专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

41. 发明申请

US20050229244A1 Method and apparatus for preventing network attacks by authenticating internet control message protocol packets 有权
标题翻译：通过认证互联网控制消息协议包来防止网络攻击的方法和装置
公开(公告)号：US20050229244A1
公开(公告)日：2005-10-13
申请号：US10820980
申请日：2004-04-07
申请人： Amol Khare , Mitesh Dalal , Anantha Ramaiah , Sharad Ahlawat
发明人： Amol Khare , Mitesh Dalal , Anantha Ramaiah , Sharad Ahlawat
IPC分类号： G06F11/30 , G06F12/14 , H04L9/00 , H04L9/32 , H04L29/06
CPC分类号： H04L63/12 , H04L63/1458 , H04L63/1466
摘要： A method of preventing an attack on a network, the method comprising the computer-implemented steps of receiving an ICMP packet that includes a copy of a header associated with a connection in a connection-oriented transport protocol; obtaining a packet sequence value from the header; determining if the packet sequence value is valid; and updating a parameter value associated with the transport protocol connection only if the packet sequence value is determined to be valid. Use of the disclosed method enables authenticating ICMP packets so that responsive measures of a network element, such as adjusting an MTU value, are performed only when the ICMP packet is determined to be authentic.
摘要翻译：一种防止对网络的攻击的方法，所述方法包括计算机实现的步骤，用于接收包括与面向连接的传输协议中的连接相关联的报头的副本的ICMP分组; 从头部获取分组序列值; 确定分组序列值是否有效; 以及仅当所述分组序列值被确定为有效时，才更新与所述传输协议连接相关联的参数值。使用所公开的方法使得能够认证ICMP分组，使得仅当确定ICMP分组是可信的时候才执行诸如调整MTU值的网元的响应度量。

42. 发明申请

US20050216954A1 Preventing network reset denial of service attacks using embedded authentication information 有权
标题翻译：使用嵌入式认证信息防止网络重置拒绝服务攻击
公开(公告)号：US20050216954A1
公开(公告)日：2005-09-29
申请号：US10842015
申请日：2004-05-06
申请人： Anantha Ramaiah , Shrirang Bage , Amol Khare , Mitesh Dalal
发明人： Anantha Ramaiah , Shrirang Bage , Amol Khare , Mitesh Dalal
IPC分类号： H04L1/16 , H04L9/00 , H04L29/06
CPC分类号： H04L63/1458 , H04L1/16 , H04L63/1466
摘要： Approaches for preventing TCP RST attacks intended to cause denial of service in packet-switched networks are disclosed. In one approach, upon receiving a TCP RST packet, an endpoint node determines whether the TCP segment contains valid authentication information. The TCP RST segment is accepted and the TCP connection is closed only when the authentication information is valid. Authentication information may comprise a reset type values, and either initial sequence numbers of both endpoints, or a copy of a TCP header and options values previously sent by the endpoint node that is performing the authentication. Thus, attacks are thwarted because an attacker cannot know or reasonably guess the required authentication information.
摘要翻译：公开了用于防止在分组交换网络中导致拒绝服务的TCP RST攻击的方法。在一种方法中，在接收到TCP RST分组时，端点节点确定TCP分段是否包含有效的认证信息。 TCP RST段被接受，只有认证信息有效时才关闭TCP连接。认证信息可以包括复位类型值，以及两个端点的初始序列号，或TCP头部的副本以及由执行认证的端点节点先前发送的选项值。因此，攻击是挫败的，因为攻击者无法知道或合理地猜测所需的身份验证信息。

43. 发明申请

US20130282884A1 ENABLING APPLICATIONS IN A MULTI-TRANSPORT STACK ENVIRONMENT 有权
标题翻译：在多个运输堆栈环境中实现应用
公开(公告)号：US20130282884A1
公开(公告)日：2013-10-24
申请号：US13450744
申请日：2012-04-19
申请人： Balachander Chandrasekaran , Anantha Ramaiah , Manoj Kumar Pandey , Siva Yaragalla
发明人： Balachander Chandrasekaran , Anantha Ramaiah , Manoj Kumar Pandey , Siva Yaragalla
IPC分类号： G06F15/173
CPC分类号： H04L49/70 , H04L45/38 , H04L61/103
摘要： In one embodiment, an apparatus includes a first transport stack, a virtual network interface controller (VNIC), and a second transport stack. The first transport stack is associated with an Internetwork Operating System (IOS), as well as with a plurality of interface-based Internet Protocol (IP) addresses and a plurality of IP addresses. The VNIC is configured to dynamically provision the plurality of interface-based IP addresses and the plurality of IP addresses. The second transport stack is associated with a kernel, and configured to communicate with a first application. The MS is configured to enable the first application to share the plurality of IP addresses and the plurality if IP addresses with a plurality of applications.
摘要翻译：在一个实施例中，装置包括第一传输堆栈，虚拟网络接口控制器（VNIC）和第二传输栈。第一传输堆栈与互联网操作系统（IOS）以及多个基于接口的因特网协议（IP）地址和多个IP地址相关联。 VNIC被配置为动态地配置多个基于接口的IP地址和多个IP地址。第二个传输堆栈与内核相关联，并配置为与第一个应用程序进行通信。 MS被配置为使得第一应用能够与多个应用共享多个IP地址和多个IP地址。

44. 发明授权

US08074275B2 Preventing network denial of service attacks by early discard of out-of-order segments 有权
标题翻译：通过早期丢弃无序段来防止网络拒绝服务攻击
公开(公告)号：US08074275B2
公开(公告)日：2011-12-06
申请号：US11345999
申请日：2006-02-01
申请人： Anantha Ramaiah , Mahadev Somasundaram , Senthil Sivakumar
发明人： Anantha Ramaiah , Mahadev Somasundaram , Senthil Sivakumar
IPC分类号： H04L12/00 , H04L12/28 , H04L29/14
CPC分类号： H04L47/10 , H04L45/54 , H04L45/58 , H04L63/1458 , H04L69/16 , H04L69/163
摘要： A method of preventing network denial of service attacks by early discard of out-of-order segments comprises creating a reassembly queue for a connection between a first network node and a second network node, wherein the connection has been established based on a transport-layer network protocol, the reassembly queue having a size based on a buffer size of an input interface with which the connection is associated. As out-of-order data segments arrive on the connection, and before other processing of the segments, whether the reassembly queue is full is determined, and the out-of-order segments are discarded if the reassembly queue is full. The size of the reassembly queue is automatically changed in response to one or more changes in any of network conditions and device resources.
摘要翻译：通过早期丢弃无序段来防止网络拒绝服务攻击的方法包括为第一网络节点和第二网络节点之间的连接创建重组队列，其中已经基于传输层建立了连接网络协议，所述重组队列具有基于与所述连接相关联的输入接口的缓冲器大小的大小。由于无序数据段到达连接，并且在段的其他处理之前，确定重新组装队列是否已满，并且如果重新组装队列已满，则会丢弃无序段。响应于任何网络条件和设备资源中的一个或多个更改，自动更改重组队列的大小。

45. 发明申请

US20110093591A1 Detecting Unavailable Network Connections 有权
标题翻译：检测不可用的网络连接
公开(公告)号：US20110093591A1
公开(公告)日：2011-04-21
申请号：US12976923
申请日：2010-12-22
申请人： Mitesh Dalal , Anantha Ramaiah , Ruchi Kapoor , Chandrashekhar Appanna
发明人： Mitesh Dalal , Anantha Ramaiah , Ruchi Kapoor , Chandrashekhar Appanna
IPC分类号： G06F15/173
CPC分类号： H04L67/1048 , H04J3/14 , H04L1/187 , H04L45/02 , H04L45/22 , H04L45/28 , H04L45/586 , H04L67/104 , H04L67/1095 , H04L67/14 , H04L69/14 , H04L69/16 , H04L69/40
摘要： A method for detecting unavailable network connections comprises, at a first data processing node that is hosting a transport protocol connection that uses a plurality of sequence values to identify messages sent to a peer node, wherein the first node is communicatively coupled to a second data processing node serving as a redundant backup, periodically sending a checkpoint sequence value to the second node; detecting that either the transport protocol connection or a process using the transport protocol connection is unavailable, without use of a timeout; and in response thereto, sending a notification to the peer node, wherein the notification includes the checkpoint sequence value. One embodiment provides for rapidly detecting and responding to failure of a TCP process without using long timeouts as conventionally provided in long-lived applications that run on top of TCP.
摘要翻译：一种用于检测不可用网络连接的方法包括：在承载使用多个序列值以识别发送到对等节点的消息的传输协议连接的第一数据处理节点处，其中所述第一节点通信地耦合到第二数据处理节点用作冗余备份，周期性地向第二节点发送检查点序列值; 检测传输协议连接或使用传输协议连接的进程不可用，而不使用超时; 并且响应于此，向所述对等节点发送通知，其中所述通知包括所述检查点序列值。一个实施例提供了快速检测和响应TCP过程的故障，而不需要在TCP上运行的长寿命应用程序中常规提供的长时间超时。

46. 发明授权

US07688819B2 Faster routing protocol convergence using efficient message markup 有权
标题翻译：使用有效的消息标记更快地路由协议收敛
公开(公告)号：US07688819B2
公开(公告)日：2010-03-30
申请号：US11369262
申请日：2006-03-06
申请人： Anantha Ramaiah , Keyur Patel , David D. Ward , Robert Raszuk
发明人： Anantha Ramaiah , Keyur Patel , David D. Ward , Robert Raszuk
IPC分类号： H04L12/28 , H04L12/56
CPC分类号： H04L45/04 , H04L45/02
摘要： Devices executing routing protocols can mark routing protocol messages as urgent so that peer devices are signaled to consume the messages on an expedited basis. Performance of routing protocols improves as a result; for example, Border Gateway Protocol convergence time is reduced. An example router comprises a network interface, a processor, a transport layer protocol module that implements a transport layer network protocol, a routing protocol module that implements a network packet routing protocol and sends peering session messages over transport layer connections, and instructions to perform providing a first routing protocol message to the transport layer protocol module that comprises urgent data at least in part; requesting the transport layer protocol module to mark, as urgent, one or more data segments that carry the first routing protocol message; marking, as urgent, one or more segments that carry the first routing protocol message; and sending the segments to peer devices over the connections.
摘要翻译：执行路由协议的设备可以将路由协议消息标记为紧急，以便对等设备进行信号通知以快速消费消息。因此，路由协议的性能得到改善; 例如，边界网关协议收敛时间减少。示例路由器包括网络接口，处理器，实现传输层网络协议的传输层协议模块，实现网络分组路由协议并通过传输层连接发送对等会话消息的路由协议模块，以及执行提供的指令至少部分地包括紧急数据的传输层协议模块的第一路由协议消息; 请求传输层协议模块紧急地标记携带第一路由协议消息的一个或多个数据段; 标记为紧急的携带第一路由协议消息的一个或多个段; 并通过连接将段发送到对等设备。

47. 发明授权

US07593331B2 Enhancing transmission reliability of monitored data 有权
标题翻译：提高监控数据的传输可靠性
公开(公告)号：US07593331B2
公开(公告)日：2009-09-22
申请号：US11655003
申请日：2007-01-17
申请人： Alpesh Patel , Anantha Ramaiah , Syam Sundar Appala , Praveen Joshi
发明人： Alpesh Patel , Anantha Ramaiah , Syam Sundar Appala , Praveen Joshi
IPC分类号： H04L12/26 , H04L12/54 , G06F15/16 , G06F11/00
CPC分类号： H04L69/16 , H04L1/1874 , H04L47/14 , H04L47/19 , H04L47/27 , H04L47/28 , H04L47/29 , H04L49/90 , H04L69/163 , H04W80/06
摘要： In one embodiment, an apparatus comprises logic encoded in one or more tangible media for enhancing transmission reliability of monitored data. The logic is operable to receive a plurality of segments for transmission over a TCP connection to a network node, where the TCP connection is associated with a transmit queue and a retransmit queue. The logic is also operable to detect a transmission anomaly on the TCP connection to the network node, and in response to detecting the transmission anomaly, is operable to perform any one of: store segments into a persistent buffer prior to transferring the segments into the transmit queue; copy segments from the retransmit queue into the persistent buffer, where the segments have been transmitted but not yet acknowledged by the network node; and copy segments from the transmit queue into the persistent buffer, where the segments have not yet been transmitted to the network node.
摘要翻译：在一个实施例中，一种装置包括在一个或多个有形介质中编码的逻辑，用于增强被监视数据的传输可靠性。该逻辑可操作以接收多个段以便通过TCP连接传输到网络节点，其中TCP连接与发送队列和重发队列相关联。该逻辑还可操作用于检测到与网络节点的TCP连接上的传输异常，并且响应于检测到传输异常，可操作以执行以下任何一个：在将段传送到传输之前将段存储到永久缓冲器中队列; 将所述重传队列中的段复制到所述持久缓冲器中，其中所述段已被发送但尚未被所述网络节点确认; 并将段从传输队列复制到持久缓冲区中，其中段尚未传送到网络节点。

48. 发明申请

US20090219805A1 COOPERATIVE TCP / BGP WINDOW MANAGEMENT FOR STATEFUL SWITCHOVER 有权
标题翻译：合作TCP / BGP窗口管理用于状态切换
公开(公告)号：US20090219805A1
公开(公告)日：2009-09-03
申请号：US12418913
申请日：2009-04-06
申请人： Chandrashekhar Appanna , Anantha Ramaiah , Lester S. Bird
发明人： Chandrashekhar Appanna , Anantha Ramaiah , Lester S. Bird
IPC分类号： G06F11/00
CPC分类号： H04L47/27 , H04L45/04 , H04L45/586 , H04L69/40
摘要： A system and method for performing stateful switchover with reduced data, such as only metadata about a TCP window state. The metadata comprises a size of TCP packets used to send BGP messages, and which of those have been acknowledged by a neighbor networking device. The networking device comprises a BGP module to establish a BGP session between the networking device and a neighbor networking device. An active transport module within the networking device synchronizes with a standby transport module within the networking device by sending the metadata. A fault detector within the networking device initiates a stateful switchover from the active transport module to the standby transport module responsive to detecting a failure of a process and/or processor. The standby transport module uses the metadata to determine stateful metadata for preserving current BGP and TCP sessions of the networking device.
摘要翻译：一种用简单数据进行状态切换的系统和方法，例如仅关于TCP窗口状态的元数据。元数据包括用于发送BGP消息的TCP数据包的大小，以及哪些哪些已被邻居网络设备确认。网络设备包括BGP模块，用于在组网设备和邻居网络设备之间建立BGP会话。网络设备内的主动传输模块通过发送元数据与网络设备内的备用传输模块进行同步。响应于检测到过程和/或处理器的故障，网络设备内的故障检测器启动从主动传输模块到备用传输模块的状态切换。备用传输模块使用元数据来确定用于保留网络设备的当前BGP和TCP会话的状态元数据。

49. 发明授权

US07545810B2 Approaches for switching transport protocol connection keys 有权
标题翻译：切换传输协议连接密钥的方法
公开(公告)号：US07545810B2
公开(公告)日：2009-06-09
申请号：US11173690
申请日：2005-07-01
申请人： Satish K. Mynam , Anantha Ramaiah , Chandrashekhar Appanna , Keyur Patel
发明人： Satish K. Mynam , Anantha Ramaiah , Chandrashekhar Appanna , Keyur Patel
IPC分类号： H04L12/56 , H04L9/14
CPC分类号： H04L63/123 , H04L9/0891 , H04L9/3239 , H04L9/3247 , H04L2209/38 , H04L2209/80
摘要： Approaches are disclosed for switching transport protocol connection keys. In a transport protocol module configured to use a first key for signing messages associated with a transport protocol connection, a second key is configured for the transport protocol connection. A first message that is associated with the transport protocol connection is received. The first message includes a first signature. A first and a second message digests are computed for the first message, where the first message digest is based on the first key and the second message digest is based on the second key. The first message is validated if the first signature in the first message matches any one of the first message digest and the second message digest.
摘要翻译：公开了用于切换传输协议连接密钥的方法。在被配置为使用第一密钥来签署与传输协议连接相关联的消息的传输协议模块中，为传输协议连接配置第二密钥。接收与传输协议连接相关联的第一消息。第一个消息包括第一个签名。针对第一消息计算第一和第二消息摘要，其中第一消息摘要基于第一密钥，第二消息摘要基于第二密钥。如果第一消息中的第一个签名与第一个消息摘要和第二个消息摘要中的任何一个匹配，则验证第一个消息。

50. 发明授权

US07412600B2 Approaches for automatically switching message authentication keys 有权
标题翻译：自动切换消息认证密钥的方法
公开(公告)号：US07412600B2
公开(公告)日：2008-08-12
申请号：US11261683
申请日：2005-10-28
申请人： John C. Wong , Anantha Ramaiah , Amol Khare , Mitesh Dalal , Shrirang Bage , Lin Han
发明人： John C. Wong , Anantha Ramaiah , Amol Khare , Mitesh Dalal , Shrirang Bage , Lin Han
IPC分类号： H04L29/00
CPC分类号： H04L69/16 , H04L63/0846 , H04L63/12 , H04L69/163
摘要： Approaches are disclosed for switching transport protocol connection keys. A method of automatically changing a message authentication key at each of two endpoints of a connection in a telecommunications network comprises testing a sequence value received in each of a plurality of data segments on the connection; and selecting a next message authentication key, from among a plurality of stored message authentication keys, for use in authenticating subsequently received data segments, when the sequence value matches a specified characteristic.
摘要翻译：公开了用于切换传输协议连接密钥的方法。一种在电信网络中的连接的两个端点中的每个端点处自动改变消息认证密钥的方法包括测试在所述连接上的多个数据段中的每一个中接收到的序列值; 以及当所述序列值与特定特征匹配时，从多个存储的消息认证密钥中选择用于认证随后接收的数据段的下一个消息认证密钥。

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式