Sri International

Steven Mark Dawson

Patrick Denis Lincoln

Phillip Andrew Porras

David W J Stringer-Calvert

Michael G Corr

David A Watt

John Peter Marcotullio

David Manseau

Keith M Skinner

Ulf E Lindqvist

Pierangela Samarati

Sabrina De Capitani Di Vimercati

Magnus Almgren

A network security policy may be implemented at network switches as a set of active packet disposition directives. In a dynamically programmable network, the network switches can be dynamically reprogrammed with packet disposition directives. A security actuator receives flow policy directives from a number of network applications. The flow policy directives express higher-level network security policy goals, including blocking and/or redirecting network traffic. The security actuator converts a flow policy directive into one or more packet disposition directives. The packet disposition directives may include trigger rules to cause network communications to be monitored for matching trigger packets. An automated mechanism initiated by the security actuator may cause trigger packets to be forwarded to the security actuator for analysis. The security actuator may generate packet disposition directives in response to receiving the trigger packets.

Security actuator for a dynamically programmable computer network

In one embodiment, the present invention is a method and apparatus for identifying wireless transmitters. In one embodiment, a method for identifying a transmitter in a wireless computing network includes extracting one or more radio frequency signal characteristics from a communication from the transmitter and generating a fingerprint of the transmitter in accordance at least one of the extracted radio frequency signal characteristics.

Method and apparatus for identifying wireless transmitters

In one embodiment, the present invention is a method and apparatus for wireless network security. In one embodiment, a method for securing a wireless computing network includes receiving a communication from an unidentified transmitter, identifying the transmitter in accordance with a fingerprint generated from one or more radio frequency signal characteristics extracted from the communication, and taking action in response to an identity of the transmitter.

Method and apparatus for wireless network security

A groupware management system for collaborative groups is disclosed that is scalable to support large, dynamic, multiple, and other virtual VPNs. The system may introduce a graph (or hierarchical) structure to the VPN, providing multiple master nodes controlling membership in subsets of the collaborative group. Use of multiple master nodes in a graph-structured (or hierarchical) network topology often relaxes the need for a single, centralized, globally consistent view of VPN group membership, and enables distribution of the management burden among multiple master nodes. Membership in the VPN may be changed dynamically by the second master node for the member nodes of the second subset, without requiring the first master node to dynamically update its group membership records to reflect the change and in many cases without even having to notify the first master node (and vice versa), for example. In further embodiments, the use of multiple master nodes may increase the reliability and efficiency of VPNs, such as by enabling load balancing of master node tasks. Fail-over mechanisms may also be used to transparently re-route management tasks to an alternate master node especially in the case of failure of the current master node serving a given member node.

Methods and apparatus for scalable, distributed management of virtual private networks

A scalable method and architecture for efficiently locating desired resources within a network containing a plurality of server nodes, each of which hosts or otherwise provides access to a subset of a global resource set. In one aspect of the invention, each of the server nodes are assigned membership in at least two sets, an 'announce' set and a 'request' set.

Method and apparatus for providing scalable resource discovery

A method includes passing a request for data received by a first server process executing in a first server to a detection process that includes packing a subset of the data into an analysis format and passing the subset to an analysis process.

Application-layer anomaly and misuse detection

A method and apparatus for deconstructing video into a hierarchical structure, distributing the deconstructed video and reconstructing the deconstructed video to form a video signal having characteristics that match the capabilities of a user device. The video stream may be deconstructed using a single dimension deconstruction or a multidimensional deconstruction.

Method and apparatus for generating, distributing and reconstructing deconstructed video

Despite advances in recent years in the area of mandatory access control in database systems, today's information repositories remain vulnerable to inference and data association attacks that can result in serious information leakage. Without support for coping against these attacks, sensitive information can be put at risk because of release of other (less sensitive) related information. The ability to protect information disclosure against such improper leakage would be of great benefit to governmental, public, and private institutions, which are, today more than ever, required to make portions of their data available for external release. In accordance with the invention, a solution to the problem of classifying information by enforcing explicit data classification as well as inference and association constraints is provided. We formulate the problem of determining a classification that ensures satisfaction of the constraints, while at the same time guaranteeing that information will not be unnecessarily overclassified.

Growing community of inventors

Menlo Park, CA, United States of America

Steven Mark Dawson