Aerohive Networks, Inc.

Aruba Networks, Inc.

Palo Alto Networks, Inc.

Extreme Networks, Inc.

Zingbox, Ltd.

Aruba Networks Cayman

Xu Zou

Jianlin Zeng

Mei Wang

John William Hanay

Mu Lin

Kangchang Huang

Mingliang Li

Kenshin Sakura

Wei Song

Peng Fan

Yan Liu

Gong Cheng

Sultanbek Omurzakov

Dylan Stewart Spagnuolo

Aveek Kumar Das

A software bill of materials (SBOM) and vulnerability management system ('system') disclosed herein extracts software component-related identifiers for Internet of Things (IoT) devices using deep packet inspection. The system filters the identifiers by removing identifiers that match a blacklist of identifiers known to not correspond to software components. The system then populates SBOM fields using a database storing the filtered identifiers with a schema that is uniform across SBOM file formats and queries a vulnerability database with software components indicated in the filtered identifiers to identify vulnerabilities for each IoT device for security risk assessment.

Software bill of materials and vulnerability management via deep packet inspection

Management of IoT devices through a private cloud. An IoT device is coupled to a gateway. A request from the IoT device to connect to a private cloud, wherein the private cloud is used to manage IoT devices, is received at a private cloud control center agent. An identification of the IoT device is determined. The IoT device is onboarded, using the identification, for management through the private cloud. A device profile of the IoT device is generated. The flow of data to and from the IoT device is regulated through application of IoT rules according to the device profile of the IoT device.

Private cloud control

Disclosed is a system comprising: an authentication datastore; a device presence engine; a traffic monitor engine; an authentication presence monitor engine; an authentication server selection engine; and a traffic routing engine. In operation: the device presence engine is configured to detect presence of a user device on a trusted network; the traffic monitor engine is configured to monitor, in response to the detection, traffic on the trusted network from the device; the authentication presence monitor engine is configured to evaluate onboarding characteristics of the user device in response to the monitoring; the authentication server selection engine is configured to select one of a plurality of authentication servers to authenticate the user device to the trusted network, the selecting based on the onboarding characteristics; and the traffic routing engine is configured to route traffic from the user device to the selected authentication server.

Split authentication network systems and methods

Authenticating a client device coupled to an authenticator network device for a network. A service request is received from the client device at the authenticator network device. User credentials, including a user ID, a user key, and a nonce for a user are received at the authenticator network device. A token is generated using the received user credentials. The service request is modified to include the token and a user ID parameter that is the user ID to generate a modified service request. The modified service request is used to provide single sign-on access to a service that is the subject of the service request.

Wireless device authentication and service access

A request related to an access to a network by a first user device may be received. The user device may be included in a plurality of user devices associated with a first first-level security profile assigned to the user. An application extension to an application executing on the first user device may be accessed in response to the request related to the access. A network connectivity file may be provided to the application extension. The network connectivity file may include network configuration information for the first user device. The network configuration information may be associated with a first second-level security profile assigned to the first user device. Instructions to configure the first user device to access the network based at least in part on the network configuration information in the network connectivity file may be provided.

User-based network onboarding

A wireless mesh communication network includes a plurality of wireless routers which can be managed in a hierarchical manner with respect to one another and all of the routers are capable of detecting and avoiding interference on channels over which they communicate with one another. Depending upon whether a channel is active or inactive, a wireless router can either passively detect interference and then switch channels to avoid it or actively detect interference and then switch channels to avoid it.

Method and apparatus for detecting and avoiding interference in a communications network

Management of IoT devices through a private cloud. An IoT device is coupled to a gateway. A request from the IoT device to connect to a private cloud, wherein the private cloud is used to manage IoT devices, is received at a private cloud control center agent. An identification of the IoT device is determined. The IoT device is onboarded, using the identification, for management through the private cloud. A device profile of the IoT device is generated. The flow of data to and from the IoT device is regulated through application of IoT rules of an IoT firewall according to the device profile of the IoT device.

A network security system including a first-level security profile engine and a second-level security profile engine is disclosed. The first-level security profile engine may assign a first-level security profile for a first user device, the first user device requesting access to a network; the second-level security profile engine assigns a first second-level security profile to the first user device, the first second-level security profile providing first network configuration information for the first user device; a device selection engine receives a selection of a second user device associated with the first-level security profile; and the second-level security profile engine assigns a second second-level security profile to the second user device, the second second-level security profile providing second network configuration information for the second user device. A device network configuration engine can then configure the first user device to access the network based on the first network configuration information.

Growing community of inventors

San Jose, CA, United States of America

Xu Zou