利索-全球专利检索

  1. 登录
  2. 注册

搜索结果

43 条记录 (耗时 0.024 秒)

    Methods, apparatuses, and systems for the dynamic evaluation and delegation of network access control
    1.
    发明授权
    Methods, apparatuses, and systems for the dynamic evaluation and delegation of network access control 有权
    用于动态评估和授权网络访问控制的方法，设备和系统

    公开(公告)号：US07827593B2

    公开(公告)日：2010-11-02

    申请号：US11171593

    申请日：2005-06-29

    申请人： Ned M. Smith ,  Howard C. Herbert ,  Karanvir Grewal

    发明人： Ned M. Smith ,  Howard C. Herbert ,  Karanvir Grewal

    IPC分类号： G06F7/04 ,  H04L29/06

    CPC分类号： H04L63/20 ,  H04L63/105 ,  H04L63/1408

    摘要： Embodiments of the inventions are generally directed to methods, apparatuses, and systems for the dynamic evaluation and delegation of network access control. In an embodiment, a platform includes a switch to control a network connection and an endpoint enforcement engine coupled with the switch. The endpoint enforcement engine may be capable of dynamically switching among a number of network access control modes responsive to an instruction received from the network connection.

    摘要翻译： 本发明的实施例一般涉及用于动态评估和授权网络访问控制的方法，装置和系统。 在一个实施例中，平台包括用于控制网络连接的开关和与开关耦合的端点执行引擎。 端点执行引擎可以响应于从网络连接接收的指令而能够在多个网络访问控制模式之间动态切换。

    Methods, apparatuses, and systems for the dynamic evaluation and delegation of network access control
    2.
    发明授权
    Methods, apparatuses, and systems for the dynamic evaluation and delegation of network access control 有权
    用于动态评估和授权网络访问控制的方法，设备和系统

    公开(公告)号：US08752132B2

    公开(公告)日：2014-06-10

    申请号：US12901349

    申请日：2010-10-08

    申请人： Ned M. Smith ,  Howard C. Herbert ,  Karanvir Grewal

    发明人： Ned M. Smith ,  Howard C. Herbert ,  Karanvir Grewal

    IPC分类号： H04L29/06

    CPC分类号： H04L63/20 ,  H04L63/105 ,  H04L63/1408

    摘要： Embodiments of the inventions are generally directed to methods, apparatuses, and systems for the dynamic evaluation and delegation of network access control. In an embodiment, a platform includes a switch to control a network connection and an endpoint enforcement engine coupled with the switch. The endpoint enforcement engine may be capable of dynamically switching among a number of network access control modes responsive to an instruction received from the network connection.

    摘要翻译： 本发明的实施例一般涉及用于动态评估和授权网络访问控制的方法，装置和系统。 在一个实施例中，平台包括用于控制网络连接的开关和与开关耦合的端点执行引擎。 端点执行引擎可以响应于从网络连接接收的指令而能够在多个网络访问控制模式之间动态切换。

    METHODS, APPARATUSES, AND SYSTEMS FOR THE DYNAMIC EVALUATION AND DELEGATION OF NETWORK ACCESS CONTROL
    3.
    发明申请
    METHODS, APPARATUSES, AND SYSTEMS FOR THE DYNAMIC EVALUATION AND DELEGATION OF NETWORK ACCESS CONTROL 有权
    动态评估和网络访问控制代码的方法，设备和系统

    公开(公告)号：US20130276052A1

    公开(公告)日：2013-10-17

    申请号：US12901349

    申请日：2010-10-08

    申请人： Howard C. Herbert ,  Karanvir Grewal ,  Ned M. Smith

    发明人： Howard C. Herbert ,  Karanvir Grewal ,  Ned M. Smith

    IPC分类号： H04L29/06

    CPC分类号： H04L63/20 ,  H04L63/105 ,  H04L63/1408

    摘要： Embodiments of the inventions are generally directed to methods, apparatuses, and systems for the dynamic evaluation and delegation of network access control. In an embodiment, a platform includes a switch to control a network connection and an endpoint enforcement engine coupled with the switch. The endpoint enforcement engine may be capable of dynamically switching among a number of network access control modes responsive to an instruction received from the network connection.

    摘要翻译： 本发明的实施例一般涉及用于动态评估和授权网络访问控制的方法，装置和系统。 在一个实施例中，平台包括用于控制网络连接的开关和与开关耦合的端点执行引擎。 端点执行引擎可以响应于从网络连接接收的指令而能够在多个网络访问控制模式之间动态切换。

    METHOD AND APPARATUS FOR SECURE NETWORK ENCLAVES
    5.
    发明申请
    METHOD AND APPARATUS FOR SECURE NETWORK ENCLAVES 有权
    用于安全网络包装的方法和装置

    公开(公告)号：US20090210699A1

    公开(公告)日：2009-08-20

    申请号：US12032618

    申请日：2008-02-15

    申请人： Karanvir Grewal ,  Men Long ,  Prashant Dewan

    发明人： Karanvir Grewal ,  Men Long ,  Prashant Dewan

    IPC分类号： H04L9/32

    CPC分类号： H04L63/061 ,  H04L9/083 ,  H04L9/321 ,  H04L9/3247

    摘要： Methods and apparatus are disclosed to provide for security within a network enclave. In one embodiment authentication logic initiates authentication with a central network authority. Packet processing logic receives a key and an identifier from the central network authority. Security protocol logic then establishes a client-server security association through a communication that includes a client identifier and an encrypted portion and/or an authorization signature, wherein a client authorization key allocated by the central network authority can be reproduced by a server, other than said central network authority, from the client identifier and a derivation key provided to the server by the central network authority to decrypt the encrypted portion and/or to validate the communication using the authorization signature. The server may also provide the client with new session keys and/or new client session identifiers using server-generated derivation keys if desired, protecting these with the client authorization key.

    摘要翻译： 公开了提供网络飞地内的安全性的方法和装置。 在一个实施例中，认证逻辑启动与中央网络授权机构的认证。 分组处理逻辑从中央网络机构接收密钥和标识符。 然后，安全协议逻辑通过包括客户端标识符和加密部分和/或授权签名的通信来建立客户机 - 服务器安全关联，其中由中央网络机构分配的客户机授权密钥可以由服务器再现，除了 所述中央网络机构根据客户端标识符和由中央网络机构提供给服务器的导出密钥来解密加密部分和/或使用授权签名验证通信。 如果需要，服务器还可以使用服务器生成的导出密钥向客户端提供新的会话密钥和/或新的客户端会话标识符，并用客户端授权密钥来保护它们。

    END-TO-END NETWORK SECURITY WITH TRAFFIC VISIBILITY
    6.
    发明申请
    END-TO-END NETWORK SECURITY WITH TRAFFIC VISIBILITY 审中-公开
    具有交通可见性的端到端网络安全

    公开(公告)号：US20090119510A1

    公开(公告)日：2009-05-07

    申请号：US11935783

    申请日：2007-11-06

    申请人： Men Long ,  Jesse Walker ,  David Durham ,  Marc Millier ,  Karanvir Grewal ,  Prashant Dewan ,  Uday Savagaonkar ,  Steven D. Williams

    发明人： Men Long ,  Jesse Walker ,  David Durham ,  Marc Millier ,  Karanvir Grewal ,  Prashant Dewan ,  Uday Savagaonkar ,  Steven D. Williams

    IPC分类号： H04L9/32

    CPC分类号： H04L63/0428 ,  H04L9/0631 ,  H04L9/3242 ,  H04L63/08 ,  H04L63/1466 ,  H04L63/168 ,  H04L2209/12 ,  H04L2209/38

    摘要： End-to-end security between clients and a server, and traffic visibility to intermediate network devices, achieved through combined mode, single pass encryption and authentication using two keys is disclosed. In various embodiments, a combined encryption-authentication unit includes a cipher unit and an authentication unit coupled in parallel to the cipher unit, and generates an authentication tag using an authentication key in parallel with the generation of the cipher text using an encryption key, where the authentication and encryption key have different key values. In various embodiments, the cipher unit operates in AES counter mode, and the authentication unit operates in parallel, in AES-GMAC mode Using a two key, single pass combined mode algorithm preserves network performance using a limited number of HW gates, while allowing an intermediate device access to the encryption key for deciphering the data, without providing that device the ability to compromise data integrity, which is preserved between the end to end devices.

    摘要翻译： 公开了客户机与服务器之间的端到端安全性，以及通过组合模式，单程加密和使用两个密钥的认证实现的对中间网络设备的流量可见性。 在各种实施例中，组合加密认证单元包括与密码单元并行耦合的密码单元和认证单元，并且使用加密密钥与密文生成并行地使用认证密钥生成认证标签，其中 认证和加密密钥具有不同的密钥值。 在各种实施例中，密码单元以AES计数器模式运行，并且认证单元以AES-GMAC模式并行操作。使用双键单通组合模式算法使用有限数量的HW门保留网络性能，同时允许 中间设备访问用于解密数据的加密密钥，而不提供该设备损害数据完整性的能力，这在端到端设备之间保留。

    Detection of network environment for network access control
    10.
    发明授权
    Detection of network environment for network access control 有权
    网络访问控制网络环境检测

    公开(公告)号：US07814531B2

    公开(公告)日：2010-10-12

    申请号：US11478987

    申请日：2006-06-30

    申请人： Hormuzd Khosravi ,  Karanvir Grewal ,  Ahuva Kroiser ,  Avigdor Eldar

    发明人： Hormuzd Khosravi ,  Karanvir Grewal ,  Ahuva Kroiser ,  Avigdor Eldar

    IPC分类号： H04L9/00 ,  H04L12/22

    CPC分类号： H04L63/102 ,  H04L61/2015 ,  H04L63/0227 ,  H04L63/101 ,  H04L63/12

    摘要： A method and apparatus for detection of network environment to aid policy selection for network access control. An embodiment of a method includes receiving a request to connect a device to a network and, if a security policy is received for the connection of the device, applying the policy for the device. If a security policy for the connection of the device is not received, the domain of the device is determined by determining whether the device is in an enterprise domain and determining whether the device is in a network access control domain, which allows selection of an appropriate domain/environment specific policy.

    摘要翻译： 一种检测网络环境以帮助网络访问控制的策略选择的方法和装置。 一种方法的实施例包括接收将设备连接到网络的请求，并且如果接收到用于设备的连接的安全策略，则应用所述设备的策略。 如果没有接收到用于连接设备的安全策略，则通过确定设备是否在企业域中并确定设备是否在网络访问控制域中来确定设备的域，这允许选择适当的 域/环境特定策略。