利索-全球专利检索

  1. 登录
  2. 注册

搜索结果

36 条记录 (耗时 0.02 秒)

    L2/L3 multi-mode switch including policy processing
    1.
    发明授权
    L2/L3 multi-mode switch including policy processing 有权
    L2 / L3多模切换包括策略处理

    公开(公告)号：US08594085B2

    公开(公告)日：2013-11-26

    申请号：US11734198

    申请日：2007-04-11

    申请人： Nir Zuk ,  Yuming Mao ,  Haoying Xu ,  Arnit Green

    发明人： Nir Zuk ,  Yuming Mao ,  Haoying Xu ,  Arnit Green

    IPC分类号： H04L12/28

    CPC分类号： H04L69/22 ,  H04L45/04 ,  H04L45/308 ,  H04L45/54 ,  H04L45/56 ,  H04L45/60 ,  H04L45/66 ,  H04L45/745

    摘要： Methods and apparatus for processing data packets in a computer network are described. One general method includes receiving a data packet; examining the data packet to classify the data packet including classifying the data packet as a L2 or L3 packet and including determining at least one zone associated with the packet; processing the packet in accordance with one or more policies associated with the zone; determining forwarding information associated with the data packet; and if one or more policies permit, forwarding the data packet toward an intended destination using the forwarding information.

    摘要翻译： 描述了在计算机网络中处理数据分组的方法和装置。 一种一般方法包括接收数据包; 检查所述数据分组以对所述数据分组进行分类，包括将所述数据分组分类为L2或L3分组，并且包括确定与所述分组相关联的至少一个区域; 根据与该区域相关联的一个或多个策略来处理分组; 确定与所述数据分组相关联的转发信息; 并且如果一个或多个策略允许，则使用转发信息将数据分组转发到预期目的地。

    L2/L3 MULTI-MODE SWITCH INCLUDING POLICY PROCESSING
    2.
    发明申请
    L2/L3 MULTI-MODE SWITCH INCLUDING POLICY PROCESSING 有权
    L2 / L3多模式开关，包括政策处理

    公开(公告)号：US20080253366A1

    公开(公告)日：2008-10-16

    申请号：US11734198

    申请日：2007-04-11

    申请人： Nir Zuk ,  Yuming Mao ,  Haoying Xu ,  Arnit Green

    发明人： Nir Zuk ,  Yuming Mao ,  Haoying Xu ,  Arnit Green

    IPC分类号： H04L12/56

    CPC分类号： H04L69/22 ,  H04L45/04 ,  H04L45/308 ,  H04L45/54 ,  H04L45/56 ,  H04L45/60 ,  H04L45/66 ,  H04L45/745

    摘要： Methods and apparatus for processing data packets in a computer network are described. One general method includes receiving a data packet; examining the data packet to classify the data packet including classifying the data packet as a L2 or L3 packet and including determining at least one zone associated with the packet; processing the packet in accordance with one or more policies associated with the zone; determining forwarding information associated with the data packet; and if one or more policies permit, forwarding the data packet toward an intended destination using the forwarding information.

    摘要翻译： 描述了在计算机网络中处理数据分组的方法和装置。 一种一般方法包括接收数据包; 检查所述数据分组以对所述数据分组进行分类，包括将所述数据分组分类为L2或L3分组，并且包括确定与所述分组相关联的至少一个区域; 根据与该区域相关联的一个或多个策略来处理分组; 确定与所述数据分组相关联的转发信息; 并且如果一个或多个策略允许，则使用转发信息将数据分组转发到预期目的地。

    Security processing in active security devices
    3.
    发明授权
    Security processing in active security devices 有权
    主动安全设备中的安全处理

    公开(公告)号：US08769664B1

    公开(公告)日：2014-07-01

    申请号：US12363102

    申请日：2009-01-30

    申请人： Nir Zuk ,  Wilson Xu ,  Yuming Mao

    发明人： Nir Zuk ,  Wilson Xu ,  Yuming Mao

    IPC分类号： G06F9/00 ,  G06F15/16 ,  H04L29/06

    CPC分类号： H04L63/02 ,  H04L63/0236

    摘要： Methods, systems, and apparatus, including computer program products, featuring receiving at a first security device a packet. The first security device determines that the packet is associated with a flow assigned to a distinct second security device. The first security device sends the packet to the second security device. After the second security device performs security processing using the packet, the first security device receives from the second security device a message regarding the packet. The first security device transmits the packet.

    摘要翻译： 方法，系统和装置，包括计算机程序产品，其特征在于在第一安全装置处接收分组。 第一安全设备确定分组与分配给不同的第二安全设备的流相关联。 第一个安全设备将数据包发送到第二个安全设备。 在第二安全设备使用该分组执行安全处理之后，第一安全设备从第二安全设备接收关于分组的消息。 第一安全设备发送数据包。

    Intelligent integrated network security device
    4.
    发明授权
    Intelligent integrated network security device 失效
    智能集成网络安全设备

    公开(公告)号：US08726016B2

    公开(公告)日：2014-05-13

    申请号：US13616067

    申请日：2012-09-14

    申请人： Nir Zuk

    发明人： Nir Zuk

    IPC分类号： H04L29/06

    CPC分类号： H04L63/02 ,  H04L63/0209 ,  H04L63/0218 ,  H04L63/0227 ,  H04L63/0254 ,  H04L63/0263 ,  H04L63/12 ,  H04L63/1416 ,  H04L63/1441 ,  H04L69/22

    摘要： Methods, computer program products and apparatus for processing data packets are described. Methods include receiving the data packet, examining the data packet, determining a single flow record associated with the packet and extracting flow instructions for two or more devices from the single flow record.

    摘要翻译： 描述了处理数据包的方法，计算机程序产品和装置。 方法包括接收数据分组，检查数据分组，确定与分组相关联的单个流记录，并从单流记录中提取两个或多个设备的流指令。

    MANAGING NETWORK DEVICES
    5.
    发明申请
    MANAGING NETWORK DEVICES 有权
    管理网络设备

    公开(公告)号：US20120166599A1

    公开(公告)日：2012-06-28

    申请号：US13335745

    申请日：2011-12-22

    申请人： Nir Zuk ,  Ravi Ithal ,  Anupam Bharali

    发明人： Nir Zuk ,  Ravi Ithal ,  Anupam Bharali

    IPC分类号： G06F15/177

    CPC分类号： H04L41/08 ,  H04L12/4679 ,  H04L41/0853 ,  H04L63/0272 ,  H04L67/10

    摘要： Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for managing network devices. A central management system stores shared configuration objects in a central configuration database. A network device stores shared configuration objects and device-specific configuration objects in a local configuration database. The local configuration database's shared configuration objects correspond to shared configuration objects in the central configuration database. The network device can be configured locally or using the central management system.

    摘要翻译： 方法，系统和装置，包括在计算机存储介质上编码的计算机程序，用于管理网络设备。 中央管理系统将共享配置对象存储在中央配置数据库中。 网络设备将共享的配置对象和设备特定的配置对象存储在本地配置数据库中。 本地配置数据库的共享配置对象与中央配置数据库中的共享配置对象相对应。 网络设备可以在本地配置或使用中央管理系统。

    System for securing the flow of and selectively modifying packets in a computer network
    8.
    发明授权
    System for securing the flow of and selectively modifying packets in a computer network 失效
    用于保护计算机网络中的数据包的流量和选择性修改的系统

    公开(公告)号：US5835726A

    公开(公告)日：1998-11-10

    申请号：US664839

    申请日：1996-06-17

    申请人： Gil Shwed ,  Shlomo Kramer ,  Nir Zuk ,  Gil Dogon ,  Ehud Ben-Reuven

    发明人： Gil Shwed ,  Shlomo Kramer ,  Nir Zuk ,  Gil Dogon ,  Ehud Ben-Reuven

    IPC分类号： H04L9/32 ,  H04L29/06 ,  G06F13/36 ,  G06F15/401

    CPC分类号： H04L63/0227 ,  H04L29/06 ,  H04L63/0263 ,  H04L63/0272 ,  H04L63/123 ,  H04L63/126 ,  H04L9/3247

    摘要： The present invention discloses a novel system for controlling the inbound and outbound data packet flow in a computer network. By controlling the packet flow in a computer network, private networks can be secured from outside attacks in addition to controlling the flow of packets from within the private network to the outside world. A user generates a rule base which is then converted into a set of filter language instruction. Each rule in the rule base includes a source, destination, service, whether to accept or reject the packet and whether to log the event. The set of filter language instructions are installed and execute on inspection engines which are placed on computers acting as firewalls. The firewalls are positioned in the computer network such that all traffic to and from the network to be protected is forced to pass through the firewall. Thus, packets are filtered as they flow into and out of the network in accordance with the rules comprising the rule base. The inspection engine acts as a virtual packet filtering machine which determines on a packet by packet basis whether to reject or accept a packet. If a packet is rejected, it is dropped. If it is accepted, the packet may then be modified. Modification may include encryption, decryption, signature generation, signature verification or address translation. All modifications are performed in accordance with the contents of the rule base. The present invention provides additional security to a computer network by encrypting communications between two firewalls between a client and a firewall. This permits the use of insecure public networks in constructing a WAN that includes both private and public network segments, thus forming a virtual private network.

    摘要翻译： 本发明公开了一种用于控制计算机网络中的入站和出站数据分组流的新颖系统。 通过控制计算机网络中的分组流，除了控制从专用网络到外界的分组流之外，还可以保护专用网络免受外部攻击。 用户生成规则库，然后将其转换成一组过滤器语言指令。 规则库中的每个规则都包括源，目标，服务，是接受还是拒绝数据包以及是否记录事件。 一组过滤器语言指令在安装在作为防火墙的计算机上的检测引擎上安装和执行。 防火墙位于计算机网络中，以便所有来往和来自网络的流量都被强制通过防火墙。 因此，根据包括规则库的规则，分组在流入和流出网络时被过滤。 检查引擎作为虚拟分组过滤机，其基于分组确定是否拒绝或接受分组。 如果数据包被拒绝，则丢弃。 如果接受，则可以修改分组。 修改可以包括加密，解密，签名生成，签名验证或地址转换。 所有修改都是根据​​规则库的内容进行的。 本发明通过加密客户端和防火墙之间的两个防火墙之间的通信来向计算机网络提供额外的安全性。 这允许在构建包括私有和公共网段的WAN的情况下使用不安全的公共网络，从而形成虚拟专用网络。

    Identification of malware sites using unknown URL sites and newly registered DNS addresses
    9.
    发明授权
    Identification of malware sites using unknown URL sites and newly registered DNS addresses 有权
    使用未知网址和新注册的DNS地址识别恶意软件站点

    公开(公告)号：US08966625B1

    公开(公告)日：2015-02-24

    申请号：US13115014

    申请日：2011-05-24

    申请人： Nir Zuk ,  Renzo Lazzarato ,  Huagang Xie

    发明人： Nir Zuk ,  Renzo Lazzarato ,  Huagang Xie

    IPC分类号： G06F11/00

    CPC分类号： H04L63/145 ,  G06F21/57 ,  G06F2221/034 ,  G06F2221/2111 ,  H04L63/1408 ,  H04L63/168

    摘要： In some embodiments, identification of malware sites using unknown URL sites and newly registered DNS addresses includes performing a heuristic analysis for information associated with a network site; and assigning a score based on the heuristic analysis, in which the score indicates whether the network site is potentially malicious. In some embodiments, the system includes a security appliance that is in communication with the Internet. In some embodiments, the network site is associated with a network domain and/or a network uniform resource locator (URL). In some embodiments, performing a heuristic analysis for information associated with a network site further includes determining if a network site has recently been registered. In some embodiments, performing a heuristic analysis for information associated with a network site further includes determining if a network site is associated with recently changed DNS information. In some embodiments, performing a heuristic analysis for information associated with a network site further includes determining geographical information as well as an IP network location associated with the network site.

    摘要翻译： 在一些实施例中，使用未知URL站点和新注册的DNS地址来识别恶意软件站点包括对与网络站点相关联的信息执行启发式分析; 并且基于启发式分析来分配分数，其中分数指示网络站点是否是潜在的恶意的。 在一些实施例中，系统包括与互联网通信的安全设备。 在一些实施例中，网络站点与网络域和/或网络统一资源定位符（URL）相关联。 在一些实施例中，对与网络站点相关联的信息执行启发式分析还包括确定网络站点是否最近已被注册。 在一些实施例中，对与网络站点相关联的信息执行启发式分析还包括确定网络站点是否与最近更改的DNS信息相关联。 在一些实施例中，对与网络站点相关联的信息执行启发式分析还包括确定地理信息以及与网络站点相关联的IP网络位置。

    Identifying user names and enforcing policies
    10.
    发明授权
    Identifying user names and enforcing policies 有权
    识别用户名和执行策略

    公开(公告)号：US08677447B1

    公开(公告)日：2014-03-18

    申请号：US13115508

    申请日：2011-05-25

    申请人： Nir Zuk ,  Song Wang

    发明人： Nir Zuk ,  Song Wang

    IPC分类号： H04L29/06 ,  G06F15/16

    CPC分类号： H04L63/02 ,  H04L63/029 ,  H04L67/06 ,  H04L67/22

    摘要： Techniques for identifying user names and enforcing policies are disclosed. An external user account associated with an external application request is identified. A policy is applied based on the identified external user account. One example policy is that access to the external application (via the external user account) should be blocked.

    摘要翻译： 公开了用于识别用户名和执行策略的技术。 识别与外部应用程序请求相关联的外部用户帐户。 基于所识别的外部用户帐户应用策略。 一个示例性的策略是，应该阻止访问外部应用程序（通过外部用户帐户）。