Foundry Networks, Inc.

Palo Alto Networks, Inc.

Trend Micro Inc.

Brocade Communications Systems, Inc.

A 10 Networks, Incorporated

Philip Kwan

Shu Lin

Ronald W Szeto

Lei Chang

Nitin Jain

Chang Li

Ravindran Suresh

Chunqing Cai

Chi-Jui Ho

Santosh Narayankhedkar

Sudeep Padiyar

Michael Harry Palmer

Pulikeshi Ramanath

Lin Wang

Sameer Kumar

Raymond Wai-Kit Kwong

Lee Chen

John Chiong

Stateful inspection and classification of packets is disclosed. A first differentiated services header value (DSHV) to associate with a first packet type and a corresponding first quality of service treatment is received from a configuration interface for a first packet type associated with a network traffic flow originating from a first application type. A second DSHV is received from the configuration interface to associate with a second packet type. A first packet having the first packet type is received and the first quality of service treatment is applied to the first packet. A second packet having the second packet type is received and the second quality of service treatment is applied to the second packet.

Stateful packet inspection and classification

An indication that a change associated with adjusting capacity to provide security services to network traffic in a network environment is received. In response to receiving the indication, a set of instructions for configuring at least one of: a network device and a security appliance is determined. As a result of applying the instructions, at least one of: an amount of network traffic provided by the network device to the security appliance will increase, or at least a portion of network traffic that would otherwise be provided by the network device to the security appliance will instead be provided to another security appliance. The set of instructions is transmitted.

Dynamic security scaling

Techniques for enhanced Software-Defined Wide Area Network (SD-WAN) path quality measurement and selection are disclosed. In some embodiments, a system/method/computer program product for enhanced SD-WAN path quality measurement and selection includes periodically performing a network path measurement for each of a plurality of network paths at a Software-Defined Wide Area Network (SD-WAN) interface; updating a version if the network path measurement exceeds a threshold for one or more of the plurality of network paths; and selecting one of the plurality of network paths for a session based on the version according to an application policy.

Enhanced SD-WAN path quality measurement and selection

Stateful inspection and classification of packets is disclosed. For a first packet associated with a network traffic flow, a differentiated services header value (DSHV) is determined to associate with the first packet. The DSHV is used to perform a lookup of a quality of service treatment associated with the DSHV. The treatment is applied to the first packet. A determination is made, for a second packet associated with the network traffic flow, to associate a second DSHV with the second, where the second DSHV is different from the first DSHV.

An indication that a change implicating security in a network environment needs to be made is received. In response to receiving the indication, a first set of instructions for reconfiguring at least one network device is determined, and a second set of instructions for reconfiguring at least one security device is determined. At least one network device and at least one security device are, respectively, caused to be reconfigured in accordance with the respective first and second set of instructions.

Techniques for latency-based policy activation are disclosed. In some embodiments, a system for latency-based policy activation includes collecting a plurality of latency measures associated with monitored network communications; correlating the plurality of latency measures associated with the monitored network communications to detect anomalous network activity based on a profile; and performing a mitigation response to the anomalous network activity based on a policy.

Latency-based policy activation

Stateful inspection and classification of packets is disclosed. For a first packet associated with a network traffic flow, a differentiated services header value is determined. The differentiated services header value is used to perform a lookup of a quality of service treatment associated with the differentiated services header value. The treatment is applied to the first packet. A return traffic packet is received. A differentiated services header value is written in the header of the return traffic packet.

A system and method that provides for copying ARP replies, and generating data packets which include the ARP reply, and other information such as an identification of the port on the ARP reply was received. These data packets are then transmitted to an ARP collector which stores the ARP reply and port information. The ARP collector then uses this stored information, and analyzes future data packets relative to the stored information to detect occurrences of ARP spoofing. The ARP collector further provides for generating alerts and taking security actions when ARP reply spoofing is detected.

System and method for ARP anti-spoofing security

A system and method that provides for protection of a CPU of a router, by establishing a management port on a router. Hosts which are connected to a non-management ports of the router are denied access to management functions of a CPU of the router. The system and method can utilize an application specific integrated circuit, in conjunction with a CAM-ACL, which analyzes data packets received on the ports of router, and the ASIC operates to drop data packets which are directed to the CPU of the router. This system and method operates to filter data packets which may be generated in attempts to hack in to control functions of a network device, and the operation does not require that the CPU analyze all received data packets in connection with determining access to the control functions of the router.

System and method for protecting CPU against remote access attacks

Encryption of message content of an e-mail sent by way of a webmail service may be performed in response to activation of a user interface element. The message content may be encrypted using a symmetric key. A public key of a recipient of the e-mail is received from a backend service and employed to encrypt the symmetric key. The encrypted symmetric key and encrypted message content are sent to a recipient by way of the webmail service. Decryption of the encrypted message content may be performed in response to activation of another user interface element. A private key of the recipient is received from the backend service and employed to decrypt the encrypted symmetric key. The symmetric key is thereafter employed to decrypt the encrypted message content.

Messaging system with user-friendly encryption and decryption

A person-to-person secure file transfer system includes an originating computer that receives a public key of a recipient from a cloud computing system. The originating computer encrypts a file using a message key, and encrypts the message key using the public key of the recipient. The encrypted file is stored in the cloud computing system. In response to a request from a receiving computer, the cloud computing system decrypts the encrypted message key using a private key of the recipient, decrypts the encrypted file using the message key, and provides the now decrypted file to the receiving computer. In another example, the cloud computing system provides the private key of the recipient and the encrypted file to the receiving computer, which decrypts the encrypted message key using the private key of the recipient and decrypts the encrypted file using the message key.

Methods and system for person-to-person secure file transfer

A system, method and apparatus for providing multiple access modes in a data communications network includes a network access device having a plurality of input ports, a plurality of output ports, and a switching fabric for routing data received on the plurality of input ports to at least one of the plurality of output ports. Control logic within the network access device is adapted to determine whether a user device coupled to one of the plurality of input ports supports a user authentication protocol used by a host network. If the user authentication protocol is not supported, then the input port to which the network access device is coupled is placed in a semi-authorized access state that limits access to a pre-configured network accessible via the host network.

Growing community of inventors

San Jose, CA, United States of America

Philip Kwan