Centripetal Networks, Inc.

Avaya Inc.

Paul Sprague

Sean A Moore

Peter P Geremia

Richard Goodwin

Vincent Mutolo

Alexander Chinchilli

Justin Makoto Leach

Christopher T Rodney

Sean S B Moore

Ilya Freytsis

Howard C Reith, Iii

James P Towey, Jr

Methods, apparatuses, systems, and machine-readable media are disclosed for improving packet filtering efficiency by reducing processing time and/or by reducing memory usage. Any of various types of data structures, such as flat hash maps and/or ruletrees, may be used by a packet filtering appliance to search for cybersecurity policy packet filtering rules that should be applied to in-transit packets. The packet filtering appliance may search the index data structures for matches of search objects, in the form of values that the packet filtering appliance extracts from in-transit packets, to threat indicator matching criteria of the policy rules. Each of the index data structures may map rule identifiers (rule IDs) of policy rules to keys that are based on (or that comprise) the matching criteria of those rules.

Methods and systems for efficient cybersecurity policy enforcement on network communications

Network devices that are inserted inline into network links and process in-transit packets may significantly improve their packet-throughput performance by not assigning L3 IP addresses and L2 MAC addresses to their network interfaces and thereby process packets through a logical fast path that bypasses the slow path through the operating system kernel. When virtualizing such Bump-In-The-Wire (BITW) devices for deployment into clouds, the network interfaces must have L3 IP and L2 MAC addresses assigned to them. Thus, packets are processed through the slow path of a virtual BITW device, significantly reducing the performance. By adding new logic to the virtual BITW device and/or configuring proxies, addresses, subnets, and/or routing tables, a virtual BITW device can process packets through the fast path and potentially improve performance accordingly. For example, the virtual BITW device may be configured to enforce a virtual path (comprising the fast path) through the virtual BITW device.

Methods and systems for efficient virtualization of inline transparent computer networking devices

A software and hardware system that provides for per flow guaranteed throughput and goodput for packet data flows using network transport protocols that have window-based flow control mechanisms or TCP-friendly flow control mechanisms. The system and method for guaranteed throughput of individual flows in turn enables a method for provisioning link bandwidth among multiple flows and provisioning network throughput and goodput at the granularity of individual flows. The invention also eliminates Layer 3 packet drops for a data flow using window-based flow control or TCP-friendly flow control, which in turn obviates congestion collapse and quality collapse scenarios.

System and method for per flow guaranteed throughput, multiple TCP flow bandwidth provisioning, and elimination of packet drops for transmission control protocol (TCP) and TCP-friendly protocols

A classification mechanism automatically aligns time-sensitive data streams to sequences (schedules), according to information in the packets or other information and classification criteria specified by a human network administrator, a sequence agent, an application program or otherwise. When a packet arrives at a first sequence-aware switch along a path, the packet is aligned to a new or existing sequence. When a new sequence is established, appointments are reserved at sequence-aware switches along the path. The packet is placed in a queue, based on its classification. When the packet reaches the head of the queue, at that queue's appointment time, the switch forwards the packet along the path. If possible, appointments have been reserved at subsequent switches along the packet's path, so the packet can be forwarded through the subsequent switches without delay. Packets that do not match any classification criteria are handled on a best-effort basis.

Systems and methods for the schedule alignment of packet flow

Growing community of inventors

North Berwick, ME, United States of America

Paul Sprague