中科微点-全球专利检索

  1. Login
  2. Sign Up

Search Results

21 records (took 0.012 seconds)

    Critical firewall functionality management
    1.
    发明授权
    Critical firewall functionality management 有权

    公开(公告)号：US11245668B1

    公开(公告)日：2022-02-08

    申请号：US16294491

    申请日：2019-03-06

    Applicant: Juniper Networks, Inc.

    Inventor： Sreekanth Rupavatharam ,  Prashant Singh ,  Erin C. MacNeil

    IPC: H04L29/06

    Abstract: A network device may detect, from an application associated with a user space of the network device, a request to configure a firewall provided by a kernel of the network device with a rule. The network device may intercept the request to configure the firewall before the firewall is configured with the rule. The network device, based on intercepting the request to configure the firewall, may analyze the rule to determine whether the rule modifies a critical functionality of the firewall. The network device may reject the request to configure the firewall based on determining that the rule modifies the critical functionality of the firewall.

    Apparatus, system, and method for applying firewall rules on packets in kernel space on network devices
    4.
    发明授权
    Apparatus, system, and method for applying firewall rules on packets in kernel space on network devices 有权

    公开(公告)号：US10798062B1

    公开(公告)日：2020-10-06

    申请号：US16654915

    申请日：2019-10-16

    Applicant: Juniper Networks, Inc.

    Inventor： Prashant Singh ,  Sreekanth Rupavatharam ,  Hariprasad Shanmugam

    IPC: H04L29/06

    Abstract: A disclosed method for applying firewall rules on packets in kernel space on network devices may include (1) intercepting, via a socket-intercept layer in kernel space on a routing engine of a network device, a packet that is destined for a remote device and then, in response to intercepting the packet in kernel space on the routing engine, (2) identifying an egress interface index that specifies an egress interface that (A) is external to kernel space and (B) is capable of forwarding the packet from the network device to the remote device, and (3) applying, on the packet in kernel space, at least one firewall rule based at least in part on the egress interface index before the packet egresses from the routing engine. Various other apparatuses, systems, and methods are also disclosed.

    Intercepting socket metadata
    6.
    发明授权
    Intercepting socket metadata 有权

    公开(公告)号：US10127091B1

    公开(公告)日：2018-11-13

    申请号：US15388018

    申请日：2016-12-22

    Applicant: Juniper Networks, Inc.

    Inventor： Erin C. MacNeil ,  Hariprasad Shanmugam ,  Sreekanth Rupavatharam

    IPC: G06F9/54

    Abstract: A device may receive, by a kernel of the device and from a loadable kernel module of the device, information that instructs the kernel to invoke a callback function associated with the loadable kernel module based on an execution of a hook of the kernel. The device may receive, by the kernel of the device and from an application of the device, a socket application programming interface (API) call. The socket API call may include control information. The device may execute, by the kernel of the device, the hook based on receiving the socket API call. The device may invoke, by the kernel of the device, the callback function associated with the loadable kernel module based on executing the hook to permit a functionality associated with the callback function to be provided. The kernel may provide the control information, associated with the socket API call, to the callback function as an argument.

    Determining synchronization of filter rules (e.g., on iptable filter tables on Linux kernal) across firewall filter application restarts
    7.
    发明授权
    Determining synchronization of filter rules (e.g., on iptable filter tables on Linux kernal) across firewall filter application restarts 有权

    公开(公告)号：US10887282B1

    公开(公告)日：2021-01-05

    申请号：US16166030

    申请日：2018-10-19

    Applicant: Juniper Networks, Inc.

    Inventor： Sreekanth Rupavatharam ,  Prashant Singh ,  Hariprasad Shanmugam

    IPC: G06F21/00 ,  H04L29/06 ,  H04L12/26 ,  G06F16/22

    Abstract: Filter synchronization across a restart of a firewall filter application for converting filter information for filters into corresponding iptables filter table rules, is ensured by (1) computing a hash value for filter information derived from a filter using the filter or information derived from the filter, (2) determining an iptables filter table rule using the filter information for the filter, (3) associating the hash value with the corresponding iptables filter table rule, and (4) adding the determined iptables filter table rule and the hash value to iptables filter table rules in a Linux kernel. When a restart of the firewall filter application is detected, (1) a current instance of filter information derived from a current instance of the filter is obtained, (2) a hash value for the current instance of filter information is computed using the current instance of the filter or information derived from the current instance of the filter, (3) the hash value for the filter information is obtained from the iptables rules, and (4) whether the hash value for the current instance of the filter information is the same as the hash value for the filter information is determined. If it is determined that the hash value for the current instance of the filter information is not the same as the hash value for the filter information, then (1) a new iptables rule for the current instance of the filter information is determined, and (2) the iptables filter rule and the hash value in the iptables rules is replaced with the new iptables rule and the hash value for the current instance of the filter information.

    Apparatus, system, and method for applying firewall rules at dynamic offsets within packets in kernel space
    8.
    发明授权
    Apparatus, system, and method for applying firewall rules at dynamic offsets within packets in kernel space 有权

    公开(公告)号：US10798059B1

    公开(公告)日：2020-10-06

    申请号：US15726718

    申请日：2017-10-06

    Applicant: Juniper Networks, Inc.

    Inventor： Prashant Singh ,  Sreekanth Rupavatharam ,  Hariprasad Shanmugam ,  Erin MacNeil

    IPC: H04L29/06 ,  H04L29/08

    Abstract: A disclosed method may include (1) receiving a packet at a tunnel driver in kernel space on a routing engine of a network device, (2) identifying, at the tunnel driver, metadata of the packet that indicates whether at least one firewall filter had already been correctly applied to the packet before the packet arrived at the tunnel driver, (3) determining, based at least in part on the metadata of the packet, that the firewall filter had not been correctly applied to the packet before the packet arrived at the tunnel driver, and then in response to determining that the firewall filter had not been correctly applied to the packet, (4) invoking at least one firewall filter hook that applies at least one firewall rule on the packet before the packet is allowed to exit kernel space on the routing engine. Various other apparatuses systems, and methods are also disclosed.

    Intercepting socket metadata
    9.
    发明授权
    Intercepting socket metadata 有权

    公开(公告)号：US10740162B2

    公开(公告)日：2020-08-11

    申请号：US16176694

    申请日：2018-10-31

    Applicant: Juniper Networks, Inc.

    Inventor： Erin C. MacNeil ,  Hariprasad Shanmugam ,  Sreekanth Rupavatharam

    IPC: G06F9/54

    Abstract: A device may receive, by a kernel of the device and from a loadable kernel module of the device, information that instructs the kernel to invoke a callback function associated with the loadable kernel module based on an execution of a hook of the kernel. The device may receive, by the kernel of the device and from an application of the device, a socket application programming interface (API) call. The socket API call may include control information. The device may execute, by the kernel of the device, the hook based on receiving the socket API call. The device may invoke, by the kernel of the device, the callback function associated with the loadable kernel module based on executing the hook to permit a functionality associated with the callback function to be provided. The kernel may provide the control information, associated with the socket API call, to the callback function as an argument.

    Systems and methods for debugging network stacks based on evidence collected from selective tracing
    10.
    发明授权
    Systems and methods for debugging network stacks based on evidence collected from selective tracing 有权

    公开(公告)号：US11374842B1

    公开(公告)日：2022-06-28

    申请号：US16940422

    申请日：2020-07-28

    Applicant: Juniper Networks, inc.

    Inventor： Prashant Singh ,  Sreekanth Rupavatharam

    IPC: H04L43/10 ,  H04L43/0829 ,  G06F11/36 ,  H04L9/40 ,  G06F8/65

    Abstract: A disclosed method may include (1) determining that a packet traversing a network device has been selected for conditional tracing by (A) comparing a characteristic of the packet against a firewall rule that calls for all packets exhibiting the characteristic to be conditionally debugged while traversing the network device and (B) determining, based at least in part on the comparison, that the firewall rule applies to the packet due at least in part to the packet exhibiting the characteristic, (2) tracing a journey of the packet within the network device in response to the determination by collecting information about the packet's journey through a network stack of the network device, and then (3) performing at least one action on the network device based at least in part on the information collected about the packet's journey through the network stack. Various other systems, methods, and computer-readable media are also disclosed.

Patent Agency Ranking