Abstract: Providing secure network access in a networked client device. A client device is provided with a secure connection adapter. In operation, the secure connection adapter detects the network environment of the client device and determines of the network environment is trusted or untrusted. If the client device is operating in an untrusted network environment, the secure connection adapter establishes a secure connection to an enterprise host using a secure tunnel such as IPSec, SSL, or other secure connection. Programs executing on the client device now operate in the secure network environment, with all network activity routed through the secure connection to the enterprise. Optionally, a split tunnel mechanism may be used to direct some network traffic directly to the Internet from the client device.

Abstract: To efficiently perform encryption/decryption and message authentication processing for a plurality of messages in parallel, an information processing apparatus includes a plurality of encryption/decryption and message authentication units which can perform encryption/decryption processing and message authentication processing by switching between them in a predetermined block unit, and are configured to be operable in parallel, and a data transfer control unit which distributes processing target data associated with an encryption/decryption and message authentication processing request to the plurality of encryption/decryption and message authentication units.

Abstract: Systems and methods are described for using a client agent to manage HTTP authentication cookies. One method includes intercepting, by a client agent executing on a client, a connection request from the client; establishing, by the client agent, a transport layer virtual private network connection with a network appliance; transmitting, by the client agent via the established connection, an HTTP request comprising an authentication cookie; and transmitting, by the client agent via the connection, the connection request.

Abstract: A microchip for a computer configured to connect to at least one network of computers. The microchip includes at least a first internal hardware firewall configured to deny access to at least a first protected portion of said microchip from said network, and at least one general purpose microprocessor including at least two general purpose core or general purpose processing units. At least a first core or processing unit is located within the first protected portion of the microchip. At least a second core or processing unit is located within a second portion of the microchip that is not protected by at least said first internal hardware firewall. At least the second core or processing unit is separated from the first core or processing unit by at least the first internal hardware firewall and is located between at least the first internal hardware firewall and the at least one network.

Abstract: A method is disclosed for determining the authentication capabilities of a supplicant before initiating an authentication conversation with a client, for example, using Extensible Authentication Protocol (EAP). In one aspect, the method provides for sending, to a supplicant that is requesting access to a computer network subject to authentication of a user of the supplicant, a list of first authentication methods that are supported by an authentication server; receiving, from the supplicant, a counter-list of second authentication methods that are supported by the supplicant; determining how many second authentication methods in the counter-list match the first authentication methods; and performing an authentication policy action based on how many of the second authentication methods match the first authentication methods. Policy actions can include blocking access, re-directing to sources of acceptable authentication methods, granting one of several levels of network access, etc.

Abstract: The present invention is directed generally to systems and methods for management of nodes, such as multimedia communication endpoints and/or intermediary devices, residing across disparate networks. Embodiments of the present invention provide systems and methods for managing by a centralized management system nodes residing on disparate protected networks, such as for managing such operations as scheduling, configuring, updating software, etc., nodes such as multimedia communication endpoints (e.g., videoconferencing endpoint devices and/or other multimedia communication devices) and/or intermediary devices (e.g., routers, switches, hubs, etc.). Further, embodiments of the present invention provide systems and methods for transmitting management data between a centralized management system and nodes on disparate protected networks without sacrificing security desired by each network and in a manner that is not administratively burdensome.

Abstract: Network computing systems may implement data loss prevention (DLP) techniques to reduce or prevent unauthorized use or transmission of confidential information or to implement information controls mandated by statute, regulation, or industry standard. Implementations of network data transmission analysis systems and methods are disclosed that can use contextual information in a DLP policy to monitor data transmitted via the network. The contextual information may include information based on a network user's organizational structure or services or network infrastructure. Some implementations may detect bank card information in network data transmissions. Some of the systems and methods may be implemented on a virtual network overlaid on one or more intermediate physical networks that are used as a substrate network.

Abstract: A wall plate assembly has a first port adapted to be coupled to a device and a second port adapted to be coupled to a communications network. The wall plate assembly is operable to obtain authentication information from a user and to determine from the obtained authentication information whether the user should be granted or denied access to the network. The assembly is operable when the determination indicates the user should be granted access to provide endpoint location identification information associated with the wall plate assembly and the authentication information to the second port, and is operable responsive to a acknowledgement signal received via the second port to grant access to the network via the first port. The assembly is operable when either no acknowledgment signal is received or the determination indicates the user should be denied access to isolate the first port from the network.

Abstract: Assertions for elevated privilege associated with transparent code may be ignored, prohibited, or modified.

Abstract: Outbound communication from a computer is monitored, and requests to access remote links are identified. This process identifies attempts by users to access links provided by third parties in emails and such, as well other attempts by users to access remote domains. Domains in the identified requests are profiled, by testing them for properties associated with known legitimate domains, and for properties associated with known fraudulent domains. A trustworthiness score for a domain is calculated based on the results of the profiling. The trustworthiness score is compared to a predetermined threshold, and from the results it is determined whether or not the domain is legitimate. If the domain is fraudulent, appropriate action is taken, such as blocking the attempt to access the domain.

Abstract: The present invention relates to a system and methods for enabling a user control in third-party computing environments or cloud computing via a virtual private network created by a control module, which contains parameters defined by the user. The system and methods are used to create a fault tolerant virtual private network that allows user control over addressing, security encryption, routing, and the enablement of multicast protocols, regardless of the prohibition set by the third-party computing environment.

Abstract: Various systems, apparatus, and methods include an apparatus comprising a transparent proxy coupled to a plurality of non-configured clients and coupled to one or more servers, the transparent proxy operable to intercept a request for a secured connection to a first server of the one or more servers, the request from a first non-configured client of the plurality of non-configured clients and including a server name indication extension, and to supply a proper certificate to the first non-configured client including the server name indication extension as a common name in the proper certificate.

Abstract: Data traffic is routed from a customer edge (CE) router to an Ethernet services router via a generic routing encapsulation (GRE) tunnel. Upon routing the data traffic from the CE router to the Ethernet services router, the data traffic is routed from the Ethernet services router to an aggregation switch. Upon routing the data traffic from the Ethernet services router to the aggregation switch, the data traffic is routed from the aggregation switch to a service switch through a security module, the security module configured to filter the data traffic. The filtered data traffic is routed from the service switch to the Ethernet services router. Upon routing the filtered data traffic from the service switch to the Ethernet services router, the filtered data traffic is routed from the Ethernet services router to a provider edge (PE) router.

Abstract: A method for efficiently decrypting asymmetric SSL pre-master keys is divided into a key agent component that runs in user mode, and an SSL driver running in kernel mode. The key agent can take advantage of multiple threads for decoding keys in a multi-processor environment, while the SSL driver handles the task of symmetric decryption of the SSL encrypted data stream. The method is of advantage in applications such as firewalls with deep packet inspection in which all encrypted data traffic passing through the firewall must be decrypted for inspection.

Abstract: An IMS multimedia communication method and system, terminal and IMS core network, wherein the IMS multimedia communication method includes signal negotiation performed between the terminal and the IMS core network, and during the process of signal negotiation, an IPSec-ESP security association for media transmission is established between the terminal and the IMS core network; the media content is transmitted between the terminal and the IMS core network via the IPSec-ESP security association for media transmission. The security of media content transmitted between the terminal and the IMS core network is maintained solving the safety problem of multimedia communication under IMS in related technology, and preventing the media content from being maliciously stolen and tampered by others when transmitted between the terminal and the IMS core network.

Abstract: The present invention provides a network security apparatus for monitoring telecommunication information flowing through a network and carrying out detection of, and/or protection from, an illegitimate intrusion to the network, comprising: an anomaly judgment unit for judging a presence or absence of an abnormality of the telecommunication information based on judgment reference information by using a statistical method; a learning unit for creating the judgment reference information from the telecommunication information; a first port for importing first telecommunication information currently from the network; a second port for importing second telecommunication information accumulated by a telecommunication information accumulation apparatus historically; and a telecommunication information allocation unit for allocating the first and second telecommunication information taken in respectively from the first and second ports to the anomaly judgment unit and the learning unit, wherein the learning unit creat

Abstract: The present invention is directed towards systems and methods for split proxying Secure Socket Layer (SSL) communications via intermediaries deployed between a client and a server. The method includes establishing, by a server-side intermediary, a SSL session with a server. A client-side intermediary may establish a second SSL session with a client using SSL configuration information received from the server-side intermediary. Both intermediaries may communicate via a third SSL session. The server-side intermediary may decrypt data received from the server using the first SSL session's session key. The server-side intermediary may transmit to the client-side intermediary, via the third SSL session, data encrypted using the third SSL session's session key. The client-side intermediary may decrypt the encrypted data using the third SSL session's session key. The client-side intermediary may transmit to the client the data encrypted using the second SSL session's session key.

Abstract: The present invention provides a star-connected network (C1-C4, P1-P8) having a number of peripheral nodes (P1-P8) and a central control arrangement (C1-C4). Each peripheral node has means for restricting communications across the network to the central control arrangement using a respective encrypted connection unless the peripheral node has received explicit authorisation from the control arrangement to set up a direct connection with another peripheral node.

Abstract: Systems, methods and apparatus for protecting sensitive data in a file that has been replaced with pointer(s) for each sensitive data. The sensitive data items are protected by restricting subsequent access to and use of the sensitive data items via the pointers by: receiving a first request for data stored in a file on the data storage, determining whether the requested data includes at least one of the pointers, providing the requested data whenever the requested data does not include any of the pointers, and performing the following steps whenever the requested data includes at least one of the pointers: sending a second request containing the pointer(s) included in the requested data to the server that authenticates the second request, denying the first request whenever the authentication fails, and receiving and providing the extracted data item(s) corresponding to the pointer(s) included in the requested data whenever the authentication succeeds.

Abstract: An apparatus for establishing a virtual private network with an internet protocol multimedia subsystem (IMS) device that includes a key derivation module, a tunneling protocol module, a tunnel management module, and a security policies module. The apparatus includes a non-volatile memory configured to store a first routing table that maps host addresses and IMS addresses of security devices allowing access to those hosts, such that when an application running in the IMS device requests communication to a host address, the apparatus initiates a session with the IMS address to which the host address is mapped. The session is initiated by a message that includes a body that contains, for each tunneling protocol supported by the tunneling protocol module, data about the local tunnel endpoint (e.g.

Abstract: A device, system, and method are provided for simply and securely pairing a wireless peripheral device with a host device or system. The device, claim, and method and other peripheral devices provide for improved simplification and security of the pairing process involved with establishing a secure wireless connection between a peripheral device and a host. Simplification is improved because actions required by the user to complete the pairing process are minimized, and security is improved because of a greatly increased ability on the part of the user to ensure that pairing process is conducted in a secure environment. The pairing may be applicable to any number of host devices and peripheral devices. The host device may be a desktop computer, notebook computer, tablet computer, or similar device, and the peripheral device may be a keyboard, mouse, game controller, or personal digital assistant (PDA).

Abstract: In a communication system of the present invention, second setting information is automatically generated according to first setting information used for performing predetermined processing between at least two devices when the first setting information is set to a first device of the at least two devices, where the second setting information is generated for a second device of the at least two devices. Then, the communication system transmits the automatically-generated second setting information to the second device. Otherwise, the communication system writes the automatically-generated second setting information onto a portable recording medium so that the second device can read the second setting information from the portable recording medium.

Abstract: Obscuring form data to be passed in forms that are sent in messages over a communications network. The form data to be obscured is removed from a form and inserted as a portion of a Uniform Resource Location (“URL”) string. The obscured form data may comprise hidden fields and/or links. An obfuscation is then applied to the portion of the URL string, thereby obscuring the information for sending on an outbound message. The original information is recovered from an inbound message which contains the obscured information by reversing the processing used for the obscuring. In one aspect, the obfuscation comprises encryption. In another aspect, the obfuscation comprises creating a tiny URL that replaces the portion of the URL string.

Abstract: The disclosure provides a method and apparatus for transmitting data securely using an unreliable communication protocol, such as User Datagram Protocol. In one variation, the disclosure describes retaining compatibility with conventional Secure Sockets Layer (SSL) and SOCKS protocols, such that secure UDP datagrams can be transmitted between a proxy server and a client computer in a manner analogous to conventional SOCKS processing. Further, the disclosure describes a network arrangement that employs a cache having copies distributed among a plurality of different locations. SSL/TLS session information for a session with each of the proxy servers is stored in the cache so that it is accessible to at least one other proxy server. Using this arrangement, cached SSL/TLS communication session information may be retrieved and used by a second proxy server to accept a session with the client device when the client device switches proxy servers.

Abstract: Systems and methods of the present invention provide for configuring a server and loading SSL information by dynamically loading SSL information into a template based on an implicit SSL-based configuration. A Proxy Server may be used to determine an IP address on which the incoming network request was received, implicitly configure a configuration file accordingly, determine if an SSL information is contained within a cache, on a disk or in a database for the IP address and dynamically load the SSL information into an implicit generic template.

Abstract: One embodiment disclosed relates to a method of connection-rate filtering. A rate of traffic through a port of a network device is measured. The measured traffic rate is compared with a pre-set threshold rate. Packets are sampled from the port over a period of time if the pre-set threshold rate is exceeded by the measured traffic rate, and the sampled packets are analyzed. Other embodiments are also disclosed.

Abstract: According to one embodiment, a conditional access (CA) control system comprises circuitry that is adapted to: (i) transmit information including a unique identifier assigned to a digital device and mating key generator values to the remote source, (ii) receive a mating key from the remote source, the mating key being based on the transmitted unique identifier and mating key generator values, the mating key being used to encrypt data used for scrambling either additional key information or program data prior to transmission to the digital device, and (iii) transmit the mating key generator values and the encrypted data to the digital device, the mating key generator values are used to regenerate the mating key in the digital device.

Abstract: Methods and systems for managing access to a wireless local area network are provided. A wireless access point (AP) may use a unified approach that utilizes an out-of-band channel to communicate authentication key and network address information to a guest device, and utilizes an in-band channel to establish communications with the guest device, and also provides support for in-band setup on all devices. The ability to use out-of-band where possible provides for an increase to security and usability, and the possibility of delegating access from one device to another. The unified approach thereby also provides easy management of guest access to the WLAN.

Abstract: Efficient secure password protocols are constructed that remain secure against offline dictionary attacks even when a large, but bounded, part of the storage of a server responsible for password verification is retrieved by an adversary through a remote or local connection. A registration algorithm and a verification algorithm accomplish the goal of defeating a dictionary attack. A password protocol where a server, on input of a login and a password, carefully selects several locations from the password files, properly combines their content according to some special function, and stores the result of this function as a tag that can be associated with this password and used in a verification phase to verify access by users.

Abstract: An IMS User Equipment (UE) is provided. The IMS UE comprises: searching means for searching, based on UPnP technology, a UPnP network for a host device that has IMS subscription information, establishing means for establishing a session with the host device discovered by the searching means, subscription retrieving means for retrieving, from the host device via the session, the IMS subscription information, registering means for registering with the IMS network using the IMS subscription information, key retrieving means for retrieving, from the host device via the session, a first encryption key shared with an IMS application server (AS) in an IMS network by sending identity of the IMS AS to the host device via the session, and communicating means for performing encrypted communication with the IMS AS using the first encryption key.

Abstract: A computer-implemented method, network management system, and network clients are provided for out-of-band network security management. The network management system includes routers, firewalls, and out-of-band interfaces. The out-of-band interface of the network management system transmits access control lists to network clients connected to a trusted network. The trusted network connects the routers, firewalls, and network clients. The firewalls receive access control lists from the network management system to police communications that traverse the trusted network and an untrusted network. The routers receive access control lists from the network management system to police communications that traverse the router within the trusted network. The access control lists for the routers and firewalls are transmitted over a network interface to the trusted network and are transmitted separately from the access control lists for the network clients.

Abstract: Methods and systems for protection of customer secrets in a secure reprogrammable system are disclosed, and may include controlling, via hardware logic and firmware, access to customer specific functions. The firmware may comprise trusted code, and may comprise boot code, stored in non-volatile memory, which may comprise read only memory, or a locked flash memory. A customer mode may be checked via the trusted code prior to allowing downloading of code written by a customer to the reprogrammable system. Access to customer specific functions may be restricted via commands from a trusted source. The hardware logic may be latched at startup in a disabled mode by the firmware, determined by the customer mode stored in a one time programmable memory. The customer mode may be re-checked utilizing the firmware, and may disallow the use of code other than trusted code in the reprogrammable system when the re-checking fails.

Abstract: Techniques described herein enable a client to store information indicating whether various hosts (e.g., servers, web domains) support a preferred security protocol, such as a False Start-modified TLS or SSL protocol. The client may then use this information to dynamically determine whether to use the preferred protocol when connecting to a particular host. When the client attempts a handshake to establish a secure connection with a host for the first time, the client does so using the preferred protocol. If the handshake fails, the client locally stores domain or other identifying information for the host so that the client may employ a non-preferred protocol in subsequent connection attempts. Thus, a client may avoid performance degradation caused by attempting a preferred-protocol connection with a host that does not support the preferred protocol. Stored information may include a time stamp enable periodic checks for host capability updates.

Abstract: A method and system for providing privacy in a publish-subscribe protocol is provided. A server transmits to a client a public key. The server receives from the client a pseudonym of an interest based on a division malleable commitment method applied to the public key, wherein the pseudonym of the interest functions as a commitment of the client. The server encrypts an item with a padded key and encrypting the padded key. The server transmits to the client, the encrypted item and a pseudonym of a topic associated with the item based on a modification of the commitment by the server using a hybrid conditional-oblivious transfer protocol. When the interest of the client equals the topic associated with the item, the client retrieves a correct padded key to decrypt the encrypted data item; otherwise the client retrieves a random key that is unable to decrypt the encrypted data item.

Abstract: A dual cryptographic keying system. In particular implementations, a method includes responsive to an initial session key negotiation, storing security association information for a tunnel in a security association memory; responsive to a session key renegotiation, storing security association information for the tunnel in a cache; decrypting received packets associated with the tunnel conditionally using the security association information in the cache or the security association information in the security association memory; and upon an expiration condition, overwriting the security association information, for the tunnel, in the security association memory with the security association information, for the tunnel, copied from the cache.

Abstract: Methods and systems are disclosed for providing secure transmissions across a network comprising a transmitting device and a receiving device. At the transmitting device, a stream of watermark bits is generated. Next, a plurality of watermarks is generated, each of the plurality of watermarks comprising an index number and a portion of the stream of watermark bits. The watermarks are inserted into each header of a plurality of outgoing packets. At the receiving device, the plurality of outgoing packets are received and it is determined if a received packet is valid based on the watermark in the header of the received packet. The stream of watermark bits may be generated using a stream cipher such as RC4, a block cipher such as 3DES in CBC mode, or other equivalent pseudo-random stream generating techniques.

Abstract: Sending and receiving encrypted emails. At a web browser, user input is received requesting a compose email page user interface for a web-based email system. The compose email page user interface is requested from a server for the web-based mail system. Web page code is received from the server for the compose email page user interface. The web page code for the compose email page user interface is parsed to determine screen locations of one or more user input interface elements. The compose email page user interface is rendered in the browser. One or more browser-based interface elements implemented integral to the browser are overlaid onto the compose email page user interface. User input is received in the browser user interface elements. The user input received is encrypted. The encrypted user input is transferred into one or more elements of the compose email page user interface.

Abstract: The invention relates to a computer implemented method for performing a user authentication, wherein an asymmetric cryptographic key pair is associated with the user, said key pair comprising a public key and a private key, wherein the method comprises selecting the user to be authenticated using a pseudonym of said user, wherein said pseudonym comprises the public key of the user, the method further comprising performing a cryptographic authentication of the user using the asymmetric cryptographic key pair.

Abstract: A method for providing authentication credentials to a server over a communications network includes initiating communication with a server over a communications network. The communication is to be established using a secure connection. A message is received from the server over the communications network as well as a request for a digital certificate associated with a first user account accessible to the server. An encrypted private key is decrypted in a secure hardware module to obtain a decrypted private key. The decrypted private key is associated with the first user account. The message received from the server is passed to the secure hardware module. The message is digitally signed in the secure hardware module using the decrypted private key. The digital certificate and the digitally signed message are sent to the server over the communication network.

Abstract: A system, comprising a network interface, an additional data communications interface, and processor for supporting a control interface communicated through the network interface according to an intermachine markup language protocol, for controlling the network interface and the additional data communications interface.

Abstract: A method and system for securing a handheld computing device is described. A personal encryption device may be physically connected to a handheld computing device. Responsive to the connection, a main screen user interface may be displayed on a display of the handheld computing device. The main screen user interface may include at least one cryptography option for a user of the handheld computing device. A user-defined input representative of selection of a first cryptography option of the at least one cryptography option may be received, and at least one cryptography process associated with the selected first cryptography option may be implemented by the handheld computing device and personal encryption device. The cryptography options may include encryption, decryption, digital signatures, and digital signature verification.

Abstract: A system and method for implementing an enhanced transport layer security (ETLS) protocol is provided. The system includes a primary server, an ETLS servlet and an ETLS software module. The primary server operates on a computer network and is configured to communicate over the computer network using a non-proprietary security protocol. The ETLS servlet also operates on the computer network and is securely coupled to the primary server. The ETLS servlet is configured to communicate over the computer network using an ETLS security protocol. The ETLS software module operates on a mobile device, and is configured to communicate over the computer network using either the non-proprietary security protocol or the ETLS security protocol. Operationally, the ETLS software module initially contacts the server over the computer network using the non-proprietary security protocol, and subsequently contacts the server through the ETLS servlet using the ETLS security protocol.

Abstract: Techniques are provided for implementing a zone-based firewall policy. At a virtual network device, information is defined and stored that represents a security management zone for a virtual firewall policy comprising one or more common attributes of applications associated with the security zone. Information representing a firewall rule for the security zone is defined and comprises first conditions for matching common attributes of applications associated with the security zone and an action to be performed on application traffic. Parameters associated with the application traffic are received that are associated with properly provisioned virtual machines. A determination is made whether the application traffic parameters satisfy the conditions of the firewall rule and in response to determining that the conditions are satisfied, the action is performed.

Abstract: A method and an apparatus for encrypting/decrypting packet data of a precise time synchronization protocol and a time synchronization system are illustrated. The method is suitable for the time synchronization system using a precise time protocol. The time synchronization system includes a master node and a slave node, wherein the slave node synchronizes its time with the master node. In the method for encrypting/decrypting packet data of the precise time synchronization protocol, an encryption/decryption hardware device is disposed on the hardware protocol layer of each of the master node and the slave node. The hardware protocol layer is under the data link layer, and includes the data link layer. A synchronization message is encrypted by using the encryption/decryption hardware devices of the master node to generate a frame data, and the frame data is decrypted by using the encryption/decryption hardware devices of the slave node to obtain the synchronization message.

Abstract: Embodiments of the invention are directed to automatically populating a database of names and secrets in an authentication server by sending one or more lists of one or more names and secrets by a network management software to an authentication server. Furthermore, some embodiments provide that the lists being sent are encrypted and/or embedded in otherwise inconspicuous files.

Abstract: A content import method in a digital rights management (DRM) system imports transport streams received from outside a domain, generates a content file, and regularly inserts information in the form of transport packets necessary for decrypting encrypted content into a payload of the content file. Accordingly, even if usage constraint information (UCI) included in the received content changes, packaging is possible. When a device pertaining to the domain receives half of an imported content file via streaming, transport packets of the received half of the imported content file can be promptly decrypted without a time delay.

Abstract: A method, device, system and computer program for providing a transport distribution scheme for a security protocol are disclosed. A first packet data connection is established to a remote node for transmitting packet data over a network with a security protocol. An authentication procedure is performed with the remote node via the first packet data connection for establishing a security protocol session with the remote node. At least one security parameter is negotiated with the remote node for transmitting packets through the first packet data connection. A second packet data connection is established to the remote node, and at least one security parameter is negotiated with the remote node for use with the second packet data connection. The first and second packet data connections are handled as packet data subconnections associated with the security protocol session.

Abstract: A relay device first uses latest authentication data to determine whether request-authentication data transmitted from a wireless communications device is valid. If the latest authentication data is used to determine that the request-authentication data is valid, the relay device carries out relayed communications with the wireless communications device. If the latest authentication data is used to determine that the request-authentication data is invalid, the relay device next uses a former authentication data to determine whether the request-authentication data is valid. If the former authentication data is used to determine that the request-authentication data is valid, the relay device provides the wireless communications device with the latest authentication data to update authentication data in the wireless communications device.

Abstract: Erroneous deletion of data due to a collision of digest information during data de-duplication using digest information is prevented. When backup data is stored on a backup server 1100, digest information of the backup data is generated and stored in a digest information management table 4200. In addition, when a backup data storage request is made to the backup server 1100, a digest information verification control sub-program 1127 generates digest information of data to be backed up, and performs verification against the digest information of the backed up data already stored on the backup server 1100. If, by this verification, it is found that backed up data having the same digest information is already stored, de-duplication is realized by reusing the existing backed up data without newly storing the data to be backed up.

Abstract: The embodiments described herein generally relate to methods and systems for tunneling arbitrary binary data between an HTTP endpoint and an arbitrary destination. Such tunneling of data is valuable in an environment, for example, in which a browser-based client communicates in the HTTP protocol and desires to exchange data with a remote endpoint understanding non-HTTP communications. A relay server is used as a “middle man” to connect the client to the destination, and components supporting the necessary protocols for data exchange are plugged into the relay server. To achieve reliable and ordered transmission of data, the relay server groups sessions through the assignment of session identifiers and tracks the exchange of messages through the assignment of sequence and acknowledgment numbers. Further, the relay server provides for authenticating the HTTP endpoint with the destination and for handling other operations not available in the constrained environment of the Web-based client.