Abstract: An end machine (connected to one end of secure connection) may reliably continue to use the security association (SA) even if the self_address (usually the address of the interface) of the end machine changes. The end machine includes the new IP address in the payload of a packet (e.g., an address update message) sent to another end machine at the other end of the connection. The payload can be encrypted and authenticated to avoid third party attacks. As a result, connectivity can restored for user applications reliably and quickly without requiring substantial computations and/or data exchanges.

Abstract: A self-adjusting Internet Key Exchange (IKE) daemon negotiation throttle minimizes retransmission processing during Security Association (SA) negotiation requests. The self-adjusting IKE daemon receives a request for a new negotiation to be performed by a negotiation system; determines if the negotiation system is in congestion; and if the negotiation system is determined to be in congestion: determines if a token is available in a token bucket; and if a token is available in the token bucket, removes the token from the token bucket; and performs the new negotiation.

Abstract: A security gateway receives messages rejected by a message filter based on a set of rules. The security gateway also receives attributes of the rejected messages that triggered the rules. The security gateway maintains frequencies with which the messages with a particular attribute were rejected by the rules. The security gateway finds rejected messages or attributes having a high frequency of occurrence. Since messages or attributes having a high frequency of occurrences are more likely to represent legitimate requests rather than malicious attacks, the security gateway generates exception rules, which would allow messages that have similar attributes to pass through the gateway.

Abstract: A media access control (MAC) security (MACsec) function block may implement MACsec protocols on a network. A physical layer device (PHY) may connect to the MACsec function block and an interface register configured to store command information for the MACsec function block. A central processing unit (CPU) may provide the command information for the MACsec function block to the PHY via a management data input/output (MDIO) bus. The PHY may execute either a read command or a write command against the MACsec function block based on the command information, receive, from the MACsec function block, a response corresponding to the execution of the read command or write command against the MACsec function block, and provide the response to the CPU via the MDIO bus.

Abstract: In one embodiment, a first network device receives a priority message from a second network device, wherein the priority message conforms to a connection establishment protocol and indicates a priority associated with the second network device. The first network device obtains the priority from the priority message and stores the priority. The first network device allocates resources for at least one of control or data plane processing to the second network device in accordance with the priority.

Abstract: Systems and methods for enabling trusted software to monitor and control USB traffic associated with a security extension of a host controller and devices in a USB topology is disclosed. A host controller proxy receives USB-related data from a host controller driver, determines whether the data is of a security interest, and if so, sends the data to a driver for a security extension executing in the trusted execution environment. Likewise, after software executing in the trusted execution environment evaluates and appropriately addresses data sent by the HCD proxy or data retrieved from a hardware security extension, the HCD proxy receives data from the trusted execution environment for further dissemination.

Abstract: A computer network management system with an embedded processor, an analog communication means and a digital interface for network management provides a system for remotely and securely managing a network. Backup power in the form of an uninterrupted power supply, or other power means as appropriate, allows the modem to provide power outage notification to a remote site. The system further provides authentication and authorization capabilities for security purposes.

Abstract: A method and system for including security information with a packet is disclosed. A packet is detected as it exits a first network and enters a second network. The first network is configured to support a network security technique, and the second network is not configured to support the network security technique. Network security information associated with the network security technique is included with the packet. A network device is configured to include network security information in overhead of a packet. A method for identifying a first network device in a network is also disclosed. Identification information of the first network is communicated to a second network device.

Abstract: In general, the principles of this invention are directed to techniques of locally caching endpoint security information. In particular, a local access module caches endpoint security information maintained by a remote server. When a user attempts to access a network resource through an endpoint device, the endpoint device sends authentication information and health information to the local access module. When the local access module receives the authentication information and the health information, the local access module controls access to the network resource based on the cached endpoint security information, the authentication information, and a security state of the endpoint device described by the health information.

Abstract: A method and system for best effort propagation of security group information is disclosed. The method includes determining if a reserved group identifier is associated with a destination and, if the reserved group identifier is associated with the destination, indicating that a packet received at a network node can be sent to another network node. The packet includes destination information that identifies the destination as a destination of the packet.

Abstract: A method and system for including security information with a packet is disclosed. A packet is detected as it exits a first network and enters a second network. The first network is configured to support a network security technique, and the second network is not configured to support the network security technique. Network security information associated with the network security technique is included with the packet. A network device is configured to include network security information in overhead of a packet. A method for identifying a first network device in a network is also disclosed. Identification information of the first network is communicated to a second network device.

Abstract: Described are embodiments directed to negotiating an encapsulation mode between an initiator and a responder. As part of the negotiation of the security association, an encapsulation mode is negotiated that allows packets to be sent between the initiator and responder without encapsulation. The ability to send packets without encapsulation allows intermediaries, such as a firewall, at the responder to easily inspect the packets and implement additional features such as security filtering.

Abstract: A method, system, apparatus, and computer-readable medium to detect rapidly propagating threats in a network. A rapidly propagating threat is detected by capturing a series of packets as the packets are communicated to nodes of the organizational network. The rapidly propagating threat can be detected without relying upon a known signature for the threat. Behavior of nodes when sending and receiving packets is examined for patterns typical of worm propagation.

Abstract: A network device may manage communication sessions with clients so that attempts at the client to automatically keep the session alive can be ignored for purposes of timing out the session. The device may examine resource requests received from the client as uniform resource locators (URLs) and determine whether the URLs include a context variable. The device may determine whether to reset a timeout period for the communication session based on a presence of the context variable in the URL. At the client side, the context variable may be attached to URLs that are part of functions configured to automatically access the network device.

Abstract: Pattern matching for a network flow includes storing a representation of the pattern. The representation of the pattern includes hash values representing blocks of data in the pattern. Hash values are calculated for blocks of data in the network flow. The blocks of data are spread across multiple packets in the network flow. The calculated hash values for the blocks of data in the network flow are compared to the hash values in the representation of the pattern to detect the pattern in the network flow.

Abstract: Detecting anomalous network activity through transformation of a terrain is disclosed. A set of network properties is mapped into a multidimensional terrain. The terrain is transformed into an observation domain in which data events of interest are amplified relative to other data comprising the terrain. The transformed terrain is evaluated for anomalous network activity.

Abstract: A network device is configured to receive a registration message from a private user device including a private internet protocol (IP) address associated with the private user device. A public IP address and discrete port number are assigned to the private user device and private IP address and stored in an incoming call table. The registration message is translated to include the public IP address and discrete port number. The registration message is forwarded to a proxy server for registration. An incoming call invitation message is received from a public user device, where the call invitation message is directed to the public IP address and discrete port number associated with the private user device. The call invitation message is translated to include the private IP address associated with the private user device based on the received public IP address and discrete port number and the incoming call table. The call invitation message is forwarded to the private user device.

Abstract: Embodiments of an RFID security system and method are described herein. Embodiments include an RFID security server or appliance and RFID security software. In an embodiment, the RFID security server is placed between an RFID reader and an enterprise back-end. Thus the system operates at the point where the RFID data stream leaves the RF interface and enters a physical transmission medium before any other active components on the network (such as databases, middleware, routers). The RFID security server analyzes RFID tag data (including meta-data) received from the reader in-band and detects malware and errors in the data. RFID tag data containing malware or errors is blocked from entering the enterprise back-end. Unwanted RFID tags are also identified and filtered as noise.

Abstract: In one embodiment, the present invention includes a method for secure data exchange between an external network and an internal network (1 and 2) via a transaction interface (3), in which an external user can undertake predetermined data transactions within the internal network (2). An interface server (7) and interface memory (11) may be coupled between an external network and an internal network. The present invention discloses security techniquest that may be used, including encryption, request processing, and checking. In one embodiment, a first firewall is coupled between the external network and the interface server and a second firewall is coupled between the interface server and the internal network.

Abstract: Disclosed herein is a data transmission system permitting secure and more reliable transmission of data from a data transmitter to a data receiver or receivers. The system comprises: a data transmitter for encrypting data and transmitting the encrypted data; data receivers for receiving the encrypted data from the data transmitter; satellite links used for data transmission from the data transmitter to the data receivers; and bidirectional communication channels which are also used for transmitting data from the data receivers to the data transmitter and which have a smaller capacity of data transmission than the satellite links. The satellite links are used to transmit encrypted data from the data transmitter to the data receivers. At least the bidirectional communication channels are used to communicate restrictive data transmission control information between the data transmitter and the data receivers.

Abstract: Communication nodes, acting as intermediate routers for communication packets transmitted between a source node and a destination node, are provided with different access rights to the fields of the routed communication packets. Routes of intermediate routers between the source node and the destination node are discovered and the identities of intermediate routers on the discovered routes are collected. The aggregate trust levels of the intermediate routers are computed allowing the most trusted route to be selected. Encryption keys are securely distributed to intermediate routers on the most trusted route based on the trust level of the intermediate routers and fields of the communication packets are encrypted with encryption keys corresponding to the assigned trust level. Intermediated nodes are thereby prevented from accessing selected fields of the communication packets.

Abstract: A system and method securely replicates a configuration database of a security appliance. Keys stored on an original configuration database of an original security appliance are organized as a novel key hierarchy. A replica or clone of the original security appliance may be constructed in accordance with a cloning technique of the invention. Construction of the cloned security appliance illustratively involves sharing of data between the appliances, as well as substantially replicating the key hierarchy on a cloned configuration database of the cloned appliance.

Abstract: A system, method and computer program product for providing authentication to a firewall using a lightweight directory access protocol (LDAP) directory server is disclosed. The firewall can be configured through a graphical user interface to implement an authentication scheme. The authentication scheme is based upon a determination of whether at least part of one or more LDAP entries satisfy an authorization filter.

Abstract: The present invention is directed towards systems and methods for integrating cache managing and application firewall processing in a networked system. In various embodiments, an integrated cache/firewall system comprises an application firewall operating in conjunction with a cache managing system in operation on an intermediary device. In various embodiments, the application firewall processes a received HTTP response to a request by a networked entity serviced by the intermediary device. The application firewall generates metadata from the HTTP response and stores the metadata in cache with the HTTP response. When a subsequent request hits in the cache, the metadata is identified to a user session associated with the subsequent request. In various embodiments, the application firewall can modify a cache-control header of the received HTTP response, and can alter the cookie-setting header of the cached HTTP response.

Abstract: A system is provided for establishing a secure link among multiple users on a single machine with a remote machine. The system includes a subsystem to filter traffic so that traffic from each user is separate. The subsystem generates and associates a Security Association (SA) with at least one filter corresponding to the user and the traffic, and employs the SA to establish the secure link. An Internet Key Exchange module and a policy module may be included to generate and associate the security association, wherein the policy module is configured via Internet Protocol Security (IPSEC).

Abstract: The invention is directed towards methods of configuring a firewall in a first base station (12) in a wireless wide area network (CN, RAN) as well as to a firewall configuring device (20) and a first base station (12). The first base station (12) obtains new neighbour base station data related to updating of a neighbour list of this first base station (12), which data includes data identifying a second base station (14) provided in the neighbourhood of the first base station. Based on the data the firewall configuring device (20) provides the first base station (12) with firewall configuration data including a second authentic logical address of the second base station (14), which authentic address is not provided in the neighbour list before the updating. The first base station (12) uses the firewall configuring data for updating its firewall in order to allow communication with the second base station (14).

Abstract: Methods and systems for propagating data security policies and rules up a chain of network components, for example, from an end-user device having a firewall, to a network component at the “edge” of the network, from where a policy statement can be transmitted to a service provider are described. A device, such as a computer or mobile phone, has, as part of its firewall software, a policy propagation file, that communicates with pre-existing firewall software. The firewall software creates a policy statement upon detecting a triggering event, which is transmitted from the device to the next data security component up the chain, “upstream,” in the network. The firewall server may combine policy statements from numerous end-user type devices and transmit the policy statement to an external network component. The ISP or other service provider may then use the policy statement to implement data security rules for the devices in the network.

Abstract: A system, method and computer program product for guaranteeing a data transaction over a network are disclosed. When a data transaction between at least a server and a client is detected on a network, data transmitted via the network between the server and client during the data transaction is captured. At least one identifier is associated with the captured data. A timestamp is also generated for the captured data. The timestamp includes information therein identifying at least a portion of the identifier(s). The captured data, the identifier(s) and the timestamp are stored in one or more data stores. The identifier(s) associated with the stored captured data is also mapped to an entry in an index to permit retrieval of the stored data from the data store via the index.

Abstract: A wireless access device in a wireless network, whether a known or unknown entity, can be located using a geolocation system. A signal strength is determined by a wireless intrusion detection system (WIDS) node in a wireless network for each wireless access device that it detects. Based on the signal strength, an approximate distance from the node is determined, which, in one embodiment corresponds to a radius of a circle around the node. To account for error, an approximation band of the circle is calculated that will allow a user to determine the approximate location of the device within the wireless network.

Abstract: Techniques and apparatuses for scanning a computing device for malware are described. In one implementation, a trusted operating environment, which includes a trusted operating system and a trusted antivirus tool, is embodied on a removable data storage medium. A computing device is then booted from the removable data storage medium using the trusted operating system. The trusted antivirus tool searches the computing device for malware definition updates (e.g., virus signature updates) and uses the trusted operating system to scan the computing device for malware. In another implementation, a computing device is booting from a trusted operating system on a removable device and a trusted antivirus tool on the removable device scans the computing device for malware. The removable device can update its own internal components (e.g., virus signatures and antivirus tool) by searching the computing device or a remote resource for updates and authenticating any updates that are located.

Abstract: An OSI layer 2 network device on the edge of a network such as a SAN is configured to replace the original source address of traffic entering the network with a known identifier or address, which is used to signify that entry point as the traffic source to the other nodes of the network. Nodes of the network recognize the new source address as a valid source address. The network device also maintains state (e.g., association of original source address with new source address/identifier) so as to translate addresses to enable reply traffic to be sent back to the original sender.

Abstract: Network devices, systems, and methods are provided for packet processing. One method includes receiving a checking functionality rule set as an input to a distribution algorithm. The method includes bifurcating and providing configuration instructions, as an output from the distribution algorithm, to a first logic plane associated with a first logical entity and a second logic plane associated with a second logical entity. A collaboration algorithm is used to provide processing coordination between the first logical entity and the second logical entity.

Abstract: An apparatus and method for selecting a security association timer between user equipment and a control entity in a communication system are disclosed. The apparatus includes a transmitter configured to transmit a registration request message to a control entity in a communication system, whereby the registration request message is configured to request registration with the control entity. The apparatus further includes a receiver configured to receive an authentication challenge including a temporary timer, whereby the temporary timer is configured to set a time duration for the apparatus to respond to the authentication challenge. The receiver is further configured to receive an acknowledgement message including a security association timeout value in response to the transmitted registration message, whereby the security association timeout value includes a set time length of a security association equal to a registration time length set for registration of the apparatus.

Abstract: In a method for measuring round trip time (RTT), an RTT measurement packet is transmitted to a destination node. The RTT from transmission of the RTT measurement packet to reception of a response from the destination node is measured to determine if the RTT is greater than a predetermined time period. If the RTT is greater than the predetermined time period, an RTT measurement packet is repeatedly retransmitted at a different time interval and the RTT is remeasured until either the RTT measurement packet has been transmitted a predetermined number of times or the RTT is not greater than the predetermined time period.

Abstract: A method of communication between a calling party in a first network and a called party in a second network is disclosed. The method comprises determining in the first network an address associated with the called party. The method also comprises determining, based on the address, if the called party is in a trusted network, and controlling the communication between the called party and the calling party in dependence on if the called party is in a trusted network.

Abstract: Methods and apparatus detecting attempts to obtain IP addresses by faking a MAC address in a data portion of an IP address request message are described. In accordance with the present invention, rather than use standard address allocation protocols, e.g., ARP, the DNS DCHP contacts the requesting edge router via a private secure network. The MAC address received in the address request is compared to the MAC addresses stored in the edge routers port/MAC address resolution table. If the MAC address received in the request message cannot be found in the edge router's table which was created from the MAC address included in the message's header, a fraudulent attempt to obtain a MAC address is declared. The fraudulent attempt to obtain an IP address can be reported and steps taken to identify the perpetrator of the fraud.

Abstract: The technology disclosed addresses initiation of peer-to-peer media exchange sessions, with traversal of NAT and firewall devices, in a manner adapted to roaming. In particular, involves preliminary determination of NAT/firewall topology, which reduces latency at initiation, and hole punching technologies to select a routing and traversal strategy that reduce reliance on external media relay devices.

Abstract: A method and system for providing e-mail messages to a receiving e-mail application. The e-mail messages as sent from a sending e-mail application being secure and in opaque signed format. The opaque signed e-mail messages being converted to clear signed e-mail messages by decoding extracting message content and digital signatures. The clear signed e-mails being sent to a receiving e-mail application.

Abstract: To authenticate a user having an associated asymmetric crypto-key having a private/public key pair (D,E) based on a one-time-password, the user partially signs a symmetric session key with the first portion D1 of the private key D. The authenticating entity receives the partially signed symmetric session key via the network and completes the signature with the second private key portion D2 to recover the symmetric session key. The user also encrypts a one-time-password with the symmetric session key. The authenticating entity also receives the encrypted one-time-password via the network, and decrypts the received encrypted one-time-password with the recovered symmetric session key to authenticate the user.

Abstract: In general, techniques are described of enabling a client-based web browser application to browse a directory structure provided by a server on a private network via a secure gateway. In particular, an intermediate gateway device is positioned on a network path between the client device and a server device. The gateway device communicates with the client device via a secure network connection (e.g., a Secure Sockets Layer connection). When the gateway device receives a resource identifier that identifies a directory structure from either the client device or the server device, the gateway device alters the resource identifier. In particular, the gateway device alters the resource identifier in such a way that when the client device transmits a request to view the directory structure identified by the resource identifier, the client device transmits a request to view the directory structure in a networking protocol that the gateway device permits to pass through the gateway device.

Abstract: A proxy service receives requests from a remote caller to configure a main service. The proxy service authenticates the caller and validates the request. The proxy service then passes the request along to the main service if the caller can be authenticated and if the request can be validated. The proxy service runs at a non-privileged level, but when the proxy service passes the request to the main service, the proxy service impersonates the caller so that the request to the main service is made at the original caller's level of privilege. The main service can block all inbound network traffic, since network requests to configure the main service are received by the proxy, which is a local object from the perspective of the main service. Additionally, the proxy can block inbound traffic other than a certain class of requests (e.g., Remote Procedure Calls).

Abstract: The flow of information to or from an application on a host machine is regulated by a trusted agent operating in conjunction with at least one security element, such as a firewall or a policy server. When a communication to or from the application is detected by the trusted agent, the trusted agent gathers information about the attempted communication, and formulates and sends a message based upon the gathered information to at least one security element. The security element makes a decision to permit or block at least part of the attempted communication based upon the message received from the trusted agent.

Abstract: A system for transporting data comprising a first domain comprising a first plurality of filters in a first communication channel, the first communications channel including a common portion, the first plurality of filters employing a first plurality of filtering criteria; a second domain comprising a second plurality of filters in a second communications channel, the second communications channel including the common portion, the second plurality of filters employing a second plurality of filtering criteria; a plurality of managers each coupled to one of the first plurality of filters and the second plurality of filters, each of the plurality of managers comprising means for configuring the one of the first plurality of filters and the second plurality of filters; and at least one control terminal coupled to the plurality of managers for controlling said plurality of managers.

Abstract: A method and apparatus adapting a Virtual Router Redundancy Protocol (VRRP) between a set of physical SEGs that realize a V-SEG function towards a remote IPsec/IKE peer. In tandem with the VRRP, a new protocol, referred to herein as the IPsec/IKE SA Transfer Protocol (SATP), is introduced to exchange IKE and IPsec SA information between VRRP capable SEGs. SATP synchronizes all participating SEGs with respect to dynamic IPsec state information in near real time. Thus, in the event of a master VRRP SEG failure, one of the hot-standby SEGs takes over the V-SEG function. This allows the V-SEG function to remain functional despite the possible failure of one or more participating SEGs.

Abstract: A content protection management system that enables interoperability with other Content Protection and DRM technologies. A managed security domain provides a simple, consistent and reliable experience to whole-home network subscribers. The architectural concept for the whole-home network includes an underlying control plane with an overlaying content security control plane running a particular DRM technology.

Abstract: NTLM compliant clients and servers are mutually authenticated in accordance with the Kerberos authentication protocol without migrating the clients or servers to Kerberos. With an RPC framework, a target name is generated from the server host name. The target name includes an indication that mutual authentication is to be accomplished. During the initial stages of the RPC session, the target name is sent to the server. If the server recognizes the target name, the client and server are mutually authenticated in accordance with the Kerberos protocol. If the server does not recognize the target name, the client is authenticated in accordance with the NTLM authentication protocol.

Abstract: The present invention provides a solution in which a script containing general security parameters and access policies in a file is placed on an appropriate internal server. The location of the script may then be stored on an external server. When an end-user within the organization decides to purchase a wireless network device, he may attach it to his existing computer. The computer then may retrieve the security file location from the external server, retrieve the security file from the internal server using the security file location, and program the security file into the wireless device.

Abstract: A method for offloading encryption and decryption of a message received at a message server to one or more end devices that are remote from the message server. An encrypting end device remote from the message server encrypts a message using cryptographic context and transmits the cryptographic context and encrypted message to the message server for storage at the message server. The message server stores the encrypted message as received without decrypting the message. The message server sends the stored cryptographic context and the encrypted message to a decrypting end device in response to the decrypting end device sending a request for the message server to transmit the encrypted message to the decrypting end device. The decrypting end device uses the cryptographic context to decrypt the encrypted message and then presents the decrypted message to a user of the decrypting end device.

Abstract: A system and method whereby an unregistered, anonymous user at an organization's website makes a submission/inquiry and is able to access a secure response containing private information without pre-registering or establishing an account with the organization. A response to the user is made via an unsecured e-mail notification that provides the user with an HTTPS link to an authentication page. The user then enters his/her user identification, for example, the user email address and password which was associated with the original submission/inquiry. Once the email address and password is authenticated, the secure response message is displayed on the user's web browser in SSL. Each response is provided on a per-submission basis.

Abstract: A system and/or method that facilitates the installation and/or authentication of a device by invoking installation protocols and/or authentication protocols for a non-physical connection. A physical interface component provides a physical connection between at least one wireless device and at least one network entity in which the installation protocols and/or authentication protocols can be exchanged. The physical interface component can utilize a token key to establish multiple non-physical connections with multiple wireless devices. Additionally, the physical interface component can utilize a daisy chain scheme to install and/or authenticate a wireless device.