F5 Networks, Inc.

Oracle International Corporation

F5, Inc.

Peter Michael Thornewell

Paul Imre Szabo

Timothy Scott Michels

Christopher Ryan Baker

Robert Andrew Kovalchik

Bryan David Skene

Hao Cai

Lisa M Golden

John Francis Tavares

Saxon Carl Amdahl

David Dean Schmitt

John Robert Hughes

Benn Sapin Bollay

Alan B Mimms

Nat Thirasuttakorn

Ian Smith

Nojan Moshiri

David Kushi

Bill Baumann

Jeffrey Michael Warren

Jason Haworth

Charles Cano

Songbo Zheng

Nencho Spasov Spasov

The present disclosure relates to intelligent network encryption of traffic between a source and a destination. In an example, a network element receives, during a session between the source and the destination, first traffic exchanged between the source and the destination. The network element determines whether a traffic exchange between the source and the destination is expected to be secured by at least one of the source or the destination at any of a network layer, a transport layer, or an application layer. The network element generates a decision whether to secure the first session at the network layer based on whether the traffic exchange is expected to be secured or unsecured. The network element implements the decision on at least one of the first traffic or second traffic exchanged between the source and the destination during the first session.

Network encryption based on traffic between source and destination

Embodiments are directed to stateless communication using a stateful protocol. One or more NTMAs may establish a connection with a client computer based on data exchanged with a the client computer using the stateful protocol. The exchanged data may include validation information provided by the one or more NTMAs. The exchanged data and other information associated with the connection may be discarded from one or more memories of the one or more NTMAs. A network packet communicated over the network using the stateful protocol may be obtained. Verification information and candidate validation information may be generated based on one or more characteristics of the network packet. The network packet may be validated based on a comparison of the verification information and the candidate validation information. A reply that adheres to the stateful protocol may be provided to the client computer based on the validated network packet.

Stateless communication using a stateful protocol

Technology related to processing network packets with returnable values is disclosed. In one example, a method includes intercepting a Domain Name System (DNS) request including returnable request values in respective request packet fields. A hash function can be used to characterize or modify the intercepted returnable request values. The intercepted DNS request can be forwarded to a DNS server. A DNS response including returnable response values in respective response packet fields can be received. The returnable response values and the hash function can be used to determine whether the DNS response is legitimate. A legitimate DNS response can be forwarded to a client.

Processing packets with returnable values

Methods, non-transitory computer readable media, rendezvous gateway (RG) apparatuses, and network security systems that send an RG synchronization message (SYN) to an application in a secure domain following receipt, from a client, of a client SYN comprising an indication of the application. A rendezvous agent (RA) SYN is received, via a firewall coupled to the security domain and in response to the RG SYN, from an RA in the secure domain. A first RG synchronization-acknowledgement message (SYN+ACK) is sent to the client in response to the client SYN. A second RG SYN+ACK is sent, via the firewall, to the RA in response to the RA SYN. The RA is notified of receipt of a client acknowledgement message (ACK) from the client. An RA ACK is received, from the RA and via the firewall, in response to the notification, to thereby establish a full connection between the client and the application.

Methods for secure access to services behind a firewall and devices thereof

Embodiments are directed to managing communication over a network with traffic management computers (TMCs). If network traffic that is statelessly monitored is selected for stateful monitoring, the TMCs may perform operations to transition from stateless monitoring to stateful monitoring with minimal disruption of users/clients. TMCs may receive the network traffic that include network packets. If the network packets are statelessly monitored by the TMCs one or more stateless network management operations may be performed on the network packets. If the network packets may be statefully monitored the TMCs may perform stateful network management operations on the network packets.

Inserting and removing stateful devices in a network

A method, computer readable medium, and device for providing authenticated domain name service includes forwarding at a traffic management device a request for a domain name from a client device to one or more servers coupled to the traffic management device. The traffic management device receives a first response comprising at least a portion of the domain name from the one or more servers. The traffic management device attaches a first signature to the first response when the first response is determined by the traffic management device to be an unauthenticated response, and provides the first response with the first signature to the client device.

Methods for DNSSEC proxying and deployment amelioration and systems thereof

A method, computer readable medium, and device for dynamic DNS implementation, comprises receiving, at a network traffic management device, a first DNS response from a DNS server, wherein the first DNS response is compliant with Internet Protocol version 4 (IPv4). The first DNS response corresponds to a first DNS request from a client device being compliant with Internet Protocol version 6 (IPv6). The first DNS response is converted into a DNS second response that is compliant with IPv6, by attaching a prefix that identifies a network gateway device which is to handle receive subsequent non-DNS requests from the client device. The second DNS response is routed to the client device. Subsequent non-DNS requests from the client device that contain at least a part of the prefix allow the network traffic management device to route the non-DNS request through the designated network gateway device.

Methods for dynamic DNS implementation and systems thereof

Embodiments are directed towards improving the performance of network traffic management devices by optimizing the management of hot connection flows. A packet traffic management device ('PTMD') may employ a data flow segment ('DFS') and control segment (&#x201c;CS&#x201d;). The CS may perform high-level control functions and per-flow policy enforcement for connection flows maintained at the DFS, while the DFS may perform statistics gathering, per-packet policy enforcement (e.g., packet address translations), or the like, on connection flows maintained at the DFS. The DFS may include high-speed flow caches and other high-speed components that may be comprised of high-performance computer memory. Making efficient use of the high speed flow cache capacity may be improved by maximizing the number of hot connection flows and minimizing the number of malicious and/or in-operative connections flows (e.g., non-genuine flows) that may have flow control data stored in the high-speed flow cache.

Data flow segment optimized for hot flows

Embodiments are directed towards employing a packet traffic management device that has a split data flow segment ('DFS') and control segment ('CS') to determine if a connection flow update provided by the DFS to the CS is valid. The CS may be utilized to establish connection flows at the DFS based on connection flow requests. The CS may generate a connection flow identifier (&#x201c;CFID&#x201d;) for a connection flow request. The CS may cache the CFID at the CS. The CS may establish a connection flow at the DFS based at least on the connection flow request and the CFID. After a connection flow is established, a DFS may provide a connection flow update and a corresponding CFID to the CS. The CS may determine that the connection flow update is valid if the corresponding CFID matches the CFID cached at the CS.

Minimize recycle SYN issues for split TCP hot flows to improve system reliability and performance

A method, non-transitory computer readable medium, and network device that generates a network communication including a destination address associated with a second network device and a destination port number, wherein the destination port number corresponds to a service operating on the second network device. An initial SSL handshake protocol message is generated and at least the destination port number is inserted into a server name indicator (SNI) extension of the initial SSL handshake protocol message. An SSL connection is established with the second network device using a predetermined port number and the initial SSL handshake protocol message is sent to the second network device. Information included in the network communication is sent to the second network device using the SSL connection.

Methods for secure communication between network device services and devices thereof

A traffic management device (TMD) is situated between a one or more network devices providing jumbo network traffic and one or more device providing non-jumbo network traffic. The TMD is configured to employ TCP segmentation offload hardware within a Network Interface Card (NIC) at the level two/four layers of the OSI stack by rewriting maximum segment size (MSS) information during initial handshake operations, such that jumbo frames may be split into digestible size frames for a non-jumbo network communications.

Utilization of TCP segmentation offload with jumbo and non-jumbo networks

Embodiments are directed towards minimizing the impact flood attacks may have on packet traffic management performance. A packet traffic management device ('PTMD') may employ a data flow segment ('DFS') and control segment (&#x201c;CS&#x201d;). The CS may perform high-level control functions and per-flow policy enforcement for connection flows maintained at the DFS, while the DFS may perform statistics gathering, per-packet policy enforcement (e.g., packet address translations), or the like, on connection flows maintained at the DFS. The DFS may include high-speed flow caches and other high-speed components that may be comprised of high-performance computer memory. The impact of flood attacks may be reduced by protecting the high-speed flow caches from being consumed by flow control data associated with malicious and/or in-operative non-genuine network connections. In at least one of the various embodiments, flood control filters may be adaptively activated based on the condition and quality of network traffic received at PTMD.

Minimize SYN-flood issues with flow cache while maintaining performance

Methods, computer-readable media, and apparatuses for network flow state preservation include migration of at least one application hosted on a first server device to a second server device coupled to a second traffic management device is detected at a first traffic management device. At least a portion of connection state information associated with a network connection between at least one client device and the application is communicated by the first traffic management device to the second traffic management device via a communication channel between the first and second traffic management devices. The application is provided by the first traffic management device to the at least one client device during the migration based upon the connection state information.

Growing community of inventors

Seattle, WA, United States of America

Peter Michael Thornewell