公开(公告)号：US09537846B2

公开(公告)日：2017-01-03

申请号：US14253411

申请日：2014-04-15

申请人： Mahesh Jethanandani ,  Ankur Saxena ,  Ashesh Mishra

发明人： Mahesh Jethanandani ,  Ankur Saxena ,  Ashesh Mishra

IPC分类号： H04L29/06

CPC分类号： H04L63/08 ,  H04L63/1441 ,  H04L63/162

摘要： A method, a network element, and a network include determining an authentication mechanism between two nodes in a network path; operating the network path; performing connectivity check between the two nodes in the network path; and authenticating specific frames in the connectivity check between the two nodes with the authentication mechanism responsive to the specific frames affecting a state of the network path. The frames can be Bidirectional Forwarding Detection (BFD), Continuity Check Messages (CCMs), etc. Advantageously, the method, network element, and network reduce the computational load of providing authentication while maintaining secure authentication for important frames, i.e., ones that affect the state of the network path.

摘要翻译： 一种方法，网络元件和网络包括确定网络路径中的两个节点之间的认证机制; 操作网络路径; 在网络路径中的两个节点之间执行连接性检查; 并使用认证机制对两个节点之间的连接性检查中的特定帧进行认证，以响应影响网络路径状态的特定帧。 这些帧可以是双向转发检测（BFD），连续性检查消息（CCM）等。有利的是，方法，网络元素和网络减少了提供认证的计算负担，同时保持重要帧的安全认证，即影响 网络路径的状态。

公开(公告)号：US20150295909A1

公开(公告)日：2015-10-15

申请号：US14253411

申请日：2014-04-15

申请人： Mahesh Jethanandani ,  Ankur Saxena ,  Ashesh Mishra

发明人： Mahesh Jethanandani ,  Ankur Saxena ,  Ashesh Mishra

IPC分类号： H04L29/06

CPC分类号： H04L63/08 ,  H04L63/1441 ,  H04L63/162

摘要： A method, a network element, and a network include determining an authentication mechanism between two nodes in a network path; operating the network path; performing connectivity check between the two nodes in the network path; and authenticating specific frames in the connectivity check between the two nodes with the authentication mechanism responsive to the specific frames affecting a state of the network path. The frames can be Bidirectional Forwarding Detection (BFD), Continuity Check Messages (CCMs), etc. Advantageously, the method, network element, and network reduce the computational load of providing authentication while maintaining secure authentication for important frames, i.e., ones that affect the state of the network path.

摘要翻译： 一种方法，网络元件和网络包括确定网络路径中的两个节点之间的认证机制; 操作网络路径; 在网络路径中的两个节点之间执行连接性检查; 并使用认证机制对两个节点之间的连接性检查中的特定帧进行认证，以响应影响网络路径状态的特定帧。 这些帧可以是双向转发检测（BFD），连续性检查消息（CCM）等。有利的是，方法，网络元素和网络减少了提供认证的计算负担，同时保持对重要帧的安全认证，即影响 网络路径的状态。

公开(公告)号：US08639842B1

公开(公告)日：2014-01-28

申请号：US11479981

申请日：2006-06-30

申请人： Nagaraj A. Bagepalli ,  Abhijit Patra ,  Murali Bashyam ,  David Wei-Shen Chang ,  Mahesh Jethanandani

发明人： Nagaraj A. Bagepalli ,  Abhijit Patra ,  Murali Bashyam ,  David Wei-Shen Chang ,  Mahesh Jethanandani

IPC分类号： G06F15/16 ,  G06F15/173

CPC分类号： G06F9/5033 ,  H04L63/0272 ,  H04L65/605 ,  H04L67/1027 ,  H04L67/1038

摘要： Systems and procedures are presented for communicating multiple data streams through an SSLVPN gateway. One implementation of a method includes receiving a plurality of incoming data streams and load balancing the incoming data streams. The load balancing includes assigning a first set of one or more incoming data streams to a first subprocessor, and responding to the first set of incoming data streams with outgoing data streams that include a first identifier that indicates the first subprocessor. One implementation of a network element includes a plurality of subprocessors and a dispatcher module. The dispatcher module is coupled to the plurality of subprocessors, and is configured to recognize an identifier in a received data stream. The dispatcher module dispatches the received data stream to a corresponding subprocessor of the plurality of processors in response to the identifier in the received data stream.

摘要翻译： 呈现系统和程序，用于通过SSLVPN网关传送多个数据流。 一种方法的实现包括接收多个输入数据流并负载平衡输入数据流。 负载平衡包括将第一组一个或多个输入数据流分配给第一子处理器，以及响应于包括指示第一子处理器的第一标识符的输出数据流的第一组输入数据流。 网元的一个实现包括多个子处理器和调度器模块。 调度器模块耦合到多个子处理器，并且被配置为识别接收的数据流中的标识符。 调度器模块响应于接收到的数据流中的标识符将接收到的数据流分派到多个处理器的对应的子处理器。

公开(公告)号：US09602374B2

公开(公告)日：2017-03-21

申请号：US14336884

申请日：2014-07-21

申请人： Ashesh Mishra ,  Ankur Saxena ,  Mahesh Jethanandani

发明人： Ashesh Mishra ,  Ankur Saxena ,  Mahesh Jethanandani

IPC分类号： H04L12/26

CPC分类号： H04L43/0811 ,  H04L43/0829 ,  H04L43/0864 ,  H04L43/106

摘要： A method and network element include receiving, at a receiver node, at least one of sender timestamps and sequence numbers in continuity check (CC) frames sent by a sender node; determining receiver timestamps at the receiver node; detecting instability based on one or more of the at least one of sender timestamps and sequence numbers and the receiver timestamps; and performing a remedial action based on the detecting instability. The CC frames can include Bidirectional Forwarding Detection (BFD) or Continuity Check Message (CCM) frames which are regularly transmitted in a session, but do not currently include timestamps or sequence numbers.

公开(公告)号：US09300642B2

公开(公告)日：2016-03-29

申请号：US12942588

申请日：2010-11-09

申请人： Brian Weis ,  Mahesh Jethanandani ,  Keyur Patel ,  Anantha Ramaiah

发明人： Brian Weis ,  Mahesh Jethanandani ,  Keyur Patel ,  Anantha Ramaiah

IPC分类号： G06F15/16 ,  H04L29/06 ,  H04L12/755 ,  H04L12/721 ,  H04L12/26 ,  H04L12/751 ,  H04L12/703 ,  H04L12/715

CPC分类号： H04L63/06 ,  H04L43/12 ,  H04L45/02 ,  H04L45/021 ,  H04L45/04 ,  H04L45/12 ,  H04L45/28 ,  H04L45/70 ,  H04L63/08

摘要： In an embodiment, a method comprises establishing a first data communications session with a first router. In response to receiving a first request to establish a second data communications session, a probe message that is configured to test whether the first data communications session or the first router is responsive is sent to the first router. In response to determining that the first router has not acknowledged the probe message before a probe timer has expired, and receiving a second request to establish the second data communications session, the second data communications session with the first router is established and a state for the first data communications session is deleted.

摘要翻译： 在一个实施例中，一种方法包括与第一路由器建立第一数据通信会话。 响应于接收到建立第二数据通信会话的第一请求，被配置为测试第一数据通信会话或第一路由器是否响应的探测消息被发送到第一路由器。 响应于在探测定时器期满之前确定第一路由器尚未确认探测消息，并且接收建立第二数据通信会话的第二请求，建立与第一路由器的第二数据通信会话，并且为 第一个数据通信会话被删除。

公开(公告)号：US20160020973A1

公开(公告)日：2016-01-21

申请号：US14336884

申请日：2014-07-21

申请人： Ashesh MISHRA ,  Ankur SAXENA ,  Mahesh JETHANANDANI

发明人： Ashesh MISHRA ,  Ankur SAXENA ,  Mahesh JETHANANDANI

IPC分类号： H04L12/26

CPC分类号： H04L43/0811 ,  H04L43/0829 ,  H04L43/0864 ,  H04L43/106

摘要： A method and network element include receiving, at a receiver node, at least one of sender timestamps and sequence numbers in continuity check (CC) frames sent by a sender node; determining receiver timestamps at the receiver node; detecting instability based on one or more of the at least one of sender timestamps and sequence numbers and the receiver timestamps; and performing a remedial action based on the detecting instability. The CC frames can include Bidirectional Forwarding Detection (BFD) or Continuity Check Message (CCM) frames which are regularly transmitted in a session, but do not currently include timestamps or sequence numbers.

摘要翻译： 方法和网络元件包括在接收器节点处接收由发送器节点发送的连续性检查（CC）帧中的发送者时间戳和序列号中的至少一个; 确定接收机节点处的接收机时间戳; 基于发送者时间戳和序列号和接收者时间戳中的至少一个中的一个或多个来检测不稳定性; 并基于检测不稳定性执行补救动作。 CC帧可以包括在会话中定期发送但不包括时间戳或序列号的双向转发检测（BFD）或连续性检查消息（CCM）帧。

公开(公告)号：US20120117248A1

公开(公告)日：2012-05-10

申请号：US12942588

申请日：2010-11-09

申请人： Brian Weis ,  Mahesh Jethanandani ,  Keyur Patel ,  Anantha Ramaiah

发明人： Brian Weis ,  Mahesh Jethanandani ,  Keyur Patel ,  Anantha Ramaiah

IPC分类号： G06F15/16

CPC分类号： H04L63/06 ,  H04L43/12 ,  H04L45/02 ,  H04L45/021 ,  H04L45/04 ,  H04L45/12 ,  H04L45/28 ,  H04L45/70 ,  H04L63/08

摘要： In an embodiment, a method comprises establishing a first data communications session with a first router. In response to receiving a first request to establish a second data communications session, a probe message that is configured to test whether the first data communications session or the first router is responsive is sent to the first router. In response to determining that the first router has not acknowledged the probe message before a probe timer has expired, and receiving a second request to establish the second data communications session, the second data communications session with the first router is established and a state for the first data communications session is deleted.

摘要翻译： 在一个实施例中，一种方法包括与第一路由器建立第一数据通信会话。 响应于接收到建立第二数据通信会话的第一请求，被配置为测试第一数据通信会话或第一路由器是否响应的探测消息被发送到第一路由器。 响应于在探测定时器期满之前确定第一路由器尚未确认探测消息，并且接收建立第二数据通信会话的第二请求，建立与第一路由器的第二数据通信会话，并且为 第一个数据通信会话被删除。

公开(公告)号：US20070266233A1

公开(公告)日：2007-11-15

申请号：US11383093

申请日：2006-05-12

申请人： Mahesh Jethanandani ,  Murali Bashyam ,  Nagaraj Bagepalli ,  Abhijit Patra

发明人： Mahesh Jethanandani ,  Murali Bashyam ,  Nagaraj Bagepalli ,  Abhijit Patra

IPC分类号： H04L9/00

CPC分类号： H04L63/166 ,  H04L69/16 ,  H04L69/166

摘要： Methods and apparatus for secure network communication in a Secure Sockets Layer (SSL) by avoiding small Transmission Control Protocol (TCP) packets are provided. For some embodiments, these small packets may be avoided by adjusting a maximum segment size (MSS) used in transmissions between an encryption engine and a server to compensate for the amount of overhead added by the encryption process.

摘要翻译： 提供了通过避免小型传输控制协议（TCP）数据包在安全套接字层（SSL）中进行安全网络通信的方法和装置。 对于一些实施例，可以通过调整在加密引擎和服务器之间的传输中使用的最大段大小（MSS）来补偿这些小分组，以补偿由加密过程添加的开销量。