Fortinet, Inc.

Infoblox Inc.

Best-supplier International Inc.

Wei Wang

Thomas S Clark

Sebastien Woirgard

Etienne M Liu

Barry Arlen Frew

Frederic Andrew Voltmer

Zhifeng Zhang

Kugaprakash Visagamani

Robert A May

Tao Huang

Ihab Khalil

Junfeng Jia

Michael Xie

Hongbin Lu

John Charles Voss

Dayong Zhou

Dazhi Li

A new container of a pool of containers is spawned in the operating system of the embedded networking device to execute a firewall separate from an operating system of a host device. Each of the containers is generated by a separate toolchain to include custom runtime libraries. The firewall utilizes the custom libraries rather than the host libraries, and wherein user privileges within a container is different from user privileges for the host. The new container executes a firewall instance to inspect data packets processed by the embedded networking device.

Containerized firewall in an embedded device for protecting against malicious data traffic on a data communication network

Techniques for cloud network automation for IP address and DNS record management are disclosed. In some embodiments, a system, process, and/or computer program product for cloud network automation for IP address and DNS record management includes receiving at a cloud platform appliance (e.g., a virtual or physical IP address and/or DNS management appliance) a cloud request related to a resource (e.g., a virtual or physical resource) in a cloud environment from a global cloud manager; and processing the cloud request at the cloud platform appliance to determine whether to proxy the cloud request to another cloud platform appliance or a grid master or to locally process the cloud request, wherein a storage of infrastructure metadata information for IP address and/or DNS record management is updated based on the cloud request.

Cloud network automation for IP address and DNS record management

Systems and methods for controlling applications on a network are provided. According to one embodiment, a network security device intercepts network traffic and conducts a heuristic detection of an application protocol used in the network traffic by multiple application protocol identifying engines defined in a heuristic rule. According to another embodiment, the network security device confirms a suspect application protocol as an actual application protocol used in the network traffic by sending a probing request to the destination peer of the network traffic based on the suspect application protocol. The suspect application protocol is confirmed if an appropriate response is received from the destination peer.

Application control

Methods and systems are provided for implementing application layer security. According to one embodiment, security rules applicable to end users of a private IP network and particular resources accessible within the network are maintained by a network appliance. A packet originated within the network is received by the network appliance. An application type associated with the packet is determined based on layer 7 information within the packet. Layer 7 information fields are extracted from the packet that are indicative of an identity of an end user associated with the packet. An SSO process is performed including receiving and authenticating credentials of the end user on behalf of multiple resources within the network based on the identity of the end user. One or more security rules are identified and applied to the packet based on the identity of the end user and the determined application type.

Application layer-based single sign on

Methods and systems are provided for implementing application layer security. According to one embodiment, an application layer packet is received by a network appliance and one or more information fields, selected based on an application type associated with the packet, are used to identify an associated end user. Then, security rules that match the traffic pattern, traffic content and identified end user can be applied to the packet. Identification of end users based on application layer information allows different security rules to be implemented for end users or groups thereof. Application of security rules based on identification of an end user based on application layer information can also facilitate implementation of an application-layer-based single sign-on (SSO) process.

Systems and methods for dual mode hardware acceleration for cryptographic operations are provided. According to one embodiment, data upon which a cryptographic operation is to be performed is receive by a computer system that includes a host CPU and a cryptographic hardware accelerator. The data is divided into multiple blocks. Performance of the operation on a first block is offloaded to the hardware accelerator. For each remaining block: (i) the CPU requests state information of the hardware accelerator; (ii) when the state satisfies a condition, then performance of the operation is offloaded to the hardware accelerator; (iii) otherwise, the operation is performed by the CPU by invoking a native hardware supported cryptographic instruction. In this manner, the cryptographic operation is performed on at least one of the blocks by the hardware accelerator and the operation is performed on at least another of the blocks by the CPU.

Dual-mode processing of cryptographic operations

A method and system for enforcing compliance with a policy on a client computer in communication with a network is disclosed. The method involves receiving a data transmission from the client computer on the network. The data transmission includes status information associated with the client computer. The data transmission is permitted to continue when the status information meets a criterion.

Enforcing compliance with a policy on a client

Systems and methods for inline security protocol inspection are provided. According to one embodiment, a security device receives an encrypted packet from a first network appliance and buffers the encrypted packet in a buffer. An inspection module accesses the encrypted packet from the buffer, decrypts the encrypted packet to produce plain text and scans the plain text by the inspection module.

Inline inspection of security protocols

Methods and systems for improved attack context data logging are provided. According to one embodiment, prior to a logging event being triggered (i) it is determined by a network security device whether a received packet is potentially associated with a threat or undesired activity by analyzing the packet; (ii) when the determination is negative, the packet is stored within a circular buffer; and (iii) when the determination is affirmative, (a) the logging event is triggered, (b) pre-attack context information regarding the threat is captured by extracting information from packets within the circular buffer and (c) the pre-attack context information is stored within a log. After the logging event has been triggered and until information regarding a predefined quantity of packets has been logged, post-attack context information regarding the threat is captured by extracting information from subsequently received packets and the post-attack context information is stored within the log.

Logging attack context data

Methods and systems for improved attack context data logging are provided. According to one embodiment, configuration information is received from an administrator of a network security device. The configuration information includes information indicative of a quantity of packets to be captured for post attack analysis. Responsive to receipt of the configuration information, a size of a circular buffer is configured based thereon. Multiple packets directed to a network protected by the network security device are received from an external network. The received packets are temporarily buffered within the circular buffer. An analysis is performed to determine whether one of the received packets is potentially associated with a threat or undesired activity ('trigger packet'). Responsive to an affirmative determination, contextual information is captured by extracting information regarding at least a portion of the configured quantity of packets from the circular buffer and storing the contextual information within a log.

Systems and methods for inline security protocol inspection are provided. According to one embodiment, a security device receives an encrypted raw packet from a first network appliance and buffers the encrypted raw packet in a buffer. An inspection module accesses the encrypted raw packet from the buffer, decrypts the encrypted raw packet to produce a plain text and scans the plain text by the inspection module.

Visualization for managing multiple IP address management systems is provided. In some embodiments, visualization for managing multiple IP address management systems for an IP address management manager system includes communicating with a plurality of IP address management systems to determine IP address management information managed by each of the IP address management systems; and generating a graphical visualization of an IP address space managed by the plurality of IP address management systems based on the IP address management information managed by each of the IP address management systems, in which the graphical visualization of the IP address space managed by the plurality of IP address management systems indicates any gaps or overlaps in the IP address space managed by the plurality of IP address management systems.

Growing community of inventors

Burnaby, Canada

Wei Wang