COMBINING NETWORK ENDPOINT POLICY RESULTS
Granted: May 29, 2014
Application Number:
20140150053
An endpoint integrity system controls access to resources of a protected network for endpoint devices attempting to access the protected network. The system may include a number of evaluation modules that communicate with an endpoint device. The evaluation modules generate policy results for the endpoint device, in which each of the policy results assume one of three or more states, called a multi-state policy result. The multi-state policy results are combined to produce a combined…
CONFIGURING NETWORKS INCLUDING SPANNING TREES
Granted: May 22, 2014
Application Number:
20140140245
A method may include receiving a reconfiguration to a first Virtual Local Area Network (VLAN)/spanning tree table, where the first VLAN/spanning tree table has a first identifier and is associated with a region of a network; updating the first VLAN/spanning tree table to generate a second VLAN/spanning tree table based on the reconfiguration; determining a second identifier of the second VLAN/spanning tree table; and generating a list of identifiers associated with the region of the…
USING A WAVEGUIDE TO DISPLAY INFORMATION ON ELECTRONIC DEVICES
Granted: May 22, 2014
Application Number:
20140139764
An electronic device includes an instrument panel that includes a display opening, where the instrument panel is located in a first plane; a circuit board located inside the electronic device, where the circuit board includes a display device that includes a display area, and where the display area is located in a second plane that is different from the first plane; and a waveguide that couples the display area to the display opening and guides light, and/or an image displayed in the…
SINGLE SIGN-ON FOR NETWORK APPLICATIONS
Granted: May 15, 2014
Application Number:
20140137225
A method may include authenticating a device to a first server, where the device includes an agent; receiving a request, in the first server from a second server, to verify the authenticity of the device, where the device is not authenticated to the second server; sending a browser plug-in to the device to communicate with the agent for verifying the authenticity of the device; receiving, in the first server, a message from the agent verifying the authenticity of the device; and sending…
MEDIA ACCESS CONTROL ADDRESS TRANSLATION IN VIRTUALIZED ENVIRONMENTS
Granted: May 8, 2014
Application Number:
20140130146
A method and a network device are provided to transmit network packets through a network security device. The method, performed by the network device, receives a request to send a network packet from a first computing device to a second computing device over a network that includes the network device and the network security device. The network packet includes a first network interface identifier for identifying the first computing device and a second network interface identifier for…
CREATING SEARCHABLE AND GLOBAL DATABASE OF USER VISIBLE PROCESS TRACES
Granted: May 8, 2014
Application Number:
20140129700
In one example, a controller device includes one or more network interfaces communicatively coupled to one or more devices of a virtual network, and a processor configured to determine, for the virtual network, a set of two or more related processes executed by respective devices in the virtual network, receive via the network interfaces data for the set of two or more related processes, and aggregate the data for the set of two or more related processes to form aggregated data for the…
PROVISIONING LAYER THREE ACCESS FOR AGENTLESS DEVICES
Granted: May 1, 2014
Application Number:
20140123217
A method may include obtaining a layer two identification of an endpoint that is seeking access to a network, the endpoint omitting an agent to communicate a layer three address of the endpoint to a policy node, applying one or more authentication rules based on the layer two identification of the endpoint, assigning the layer three address to the endpoint, learning, by the policy node, the layer three address of the endpoint, and provisioning layer three access for the endpoint to the…
DETECTING MEMORY CORRUPTION
Granted: May 1, 2014
Application Number:
20140122826
A device identifies, based on a program code instruction, an attempted write access operation to a fenced memory slab, where the fenced memory slab includes an alternating sequence of data buffers and guard buffers. The device assigns read-only protection to the fenced slab and invokes, based on the attempted write access operation, a page fault operation. When a faulting address of the attempted write operation is not an address for one of the multiple data buffers, the device performs…
MULTI-CHASSIS TOPOLOGY DISCOVERY USING IN-BAND SIGNALING
Granted: May 1, 2014
Application Number:
20140119238
A multi-chassis network device may automatically detect whether cables connected between chassis devices are correctly inserted. The device may insert, into a first data stream output from a first port of the device, control information identifying the first port. The device may receive, from a second data stream received by the first port of the device, second control information identifying a second port, at another device connected to the device via a cable. The device may determine,…
MULTI-METHOD GATEWAY-BASED NETWORK SECURITY SYSTEMS AND METHODS
Granted: April 24, 2014
Application Number:
20140115688
Systems and methods for detecting and preventing network security breaches are described. The systems and methods present a gateway-based packet-forwarding network security solution to not only detect security breaches but also prevent them by directly dropping suspicious packets and connections. The systems and methods employ multiple techniques to detect and prevent network security breaches, including stateful signature detection, traffic signature detection, and protocol anomaly…
INTELLIGENT INTEGRATED NETWORK SECURITY DEVICE FOR HIGH-AVAILABILITY APPLICATIONS
Granted: April 24, 2014
Application Number:
20140115379
Methods and apparatuses for inspecting packets are provided. A primary security system may be configured for processing packets. The primary security system may be operable to maintain flow information for a group of devices to facilitate processing of the packets. A secondary security system may be designated for processing packets upon a failover event. Flow records may be shared from the primary security system with the secondary security system.
HIGH-AVAILABILITY REMOTE-AUTHENTICATION DIAL-IN USER SERVICE
Granted: April 24, 2014
Application Number:
20140115160
A method may include receiving, in a first server from a second server, a request for a service of a network by a device; sending, from the first server to the second server, a response to the request for the service to permit access to the service; and sending state information about the response to a third server for storage in a database.
PRESERVING AN AUTHENTICATION STATE BY MAINTAINING A VIRTUAL LOCAL AREA NETWORK (VLAN) ASSOCIATION
Granted: April 17, 2014
Application Number:
20140109196
A method may include detecting a presence of a first server device; communicating, with the first server device, to obtain information associated with the first server device; sending, to a second server device, a request for authentication services, where the request includes the information associated with the first server device; receiving, from the second server device, a notification that the first server device has been authenticated, where the notification includes a session…
APPLICATION-LAYER TRAFFIC OPTIMIZATION SERVICE MAP UPDATES
Granted: April 10, 2014
Application Number:
20140101254
Using the ALTO Service, networking applications can request through the ALTO protocol information about the underlying network topology from the ISP or Content Provider. The ALTO Service provides information such as preferences of network resources with the goal of modifying network resource consumption patterns while maintaining or improving application performance. This document describes, in one example, an ALTO server that implements enhancements to the ALTO service to enable…
VIRTUAL HONEYPOT
Granted: April 3, 2014
Application Number:
20140096229
A virtual honeypot is configured within a security appliance by configuring one or more network addresses associated with the virtual honeypot. The security appliance receives network traffic destined for the virtual honeypot sent to the one or more network addresses associated with the virtual honeypot, and forwards the traffic to a remote honeypot such that the remote honeypot appears to be connected to a network local to the security appliance.
NETWORK ADDRESS TRANSLATION FOR APPLICATION OF SUBSCRIBER-AWARE SERVICES
Granted: April 3, 2014
Application Number:
20140092899
In general, techniques are described for informing services nodes of private network address information in order to apply subscriber-aware services with the services node. In some examples, a services node includes an Authentication, Authorization, and Accounting (AAA) interface to receive a AAA message, wherein the AAA message has been extended from a AAA protocol to specify a private network address of a subscriber device authenticated to an access network by the AAA server and…
METHODS AND APPARATUS FOR A COMMON CONTROL PROTOCOL FOR WIRED AND WIRELESS NODES
Granted: April 3, 2014
Application Number:
20140092884
In some embodiments, an apparatus comprises of a control module implemented in at least one of a memory or a processing device that is configured to receive, via a network and from a wireless access point or an access network node, a control packet defined based on a control protocol. The control packet is associated with at least one control function of the wireless access point or access network node. The control module is configured to determine a status of an access network node…
MAINTAINING LOAD BALANCING AFTER SERVICE APPLICATION WITH A NETWOK DEVICE
Granted: April 3, 2014
Application Number:
20140092738
In general, techniques are described for maintaining load balancing after service application. A network device comprising ingress and egress forwarding components and a service card may implement the techniques. An ingress forwarding component receives a packet and, in response to a determination that the service is to be applied to the packet, updates the packet to include an ingress identifier that identifies the ingress forwarding component, thereafter transmitting the updated packet…
METHODS AND APPARATUS FOR CONTROLLING WIRELESS ACCESS POINTS
Granted: April 3, 2014
Application Number:
20140092723
In some embodiments, an apparatus comprises of a first Control And Provisioning of Wireless Access Points (CAPWAP) module implemented in at least one of a memory or a processing device that is configured to be designated as a backup control module for a wireless access point during a first time period. The first CAPWAP control module is configured to receive state information associated with the wireless access point during the first time period from a second CAPWAP control module. The…
DISTRIBUTED ADMISSION CONTROL
Granted: March 27, 2014
Application Number:
20140086090
A first network client requests initiation of a data transfer with a second network client. An admission control facility (ACF) responds to the initiation request by performing admission analysis to determine whether to initiate the data transfer. The ACF sends one or more packets to the second network client. In response, the second network client sends acknowledgment packets back to the ACF. The ACF performs admission analysis based on the packets sent and the acknowledgment packets,…
