Aruba Networks, Inc.

Hewlett Packard Enterprise Development LP

Ramesh Ardeli

Hari Krishna Kurmala

Vamsi Kodavanty

Venkatesan Marichetty

Gopal Agarwal

Venkatesh Joshi

Edward Vajravelu

Pradeep Iyer

An example embodiment of the present techniques determines, in response to a byte-serving request to download a portion of a resource, that the resource has previously been determined to comprise malware. Further, the byte-serving request is modified to request downloading all the resource. Additionally, all the resource is requested for downloading using the modified byte-serving request.

Preventing malware downloads

The present disclosure discloses a system and method for dynamically modifying role based access control for a client based on the activity. Generally, a client device is granted access to a network resource based on a first reputation score assigned to the client device. The activity of the client device is monitored. Responsive to monitoring the activity of the client device, a second reputation score is determined for the client device based on the activity. The access by the client device to the network resource is then modified to be granted based on the second reputation score.

Client reputation driven role-based access control

Methods and systems are described for intelligently steering client devices operating in an enterprise network system to an appropriate access point based on types of traffic on each client device and/or types of traffic on access points. In particular, client devices may be moved to a different access point when the wireless channel provided by a current access point fails to meet the signal strength requirements of latency sensitive traffic utilized by the client device. Client devices may be further steered to new access points based on load conditions on access points. For example, client devices with low priority traffic sessions may be steered away from access points with high traffic load levels. Accordingly, the methods and systems described herein ensure improved network access for latency sensitive access categories and/or access categories that are considered important to an enterprise system with minimal disruptions to these sessions.

Deep packet inspection (DPI) aware client steering and load balancing in wireless local area network (WLAN) infrastructure

In example implementations, a method is provided that is executed by a processor. A multiplexed data stream is received over a single transmission control protocol (TCP) connection that uses a SPDY protocol. The multiplexed data stream contains data packets associated with a plurality of different data streams. A plurality of sub-contexts are generated. Each one of the sub-contexts is associated with a different one of the plurality of different data streams. The data packets are demultiplexed from the multiplexed data stream into a respective one of the plurality of sub-contexts. The plurality of different data streams in the respective one of the plurality of sub-contexts are examined to detect a malware.

Detecting malware on SPDY connections

An example implementation of the present techniques determines, in response to a request to download a resource, whether the resource has previously been determined to comprise malware. Additionally, it is determined, if the resource has previously been determined to comprise malware, whether the resource has changed since the previous determination. Further the request to download the resource is terminated if the resource has not changed.

Malware detection

Examples disclosed herein relate to enforcing a policy to a packet stream based on a classification and a determination that a proxy connection is associated with the packet stream. In the example, the packet stream is received. In this example, a host value is determined for the packet stream. Also, in the example, it is determined whether the packet stream is associated with the proxy connection. Further, in the example, a classification is determined based on the host value. In this example, the policy is enforced for the packet stream based on the classification and the determination that the proxy connection is associated with the packet stream.

Policy enforcement based on host value classification

The present disclosure discloses a method and network device for intelligent handling of voice calls from mobile voice client devices. In some embodiments, the network device detects that a load, corresponding to a plurality of client devices associated with an access point, exceeds a particular threshold value. In some embodiments, the network device detects that a call quality for a current ongoing call, corresponding to a first client device associated with an access point, is below a first threshold value. In response, the network device selects a particular client device, of the plurality of client devices associated with the access point, for disassociation with the access point. The network device then causes the particular client device to disassociate with the access point.

Intelligent handling of voice calls from mobile voice client devices

The present disclosure discloses a method and a network device for performing dynamic detection and application-based policy enforcement of proxy connections in a network. Specifically, a network device receives, from a client device, a packet in a session. The network device then determines whether the packet is transmitted to a proxy. In response to determining that the packet is associated with a different application classification or web content category during the same session, the network device re-applies network firewall policies to determine whether to allow or deny transmission of the packet to the proxy.

Dynamic detection and application-based policy enforcement of proxy connections

The present disclosure discloses a method and a network device for adaptive resource allocation in congested wireless local area network deployment. Specifically, a network device dynamically assigns priorities of client devices associated with a remote access point based at least on an application type or a traffic type corresponding to each client device. Further, the network device transmits the priorities of the client devices to the remote access point in response to the wired uplink being unavailable. The priorities of the client devices facilitate the remote access point to limit a number of client devices connected to the remote access point subsequent to the wired uplink being unavailable.

Adaptive resource allocation in congested wireless local area network deployment

A system and a method are described that reduce or eliminate inefficiencies caused by double encryption in network tunnel communications. In particular, a set of virtual tunnels may be established that require a lower level of encryption in comparison to a full-encryption tunnel. Upon determining that a session is end-to-end encrypted, the system and method described herein may assign the session to one of the virtual tunnels instead of the full-encryption tunnel. By intelligently assigning sessions to virtual tunnels when encryption has already been applied, double encryption may be avoided, which will improve throughput and decrease processor usage. However, in cases where a session is not end-to-end encrypted, the full-encryption tunnel may be utilized to ensure secure communications are maintained between gateways.

Method and apparatus for avoiding double-encryption in site-to-site IPsec VPN connections

The present disclosure discloses a method and a network device for session aware access point load balancing. Specifically, a network device monitors data corresponding to a plurality of client devices associated with a first access point. Then, the network device determines whether the data matches particular criteria. Responsive to determining that the data matches the particular criteria, the network device select at least a first client device of the plurality of client devices for disassociation and/or de-authentication. Moreover, the network device causes disassociation and/or de-authentication of the first client device from the first access point.

Growing community of inventors

Sunnyvale, CA, United States of America

Ramesh Ardeli