controlling bandwidth for transfer of the content based on content authorization

A policy-based approach for managing the export of network flow statistical data uses constraints and prioritization to select flow data to be exported by flow monitoring processes. According to the approach, a flow monitoring process monitors a plurality of flows at an observation point. The flow monitoring process generates flow statistical data for the plurality of flows. Policy data is made available to the flow monitoring process and includes constraint data and priority data. The constraint data indicates usage constraints for one or more resources available to the flow monitoring process. The priority data indicates a desired priority of flow attributes. The flow monitoring process uses the policy data to select one or more flows from the plurality of flows, such that the resource usage constraints are satisfied. The flow monitoring process exports a portion of the flow statistical data that corresponds to the selected one or more flows.

Growing community of inventors

Saratoga, CA, United States of America

Paul Harry Gleichauf