A 10 Networks, Incorporated

Adobe, Inc.

Tibco Software Inc.

Aio Networks, Inc.

Yang Yang

Ali Golshan

Xuyang Jiang

Yichao He

Liang Han

Martin Grimm

Zhe Lin

Jingwan Lu

Baldo Antonio Faieta

Shabnam Ghadar

Wei Sun

Zhixin Shu

Cameron Smith

Jakub Fiser

Alex Charles Filipkowski

Sabin S Ielceanu

Elya Schechtman

Stephen Bafico

Paul Jiang

Thomas W Hillman

In some embodiments, a context-based translation application generates a co-occurrence data structure for a target language describing co-occurrences of target language words and source language words. The context-based translation application receives an input tag for an input image in the source language to be translated into the target language. The context-based translation application obtains multiple candidate translations in the target language for the input tag and determines a translated tag from the multiple candidate translations based on the co-occurrence data structure. The context-based translation application further associates the translated tag with the input image.

Context-based image tag translation

Face anonymization techniques are described that overcome conventional challenges to generate an anonymized face. In one example, a digital object editing system is configured to generate an anonymized face based on a target face and a reference face. As part of this, the digital object editing system employs an encoder as part of machine learning to extract a target encoding of the target face image and a reference encoding of the reference face. The digital object editing system then generates a mixed encoding from the target and reference encodings. The mixed encoding is employed by a machine-learning model of the digital object editing system to generate a mixed face. An object replacement module is used by the digital object editing system to replace the target face in the target digital image with the mixed face.

Face anonymization in digital images

Provided are methods and systems for establishing secure sessions. A method for establishing secure sessions may commence with receiving a request to establish a secure session between a client and a server. Client security parameters may be provided in client extension fields of the request. The method may include forwarding the request to the server and receiving a secure session response from the server. Server security parameters may be provided in server extension fields of the secure session response. The method may include receiving a server key secret, forwarding the secure session response and the server key secret to the client, receiving a client key secret, and forwarding the client key secret to the server. The method may continue with calculating a session key and establishing a first secure session between the security gateway and the server and a second secure session between the security gateway and the client.

Slave secure sockets layer proxy system

Provided are a service gateway and a method for generating secure name records. The method may commence with receiving a name service request from a host. The name service request may include a name. The method may further include obtaining a service server name record from a name service server. The service server name record may include a plurality of name entries corresponding to the name. The method may then continue with generating a plurality of service gateway name records using the name and the plurality of name entries. The method may further include sending a service gateway name record of the plurality of service gateway name records to the host as a response to the name service request.

Generating secure name records

System and method for mobile network access load balancing. In accordance with a first method embodiment, a method includes receiving, at a network access load balancing controller, performance status information from a mobile network access gateway. The method also includes calculating, at the network access load balancing controller, a dynamic performance score for the mobile network access gateway utilizing the performance status information and calculating, at the network access load balancing controller, a weighted ranking of dynamic performance scores of a plurality of mobile network access gateways. The method further includes assigning, based on the weighted ranking of dynamic performance scores, one of the plurality of mobile network access gateways to serve as a mobile network access gateway for a user element.

System and method for mobile network access load balancing

Provided are methods and systems for caching network generated security certificates. An example system may include a security gateway node and a storage module. The security gateway node may be operable to receive, from a client, a session request to establish a secure connection with a server. Based on the session request, the security gateway node may establish a first secure session between the client and the security gateway node and a second secure session between the security gateway node and the server. The security gateway node may receive a server certificate from the server. The security gateway node may match the server certificate against a gateway certificate table. Based on the matching, the security gateway node may receive a gateway certificate associated with the gateway certificate entry that matches the server certificate. The gateway certificate may be used for performing the first secure session.

Caching network generated security certificates

Provided are a method and a system for intercepting secure shell (SSH) sessions. The method may commence with intercepting, by a client-facing SSH gateway, a session request to establish an SSH session between a client and a server. The method may continue with establishing a first SSH session between the client and the client-facing SSH gateway and receiving encrypted data packets of the SSH session from the client via the first SSH session. The client-facing SSH gateway may decrypt the encrypted data packets, establish a communication session with a server-facing SSH gateway, and forward decrypted data packets to the server-facing SSH gateway via the communication session. The server-facing SSH gateway may receive the decrypted data packets, establish a second SSH session between the server-facing SSH gateway and the server, encrypt the decrypted data packets, and forward the encrypted data packets to the server via the second SSH session.

Interception of secure shell communication sessions

A method and system for selecting a server load balancer (SLB) for processing requests associated with a client are provided. The method may commence with receiving a Domain Name System (DNS) request from a client DNS server associated with the client. The method may include determining a geolocation of the client. The method may continue with receiving a time delay record including a round trip time (RTT) between the client and each of pluralities of SLBs and a geolocation of each SLB. The method may include matching the geolocation of the client and the geolocation of each of the pluralities of SLBs. The method may include selecting SLBs having the geolocation that matches the geolocation of the client. The method may further include selecting, from the SLBs, an SLB having a lowest RTT and sending a DNS response comprising network data of the selected SLB to the client DNS server.

Distributed global server load balancing controllers sharing service delay time

Provided are methods and systems for managing health statuses of servers. The method for managing health statuses of servers in a distributed GSLB system may include receiving, at a GSLB site controller, health statuses of local servers associated with the GSLB site controller. The method may further include exchanging, by the GSLB site controller, the health statuses of the local servers with health statuses of remote servers associated with at least one remote GSLB site controller. The method may further include distributing, by the GSLB site controller, at least a part of the health statuses of the local servers and the remote servers to SLBs associated with the GSLB site controller.

Managing health status of network devices in a distributed global server load balancing system

Provided are a method and a system for exchanging control information between secure socket layer (SSL) gateways. The method may commence with intercepting, by a client facing node, a client request including session-specific information and a session request to establish an SSL communication session between a client and a server. The method may continue with generating an SSL extension based on the session-specific information and adding the SSL extension to the session request to obtain an extended session request. The extended session request may be sent to a server facing node in communication with the client facing node. The method may further include identifying the session-specific information contained in the SSL extension of the extended session request and generating a further session request for establishing the SSL communication session between the server facing node and the server. The method may further include sending the further session request to the server.

Exchange of control information between secure socket layer gateways

Provided are methods and systems for inspecting secure data. A system for inspecting secure data comprises a server facing module, and a client facing module in communication with the server facing module. The client facing module is operable to intercept a client request associated with the secure data to establish a secure connection with a server, establish a data traffic channel via the server facing module, and provide a control message to the server facing module via the data traffic channel. The control message includes an instruction to the server facing module to obtain a security certificate from the server. The security certificate is received from the server facing module via the data traffic channel. The security certificate is forged to establish the secure connection between the client and the client facing module. The client facing module sends unencrypted data to the server facing module via the data traffic channel.

Implementation of secure socket layer intercept

Disclosed herein are systems and methods for a security gateway to process secure network sessions where there is a server certificate validation error. In various embodiments, varying security policies can be applied to the secure network sessions, including intercepting of network data, bypass of the security gateway, or termination of the secure sessions.

Processing a security policy for certificate validation error

Described are systems and methods for verifying server security certificates using hash codes. The system may include a client secure socket layer (SSL) node, a service gateway node, and a storage node. The client SSL node may receive a session request from a client. The service gateway node may forward the session request to a server to receive a server security certificate. The service gateway node may query a server domain name system module to receive a hash code. The hash code may include a first hash value and a hash function to obtain the server security certificate based on the first hash value. The service gateway node may calculate a second hash value by applying the hash function to the server security certificate and match the second hash value and the first hash value to determine whether the server security certificate is valid.

Verification of server certificates using hash codes

A security network system may include a security gateway operable to establish a client session between the security gateway and a client device. The security gateway is operable to receive client session information from the client session. The client session information includes an identification of a server with which the client device needs to exchange data. The security network system may also include a Hardware Security Module (HSM) in communication with the security gateway. The HSM is operable to establish, in concert with the security gateway, a secure session between the security gateway and the server based on the client session data, a public key, a secret key, and context attributed to the secure session.

SSL gateway with integrated hardware security module

Provided are methods and systems for load balancing client requests between sites associated with a domain name. A method comprises determining a first active response delay time between a Domain Name System server and a first site. The method further comprises determining a first application response delay time between the first site and one or more first servers associated with the first site. According to the method, the first active response delay time and the first application response delay time are compounded to produce a first compounded response delay time. The method further comprises determining a second active response delay time and a second application response delay for a second site to produce a second compounded response delay time. The first compounded response delay time and the second compounded response delay time are compared to perform load balancing between the first site and the second site.

Growing community of inventors

San Jose, CA, United States of America

Yang Yang