Abstract: Embodiments of the present invention provide systems and methods for exchanging information. Communications between an intrusion prevention system (IPS) and at least one end-point are facilitated by controlling network traffic flow in an IPS and the at least one end-point and formation of an information plane. The formed information plane allows attributes of the IPS and the at least one end-point to reside in the formed information plane. A network access policy (NAP) works in conjunction with an IPS and leverages created customized network objects (CNOs). Upon analyzing data packets, the data packets may or may not be forwarded to the IPS.

Abstract: Embodiments can provide a computer implemented method in a data processing system comprising a processor and a memory comprising instructions, which are executed by the processor to cause the processor to implement a system for transforming a Channel ID communication, the method comprising: generating, by a SSL/TLS inspector, a secret; receiving, from a client, a Channel ID communication comprising a public key value; deriving, by the SSL/TLS inspector, a random seed value for a private key using the secret and the public key value of the Channel ID communication; generating, by the SSL/TLS inspector, a new private key based upon the random seed value; deriving, by the SSL/TLS inspector, a new public key based upon the new private key; generating, by the SSL/TLS inspector, a transformed Channel ID communication based upon the new private key and the new public key; and forwarding, by the SSL/TLS inspector, the transformed Channel ID communication to a server.

Abstract: A computer program product for transmitting data flow in a network between two resources using a processing circuit to perform a method which includes obtaining a data record from a first resource, storing the data record and an associated data record identifier in a first memory, transmitting the data record from a first network to a second network, storing the data record and an associated data record identifier in a second memory, determining by an inline service provider whether the data record is suitable for transmission from a first resource to a second resource; based on determining that the data record is suitable for transmission by the inline service provider transmitting only the data record identifier stored in the second memory to the first switch and retrieving the data record stored in the first memory associated with the data record identifier for transmission to the second resource.

Abstract: An intelligent network management device including an analytic unit, conducting an analysis according to received packets in order to determine whether a given event is occurred; and a processing unit, generating and sending a control instruction to a SDN controller to change configurations of a SDN switch when the analytic unit determined the given event has been occurred.

Abstract: According to one exemplary embodiment, a method for orchestrating a flow of a packet through a software-defined network (SDN) switch is provided. The method may include determining at least one available service associated with the SDN switch. The method may also include receiving the packet at an input port associated with the SDN switch, wherein the packet has a destination value and a packet type. The method may then include generating a flow entry based on the at least one available service and the packet type, wherein the flow entry has a plurality of entry characteristics and an action. The method may further include selecting the flow entry based on matching the plurality of entry characteristics to the destination value and the packet type. The method may also include performing the action associated with the selected flow entry.

Abstract: According to one exemplary embodiment, a method for orchestrating a flow of a packet through a software-defined network (SDN) switch is provided. The method may include determining at least one available service associated with the SDN switch. The method may also include receiving the packet at an input port associated with the SDN switch, wherein the packet has a destination value and a packet type. The method may then include generating a flow entry based on the at least one available service and the packet type, wherein the flow entry has a plurality of entry characteristics and an action. The method may further include selecting the flow entry based on matching the plurality of entry characteristics to the destination value and the packet type. The method may also include performing the action associated with the selected flow entry.

Abstract: A mechanism is provided for generating a packet inspection policy for a policy enforcement point in a centralized management environment. Data of a network topology for the policy enforcement point corresponding to a network infrastructure is updated according to metadata of the policy enforcement point, the metadata including a capability of the policy enforcement point. The packet inspection policy for the policy enforcement point is generated according to the data of the network topology and the capability of the policy enforcement point. The packet inspection policy is then deployed to the policy enforcement point.

Abstract: An image correction system includes a storage device and a processor. The storage device is configured to store multiple reference patterns corresponding to different color temperatures. The processor is configured to execute operations of receiving an input image and correspondingly transforming the input image into multiple input gamut points; generating an input pattern according to distribution of the input gamut points, in which the input gamut points are surrounded by the input pattern; comparing the input pattern with the reference patterns to generate a comparison result; and estimating out a color temperature corresponding to the input image according to the comparison result so as to correct the input image.

Abstract: Methods and systems for high-availability data processing include detecting, at a first data processing system, a change in link state between the first data processing system and a second data processing system. A link state between the first data processing system and a third data processing system is changed responsive to the detection in accordance with a first high availability policy stored at the first data processing system. An identifier of the first data processing system is changed in accordance with the first high availability policy to conform to a second high availability policy stored at the first data processing system. The detection, change of the link state, and change of the identifier are repeated in accordance with the second high availability policy.

Abstract: An appliance, user information device, method, and computer program product for collaborating with resources residing in multiple information devices. The user information device may communicate with the appliance, and the appliance may further communicate with a first assisting device, wherein the first assisting device has access to a first resource capable of performing a first operation. The user information device includes a device communication interface, a processor configured to execute at least one application, the at least one application configured to generate a first command associated with the first operation via the processor, and a resource agent program executable by the processor, the resource agent program configured to send the first command to the appliance via the device communication interface, the first command operable for enabling performance of the first operation using the first resource when the appliance sends the first command to the first assisting device.

Abstract: A method of translating network attributes of packets in a multi-tenant environment, and an appliance and a program product implementing the method. The method comprises the following steps: receiving a packet from a multi-tenant environment; referring to the information of tenants, translating a selected network attribute of the packet into a unique identity representing the packet in the multi-tenant environment; and forwarding the translated packet including the unique identity.

Abstract: A method of translating network attributes of packets in a multi-tenant environment, and an appliance and a program product implementing the method. The method comprises the following steps: receiving a packet from a multi-tenant environment; referring to the information of tenants, translating a selected network attribute of the packet into a unique identity representing the packet in the multi-tenant environment; and forwarding the translated packet including the unique identity.

Abstract: Embodiments provide a system and method for network tracking. Through various methods of packet encapsulation or IP option filling, one or more packets of information can be tagged with a unique security tag to prevent unauthorized access. A user agent can be validated by an authentication server through acceptance of one or more user credentials. The authentication server can generate a security token that can be transmitted to the user agent. The user agent can generate a keystream from the security token, and portions of that keystream can be attached to the packets as the security tag. The tagged packets can be forwarded to an authenticator, who can recreate the keystream from a copy of the security token provided by the authentication server. If the tags generated from the authenticator match the tags on the tagged packet, the authenticator can strip the tag from the tagged packet and forward the packet on to its next network address.

Abstract: A method for providing a transparent asynchronous network flow exchange is provided. The method may include receiving a query request from a requester, whereby the received query request is associated with a network packet. The method may also include determining if the network packet contains a plurality of defined signatures. The method may further include in response to determining that the network packet contains a plurality of defined signatures, authenticating a plurality of information associated with the network packet. The method may additionally include determining a plurality of flow related security information associated with the network packet based on the authentication of the plurality of information. The method may include sending the determined plurality of flow related security information to the requester.

Abstract: In response to receiving an unknown first session identifier from a client for a first communication session between the client and a server, a Man in the Middle (MitM) computer requests a second session identifier from the server for a second communication session between the server and the MitM computer. The MitM computer generates a third session identifier for a third communication session between the MitM computer and the client. The MitM computer generates a fourth communication session between the server and the client using a combination of the second communication session and the third communication session. In response to receiving an invalid session identifier from the client for a fifth communication session between the client and the server, the MitM computer transmits an instruction, to the client, to flush a session cache in the client to force a full TLS handshake between the client and the server.

Abstract: A method for monitoring encrypted communication sessions between computing devices includes intercepting messages of a handshaking procedure between a client and a server device, the handshaking procedure establishing an encrypted communication session between the client and server. The method further includes determining, from the messages, a session context for the encrypted session and an identifier associated with the session context. The method further includes storing the session context in a database indexed by the identifier. The method further includes intercepting, subsequent to the storing, second messages of a second handshaking procedure between the client and a second server device, the where second handshaking procedure resumes the encrypted communication session after an interruption.

Abstract: Message routing is implemented by a computer device. A global ring is connected via a network, wherein the global ring is associated with a distributed hash table (DHT) and includes a plurality of nodes which are divided exclusively into groups in advance. A first group of nodes is determined from the plurality of grouped nodes. Using the DHT for a message to be routed, a first node is located from the first group of nodes, as a routing destination.

Abstract: A first client encryption initiation is intercepted from a client. The first client encryption initiation is intended for a server. Based on the first client encryption initiation, a second client encryption initiation is initiated with the server. Receiving a server response from the server responsive to the initiated second client encryption initiation. A first secure connection is negotiated with the client. The first secure connection is based on the intercepted first client encryption initiation and based on the server response. A session key to perform secure communication with the client is obtained from the first secure connection. A second secure connection is established with the server. The second secure connection is based on the server response and the session key.

Abstract: A method for preventing network attacks on baseboard management controllers. The method includes receiving, by the network controller, a packet from a computer networking device on a computer network, where the packet is destined for a baseboard management controller (BMC); determining, by the network controller, whether the packet contains a tag identifying that the packet has been determined to be free of suspicious or malicious traffic; on condition that the packet has been determined to not contain the tag, sending the packet to a network inspection module, by the network controller, to be inspected for suspicious or malicious traffic; and on condition that the packet has been determined to contain the tag, sending the packet to the BMC by the network controller using a side band interface.

Abstract: A method for preventing network attacks on baseboard management controllers. The method includes receiving, by the network controller, a packet from a computer networking device on a computer network, where the packet is destined for a baseboard management controller (BMC); determining, by the network controller, whether the packet contains a tag identifying that the packet has been determined to be free of suspicious or malicious traffic; on condition that the packet has been determined to not contain the tag, sending the packet to a network inspection module, by the network controller, to be inspected for suspicious or malicious traffic; and on condition that the packet has been determined to contain the tag, sending the packet to the BMC by the network controller using a side band interface.