Palo Alto Networks, Inc.

Cisco Technology, Inc.

Pensando Systems Inc.

Paul Mathison

Taylor Ettema

Ho Yu Lam

Robert Earle Ashley

Qiuming Li

Pirabhu Raman

Sumandra Majee

Robert Tesh

Tuyen Van Quoc

Xuanyu Jin

Anurag Kahol

Suresh Pachiappan

Alex Waterman

Jitesh Mulchandani

Magesh Babu Nagalingam

Mangal Vithal Shrirame

Mohankumar R Tiruvayapadi

Srinivas Dharmasanam

Techniques for outbound/inbound lateral traffic punting based upon process risk are disclosed. In some embodiments, a system/process/computer program product for outbound/inbound lateral traffic punting based upon process risk includes receiving, at a network device on an enterprise network, process identification (ID) information from an endpoint (EP) agent executed on an EP device, in which the process ID information identifies a process that is associated with an outbound or inbound network session on the EP device on the enterprise network, and the EP agent selected the network session for punting to the network device for inspection; monitoring network communications associated with the network session at the network device to identify an application identification (APP ID) for the network session; and performing an action based on a security policy using the process ID information and the APP ID.

Outbound/inbound lateral traffic punting based on process risk

Described are platforms, systems, and methods for processing a chain of operations through an input output (IO) subsystem without central processing unit (CPU) involvement. In one aspect, a computer-implemented method comprises: providing, via the CPU, the chain of operations to the IO subsystem, wherein the IO subsystem is coupled to the one or more processors over Peripheral Component Interconnect Express (PCIe); processing, with the IO subsystem, the chain of operations by: retrieving, from a memory, data associated with the chain of operations; executing each of the operations in the chain to determine an output based on the data and output determined for any prior executed operation in the chain; and providing the output of each the executed operations for execution of the respective next operation in the chain; and providing, via the IO subsystem, an output for the chain of operations to the CPU.

Flexible datapath offload chaining

Techniques for fine-grained firewall policy enforcement using session APP ID and endpoint process ID correlation are disclosed. In some embodiments, a system/process/computer program product for fine-grained firewall policy enforcement using session APP ID and endpoint process ID correlation includes receiving, at a network device on an enterprise network, process identification (ID) information from an endpoint (EP) agent executed on an EP device, in which the process identification information identifies a process that is initiating a network session from the EP device on the enterprise network; monitoring network communications associated with the network session at the network device to identify an application identification (APP ID) for the network session; and performing an action based on a security policy using the process ID information and the APP ID.

Fine-grained firewall policy enforcement using session app ID and endpoint process ID correlation

Methods and systems are provided for negotiating a session with a first server, wherein data within the session travels through at least a second server such as a proxy server; replacing a first client global unique identifier (GUID) with a second GUID generated by the second server; maintaining a GUID map table at the second server mapping the second GUID with the first GUID; requesting a plurality of leases on a file from the first server, wherein the each of the plurality of lease requests comprises a lease key and the second GUID, wherein the lease key is identical for each of the plurality of leases; providing caching services, wherein caching services are associated with a lease state corresponding to one of the plurality of leases; receiving an indication that a second client has made a lease request for the file; breaking the first lease upon receipt of the indication; and communicating a lease break notification to addresses associated with the second GUID.

Method for solving coherency lock issues in proxy services

An intermediary device, which behaves as a proxy for two entities after the entities have established a connection between themselves, is disclosed, as is a method that may be performed by such a device. The intermediary device can inspect a complete message, whose parts may be spread among multiple separate packets, without engaging in handshake phases with the message's origin or destination. As a first entity negotiates connection parameters with a second entity, the intermediary device stores the connection parameters as the parameters flow through the intermediary device. After the two entities have established an original connection, the intermediary device uses the intercepted parameters to form two separate connections in the place of the original connection: one between the intermediary device and the first entity, and another between the intermediary device and the second entity. To the entities, the newly formed connections appear to be same as the original connection.

Delayed network protocol proxy for packet inspection in a network

Growing community of inventors

San Jose, CA, United States of America

Paul Mathison