USRE44701E1 - System and method for an adaptive TCP SYN cookie with time validation - Google Patents

System and method for an adaptive TCP SYN cookie with time validation Download PDF

Info

Publication number
USRE44701E1
USRE44701E1 US13/413,191 US201213413191A USRE44701E US RE44701 E1 USRE44701 E1 US RE44701E1 US 201213413191 A US201213413191 A US 201213413191A US RE44701 E USRE44701 E US RE44701E
Authority
US
United States
Prior art keywords
transition cookie
session
cookie
candidate
transition
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
US13/413,191
Inventor
Lee Chen
Ronald Wai Lun Szeto
Shih-Tsung Hwang
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
A10 Networks Inc
Original Assignee
A10 Networks Inc
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority to US11/358,245 priority Critical patent/US7675854B2/en
Application filed by A10 Networks Inc filed Critical A10 Networks Inc
Priority to US13/413,191 priority patent/USRE44701E1/en
Assigned to A10 NETWORKS, INC. reassignment A10 NETWORKS, INC. CHANGE OF ADDRESS Assignors: A10 NETWORKS, INC.
Assigned to ROYAL BANK OF CANADA, AS COLLATERAL AGENT reassignment ROYAL BANK OF CANADA, AS COLLATERAL AGENT SECURITY INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: A10 NETWORKS, INC.
Publication of USRE44701E1 publication Critical patent/USRE44701E1/en
Application granted granted Critical
Assigned to A10 NETWORKS, INC. reassignment A10 NETWORKS, INC. ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: CHEN, LEE, HWANG, SHIH-TSUNG, SZETO, RONALD WAI LUN
Application status is Active legal-status Critical
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00Traffic regulation in packet switching networks
    • H04L47/10Flow control or congestion control
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/14Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441Countermeasures against malicious traffic
    • H04L63/1458Denial of Service

Abstract

Provided is a method and system for TCP SYN cookie validation. The method includes receiving a session SYN packet by a TCP session setup module of a host server, generating a transition cookie including a time value representing the actual time, sending a session SYN/ACK packet, including the transition cookie, in response to the received session SYN packet, receiving a session ACK packet, and determining whether a candidate transition cookie in the received session ACK packet comprises a time value representing a time within a predetermined time interval from the time the session ACK packet is received.

Description

CROSS-REFERENCE TO RELATED PATENTS

This is a reissue application of U.S. Pat. No. 7,675,854 B2, originally issued on Mar. 9, 2010, based on an application that was originally filed on Feb. 21, 2006.

BACKGROUND OF THE INVENTION

When a TCP (Transmission Control Protocol) connection starts, a destination host receives a SYN (synchronize/start) packet from a source host and sends back a SYN ACK (synchronize acknowledge). The destination host normally then waits to receiver an ACK (acknowledge) of the SYN ACK before the connection is established. This is referred to as the TCP “three-way handshake.”

While waiting for the ACK to the SYN ACK, a connection queue of finite size on the destination host keeps track of connections waiting to be completed. This queue typically empties quickly since the ACK is expected to arrive a few milliseconds after the SYN ACK is sent.

A TCP SYN flood attack is a well known denial of service attack that exploits the TCP three-way handshake design by having an attacking source host generate TCP SYN packets with random source addresses toward a victim host. The victim destination host sends a SYN ACK back to the random source address and adds an entry to the connection queue, or otherwise allocates server resources. Since the SYN ACK is destined for an incorrect or non-existent host, the last part of the “three-way handshake” is never completed and the entry remains in the connection queue until a timer expires, typically, for example, for about one minute. By generating phony TCP SYN packets from random IP addresses at a rapid rate, it is possible to fill up the connection queue and deny TCP services (such as e-mail, file transfer, or WWW) to legitimate users. In most instances, there is no easy way to trace the originator of the attack because the IP address of the source is forged. The external manifestations of the problem may include inability to get e-mail, inability to accept connections to WWW or FTP services, or a large number of TCP connections on your host in the state SYN_RCVD.

A malicious client sending high volume of TCP SYN packets without sending the subsequent ACK packets can deplete server resources and severely impact the server's ability to serve its legitimate clients.

Newer operating systems or platforms implement various solutions to minimize the impact of TCP SYN flood attacks. The solutions include better resource management, and the use of a “SYN cookie”.

In an exemplary solution, instead of allocating server resource at the time of receiving a TCP SYN packet, the server sends back a SYN/ACK packet with a specially constructed sequence number known as a SYN cookie. When the server then receives an ACK packet in response to the SYN/ACK packet, the server recovers a SYN cookie from the ACK packet, and validates the recovered SYN cookie before further allocating server resources.

The effectiveness of a solution using a SYN cookie depends on the method with which the SYN cookie is constructed. However, existing solutions using a SYN cookie typically employ a hash function to construct the SYN cookie, which can lead to a high percentage of false validations of the SYN cookie, resulting in less than satisfactory protection again TCP SYN flood attack.

Therefore, there is a need for a better system and method for constructing and validating SYN cookies.

SUMMARY OF THE INVENTION

An aspect of the present invention provides a system for TCP SYN cookie validation. The system includes a host server including a processor and memory. The processor is configured for receiving a session SYN packet, generating a transition cookie, the transition cookie comprising a time value representing the actual time, sending a session SYN/ACK packet, including the transition cookie, in response to the received session SYN packet, receiving a session ACK packet, and determining whether a candidate transition cookie in the received session ACK packet comprises a time value representing a time within a predetermined time interval from the time the session ACK packet is received.

One aspect of the invention includes the system above in which the processor is further configured for regarding the received session ACK packet as valid if the candidate transition cookie in the received session ACK packet comprises a time value representing a time within a predetermined time interval from the time the session ACK packet is received.

In another aspect of the invention, the predetermined time interval is in the range of one to six seconds.

In one aspect of the invention, the predetermined time interval is three seconds.

In another aspect of the invention, the step of generating the transition cookie includes the use of data obtained from the session SYN packet.

In one aspect of the invention, the data obtained from the session SYN packet comprises the source IP address of an IP header associated with the session SYN packet.

In another aspect of the invention, the data obtained from the session SYN packet comprises the sequence number of a TCP header associated with the session SYN packet.

In another aspect of the invention, the data obtained from the session SYN packet comprises a source port associated with the session SYN packet.

In another aspect of the invention, the data obtained from the session SYN packet comprises a destination port associated with the session SYN packet.

Another aspect of the present invention provides a method for TCP SYN cookie validation. The method includes receiving a session SYN packet by a TCP session setup module, generating a transition cookie by the TCP session setup module, the transition cookie comprising a time value representing the actual time, sending a session SYN/ACK packet, including the transition cookie, in response to the received session SYN packet, receiving a session ACK packet, and determining whether a candidate transition cookie in the received session ACK packet comprises a time value representing a time within a predetermined time interval from the time the session ACK packet is received.

In an aspect of the invention, the method further includes indicating the received session ACK packet comprises a valid candidate transition cookie if the time value of the candidate transition cookie is within a predetermined time interval of the time the session ACK packet is received.

In another aspect of the invention, the step of generating the transition cookie includes the use of data obtained from the session SYN packet.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a schematic diagram illustrating a host server including a TCP session setup module and a client server, in accordance with an embodiment of the present invention;

FIG. 2 is a schematic diagram of a TCP/IP handshake in accordance with an embodiment of the present invention;

FIG. 3a illustrates a method including steps for generating a transition cookie data element by a transition cookie generator 245, in accordance with an embodiment of the present invention;

FIG. 3b illustrates a method including steps for generating a transition cookie secret key by a transition cookie generator 245 based on data obtained from the received session SYN packet, in accordance with an embodiment of the present invention;

FIG. 3c illustrates a method including steps for generating a transition cookie based on a transition cookie data element, a transition cookie secret key, and data obtained from a received session SYN packet in accordance with an embodiment of the present invention;

FIG. 4a illustrates steps for generating a candidate encrypted data element by a transition cookie validator 275 based on data obtained from a received session ACK packet, in accordance with an embodiment of the present invention;

FIG. 4b illustrates a method including steps for generating a candidate transition cookie secret key by a transition cookie validator 275 based on data obtained from a received session ACK packet and a candidate sequence number, in accordance with an embodiment of the present invention;

FIG. 4c illustrates a method including steps for generating a candidate transition cookie data element by a transition cookie validator 275 based on a candidate encrypted data element and a candidate transition cookie secret key, in accordance with an embodiment of the present invention;

FIG. 4d illustrates a method including the steps for validating a candidate transition cookie data element, in accordance with an embodiment of the present invention; and

FIG. 5 illustrates a method including steps for generating information based on a validated candidate transition cookie data element, in accordance with an embodiment of the present invention.

DETAILED DESCRIPTION

In the following description, for purposes of explanation, specific numbers, materials and configurations are set forth in order to provide a thorough understanding of the invention. It will be apparent, however, to one having ordinary skill in the art, that the invention may be practiced without these specific details. In some instances, well-known features may be omitted or simplified so as not to obscure the present invention. Furthermore, reference in the specification to “one embodiment” or “an embodiment” means that a particular feature, structure or characteristic described in connection with the embodiment is included in at least one embodiment of the invention. The appearances of the phrase “in an embodiment” in various places in the specification are not necessarily all referring to the same embodiment.

Transmission Control Protocol (“TCP”) is one of the main protocols in TCP/IP networks. Whereas the Internet Protocol (“IP”) deals only with packets, TCP enables two hosts to establish a connection and exchange streams of data. TCP guarantees delivery of data and also guarantees that packets will be delivered in the same order in which they were sent.

The terms “host server” and “client server” referred to in the descriptions of various embodiments of the invention herein described are intended to generally describe a typical system arrangement in which the embodiments operate. The “host server” generally refers to any computer system interconnected to a TCP/IP network, including but not limited to the Internet, the computer system comprising at a minimum a processor, computer memory, and computer software. The computer system is configured to allow the host server to participate in TCP protocol communications over its connected TCP/IP network. Although the “host server” may be a single personal computer having its own IP address and in communication with the TCP/IP network, it may also be a multi-processor server or server bank. The “client server” is similar to the “host server”, although it is understood that the “client server” may, in fact, be a single personal computer attached to the TCP/IP network. The only difference between the client and the host server for the purposes of the present invention is that the host server receives the SYN from the client server, sends a SYN ACK to the client server, and waits for the ACK from the client server.

FIG. 1 is a schematic diagram illustrating an embodiment of the present invention. A host server 102 may include a TCP session module 104. The TCP session setup module 104 can engage in a TCP handshake 108, such as described above, with a client server 106. In an embodiment, the TCP session setup module 104 is a software component of the host server 102. In one embodiment, the TCP session setup module 104 is implemented in an Application Specific Integrated Circuit (“ASIC”) or a Field Programmable Gate Array (“FPGA”). It is the TCP session setup module that handles the “3-way handshake” 108 between the host server 102 and the client server 106. The TCP session setup module may itself also incorporate modules for sending and receiving TCP session packets. These modules may include but are not limited to a session SYN packet receiver, a session SYN/ACK packet sender, and a session ACK packet receiver, which are all known to those of ordinary skill in the computer arts.

The TCP sessions setup module 104 may itself be embedded in one or more other host server modules (not shown). The TCP session setup module may alternatively comprise a hardware or firmware component. For example, the software which handles the TCP handshake 108 on behalf of the host server 102 may be programmed onto a externally programmable read-only memory (“EPROM”) (not shown), and the EPROM may then be integrated into the host server. In another example, the ASIC or FPGA is integrated into the host server.

FIG. 2 illustrates a TCP session setup module 104 processing TCP/IP segments (not shown), such as session SYN packet 210, session SYN/ACK packet 220, and session ACK packet 230.

A TCP/IP segment includes a TCP header and an IP header as described in IETF RFC 793 “Transmission Control Protocol” section 3.1 “Header Format”, incorporated herein by reference. A TCP header optionally includes a sack-permitted option as described in IETF RFC 2018 “TCP Selective Acknowledgement Options” section 2 “Sack-Permitted Option”, incorporated herein by reference. A session SYN packet 210 is a TCP/IP segment with the SYN control bit in the TCP Header set to “1”. A session SYN/ACK packet 220 is a TCP/IP segment with the SYN control bit and the ACK control bit in the TCP header set to “1”. A Session ACK Packet 230 is a TCP/IP segment with the ACK control bit in the TCP header set to “1”.

Referring to FIG. 2, in an embodiment, the TCP session setup module 104 receives a session SYN packet 210, obtains data from a session SYN packet 210, such as but not limited to the source IP address of the IP header, or the sequence number of the TCP header, and uses the data to generate a transition cookie 250. The transition cookie 250 is preferably a 32-bit data element. In response to the session SYN packet 210, the TCP session setup module 104 creates and sends out a session SYN/ACK packet 220 in accordance with IETF RFC 793 “Transmission Control Protocol” section 3.4 “Establishing a connection”, incorporated herein by reference. The TCP session setup module 104 preferably includes the transition cookie 250 as the sequence number of the TCP header in the session SYN/ACK packet 220.

After the TCP session setup module 104 has sent out the session SYN/ACK packet 220, it waits for receipt of a responding session ACK packet 230. In an embodiment, when a session SYN/ACK packet 230 is received, the TCP session setup module 104 generates a 32-bit candidate transition cookie 270 such that the sum of candidate transition cookie 270 and a value of “1” equal the acknowledgement number of the TCP header in the session ACK packet 230. For example, if the acknowledgement number is “41B4362A” in hexadecimal format the candidate transition cookie 270 is “41B43629” in hexadecimal format; the sum of “41B43629” and a value of “1” equals “41B4362A”. In another example, if the acknowledgement number is “00A30000” in hexadecimal format the candidate transition cookie 270 is “00A2FFFF” in hexadecimal format; the sum of “00A2FFFF” and a value of “1” equals “00A30000”. In another example, if the acknowledgement number is “00000000” in hexadecimal format the Candidate Transition Cookie 270 is “FFFFFFFF” in hexadecimal format; the sum of “FFFFFFFF” and a value of “1” equals “00000000”, with the most significant bit carried beyond the 32-bit boundary. The TCP session setup module 104 may thus validate the candidate transition cookie 270 in this manner. If the TCP session setup module 104 determines that the candidate transition cookie 270 is thus valid, the session ACK packet 230 is also valid. In this case, the TCP session setup module 104 obtains data from the validated session ACK packet 230 and sends the data and information generated during the validation of candidate transition cookie 270 to a computing module (not shown) for further processing.

In order to generate and validate transition cookies 250, 270, the TCP session setup module 104 may include a transition cookie generator 245 and a transition cookie validator 275, respectively. Alternatively, the generation and validation may be performed directly by the TCP session setup module 104. In the descriptions herein, references to the TCP and transition cookie validator 275 are understood to include any of the alternative embodiments of these components.

A transition cookie generator 245 includes the functionality of generating a transition cookie based on the data obtained from a session SYN 210 packet received by the TCP session setup module 104.

A transition cookie validator 275 includes the functionality of validating a candidate transition cookie 270 generated based on data obtained from a session ACK packet 230 received by the TCP session setup module 104.

In exemplary operation, a transition cookie generator 245 is software or firmware that generates a transition cookie 250 based on data obtained from a session SYN packet 210 received by the TCP session setup module 104. An exemplary method for generating a transition cookie 250 by a transition cookie generator 245 includes multiple steps as illustrated in FIGS. 3a-3c.

FIG. 3a illustrates exemplary steps for generating a transition cookie data element 330 by a transition cookie generator 245. A transition cookie generator 245 includes a clock 305 indicating the current time of day in microseconds in a 32-bit format.

The transition cookie data element 330 is preferably a 32-bit data element, generated by the transition cookie generator 245 based on the selective ACK 321, the MSS index 324 and the 32-bit current time of day indicated by clock 305. Selective ACK 321 is a 1-bit data element which is set to a value of “1” by transition cookie generator 245 if a TCP header in a received session SYN packet 210 includes an optional sack-permitted option, or to “0” if a TCP header in a received session SYN packet 210 does not include an optional sack-permitted option.

Maximum Segment Size (“MSS”) 322 is the maximum number of bytes that TCP will allow in an TCP/IP packet, such as session SYN packet 210, session SYN/ACK packet 220, and session ACK packet 230, and is normally represented by an integer value in a TCP packet header. If a TCP header in a received session SYN packet 210 includes a maximum segment size option, the transition cookie generator 245 sets the MSS 322 to equal the maximum segment size option data of the maximum segment size option. Otherwise, if the TCP header in a received session SYN packet 210 does not include a maximum segment size option, the transition cookie generator 245 sets the MSS 322 to a default value, for example, such as integer “536”. The MSS index 324 is a 4-bit data element set by the transition cookie generator 245 based on the MSS 322. The transition cookie generator 245 preferably includes an MSS table 307, which maps an MSS 322 to an MSS index 324. The transition cookie generator 245 maps a MSS 322 with the MSS table 307 to set the value of MSS index 324. For example, MSS 322 has an integer value of “1460”. After the mapping, MSS index 324 has a value of “4” as represented in hexadecimal format. In an alternative embodiment, means other than an MSS table 307 may be employed to determine the MSS index 324 value, such as the use of a mapping algorithm.

In generating a transition cookie data element 330, the transition cookie generator 245 sets a transition cookie data element 330 to equal the 32-bit current time of day indicated by clock 305. For example, the 32-bit current time of day may be “A68079E8” as represented in hexadecimal format, so the transition cookie data element 330 has a value of “A68079E8”.

Next, the transition cookie generator 245 replaces the least significant 4 bits (bit 0-3) of transition cookie data element 330 with the MSS index 324, and replaces bit 4 of a transition cookie data element 330 with selective ACK 321. For example, if a transition cookie data element 330 has been set to a value of “A68079E8”, selective ACK 321 has a value of “1”, and MSS index 324 has a value of “4” as represented in hexadecimal format, after the replacements, transition cookie data element 330 has a value of “A68079F4” in hexadecimal format.

FIG. 3b illustrates exemplary steps for generating a transition cookie secret key 360, such as by a transition cookie generator 245 based on data obtained from a received session SYN packet 210. The data used in generating the transition cookie secret key 360 may include at least the source IP address 312 of an IP header, a destination port 314, a source port 316 and a sequence number 318 of a TCP header in a received session SYN packet 210. In generating a transition cookie secret key 360, a transition cookie generator 245 forms a 96-bit data element, a first data item 340, by concatenating a source IP address 312, a sequence number 318, a source port 316, and a destination port 314. For example, if the source IP address 312 is 192.168.1.134, the hexadecimal representation being “C0A80186”, the sequence number 318 is “9A275B84”, the source port 316 is 4761, the hexadecimal representation being “1299”, and the destination port 314 is 240, the hexadecimal representation being “00F0”, then, after the concatenation, the first data item 340 has a hexadecimal value of “C0A801869A275B84129900F0”.

Next, since the transition cookie secret key 360 is a 128-bit data element, the transition cookie generator 245 may use a hash function to generate the transition cookie secret key 360 from the first data item 340. Further, the transition cookie generator 245 may use a secret key offset 301, which may be a 6-bit integer value, to select a 6-bit non-negative integer from first data item 340 starting at the bit indicated by secret key offset 301. For example, if the secret key offset 301 has a value of “12” and the first data item 340 has a hexadecimal value of “C0A801869A275B84129900F0”, the transition cookie generator 245 selects a 6-bit non-negative integer from the first data item 340 starting at bit 12 (bit 12-17). The selected non-negative integer is of this example is thus “16”. The transition cookie generator 245 then uses the selected non-negative integer to select 64 bits of data from the first data item 340, starting at the bit indicated by the selected non-negative integer, to generate the second data item 350, which has 64 bits.

For example, if the selected non-negative integer is “8” and the first data item 340 has a hexadecimal value of “C0A801869A275B84129900F0”, the transition cookie generator 245 selects 64 bits (bit 8-71) of the first data item 340 to generate a second data item 350, having a hexadecimal value of “869A275B84129900”. In another example, if the selected non-negative integer is “52”, and the transition cookie generator 245 selects 64 bits (bit 52-95 and bit 0-19) of the first data item 340 in a wrap-around fashion, bits 52-95 have a hexadecimal value of “C0A801869A2”, and bit 0-19 have a hexadecimal value of “900F0”, so the generated second data item 350 has a hexadecimal value of “900F0C0A801869A2”. The transition cookie generator 245 then generates a transition cookie secret key 360 by storing the second data item 350 in the least significant 64 bits (bit 0-63) of the transition cookie secret key 360 and setting the most significant 64 bits (bit 64-127) to “0”. For example, if the second data item 350 has a hexadecimal value of “869A275B84129900”, the transition cookie secret key 360 has a hexadecimal value of “0000000000000000869A275B84129900”.

FIG. 3c illustrates exemplary steps for generating a transition cookie 250 based on a transition cookie data element 330, a transition cookie secret key 360, and data obtained from a received session SYN packet 210, including a sequence number 318 of a TCP header in a received session SYN packet 210. To generate a transition cookie 250, a transition cookie generator 245 applies a cryptographic method 308 on the transition cookie secret key 360 and the transition cookie data element 330, such as an RC5 algorithm described in IETF RFC 2040 “The RC5, RC5-CBC, RC5-CBC-Pad, and RC5-CTS Algorithms” section 1 “Overview”, and sections 2-8 with detailed explanations, incorporated herein by reference. The RC5 algorithm takes a 32-bit plaintext input and a 128-bit encryption key to generate a 32-bit ciphertext output. The transition cookie generator 245 uses the transition cookie data element 330 as the plaintext input to the RC5 algorithm, and the transition cookie secret key 360 as the encryption key input to the RC5 algorithm. The transition cookie generator 245 stores the resulting 32-bit ciphertext output of the RC5 algorithm in the encrypted data element 370.

Next, the transition cookie generator 245 performs an unsigned binary addition on an encrypted data element 370 and the sequence number 318, and stores the result in the transition cookie 250. For example, if the encrypted data element 370 has a value of “0025BC83” in hexadecimal format, and the sequence number 318 has a value of “0743BD55” in hexadecimal format, the result of the addition is hexadecimal “076979D8”. After the addition, the transition cookie 250 has a value of “076979D8” in hexadecimal. In another example, if the encrypted data element 370 has a value of “BE43D096” in hexadecimal format, and the sequence number 318 has a value of “9A275B84” in hexadecimal format, the result of the addition, and the value of transition cookie 250 is hexadecimal “1586B2C1A”, with the most significant bit carried beyond the 32-bit boundary.

In another embodiment, a transition cookie generator 245 may use different steps to generate a transition cookie secret key 360. For example, a secret key offset 301 may be an integer of a different bit length, such as a 4-bit integer value, a 3-bit integer value, or a 5-bit integer value. Also, a transition cookie generator 245 may use a secret key offset 301 to select a non-negative integer value of a different bit length from a first data item 340. For example, a transition cookie generator 245 may select a 4-bit non-negative integer value, a 7-bit non-negative integer value, or a 5-bit non-negative value from a first data item 340.

In other embodiments, a transition cookie generator 245 may store a second data item 350 in the least significant 64 bits (bit 0-63) of a transition cookie secret key 360 or store second data item 350 in the most significant 64 bits (bit 64-127) of a transition cookie secret key 360.

A transition cookie generator 245 may also perform an exclusive-or operation on the most significant 48 bits (bit 0-47) of a first data item 340 and the least significant 48 bits (bit 48-95) of a first data element 340 to form a 48-bit temporary data element (not shown). Similarly, in another embodiment, a transition cookie generator 245 may perform an exclusive-or operation on the 48 even bits (bit 0, 2, 4, . . . 90, 92, 94) and the 48 odd bits (bit 1, 3, 5, . . . 93, 95, 97) to form a 48 bit temporary data element. In yet another embodiment, a transition cookie generator 245 may store a 48-bit temporary data element in the least significant 48 bits (bit 0-47) and the most significant 48 bits (bit 80-127) of a transition cookie secret key 360, and set bit 48-79 to “0”, or store a 48-bit temporary data element in the least significant 48 bits (bit 0-47) of a transition cookie secret key 360, and set the most significant 80 bits (bit 48-127) of a transition cookie secret key 360 to “0”.

In other embodiments of the invention, a transition cookie generator 245 may use an encryption algorithm to generate a transition cookie secret key 360 from the first data item 340.

In another embodiment, a transition cookie generator 245 includes a secret key and an encryption algorithm, and uses a first data element 340 as a plaintext input, and a secret key as an encryption key input to the encryption algorithm to generate a 128-bit ciphertext output. Next, a transition cookie generator 245 generates a transition cookie secret key 360 as a 128-bit ciphertext output. Alternatively, the ciphertext output may be a 96-bit data element, and a transition cookie generator 245 stores a 96-bit ciphertext output in the least significant 96 bits (bit 0-95) of a transition cookie secret key 360, and sets the most significant 32 bits (bit 96-127) to “0”. In another alternative, a transition cookie generator 245 stores the least significant 32 bits (bit 0-31) of a 96-bit ciphertext output in the most significant 32 bits (bit 96-127) of a transition cookie secret key 360.

As seen in FIG. 2, a transition cookie validator 275 validates a candidate transition cookie 270 generated from a session ACK packet 230 received by the TCP session setup module 104. An exemplary method for validating a candidate transition cookie 270 by a transition cookie validator 275 may include multiple steps as illustrated in FIGS. 4a-4d.

FIG. 4a illustrates exemplary steps for generating a candidate encrypted data element 470 by a transition cookie validator 275 based on data obtained from a received session ACK packet 230. The candidate encrypted data element 470 may be a 32-bit data element generated based on the sequence number 418 of the TCP header in the received session ACK packet 230, and the candidate transition cookie 270 generated from the received session ACK packet 230 as illustrated in FIG. 2.

The candidate sequence number 428 may be a 32-bit data element generated by a transition cookie validator 275 such that the sum of candidate sequence number 428 and a value of “1” equals the sequence number 418.

The candidate encrypted data element 470 is generated by the transition cookie validator 275 such that the result of performing an unsigned binary addition of the candidate encrypted data element 470 and the candidate sequence number 428 equals the candidate transition cookie 270.

FIG. 4b illustrates exemplary steps for generating a candidate transition cookie secret key 460 by the transition cookie validator 275 based on data obtained from the received session ACK packet 230 and a candidate sequence number 428. The data used for generating the candidate transition cookie secret key 460 may include at least a source IP address 412 of the IP header in a received session ACK packet 230, a destination port 414 and a source port 416 of the TCP header in a received session ACK packet 230. In the process, a 96-bit first data item 440 is formed by a transition cookie validator 275 by concatenating a source IP address 412, a candidate sequence number 428, a source port 416, and a destination port 414. For example, if the source IP address 412 is 192.168.1.134, having a hexadecimal representation of “C0A80186”, the candidate sequence number 428 is hexadecimal “9A275B84”, the source port 416 is 4761, having a hexadecimal representation of “1299”, and the destination port 414 is 240, having a hexadecimal representation of “00F0”, after the concatenation, the first data item 440 has a hexadecimal value of “C0A801869A275B84129900F0”.

Next, the 128-bit candidate transition cookie secret key 460 is generated from a first data item 440 by a transition cookie validator 275 using a hash function. In an embodiment, a transition cookie validator 275 uses a 6-bit secret key offset 401 to select a 6-bit non-negative integer from a first data item 440 starting at a bit indicated by secret key offset 401. For example, if the secret key offset 401 has a value of “12” and the first data item 440 is “C0A801869A275B84129900F0”, the transition cookie validator 275 selects a 6-bit non-negative integer from the first data item 440 starting at bit 12 (bits 12-17), selecting the non-negative integer “16”. The transition cookie validator 275 then generates a 64-bit second data item 350 by using the selected non-negative integer to select 64 bits of data from the first data item 440, starting at the bit indicated by the selected non-negative integer.

For example, if the selected non-negative integer is “8” and the first data item 440 has a hexadecimal value of “C0A801869A275B84129900F0”, the transition cookie validator 275 selects 64 bits (bit 8-71) of the first data item 440 to generate a second data item 450 having a hexadecimal value of “869A275B84129900”. In another example, if the first data item 440 has a hexadecimal value of “C0A801869A275B84129900F0”, and the selected non-negative integer is “52”, the transition cookie validator 275 selects 64 bits (bit 52-95 and bit 0-19) in a wrap-around fashion. Bits 52-95 have a hexadecimal value of “C0A801869A2”, and bits 0-19 have a hexadecimal value of “900F0”, so the generated second data item 450 has a hexadecimal value of “900F0C0A801869A2”.

Next, the transition cookie validator 275 generates a candidate transition cookie secret key 460 by storing the second data item 450 in the least significant 64 bits (bit 0-63) of the candidate transition cookie secret key 460 and setting the most significant 64 bits (bit 64-127) to “0”. For example, if the second data item 450 has a hexadecinmal value of “869A275B84129900”, the candidate transition cookie secret key 460 has a hexadecimal value of “0000000000000000869A275B84129900”.

FIG. 4C illustrates exemplary steps for generating a candidate transition cookie data element 430 by a transition cookie validator 275 based on a candidate encrypted data element 470 and a candidate transition cookie secret key 460.

In an embodiment, a transition cookie validator 275 applies a cryptographic method 408 on a candidate transition cookie secret key 460 and a candidate encrypted data element 470. An exemplary cryptographic method 408 is an RC5 algorithm described in IETF RFC 2040 “The RC5, RC5-CBC, RC5-CBC-Pad, and RC5-CTS Algorithms” section 1 “Overview”, and sections 2-8 with detailed explanations, incorporated herein by reference. The RC5 algorithm takes a 32-bit ciphertext input and a 128-bit decryption key to generate a 32-bit plaintext output. A transition cookie validator 275 uses a candidate encrypted data element 470 as a ciphertext input to the RC5 algorithm, and a candidate transition cookie secret key 460 as a decryption key input to the RC5 algorithm, to generate a 32-bit candidate transition cookie data element 430 as the plaintext output of the RC5 decryption algorithm.

FIG. 4d illustrates exemplary steps by a transition cookie validator 275 of validating a candidate transition cookie data element 430. In an embodiment, a transition cookie validator 275 includes a clock 305. The clock 305 indicates the current time of day, preferably in microseconds in a 32-bit format. The modified current time 409 is a 32-bit data element set by a transition cookie validator 275 sets to the current time indicated by clock 305. A transition cookie validator 275 then sets the least significant 5 bits (bit 0-4) of the modified current time 409 to “0”. For example, if the modified current time 409 has a value of “89AE03F6” in hexadecimal format, after setting the least significant 5 bits to “0”, the modified current time 409 has a hexadecimal value of “89AE03E0”.

Next, a transition cookie validator 275 sets a 32-bit adjusted candidate transition cookie data element 431 to equal the candidate transition cookie data element 430, and then sets the least significant 5 bits (bit 0-4) of the adjusted candidate transition cookie data element 431 to “0”. For example, if the adjusted candidate transition cookie data element 431 has a hexadecimal value of “89DB468F”, after setting the least significant 5 bits to “0”, the adjusted candidate transition cookie data element 431 has a hexadecimal value of “89DB4680”.

The transition cookie validator 275 may then determine if the candidate transition cookie data element 430 is valid by determining if the adjusted candidate transition cookie data element 431 is within a time margin of 3 seconds of the modified current time 409. In an embodiment, in order to determine if the adjusted candidate transition cookie data element 431 is within a time margin of 3 seconds of the modified current time 409, the transition cookie stores the modified current time 409 in the least significant 32 bits (bit 0-31) of a first 33-bit time data element, sets the most significant bit (bit 32) to “0”, and adds 6 seconds to the first 33-bit time data element. Adding 6 seconds is to add 6,000,000 micro seconds as represented by “5B8D80” in hexadecimal format. For example, if before the addition, the first 33-bit time data element has a hexadecimal value of “0FFFFFAE2”, After the addition of “5B8D80”, the first 33-bit time data element has a hexadecimal value of “1005B8862”. The transition cookie validator 275 stores the adjusted candidate transition cookie data element 431 in the least significant 32 bits (bit 0-31) of a second 33-bit time data element, sets the most significant bit (bit 32) to “0”, and adds 3 seconds to the second 33-bit time data element. Adding 3 seconds is to add 3,000,000 micro seconds as represented by hexadecimal “2DC6C0”. The transition cookie validator 275 stores the modified current time 409 in the least significant 32 bits (bit 0-31) of a third 33-bit time data element, and sets the most significant bit (bit 32) to “0”. If the second 33-bit time data element is smaller than the first 33-bit time data element and the second 33-bit time data element is larger than the third 33-bit time data element, the transition cookie validator 275 determines that the adjusted candidate transition cookie data element 431 is within 3 seconds of the modified current time 409, and thus that the candidate transition cookie data element 430 is valid.

FIG. 5 illustrates exemplary steps of generating information based on a validated candidate transition cookie data element 430. In an embodiment, candidate MSS 522 is an integer. A transition cookie validator 275 includes a reversed MSS table 507, which includes information that maps a 4-bit data element to a candidate MSS 522. A transition cookie validator 275 extracts the least significant 4-bit (bit 0-3) data from candidate transition cookie data element 430, maps the extracted 4-bit data to a reversed MSS table 507, and stores the result in a candidate MSS 522. A transition cookie validator 275 may then generate a maximum segment size option as described in IETF RFC 793 “Transmission Control Protocol” section 3.1 “Header Format”, incorporated herein by reference, and sets a maximum segment size option data of the maximum segment size option to equal a candidate MSS 522. A transition cookie validator 275 may further examine bit 4 of a candidate transition cookie data element 430. If bit 4 of candidate transition cookie data element 430 has a value of “1”, a transition cookie validator 275 may generate a sack-permitted option as described in IETF RFC 2018 “TCP Selective Acknowledgement Options” section 2, incorporated herein by reference. A TCP session setup module 104 may then send a sack-permitted option, a maximum segment size option, and data obtained from a received session ACK packet 230 to a computing module (not shown) for further processing.

There are many different encryption algorithms that use encryption keys of different bit lengths, such as, for example, 56-bit, 64-bit, 96-bit, 128-bit. These may generate ciphertext outputs of different bit lengths, for example, 96-bit, 64-bit, 128-bit, or 32-bit. Persons of ordinary skill in the cipher arts will be able to apply different methods, for example a hash function, to generate the transition cookie secret key 360 from the ciphertext output.

A transition cookie validator 275 may also use different steps to generate a candidate transition cookie secret key 460. The steps used by a transition cookie validator 275 to generate a candidate transition cookie secret key 460 are similar to the steps used by a transition cookie generator 245 to generate a transition cookie secret key 360.

Alternative embodiments of the invention may employ a different algorithm for the cryptographic methods 308, 408. In one example, the different algorithm is an RC2 algorithm described in IETF RFC 2268 “A Description of the RC2(r) Encryption Algorithm” section 1 “Introduction” and section 2-4 with detailed explanation, incorporated herein by reference. In another example, the different algorithm is a Blowfish algorithm. In one other example, the different algorithm is a Data Encryption Standards (“DES”) algorithm based on Federal Information Processing Standards Publication “Data Encryption Standard (DES) FIPS PUB 46-3”, which is incorporated herein by reference in its entirety. Other algorithms are also usable.

Also, a transition cookie validator 275 may use different time margins of modified current time 409 to determine if the candidate transition cookie data element is valid. Different time margins include but are not limited to 1 second, 4 seconds, 6 seconds, 2 seconds, or 11 seconds.

In an embodiment, the method of generating a transition cookie includes MD5 signature option information in the TCP options field. When this method is used, the method of validating a candidate transition cookie 270 correspondingly includes the MD5 signature option information in the TCP options field.

In another embodiment, transition cookie generator 245 may include a plurality of transition cookie generation methods for generating transition cookie 250. For example, the secret key offset 301 may have a different value, such as an integer value of different bit length, such as 4-bit, or 8-bit. In other examples, the selected non-negative integer from first data item 340 may be of different bit length, such as 8-bit, or 10-bit, the cryptographic method 308 may be a different algorithm than RC5, or the generating of transition cookie data element 330 may include MD5 signature option information in the TCP options field of session SYN packet 210. A transition cookie generation method may include steps different from the steps in the exemplary method illustrated in FIGS. 3a-3c.

In an embodiment, the transition cookie generator 245 may selects method to generate transition cookie 250 based on random data.

The random data may include time. In one embodiment, transition cookie generator 245 selects a method based on the time of day. Alternatively, the transition cookie generator 245 may select a method after a time period, such as 10 seconds, 30 seconds, 2 minutes or 3 hours.

In another embodiment, the random data may include a source IP address in session SYN packet 210, or a destination IP address in session SYN packet 210.

The random data may include the network interface at which a TCP session setup module 104 receives a session SYN packet 210, or a Virtual Local Area Network (VLAN) information associated with a session SYN packet 210.

In one embodiment, transition cookie validator 275 includes a plurality of transition cookie validation methods for validating candidate transition cookie 270. A transition cookie validation method may include steps different from the steps in the exemplary method illustrated in FIGS. 4a-4d. A transition cookie validator 275 may select a method to validate candidate transition cookie 270 based on random data.

In these embodiments it is understood to be preferred that the transition cookie validator 275 selects a complementary method to the method selected by transition cookie generator 245.

Although the invention herein has been described with reference to particular embodiments, it is to be understood that these embodiments are merely illustrative of the principles and applications of the present invention. It is therefore to be understood that numerous modifications may be made to the illustrative embodiments and that other arrangements may be devised without departing from the spirit and scope of the present invention as defined by the appended claims.

Claims (31)

The invention claimed is:
1. A system for TCP SYN cookie validation at a host server comprising:
a session SYN packet receiver for receiving a session SYN packet;
a transition cookie generator operating to generate a transition cookie with the use of a transition cookie secret key, the transition cookie comprising a time value representing the actual time, wherein the transition cookie generator generates the transition cookie secret key based on data obtained from the received session SYN packet, the data obtained from the SYN packet including at least one of a source IP address of an IP header, a destination port, a source port, and a sequence number of a TCP header in the received session SYN packet, wherein the transition cookie generator concatenates the obtained data from the session SYN packet to generate a first data item of the generator and the transition cookie generator uses a first hash function to generate the transition cookie secret key from the first data item of the generator;
a session SYN/ACK packet sender for sending the transition cookie in response to the received session SYN packet;
a session ACK packet receiver for receiving a session ACK packet, the session ACK packet including a candidate transition cookie; and
a transition cookie validator, for determining whether the candidate transition cookie in the received session ACK packet comprises a time value representing a time within a predetermined time interval from the time the session ACK packet is received, wherein the transition cookie validator generates a candidate transition cookie secret key based on data obtained from the received session ACK packet, the data obtained from the ACK packet including at least one of a source IP address of the IP header, a destination port, and a source port, wherein the transition cookie validator concatenates the obtained data from the session ACK packet to generate a first data item of the validator and the transition cookie validator uses the first or another hash function to generate the candidate transition cookie secret key from the first data item of the validator,
wherein at least one of:
the transition cookie generator uses a secret key offset to select one or more bits of data from the first data item of the generator in order to generate a second data item of the generator, and
the transition cookie validator uses a candidate secret key offset to select one or more bits of data from the first data item of the validator in order to generate a second data item of the validator.
2. The system according to claim 1, in which the transition cookie validator determines that the received session ACK packet is valid if the candidate transition cookie in the received session ACK packet comprises a time value representing a time within a predetermined time interval from the time the session ACK packet is received.
3. The system according to claim 1, in which the predetermined time interval is in the range of one to six seconds.
4. The system according to claim 1, in which the predetermined time interval is three seconds.
5. The system according to claim 1, in which the generating of the transition cookie includes the use of random data.
6. The system according to claim 1, in which the generating of the transition cookie includes the use of data obtained from the session SYN packet.
7. A system for TCP SYN cookie validation at a host server comprising:
a session SYN packet receiver for receiving a session SYN packet;
a transition cookie generator operating to generate a transition cookie with the use of a transition cookie secret key, the transition cookie comprising a time value representing the actual time, wherein the transition cookie generator generates the transition cookie by (i) generating an encrypted data element of the generator by applying a cryptographic method on the transition cookie secret key and a transition cookie data element, (ii) performing an unsigned binary addition on the encrypted data element of the generator and a sequence number of a TCP header in the received session SYN packet, and (iii) storing the result in the transition cookie;
a session SYN/ACK packet sender for sending the transition cookie in response to the received session SYN packet;
a session ACK packet receiver for receiving a session ACK packet, the session ACK packet including a candidate transition cookie; and
a transition cookie validator, for determining whether the candidate transition cookie in the received session ACK packet comprises a time value representing a time within a predetermined time interval from the time the session ACK packet is received.
8. The system according to claim 7, wherein the transition cookie data element comprises data based on at least one of: a selective ACK, an MSS index, and a 32-bit current time of day indicated by a clock.
9. A system for TCP SYN cookie validation at a host server comprising:
a session SYN packet receiver for receiving a session SYN packet;
a transition cookie generator operating to generate a transition cookie with the use of a transition cookie secret key, the transition cookie comprising a time value representing the actual time;
a session SYN/ACK packet sender for sending the transition cookie in response to the received session SYN packet;
a session ACK packet receiver for receiving a session ACK packet, the session ACK packet including a candidate transition cookie; and
a transition cookie validator, for determining whether the candidate transition cookie in the received session ACK packet comprises a time value representing a time within a predetermined time interval from the time the session ACK packet is received, wherein the transition cookie validator generates:
a candidate sequence number such that a sequence number of a TCP header in the received session ACK packet equals the sum of the candidate sequence number and a value of 1,
a candidate encrypted data element such that the result of performing an unsigned binary addition of the candidate encrypted data element and a candidate sequence number equals the candidate transition cookie, and
a candidate transition cookie data element by applying a cryptographic method on a candidate transition cookie secret key and the candidate encrypted data element.
10. The system according to claim 9, wherein the transition cookie validator validates the candidate transition cookie data element by adjusting the candidate transition cookie data element to generate, and determining if the adjusted candidate transition cookie data element is within a predetermined time margin of a modified current time.
11. A method for validating a TCP cookie at a host, the method comprising:
receiving a first session packet;
acquiring a transition cookie secret key based on data obtained from the received first session packet;
generating a transition cookie using the transition cookie secret key;
sending a second session packet including the transition cookie;
receiving a third session packet including a candidate transition cookie;
acquiring a candidate transition cookie secret key based on data obtained from the received third session packet; and
validating the candidate transition cookie using the candidate transition cookie secret key.
12. The method of claim 11, wherein the data obtained from the received first session packet includes:
at least one of a source IP address, a destination port, a source port, or a sequence number of a TCP header.
13. The method of claim 11, wherein acquiring the transition cookie secret key further comprises:
concatenating the data obtained from the received first session packet;
forming a first secret key transition data item based on the concatenation; and
generating the transition cookie secret key from the first secret key transition data item.
14. The method of claim 13, wherein generating the transition cookie secret key from the first secret key transition data item comprises using a hash function.
15. The method of claim 13, wherein acquiring the transition cookie secret key further comprises:
selecting one or more bits of data from the first secret key transition data item using a secret key offset;
forming a second secret key transition data item based on the selected one or more bits; and
generating the transition cookie secret key from the first secret key transition data item and the second secret key transition data item.
16. The method of claim 11, wherein the data obtained from the received third session packet includes at least one of a source IP address, a destination port, or a source port.
17. The method of claim 11, wherein acquiring the candidate transition cookie secret key further comprises:
concatenating data obtained from the received third session packet;
forming a first secret key candidate data item based on the concatenation; and
generating the candidate transition cookie secret key from the first secret key candidate data item of the validation.
18. The method of claim 17, wherein acquiring the candidate transition cookie secret key further comprises:
using a hash function to generate the candidate transition cookie secret key from the first secret key candidate data item.
19. The method of claim 17, further comprising:
determining that the received third session packet is valid if the candidate transition cookie in the received third session packet comprises a time value representing a time within a predetermined time interval from the time the third session packet is received.
20. A method for validating a TCP cookie at a host, the method comprising:
receiving a first session packet;
generating a transition cookie by applying a cryptographic method on a transition cookie secret key and a transition cookie data element;
sending a second session packet including the transition cookie in response to the received first session packet;
receiving a third session packet including a candidate transition cookie; and
validating the candidate transition cookie by determining whether the candidate transition cookie comprises a time value representing a time within a predetermined time interval from a time that the third session packet is received.
21. The method of claim 20, wherein generating the transition cookie further comprises:
generating an encrypted data element based on the application of the cryptographic method;
performing an unsigned binary addition on the encrypted data element and a sequence number of a TCP header in the received first session packet; and
storing a result of the unsigned binary addition in the transition cookie.
22. The method of claim 20, comprising acquiring the transition cookie data element based on at least one of a one-bit data item, an MSS index, or a 32-bit current time of day indicated by a clock.
23. A method for validating a TCP cookie at a host, the method comprising:
receiving a first session packet;
generating a transition cookie using a transition cookie secret key;
sending a second session packet including the transition cookie in response to the received first session packet;
receiving a third session packet including a candidate transition cookie; and
validating the candidate transition cookie by applying a cryptographic method on a candidate transition cookie secret key.
24. The method of claim 23, wherein validating the candidate transition cookie further comprises:
generating a candidate sequence number such that a sequence number of a TCP header in the received third session packet equals the sum of the candidate sequence number and a value of 1;
generating a candidate encrypted data element such that a result of performing an unsigned binary addition of the candidate encrypted data element and the candidate sequence number equals the candidate transition cookie; and
generating a candidate transition cookie data element by applying the cryptographic method on the candidate transition cookie secret key and the candidate encrypted data element.
25. The method of claim 24, further comprising:
adjusting the candidate transition cookie data element; and
validating the candidate transition cookie data element by determining if the adjusted candidate transition cookie data element is within a predetermined time margin of a modified current time.
26. A host for validating a TCP cookie, comprising:
a memory device storing instructions; and
a processor that, when executing the instructions, configures the host to:
receive a first session packet;
acquire a transition cookie secret key based on data obtained from the received first session packet;
generate a transition cookie using the transition cookie secret key;
send a second session packet including the transition cookie;
receive a third session packet including a candidate transition cookie;
acquire a candidate transition cookie secret key based on data obtained from the received third session packet; and
validate the candidate transition cookie using the candidate transition cookie secret key.
27. A host for validating a TCP cookie, comprising:
a memory storing instructions; and
a processor, that when executing the instructions, configures the host to:
receive a first session packet;
generate a transition cookie by applying a cryptographic method on a transition cookie secret key and a transition cookie data element;
send a second session packet including the transition cookie;
receive a third session packet including a candidate transition cookie; and
validate the candidate transition cookie by determining whether the candidate transition cookie comprises a time value representing a time within a predetermined time interval from the time the third session packet is received.
28. A host for validating a TCP cookie, the host comprising:
a memory storing instructions; and
a processor that, when executing the instructions, configures the host to:
receive a first session packet;
generate a transition cookie using a transition cookie secret key;
send a second session packet including the transition cookie;
receive a third session packet including a candidate transition cookie; and
validate the candidate transition cookie by applying a cryptographic method on a candidate transition cookie secret key.
29. A non-transitory computer-readable medium storing instructions that, when executed, cause a computing device to perform a method for validating a TCP cookie, the method comprising:
receiving a first session packet;
acquiring a transition cookie secret key based on data obtained from the received first session packet;
generating a transition cookie using the transition cookie secret key;
sending a second session packet including the transition cookie;
receiving a third session packet including a candidate transition cookie;
acquiring a candidate transition cookie secret key based on data obtained from the received third session packet;
validating the candidate transition cookie using the candidate transition cookie secret key.
30. A non-transitory computer-readable medium storing instructions that, when executed, cause a computing device to perform a method for validating a TCP cookie, the method comprising:
receiving a first session packet;
generating a transition cookie by applying a cryptographic method on a transition cookie secret key and a transition cookie data element;
sending a second session packet including the transition cookie in response to the received first session packet;
receiving a third session packet including a candidate transition cookie; and
validating the candidate transition cookie by determining whether the candidate transition cookie comprises a time value representing a time within a predetermined time interval from the time the third session packet is received.
31. A non-transitory computer-readable medium storing instructions that, when executed, cause a computing device to perform a method for validating a TCP cookie, the method comprising:
receiving a first session packet;
generating a transition cookie using a transition cookie secret key;
sending a second session packet including the transition cookie in response to the received first session packet;
receiving a third session packet including a candidate transition cookie; and
validating the candidate transition cookie by applying a cryptographic method on a candidate transition cookie secret key.
US13/413,191 2006-02-21 2012-03-06 System and method for an adaptive TCP SYN cookie with time validation Active USRE44701E1 (en)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US11/358,245 US7675854B2 (en) 2006-02-21 2006-02-21 System and method for an adaptive TCP SYN cookie with time validation
US13/413,191 USRE44701E1 (en) 2006-02-21 2012-03-06 System and method for an adaptive TCP SYN cookie with time validation

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US13/413,191 USRE44701E1 (en) 2006-02-21 2012-03-06 System and method for an adaptive TCP SYN cookie with time validation
US14/151,803 USRE47296E1 (en) 2006-02-21 2014-01-09 System and method for an adaptive TCP SYN cookie with time validation

Related Parent Applications (1)

Application Number Title Priority Date Filing Date
US11/358,245 Reissue US7675854B2 (en) 2006-02-21 2006-02-21 System and method for an adaptive TCP SYN cookie with time validation

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US11/358,245 Continuation US7675854B2 (en) 2006-02-21 2006-02-21 System and method for an adaptive TCP SYN cookie with time validation

Publications (1)

Publication Number Publication Date
USRE44701E1 true USRE44701E1 (en) 2014-01-14

Family

ID=38428122

Family Applications (3)

Application Number Title Priority Date Filing Date
US11/358,245 Active 2029-01-09 US7675854B2 (en) 2006-02-21 2006-02-21 System and method for an adaptive TCP SYN cookie with time validation
US13/413,191 Active USRE44701E1 (en) 2006-02-21 2012-03-06 System and method for an adaptive TCP SYN cookie with time validation
US14/151,803 Active USRE47296E1 (en) 2006-02-21 2014-01-09 System and method for an adaptive TCP SYN cookie with time validation

Family Applications Before (1)

Application Number Title Priority Date Filing Date
US11/358,245 Active 2029-01-09 US7675854B2 (en) 2006-02-21 2006-02-21 System and method for an adaptive TCP SYN cookie with time validation

Family Applications After (1)

Application Number Title Priority Date Filing Date
US14/151,803 Active USRE47296E1 (en) 2006-02-21 2014-01-09 System and method for an adaptive TCP SYN cookie with time validation

Country Status (1)

Country Link
US (3) US7675854B2 (en)

Cited By (32)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8977749B1 (en) 2012-07-05 2015-03-10 A10 Networks, Inc. Allocating buffer for TCP proxy session based on dynamic network conditions
US9094364B2 (en) 2011-12-23 2015-07-28 A10 Networks, Inc. Methods to manage services over a service gateway
US9215275B2 (en) 2010-09-30 2015-12-15 A10 Networks, Inc. System and method to balance servers based on server load status
US9219751B1 (en) 2006-10-17 2015-12-22 A10 Networks, Inc. System and method to apply forwarding policy to an application session
US9253152B1 (en) 2006-10-17 2016-02-02 A10 Networks, Inc. Applying a packet routing policy to an application session
US9270774B2 (en) 2011-10-24 2016-02-23 A10 Networks, Inc. Combining stateless and stateful server load balancing
US9338225B2 (en) 2012-12-06 2016-05-10 A10 Networks, Inc. Forwarding policies on a virtual service network
US9386088B2 (en) 2011-11-29 2016-07-05 A10 Networks, Inc. Accelerating service processing using fast path TCP
US9531846B2 (en) 2013-01-23 2016-12-27 A10 Networks, Inc. Reducing buffer usage for TCP proxy session based on delayed acknowledgement
US9596286B2 (en) 2012-05-25 2017-03-14 A10 Networks, Inc. Method to process HTTP header with hardware assistance
US9609052B2 (en) 2010-12-02 2017-03-28 A10 Networks, Inc. Distributing application traffic to servers based on dynamic service response time
US9705800B2 (en) 2012-09-25 2017-07-11 A10 Networks, Inc. Load distribution in data networks
US9806943B2 (en) 2014-04-24 2017-10-31 A10 Networks, Inc. Enabling planned upgrade/downgrade of network devices without impacting network sessions
US9843484B2 (en) 2012-09-25 2017-12-12 A10 Networks, Inc. Graceful scaling in software driven networks
US9900252B2 (en) 2013-03-08 2018-02-20 A10 Networks, Inc. Application delivery controller and global server load balancer
US9906422B2 (en) 2014-05-16 2018-02-27 A10 Networks, Inc. Distributed system to determine a server's health
US9942162B2 (en) 2014-03-31 2018-04-10 A10 Networks, Inc. Active application response delay time
US9942152B2 (en) 2014-03-25 2018-04-10 A10 Networks, Inc. Forwarding data packets using a service-based forwarding policy
US9960967B2 (en) 2009-10-21 2018-05-01 A10 Networks, Inc. Determining an application delivery server based on geo-location information
US9986061B2 (en) 2014-06-03 2018-05-29 A10 Networks, Inc. Programming a data network device using user defined scripts
US9992229B2 (en) 2014-06-03 2018-06-05 A10 Networks, Inc. Programming a data network device using user defined scripts with licenses
US9992107B2 (en) 2013-03-15 2018-06-05 A10 Networks, Inc. Processing data packets using a policy based network path
US10002141B2 (en) 2012-09-25 2018-06-19 A10 Networks, Inc. Distributed database in software driven networks
US10021174B2 (en) 2012-09-25 2018-07-10 A10 Networks, Inc. Distributing service sessions
US10020979B1 (en) 2014-03-25 2018-07-10 A10 Networks, Inc. Allocating resources in multi-core computing environments
US10027761B2 (en) 2013-05-03 2018-07-17 A10 Networks, Inc. Facilitating a secure 3 party network session by a network device
US10038693B2 (en) 2013-05-03 2018-07-31 A10 Networks, Inc. Facilitating secure network traffic by an application delivery controller
US10044582B2 (en) 2012-01-28 2018-08-07 A10 Networks, Inc. Generating secure name records
US10129122B2 (en) 2014-06-03 2018-11-13 A10 Networks, Inc. User defined objects for network devices
US10230770B2 (en) 2013-12-02 2019-03-12 A10 Networks, Inc. Network proxy layer for policy-based application proxies
USRE47296E1 (en) * 2006-02-21 2019-03-12 A10 Networks, Inc. System and method for an adaptive TCP SYN cookie with time validation
US10243791B2 (en) 2015-08-13 2019-03-26 A10 Networks, Inc. Automated adjustment of subscriber policies

Families Citing this family (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7720977B1 (en) * 2003-02-11 2010-05-18 Foundry Networks, Inc. Cookie invalidation or expiration by a switch
US8149708B2 (en) * 2006-04-20 2012-04-03 Cisco Technology, Inc. Dynamically switching streams of packets among dedicated and shared queues
US8205080B2 (en) * 2007-05-11 2012-06-19 Microsoft Corporation Over the air communication authentication using a device token
US8296835B2 (en) * 2007-05-11 2012-10-23 Microsoft Corporation Over the air communication authentication using a service token
US7921282B1 (en) 2007-08-20 2011-04-05 F5 Networks, Inc. Using SYN-ACK cookies within a TCP/IP protocol
CN102014110A (en) * 2009-09-08 2011-04-13 华为技术有限公司 Method for authenticating communication flows, communication system and protective device
KR101263329B1 (en) * 2009-12-02 2013-05-16 한국전자통신연구원 Network attack protection apparatus and method, a packet transmission and reception processing apparatus and method, including this
US8380994B2 (en) * 2009-12-23 2013-02-19 Citrix Systems, Inc. Systems and methods for generating and managing cookie signatures for prevention of HTTP denial of service in multi-core system
KR101510432B1 (en) * 2010-12-22 2015-04-10 한국전자통신연구원 Apparatus for analizing traffic
US8595477B1 (en) * 2011-03-24 2013-11-26 Google Inc. Systems and methods for reducing handshake delay in streaming protocol web requests
US9027129B1 (en) * 2012-04-30 2015-05-05 Brocade Communications Systems, Inc. Techniques for protecting against denial of service attacks
CN103491061B (en) * 2012-06-13 2017-02-15 华为技术有限公司 Ease the attack, the serial number to provide a method and apparatus
US9106561B2 (en) 2012-12-06 2015-08-11 A10 Networks, Inc. Configuration of a virtual service network
US8978143B2 (en) 2013-01-02 2015-03-10 Verisign, Inc. Reverse authorized SYN cookie
KR20150084307A (en) * 2014-01-13 2015-07-22 삼성전자주식회사 Apparatus and method for controlling an web loading time in a network
US9848067B2 (en) * 2014-04-25 2017-12-19 Cisco Technology, Inc. Managing sequence values with added headers in computing devices

Citations (24)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5958053A (en) * 1997-01-30 1999-09-28 At&T Corp. Communications protocol with improved security
US6047268A (en) * 1997-11-04 2000-04-04 A.T.&T. Corporation Method and apparatus for billing for transactions conducted over the internet
US6321338B1 (en) * 1998-11-09 2001-11-20 Sri International Network surveillance
US20020103916A1 (en) * 2000-09-07 2002-08-01 Benjie Chen Thwarting connection-based denial of service attacks
US20030135625A1 (en) * 2002-01-15 2003-07-17 International Business Machines Corporation Blended SYN cookies
US6772334B1 (en) * 2000-08-31 2004-08-03 Networks Associates, Inc. System and method for preventing a spoofed denial of service attack in a networked computing environment
US6779033B1 (en) * 2000-12-28 2004-08-17 Networks Associates Technology, Inc. System and method for transacting a validated application session in a networked computing environment
US20050240989A1 (en) * 2004-04-23 2005-10-27 Seoul National University Industry Foundation Method of sharing state between stateful inspection firewalls on mep network
US20060023721A1 (en) * 2004-07-29 2006-02-02 Ntt Docomo, Inc. Server device, method for controlling a server device, and method for establishing a connection using the server device
US7010605B1 (en) * 2000-08-29 2006-03-07 Microsoft Corporation Method and apparatus for encoding and storing session data
US20060069804A1 (en) * 2004-08-25 2006-03-30 Ntt Docomo, Inc. Server device, client device, and process execution method
US20060280121A1 (en) * 2005-06-13 2006-12-14 Fujitsu Limited Frame-transfer control device, DoS-attack preventing device, and DoS-attack preventing system
US20070019543A1 (en) * 2005-07-06 2007-01-25 Fortinet, Inc. Systems and methods for detecting and preventing flooding attacks in a network environment
US7254133B2 (en) * 2002-07-15 2007-08-07 Intel Corporation Prevention of denial of service attacks
US20070185998A1 (en) * 2006-02-06 2007-08-09 Cisco Technology, Inc. Supporting options in a communication session using a TCP cookie
US20070195792A1 (en) * 2006-02-21 2007-08-23 A10 Networks Inc. System and method for an adaptive TCP SYN cookie with time validation
US7269850B2 (en) * 2002-12-31 2007-09-11 Intel Corporation Systems and methods for detecting and tracing denial of service attacks
US7301899B2 (en) * 2001-01-31 2007-11-27 Comverse Ltd. Prevention of bandwidth congestion in a denial of service or other internet-based attack
US7370353B2 (en) * 2001-11-05 2008-05-06 Cisco Technology, Inc. System and method for managing dynamic network sessions
US7391725B2 (en) * 2004-05-18 2008-06-24 Christian Huitema System and method for defeating SYN attacks
US7430755B1 (en) * 2002-09-03 2008-09-30 Fs Networks, Inc. Method and system for providing persistence in a secure network access
US7506360B1 (en) * 2002-10-01 2009-03-17 Mirage Networks, Inc. Tracking communication for determining device states
US7512980B2 (en) * 2001-11-30 2009-03-31 Lancope, Inc. Packet sampling flow-based detection of network intrusions
US7552323B2 (en) * 2002-11-18 2009-06-23 Liquidware Labs, Inc. System, apparatuses, methods, and computer-readable media using identification data in packet communications

Family Cites Families (403)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5218602A (en) 1991-04-04 1993-06-08 Dsc Communications Corporation Interprocessor switching network
TW269763B (en) 1995-09-12 1996-02-01 Ind Tech Res Inst Seamless handoff for a wireless/wired LAN internetworking
JP2962203B2 (en) 1995-09-28 1999-10-12 日本電気株式会社 Load balancing method in the online information processing system
US5875185A (en) 1995-10-10 1999-02-23 Industrial Technology Research Inst. Seamless handoff for a wireless lan/wired lan internetworking
US5935207A (en) 1996-06-03 1999-08-10 Webtv Networks, Inc. Method and apparatus for providing remote site administrators with user hits on mirrored web sites
US5862339A (en) 1996-07-09 1999-01-19 Webtv Networks, Inc. Client connects to an internet access provider using algorithm downloaded from a central server based upon client's desired criteria after disconnected from the server
US5774660A (en) 1996-08-05 1998-06-30 Resonate, Inc. World-wide-web server with delayed resource-binding for resource-based load balancing on a distributed resource multi-node network
US6075783A (en) 1997-03-06 2000-06-13 Bell Atlantic Network Services, Inc. Internet phone to PSTN cellular/PCS system
US5995981A (en) 1997-06-16 1999-11-30 Telefonaktiebolaget Lm Ericsson Initialization of replicated data objects
EP1021757A1 (en) 1997-07-25 2000-07-26 Starvox, Inc. Apparatus and method for integrated voice gateway
JP3346234B2 (en) 1997-08-12 2002-11-18 ケイディーディーアイ株式会社 Inter-network routing control communication system of the circuit-switched network and the Internet network
JP3369445B2 (en) 1997-09-22 2003-01-20 富士通株式会社 Network service server load adjusting apparatus, method and recording medium
JP5066702B2 (en) 2000-09-29 2012-11-07 アラクリテック・インコーポレイテッド Intelligent network storage interface systems and devices
US7167927B2 (en) 1997-10-14 2007-01-23 Alacritech, Inc. TCP/IP offload device with fast-path TCP ACK generating and transmitting mechanism
US7237036B2 (en) 1997-10-14 2007-06-26 Alacritech, Inc. Fast-path apparatus for receiving data corresponding a TCP connection
US8782199B2 (en) 1997-10-14 2014-07-15 A-Tech Llc Parsing a packet header
US6226680B1 (en) 1997-10-14 2001-05-01 Alacritech, Inc. Intelligent network interface system method for protocol processing
US6003069A (en) 1997-12-16 1999-12-14 Lexmark International, Inc. Client/server printer driver system
US6167062A (en) 1998-02-02 2000-12-26 Tellabs Operations, Inc. System and associated method for the synchronization and control of multiplexed payloads over a telecommunications network
US6131163A (en) 1998-02-17 2000-10-10 Cisco Technology, Inc. Network gateway mechanism having a protocol stack proxy
US6459682B1 (en) 1998-04-07 2002-10-01 International Business Machines Corporation Architecture for supporting service level agreements in an IP network
JPH11338836A (en) 1998-05-25 1999-12-10 Nippon Telegr & Teleph Corp <Ntt> Load distribution system for computer network
US6434620B1 (en) 1998-08-27 2002-08-13 Alacritech, Inc. TCP/IP offload network interface device
US6219706B1 (en) 1998-10-16 2001-04-17 Cisco Technology, Inc. Access control for networks
US7418504B2 (en) 1998-10-30 2008-08-26 Virnetx, Inc. Agile network protocol for secure communications using secure domain names
US6571274B1 (en) 1998-11-05 2003-05-27 Beas Systems, Inc. Clustered enterprise Java™ in a secure distributed processing system
US6850965B2 (en) 1998-11-17 2005-02-01 Arthur Douglas Allen Method for connection acceptance and rapid determination of optimal multi-media content delivery over network
US6952728B1 (en) 1999-12-01 2005-10-04 Nortel Networks Limited Providing desired service policies to subscribers accessing internet
TW444478B (en) 1998-12-10 2001-07-01 Ind Tech Res Inst Ethernet switch IC with shared memory structure and its network
US6483600B1 (en) 1999-02-26 2002-11-19 3Com Corporation System and method for communicating real-time facsimiles over data networks
AU3740500A (en) 1999-03-12 2000-09-28 Nortel Networks Limited Method and apparatus for accessing network information on a network device
JP2000276432A (en) 1999-03-24 2000-10-06 Nec Corp Dynamic load distribution system for transaction message
JP2000307634A (en) 1999-04-15 2000-11-02 Kdd Corp Congestion control method by repeating station of packet exchanging network
EP1049307A1 (en) 1999-04-29 2000-11-02 International Business Machines Corporation Method and system for dispatching client sessions within a cluster of servers connected to the World Wide Web
TW425821B (en) 1999-05-31 2001-03-11 Ind Tech Res Inst Key management method
US20010049741A1 (en) 1999-06-18 2001-12-06 Bryan D. Skene Method and system for balancing load distribution on a wide area network
EP1067458A1 (en) 1999-07-09 2001-01-10 CANAL+ Société Anonyme Running and testing applications
US6374300B2 (en) 1999-07-15 2002-04-16 F5 Networks, Inc. Method and system for storing load balancing information with an HTTP cookie
JP2001051859A (en) 1999-08-11 2001-02-23 Hitachi Ltd Load information communication method
AU6902300A (en) 1999-08-13 2001-03-13 Sun Microsystems, Inc. Graceful distribution in application server load balancing
WO2001014990A1 (en) 1999-08-21 2001-03-01 Webever, Inc. Method for content delivery over the internet
US8032634B1 (en) 1999-08-23 2011-10-04 Oracle America, Inc. Approach for allocating resources to an apparatus based on resource requirements
US8019870B1 (en) 1999-08-23 2011-09-13 Oracle America, Inc. Approach for allocating resources to an apparatus based on alternative resource requirements
US8179809B1 (en) 1999-08-23 2012-05-15 Oracle America, Inc. Approach for allocating resources to an apparatus based on suspendable resource requirements
US7463648B1 (en) 1999-08-23 2008-12-09 Sun Microsystems, Inc. Approach for allocating resources to an apparatus based on optional resource requirements
US7703102B1 (en) 1999-08-23 2010-04-20 Oracle America, Inc. Approach for allocating resources to an apparatus based on preemptable resource requirements
US6578066B1 (en) 1999-09-17 2003-06-10 Alteon Websystems Distributed load-balancing internet servers
US6600738B1 (en) 1999-10-02 2003-07-29 Ericsson, Inc. Routing in an IP network based on codec availability and subscriber preference
US6748414B1 (en) 1999-11-15 2004-06-08 International Business Machines Corporation Method and apparatus for the load balancing of non-identical servers in a network environment
US6754706B1 (en) 1999-12-16 2004-06-22 Speedera Networks, Inc. Scalable domain name system with persistence and load balancing
US6587866B1 (en) 2000-01-10 2003-07-01 Sun Microsystems, Inc. Method for distributing packets to server nodes using network client affinity and packet distribution table
US6820133B1 (en) 2000-02-07 2004-11-16 Netli, Inc. System and method for high-performance delivery of web content using high-performance communications protocol between the first and second specialized intermediate nodes to optimize a measure of communications performance between the source and the destination
US6725272B1 (en) 2000-02-18 2004-04-20 Netscaler, Inc. Apparatus, method and computer program product for guaranteed content delivery incorporating putting a client on-hold based on response time
US6804224B1 (en) 2000-02-29 2004-10-12 3Com Corporation System and method for providing telephone service having private branch exchange features in a voice-over-data network telephony system
US8380854B2 (en) 2000-03-21 2013-02-19 F5 Networks, Inc. Simplified method for processing multiple connections from the same client
US7533409B2 (en) 2001-03-22 2009-05-12 Corente, Inc. Methods and systems for firewalling virtual private networks
JP2001298449A (en) 2000-04-12 2001-10-26 Matsushita Electric Ind Co Ltd Security communication method, communication system and its unit
US20020032799A1 (en) 2000-05-02 2002-03-14 Globalstar L.P. Deferring DNS service for a satellite ISP system using non-geosynchronous orbit satellites
TW518864B (en) * 2000-05-12 2003-01-21 Ibm Methods and system for defeating TCP SYN flooding attacks
US20040103315A1 (en) 2001-06-07 2004-05-27 Geoffrey Cooper Assessment tool
US20030061506A1 (en) 2001-04-05 2003-03-27 Geoffrey Cooper System and method for security policy
US8204082B2 (en) 2000-06-23 2012-06-19 Cloudshield Technologies, Inc. Transparent provisioning of services over a network
US7013482B1 (en) 2000-07-07 2006-03-14 802 Systems Llc Methods for packet filtering including packet invalidation if packet validity determination not timely made
US7814180B2 (en) 2000-07-13 2010-10-12 Infoblox, Inc. Domain name service server
CN1200368C (en) 2000-08-18 2005-05-04 清华大学 Local re-transmission method o fusing TCP for un-reliable transmission network
US7711790B1 (en) * 2000-08-24 2010-05-04 Foundry Networks, Inc. Securing an accessible computer system
EP1189404A1 (en) 2000-08-29 2002-03-20 Alcatel Data network
JP3501361B2 (en) 2000-09-04 2004-03-02 インターナショナル・ビジネス・マシーンズ・コーポレーション Computer network system, computer system, a method of communication between computer systems, performance measurement method and a recording medium of a computer system
JP2002091936A (en) 2000-09-11 2002-03-29 Hitachi Ltd Device for distributing load and method for estimating load
US9525696B2 (en) 2000-09-25 2016-12-20 Blue Coat Systems, Inc. Systems and methods for processing data flows
US7454500B1 (en) 2000-09-26 2008-11-18 Foundry Networks, Inc. Global server load balancing
US6813635B1 (en) 2000-10-13 2004-11-02 Hewlett-Packard Development Company, L.P. System and method for distributing load among redundant independent stateful world wide web server sites
AT381191T (en) 2000-10-26 2007-12-15 Prismedia Networks Inc A method and system for managing distributed contents and corresponding metadata-
US7958199B2 (en) 2001-11-02 2011-06-07 Oracle America, Inc. Switching systems and methods for storage management in digital networks
US7739398B1 (en) 2000-11-21 2010-06-15 Avaya Inc. Dynamic load balancer
US20020078164A1 (en) 2000-12-13 2002-06-20 Marnetics Ltd. System and method for data transfer acceleration in a TCP network environment
US7218722B1 (en) 2000-12-18 2007-05-15 Westell Technologies, Inc. System and method for providing call management services in a virtual private network using voice or video over internet protocol
US7031267B2 (en) 2000-12-21 2006-04-18 802 Systems Llc PLD-based packet filtering methods with PLD configuration data update of filtering rules
US7155515B1 (en) 2001-02-06 2006-12-26 Microsoft Corporation Distributed load balancing for single entry-point systems
US7149817B2 (en) 2001-02-15 2006-12-12 Neteffect, Inc. Infiniband TM work queue to TCP/IP translation
US7313822B2 (en) 2001-03-16 2007-12-25 Protegrity Corporation Application-layer security method and system
US7454523B2 (en) 2001-03-16 2008-11-18 Intel Corporation Geographic location determination including inspection of network address
GB0107967D0 (en) 2001-03-29 2001-05-23 Ibm Workload management of stateful program entities
US20020141386A1 (en) 2001-03-29 2002-10-03 Minert Brian D. System, apparatus and method for voice over internet protocol telephone calling using enhanced signaling packets and localized time slot interchanging
US6839700B2 (en) 2001-05-23 2005-01-04 International Business Machines Corporation Load balancing content requests using dynamic document generation cost information
US7269632B2 (en) 2001-06-05 2007-09-11 Xdyne, Inc. Networked computer system for communicating and operating in a virtual reality environment
GB0113844D0 (en) 2001-06-07 2001-08-01 Marconi Comm Ltd Real time processing
EP1405475A4 (en) 2001-06-18 2008-07-23 Tatara Systems Inc Method and apparatus for converging local area and wide area wireless data networks
US6944678B2 (en) 2001-06-18 2005-09-13 Transtech Networks Usa, Inc. Content-aware application switch and methods thereof
US8180921B2 (en) 2001-06-19 2012-05-15 Intel Corporation Method and apparatus for load balancing
US7343399B2 (en) 2001-06-25 2008-03-11 Nortel Networks Limited Apparatus and method for managing internet resource requests
ES2235065T3 (en) 2001-07-03 2005-07-01 Telefonaktiebolaget Lm Ericsson (Publ) Method and system for managing multiple records.
US7305492B2 (en) 2001-07-06 2007-12-04 Juniper Networks, Inc. Content service aggregation system
US7509369B1 (en) 2001-07-11 2009-03-24 Swsoft Holdings, Ltd. Balancing shared servers in virtual environments
US7366794B2 (en) 2001-07-13 2008-04-29 Certicom Corp. Method and apparatus for resolving a web site address when connected with a virtual private network (VPN)
US7072958B2 (en) 2001-07-30 2006-07-04 Intel Corporation Identifying network management policies
US20040187032A1 (en) 2001-08-07 2004-09-23 Christoph Gels Method, data carrier, computer system and computer progamme for the identification and defence of attacks in server of network service providers and operators
US7039037B2 (en) 2001-08-20 2006-05-02 Wang Jiwei R Method and apparatus for providing service selection, redirection and managing of subscriber access to multiple WAP (Wireless Application Protocol) gateways simultaneously
EP2403219B1 (en) 2001-09-28 2014-10-22 Level 3 CDN International, Inc. Method for name to address resolution
FR2830397B1 (en) 2001-09-28 2004-12-03 Evolium Sas Method to improve the performance of a transmission protocol using a retransmission timer
JP3730563B2 (en) 2001-11-02 2006-01-05 キヤノンソフトウェア株式会社 Session management apparatus and session management method and program and recording medium
JP2003186776A (en) 2001-12-13 2003-07-04 Hitachi Ltd Congestion control system
WO2003060671A2 (en) 2002-01-04 2003-07-24 Lab 7 Networks, Inc. Communication security system
US6633835B1 (en) 2002-01-10 2003-10-14 Networks Associates Technology, Inc. Prioritized data capture, classification and filtering in a network monitoring environment
US8090866B1 (en) 2002-01-18 2012-01-03 Cisco Technology, Inc. TCP proxy connection management in a gigabit environment
US7076555B1 (en) 2002-01-23 2006-07-11 Novell, Inc. System and method for transparent takeover of TCP connections between servers
CN1714545A (en) 2002-01-24 2005-12-28 艾维西系统公司 System and method for fault tolerant data communication
US7240330B2 (en) 2002-02-01 2007-07-03 John Fairweather Use of ontologies for auto-generating and handling applications, their persistent storage, and user interfaces
US7584262B1 (en) 2002-02-11 2009-09-01 Extreme Networks Method of and system for allocating resources to resource requests based on application of persistence policies
US7228359B1 (en) 2002-02-12 2007-06-05 Cisco Technology, Inc. Methods and apparatus for providing domain name service based on a client identifier
CA2372092C (en) 2002-02-15 2010-04-06 Cognos Incorporated A queuing model for a plurality of servers
US20030195962A1 (en) 2002-04-10 2003-10-16 Satoshi Kikuchi Load balancing of servers
US8554929B1 (en) 2002-05-03 2013-10-08 Foundry Networks, Llc Connection rate limiting for server load balancing and transparent cache switching
US7707295B1 (en) 2002-05-03 2010-04-27 Foundry Networks, Inc. Connection rate limiting
US7340535B1 (en) 2002-06-04 2008-03-04 Fortinet, Inc. System and method for controlling routing in a virtual router system
US6888807B2 (en) 2002-06-10 2005-05-03 Ipr Licensing, Inc. Applying session services based on packet flows
US7487264B2 (en) 2002-06-11 2009-02-03 Pandya Ashish A High performance IP processor
SE525271C2 (en) 2002-06-19 2005-01-18 Marratech Ab Device and method for transmitting private information in a group communication system
US7277963B2 (en) 2002-06-26 2007-10-02 Sandvine Incorporated TCP proxy providing application layer modifications
US7418494B2 (en) 2002-07-25 2008-08-26 Intellectual Ventures Holding 40 Llc Method and system for background replication of data objects
US7069438B2 (en) * 2002-08-19 2006-06-27 Sowl Associates, Inc. Establishing authenticated network connections
US7337241B2 (en) 2002-09-27 2008-02-26 Alacritech, Inc. Fast-path apparatus for receiving data corresponding to a TCP connection
US7236457B2 (en) 2002-10-04 2007-06-26 Intel Corporation Load balancing in a network
US7487248B2 (en) 2002-10-08 2009-02-03 Brian Moran Method and system for transferring a computer session between devices
US7792113B1 (en) 2002-10-21 2010-09-07 Cisco Technology, Inc. Method and system for policy-based forwarding
US7310686B2 (en) 2002-10-27 2007-12-18 Paxfire, Inc. Apparatus and method for transparent selection of an Internet server based on geographic location of a user
US7406087B1 (en) 2002-11-08 2008-07-29 Juniper Networks, Inc. Systems and methods for accelerating TCP/IP data stream processing
US7269348B1 (en) 2002-11-18 2007-09-11 At&T Corp. Router having dual propagation paths for packets
US7945673B2 (en) 2002-12-06 2011-05-17 Hewlett-Packard Development Company, L.P. Reduced wireless internet connect time
US7379958B2 (en) 2002-12-30 2008-05-27 Nokia Corporation Automatic and dynamic service information delivery from service providers to data terminals in an access point network
US6904439B2 (en) 2002-12-31 2005-06-07 International Business Machines Corporation System and method for aggregating user project information in a multi-server system
US7234161B1 (en) 2002-12-31 2007-06-19 Nvidia Corporation Method and apparatus for deflecting flooding attacks
US7089231B2 (en) 2002-12-31 2006-08-08 International Business Machines Corporation System and method for searching a plurality of databases distributed across a multi server domain
US7194480B2 (en) 2002-12-31 2007-03-20 International Business Machines Corporation System and method for invoking methods on place objects in a distributed environment
US20040141005A1 (en) 2003-01-22 2004-07-22 International Business Machines Corporation System and method for integrating online meeting materials in a place
US7167874B2 (en) 2003-01-22 2007-01-23 International Business Machines Corporation System and method for command line administration of project spaces using XML objects
US7835363B2 (en) 2003-02-12 2010-11-16 Broadcom Corporation Method and system to provide blade server load balancing using spare link bandwidth
US7979694B2 (en) * 2003-03-03 2011-07-12 Cisco Technology, Inc. Using TCP to authenticate IP source addresses
US20040210623A1 (en) 2003-03-06 2004-10-21 Aamer Hydrie Virtual network topology generation
WO2004084085A1 (en) 2003-03-18 2004-09-30 Fujitsu Limited Load distributing system by intersite cooperation
US20040210663A1 (en) 2003-04-15 2004-10-21 Paul Phillips Object-aware transport-layer network processing engine
US7373500B2 (en) 2003-04-15 2008-05-13 Sun Microsystems, Inc. Secure network processing
US7308499B2 (en) 2003-04-30 2007-12-11 Avaya Technology Corp. Dynamic load balancing for enterprise IP traffic
US7181524B1 (en) 2003-06-13 2007-02-20 Veritas Operating Corporation Method and apparatus for balancing a load among a plurality of servers in a computer system
US7613822B2 (en) 2003-06-30 2009-11-03 Microsoft Corporation Network load balancing with session information
US7590736B2 (en) 2003-06-30 2009-09-15 Microsoft Corporation Flexible network load balancing
US7636917B2 (en) 2003-06-30 2009-12-22 Microsoft Corporation Network load balancing with host status information
US20050027862A1 (en) 2003-07-18 2005-02-03 Nguyen Tien Le System and methods of cooperatively load-balancing clustered servers
US7814093B2 (en) 2003-07-25 2010-10-12 Microsoft Corporation Method and system for building a report for execution against a data store
KR100568231B1 (en) 2003-08-11 2006-04-07 삼성전자주식회사 Domain name service system and service method thereof
US7385923B2 (en) 2003-08-14 2008-06-10 International Business Machines Corporation Method, system and article for improved TCP performance during packet reordering
US7467202B2 (en) 2003-09-10 2008-12-16 Fidelis Security Systems High-performance network content analysis platform
KR100570836B1 (en) 2003-10-14 2006-04-13 한국전자통신연구원 A Server Load Balancing Device and Method using Load Balancing Session Label
CN100456690C (en) 2003-10-14 2009-01-28 北京邮电大学 Whole load equalizing method based on global network positioning
US7472190B2 (en) 2003-10-17 2008-12-30 International Business Machines Corporation Method, system and program product for preserving a user state in an application
JP2005141441A (en) 2003-11-06 2005-06-02 Hitachi Ltd Load distribution system
US20050125276A1 (en) 2003-12-05 2005-06-09 Grigore Rusu System and method for event tracking across plural contact mediums
US6996070B2 (en) 2003-12-05 2006-02-07 Alacritech, Inc. TCP/IP offload device with reduced sequential processing
US20050213586A1 (en) 2004-02-05 2005-09-29 David Cyganski System and method to increase network throughput
US7881215B1 (en) 2004-03-18 2011-02-01 Avaya Inc. Stateful and stateless data processing
WO2005104442A2 (en) * 2004-04-15 2005-11-03 Airgo Networks, Inc. Packet concatenation in wireless networks
US20060064478A1 (en) 2004-05-03 2006-03-23 Level 3 Communications, Inc. Geo-locating load balancing
US20060112170A1 (en) 2004-05-03 2006-05-25 Craig Sirkin Geo-locating load balancing
US7584301B1 (en) 2004-05-06 2009-09-01 Foundry Networks, Inc. Host-level policies for global server load balancing
US8423758B2 (en) 2004-05-10 2013-04-16 Tara Chand Singhal Method and apparatus for packet source validation architecture system for enhanced internet security
US8179786B2 (en) 2004-05-19 2012-05-15 Mosaid Technologies Incorporated Dynamic traffic rearrangement and restoration for MPLS networks with differentiated services capabilities
US7979072B2 (en) 2004-06-04 2011-07-12 Nortel Networks Limited Method and system for soft handoff in mobile broadband systems
US7990849B2 (en) 2004-06-17 2011-08-02 Hewlett-Packard Development Company, L.P. Automated recovery from a split segment condition in a layer2 network for teamed network resources of a computer system
US20060069774A1 (en) 2004-06-17 2006-03-30 International Business Machine Corporation Method and apparatus for managing data center using Web services
FI20040888A0 (en) 2004-06-28 2004-06-28 Nokia Corp Controlling services, packet-switched data network
US8688834B2 (en) 2004-07-09 2014-04-01 Toshiba America Research, Inc. Dynamic host configuration and network access authentication
CN1317853C (en) 2004-07-20 2007-05-23 联想网御科技(北京)有限公司 Network safety equipment and assemblied system and method for implementing high availability
TW200606667A (en) 2004-08-13 2006-02-16 Reallusion Inc System and method of converting and sharing data
US7423977B1 (en) 2004-08-23 2008-09-09 Foundry Networks Inc. Smoothing algorithm for round trip time (RTT) measurements
US7292592B2 (en) 2004-10-08 2007-11-06 Telefonaktiebolaget Lm Ericsson (Publ) Home network-assisted selection of intermediary network for a roaming mobile terminal
US20060092950A1 (en) 2004-10-28 2006-05-04 Cisco Technology, Inc. Architecture and method having redundancy in active/active stateful devices based on symmetric global load balancing protocol (sGLBP)
US20060098645A1 (en) 2004-11-09 2006-05-11 Lev Walkin System and method for providing client identifying information to a server
US7634564B2 (en) 2004-11-18 2009-12-15 Nokia Corporation Systems and methods for invoking a service from a plurality of event servers in a network
US7539132B2 (en) 2005-01-21 2009-05-26 At&T Intellectual Property Ii, L.P. Methods, systems, and devices for determining COS level
WO2006082507A1 (en) * 2005-02-04 2006-08-10 Nokia Corporation Apparatus, method and computer program product to reduce tcp flooding attacks while conserving wireless network bandwidth
US20060190997A1 (en) 2005-02-22 2006-08-24 Mahajani Amol V Method and system for transparent in-line protection of an electronic communications network
US20060187901A1 (en) 2005-02-23 2006-08-24 Lucent Technologies Inc. Concurrent dual-state proxy server, method of providing a proxy and SIP network employing the same
US8533473B2 (en) 2005-03-04 2013-09-10 Oracle America, Inc. Method and apparatus for reducing bandwidth usage in secure transactions
US20060206586A1 (en) 2005-03-09 2006-09-14 Yibei Ling Method, apparatus and system for a location-based uniform resource locator
WO2006098033A1 (en) 2005-03-17 2006-09-21 Fujitsu Limited Load-distributing communication device and load-distribution managing device
KR101141645B1 (en) 2005-03-29 2012-05-17 엘지전자 주식회사 Method for Controlling Transmission of Data Block
US7606147B2 (en) 2005-04-13 2009-10-20 Zeugma Systems Inc. Application aware traffic shaping service node positioned between the access and core networks
US7990847B1 (en) 2005-04-15 2011-08-02 Cisco Technology, Inc. Method and system for managing servers in a server cluster
KR100642935B1 (en) 2005-05-06 2006-10-31 (주)아이디스 Name service system and method thereof
US7826487B1 (en) * 2005-05-09 2010-11-02 F5 Network, Inc Coalescing acknowledgement responses to improve network communications
JP4101251B2 (en) 2005-05-24 2008-06-18 富士通株式会社 Load distribution program, the load balancing method, and a load balancer
IES20050376A2 (en) 2005-06-03 2006-08-09 Asavie R & D Ltd Secure network communication system and method
US20060277303A1 (en) 2005-06-06 2006-12-07 Nikhil Hegde Method to improve response time when clients use network services
US8458467B2 (en) 2005-06-21 2013-06-04 Cisco Technology, Inc. Method and apparatus for adaptive application message payload content transformation in a network infrastructure element
US7774402B2 (en) 2005-06-29 2010-08-10 Visa U.S.A. Adaptive gateway for switching transactions and data on unreliable networks using context-based rules
US20070022479A1 (en) 2005-07-21 2007-01-25 Somsubhra Sikdar Network interface and firewall device
US7496566B2 (en) 2005-08-03 2009-02-24 Intenational Business Machines Corporation Priority based LDAP service publication mechanism
US8982778B2 (en) 2005-09-19 2015-03-17 Qualcomm Incorporated Packet routing in a wireless communications environment
EP1770915A1 (en) 2005-09-29 2007-04-04 Matsushita Electric Industrial Co., Ltd. Policy control in the evolved system architecture
US20070086382A1 (en) 2005-10-17 2007-04-19 Vidya Narayanan Methods of network access configuration in an IP network
JP4650203B2 (en) 2005-10-20 2011-03-16 株式会社日立製作所 Information systems and management computer
US7606232B1 (en) 2005-11-09 2009-10-20 Juniper Networks, Inc. Dynamic virtual local area network (VLAN) interface configuration
US20070118881A1 (en) 2005-11-18 2007-05-24 Julian Mitchell Application control at a policy server
CN100461692C (en) 2005-11-28 2009-02-11 华为技术有限公司 Allocation system and method of network equipment
US7694011B2 (en) 2006-01-17 2010-04-06 Cisco Technology, Inc. Techniques for load balancing over a cluster of subscriber-aware application servers
CN100452041C (en) 2006-01-18 2009-01-14 腾讯科技(深圳)有限公司 Method and system for reading information at network resource site, and searching engine
US8149771B2 (en) 2006-01-31 2012-04-03 Roundbox, Inc. Reliable event broadcaster with multiplexing and bandwidth control functions
US8116312B2 (en) 2006-02-08 2012-02-14 Solarflare Communications, Inc. Method and apparatus for multicast packet reception
US7808994B1 (en) 2006-02-22 2010-10-05 Juniper Networks, Inc. Forwarding traffic to VLAN interfaces built based on subscriber information strings
US7492766B2 (en) 2006-02-22 2009-02-17 Juniper Networks, Inc. Dynamic building of VLAN interfaces based on subscriber information strings
US8832247B2 (en) 2006-03-24 2014-09-09 Blue Coat Systems, Inc. Methods and systems for caching content at multiple levels
JP5108244B2 (en) 2006-03-30 2012-12-26 株式会社エヌ・ティ・ティ・ドコモ Communication terminals and a retransmission control method
US8170572B2 (en) 2006-04-14 2012-05-01 Qualcomm Incorporated Methods and apparatus for supporting quality of service in communication systems
US7907970B2 (en) 2006-04-14 2011-03-15 Qualcomm Incorporated Providing quality of service for various traffic flows in a communications environment
US8539075B2 (en) 2006-04-21 2013-09-17 International Business Machines Corporation On-demand global server load balancing system and method of use
US7733781B2 (en) 2006-04-24 2010-06-08 Broadcom Corporation Distributed congestion avoidance in a network switching system
US7680478B2 (en) 2006-05-04 2010-03-16 Telefonaktiebolaget Lm Ericsson (Publ) Inactivity monitoring for different traffic or service classifications
WO2008005102A2 (en) 2006-05-13 2008-01-10 Sap Ag Consistent set of interfaces derived from a business object model
KR100830413B1 (en) 2006-05-25 2008-05-20 (주)씨디네트웍스 Server connection system and load balancing network system
US20070283429A1 (en) 2006-05-30 2007-12-06 A10 Networks Inc. Sequence number based TCP session proxy
GB0611249D0 (en) 2006-06-07 2006-07-19 Nokia Corp Communication system
US20070288247A1 (en) 2006-06-11 2007-12-13 Michael Mackay Digital life server
US20070294209A1 (en) 2006-06-20 2007-12-20 Lyle Strub Communication network application activity monitoring and control
WO2008003334A1 (en) 2006-07-03 2008-01-10 Telefonaktiebolaget L M Ericsson (Publ) Topology hiding of mobile agents
US20080016161A1 (en) 2006-07-14 2008-01-17 George Tsirtsis Methods and apparatus for using electronic envelopes to configure parameters
US7970934B1 (en) 2006-07-31 2011-06-28 Google Inc. Detecting events of interest
EP1885096B1 (en) 2006-08-01 2012-07-04 Alcatel Lucent Application session border element
JP4916809B2 (en) 2006-08-04 2012-04-18 エヌ・ティ・ティ・アドバンステクノロジ株式会社 Load distribution control apparatus and method
US7580417B2 (en) 2006-08-07 2009-08-25 Cisco Technology, Inc. Method and apparatus for load balancing over virtual network links
US8332925B2 (en) 2006-08-08 2012-12-11 A10 Networks, Inc. System and method for distributed multi-processing security gateway
US8079077B2 (en) 2006-08-08 2011-12-13 A10 Networks, Inc. System and method for distributed multi-processing security gateway
JP4724629B2 (en) 2006-09-14 2011-07-13 富士通株式会社 Broadcast distribution system and broadcast delivery method
US8312507B2 (en) 2006-10-17 2012-11-13 A10 Networks, Inc. System and method to apply network traffic policy to an application session
US7716378B2 (en) 2006-10-17 2010-05-11 A10 Networks, Inc. System and method to associate a private user identity with a public user identity
US8584199B1 (en) 2006-10-17 2013-11-12 A10 Networks, Inc. System and method to apply a packet routing policy to an application session
JP4680866B2 (en) 2006-10-31 2011-05-11 株式会社日立製作所 Packet transfer apparatus having a gateway load balancing
US8149807B2 (en) 2006-11-01 2012-04-03 Panasonic Corporation Communication control method, communication system, home agent allocation server, and mobile node
US8584195B2 (en) 2006-11-08 2013-11-12 Mcafee, Inc Identities correlation infrastructure for passive network monitoring
CN101193089B (en) 2006-11-20 2010-11-03 阿里巴巴集团控股有限公司 Stateful session system and its realization method
CN101094225B (en) 2006-11-24 2011-05-11 中兴通讯股份有限公司 Network, system and method of differentiated security service
US7974286B2 (en) 2006-12-04 2011-07-05 International Business Machines Corporation Reduced redundant security screening
WO2008078593A1 (en) 2006-12-22 2008-07-03 International Business Machines Corporation Message hub, program, and method
US7992192B2 (en) 2006-12-29 2011-08-02 Ebay Inc. Alerting as to denial of service attacks
US9155118B2 (en) 2007-01-22 2015-10-06 Qualcomm Incorporated Multi-link support for network based mobility management systems
US8548520B2 (en) 2007-01-26 2013-10-01 Wi-Lan Inc. Multiple network access system and method
US8379515B1 (en) 2007-02-01 2013-02-19 F5 Networks, Inc. TCP throughput control by imposing temporal delay
US8631147B2 (en) 2007-03-12 2014-01-14 Citrix Systems, Inc. Systems and methods for configuring policy bank invocations
CN100531098C (en) 2007-03-13 2009-08-19 华为技术有限公司 Point-to-point network system and intercommunicating method for overlapped network node
US8352634B2 (en) 2007-04-06 2013-01-08 International Business Machines Corporation On-demand propagation of routing information in distributed computing system
US7809002B2 (en) 2007-04-16 2010-10-05 Alcatel-Lucent Usa Inc. Method and apparatus for priority services management
US7743155B2 (en) 2007-04-20 2010-06-22 Array Networks, Inc. Active-active operation for a cluster of SSL virtual private network (VPN) devices with load distribution
US20080271130A1 (en) 2007-04-30 2008-10-30 Shankar Ramamoorthy Minimizing client-side inconsistencies in a distributed virtual file system
US9143558B2 (en) 2007-05-09 2015-09-22 Radware, Ltd. Geographic resiliency and load balancing for SIP application services
US20080291911A1 (en) 2007-05-21 2008-11-27 Ist International, Inc. Method and apparatus for setting a TCP retransmission timer
US8191106B2 (en) 2007-06-07 2012-05-29 Alcatel Lucent System and method of network access security policy management for multimodal device
US7743157B2 (en) 2007-06-26 2010-06-22 Sap Ag System and method for switching between stateful and stateless communication modes
US20090024722A1 (en) 2007-07-17 2009-01-22 International Business Machines Corporation Proxying availability indications in a failover configuration
US7992201B2 (en) 2007-07-26 2011-08-02 International Business Machines Corporation Dynamic network tunnel endpoint selection
US8032632B2 (en) 2007-08-14 2011-10-04 Microsoft Corporation Validating change of name server
US9407693B2 (en) 2007-10-03 2016-08-02 Microsoft Technology Licensing, Llc Network routing of endpoints to content based on content swarms
JP4964735B2 (en) 2007-10-24 2012-07-04 株式会社日立製作所 Network system, a management computer, and filter reconstruction method
US8553537B2 (en) 2007-11-09 2013-10-08 International Business Machines Corporation Session-less load balancing of client traffic across servers in a server group
CN101163336B (en) 2007-11-15 2010-06-16 中兴通讯股份有限公司 Method of implementing mobile phone terminal access authority authentication
CN101169785A (en) 2007-11-21 2008-04-30 浪潮电子信息产业股份有限公司 Clustered database system dynamic loading balancing method
CN101442425B (en) 2007-11-22 2012-03-21 华为技术有限公司 Gateway management method, apparatus and system
GB0723422D0 (en) 2007-11-29 2008-01-09 Level 5 Networks Inc Virtualised receive side scaling
US8125908B2 (en) 2007-12-04 2012-02-28 Extrahop Networks, Inc. Adaptive network traffic classification using historical context
US8756340B2 (en) 2007-12-20 2014-06-17 Yahoo! Inc. DNS wildcard beaconing to determine client location and resolver load for global traffic load balancing
JP5296373B2 (en) 2007-12-26 2013-09-25 インターナショナル・ビジネス・マシーンズ・コーポレーションInternational Business Machines Corporation Technology to provide the time required for processing the pre
US9100268B2 (en) 2008-02-27 2015-08-04 Alcatel Lucent Application-aware MPLS tunnel selection
US7930427B2 (en) 2008-03-03 2011-04-19 Microsoft Corporation Client-side load balancing
JP2009211343A (en) 2008-03-04 2009-09-17 Kddi Corp Server device and communication system
US8185628B2 (en) 2008-03-07 2012-05-22 At&T Mobility Ii Llc Enhanced policy capabilities for mobile data services
CN101247349A (en) 2008-03-13 2008-08-20 华耀环宇科技(北京)有限公司 Network flux fast distribution method
CN101547189B (en) 2008-03-28 2011-08-10 华为技术有限公司 Method, system and device for establishing CoD service
US8151019B1 (en) 2008-04-22 2012-04-03 Lockheed Martin Corporation Adaptive network traffic shaper
US7886021B2 (en) 2008-04-28 2011-02-08 Oracle America, Inc. System and method for programmatic management of distributed computing resources
CN101261644A (en) 2008-04-30 2008-09-10 杭州华三通信技术有限公司 Method and device for accessing united resource positioning symbol database
CN101577661B (en) 2008-05-09 2013-09-11 华为技术有限公司 Method and equipment for switching path
US8345691B2 (en) 2008-05-15 2013-01-01 Cellco Partnership Scheduling with quality of service support in wireless system
WO2009150849A1 (en) 2008-06-12 2009-12-17 パナソニック株式会社 Network monitoring device, bus system monitoring device, method and program
US7990855B2 (en) 2008-07-11 2011-08-02 Alcatel-Lucent Usa Inc. Method and system for joint reverse link access and traffic channel radio frequency overload control
CN101631065B (en) 2008-07-16 2012-04-18 华为技术有限公司 Method and device for controlling congestion of wireless multi-hop network
US8271652B2 (en) 2008-07-24 2012-09-18 Netapp, Inc. Load-derived probability-based domain name service in a network storage cluster
US7890632B2 (en) 2008-08-11 2011-02-15 International Business Machines Corporation Load balancing using replication delay
US8307422B2 (en) 2008-08-14 2012-11-06 Juniper Networks, Inc. Routing device having integrated MPLS-aware firewall
CN102124697B (en) 2008-08-18 2014-08-27 F5网络公司 Upgrading network traffic management devices while maintaining availability
JP5211987B2 (en) 2008-09-26 2013-06-12 ブラザー工業株式会社 Terminal device and the time adjusting method thereof
WO2010037794A2 (en) 2008-10-03 2010-04-08 Telefonaktiebolaget Lm Ericsson (Publ) Monitoring mechanism for a distributed database
US7958247B2 (en) 2008-10-14 2011-06-07 Hewlett-Packard Development Company, L.P. HTTP push to simulate server-initiated sessions
US8266288B2 (en) 2008-10-23 2012-09-11 International Business Machines Corporation Dynamic expiration of domain name service entries
US20100106854A1 (en) 2008-10-29 2010-04-29 Hostway Corporation System and method for controlling non-existing domain traffic
JP2010108409A (en) 2008-10-31 2010-05-13 Hitachi Ltd Storage management method and management server
US8359402B2 (en) 2008-11-19 2013-01-22 Seachange International, Inc. Intercept device for providing content
US8260926B2 (en) 2008-11-25 2012-09-04 Citrix Systems, Inc. Systems and methods for GSLB site persistence
US8125911B2 (en) 2008-11-26 2012-02-28 Cisco Technology, Inc. First-hop domain reliability measurement and load balancing in a computer network
US8844018B2 (en) 2008-12-18 2014-09-23 At&T Intellectual Property I, L.P. Methods and apparatus to enhance security in residential networks
US20100205310A1 (en) 2009-02-12 2010-08-12 Yaniv Altshuler System and method for dynamically optimizing tcp window size
US9112871B2 (en) 2009-02-17 2015-08-18 Core Wireless Licensing S.A.R.L Method and apparatus for providing shared services
US8364163B2 (en) 2009-02-23 2013-01-29 Research In Motion Limited Method, system and apparatus for connecting a plurality of client machines to a plurality of servers
US20100228819A1 (en) 2009-03-05 2010-09-09 Yottaa Inc System and method for performance acceleration, data protection, disaster recovery and on-demand scaling of computer applications
CN101834777B (en) 2009-03-11 2015-07-29 瞻博网络公司 Http-based session cache acceleration
EP2234333B1 (en) 2009-03-23 2015-07-15 Corvil Limited System and method for estimation of round trip times within a tcp based data network
US8259726B2 (en) 2009-05-28 2012-09-04 Force10 Networks, Inc. Method and apparatus for forwarding table reduction
US8296434B1 (en) 2009-05-28 2012-10-23 Amazon Technologies, Inc. Providing dynamically scaling computing load balancing
US8266088B2 (en) 2009-06-09 2012-09-11 Cisco Technology, Inc. Tracking policy decisions in a network
EP2441211B1 (en) 2009-06-10 2016-03-23 Telefonaktiebolaget LM Ericsson (publ) Performance monitoring in a communication network
US8060579B2 (en) 2009-06-12 2011-11-15 Yahoo! Inc. User location dependent DNS lookup
US8289975B2 (en) 2009-06-22 2012-10-16 Citrix Systems, Inc. Systems and methods for handling a multi-connection protocol between a client and server traversing a multi-core system
US8863111B2 (en) 2009-06-26 2014-10-14 Oracle International Corporation System and method for providing a production upgrade of components within a multiprotocol gateway
US9137301B1 (en) 2009-06-30 2015-09-15 Amazon Technologies, Inc. Client based opportunistic routing
US9749387B2 (en) 2009-08-13 2017-08-29 Sap Se Transparently stateful execution of stateless applications
US9960967B2 (en) 2009-10-21 2018-05-01 A10 Networks, Inc. Determining an application delivery server based on geo-location information
WO2011049135A1 (en) 2009-10-23 2011-04-28 日本電気株式会社 Network system, control method thereof, and controller
JP5378946B2 (en) 2009-10-26 2013-12-25 株式会社日立製作所 Server management device and server management methods
US8370920B2 (en) 2009-10-28 2013-02-05 Aunigma Network Security Corp. System and method for providing unified transport and security protocols
US8311014B2 (en) 2009-11-06 2012-11-13 Telefonaktiebolaget L M Ericsson (Publ) Virtual care-of address for mobile IP (internet protocol)
US9088611B2 (en) 2009-11-25 2015-07-21 Citrix Systems, Inc. Systems and methods for client IP address insertion via TCP options
US8190736B2 (en) 2009-12-16 2012-05-29 Quantum Corporation Reducing messaging in a client-server system
US8335853B2 (en) 2009-12-17 2012-12-18 Sonus Networks, Inc. Transparent recovery of transport connections using packet translation techniques
US8255528B2 (en) 2009-12-23 2012-08-28 Citrix Systems, Inc. Systems and methods for GSLB spillover
US8285298B2 (en) 2009-12-23 2012-10-09 At&T Mobility Ii Llc Chromatic scheduler for network traffic with disparate service requirements
US7991859B1 (en) 2009-12-28 2011-08-02 Amazon Technologies, Inc. Using virtual networking devices to connect managed computer networks
US8224971B1 (en) 2009-12-28 2012-07-17 Amazon Technologies, Inc. Using virtual networking devices and routing information to initiate external actions
US20120290727A1 (en) 2009-12-31 2012-11-15 Bce Inc. Method and system for increasing performance of transmission control protocol sessions in data networks
US8789061B2 (en) 2010-02-01 2014-07-22 Ca, Inc. System and method for datacenter power management
US8301786B2 (en) 2010-02-10 2012-10-30 Cisco Technology, Inc. Application session control using packet inspection
US8804513B2 (en) 2010-02-25 2014-08-12 The Trustees Of Columbia University In The City Of New York Methods and systems for controlling SIP overload
US8533337B2 (en) 2010-05-06 2013-09-10 Citrix Systems, Inc. Continuous upgrading of computers in a load balanced environment
JP5557590B2 (en) 2010-05-06 2014-07-23 株式会社日立製作所 Load balancer and systems
US8499093B2 (en) 2010-05-14 2013-07-30 Extreme Networks, Inc. Methods, systems, and computer readable media for stateless load balancing of network traffic flows
US20110289496A1 (en) 2010-05-18 2011-11-24 North End Technologies, Inc. Method & apparatus for load balancing software update across a plurality of publish/subscribe capable client devices
US8539068B2 (en) 2010-06-07 2013-09-17 Salesforce.Com, Inc. Methods and systems for providing customized domain messages
US20110307541A1 (en) 2010-06-10 2011-12-15 Microsoft Corporation Server load balancing and draining in enhanced communication systems
US9680750B2 (en) 2010-07-06 2017-06-13 Nicira, Inc. Use of tunnels to hide network addresses
US8750164B2 (en) 2010-07-06 2014-06-10 Nicira, Inc. Hierarchical managed switch architecture
US9363312B2 (en) 2010-07-28 2016-06-07 International Business Machines Corporation Transparent header modification for reducing serving load based on current and projected usage
US8520672B2 (en) 2010-07-29 2013-08-27 Cisco Technology, Inc. Packet switching device using results determined by an application node
US8675488B1 (en) 2010-09-07 2014-03-18 Juniper Networks, Inc. Subscriber-based network traffic management
US8949410B2 (en) 2010-09-10 2015-02-03 Cisco Technology, Inc. Server load balancer scaling for virtual servers
US9215275B2 (en) 2010-09-30 2015-12-15 A10 Networks, Inc. System and method to balance servers based on server load status
US20120084460A1 (en) 2010-10-04 2012-04-05 Openwave Systems Inc. Method and system for dynamic traffic steering
US9237194B2 (en) 2010-11-05 2016-01-12 Verizon Patent And Licensing Inc. Load balancer and firewall self-provisioning system
US8533285B2 (en) 2010-12-01 2013-09-10 Cisco Technology, Inc. Directing data flows in data centers with clustering services
US9609052B2 (en) 2010-12-02 2017-03-28 A10 Networks, Inc. Distributing application traffic to servers based on dynamic service response time
US9426690B2 (en) 2010-12-07 2016-08-23 Telefonaktiebolaget Lm Ericsson (Publ) Method for enabling traffic acceleration in a mobile telecommunication network
US9152293B2 (en) 2010-12-09 2015-10-06 Verizon Patent And Licensing Inc. Server IP addressing in a computing-on-demand system
US8965957B2 (en) 2010-12-15 2015-02-24 Sap Se Service delivery framework
US8755283B2 (en) 2010-12-17 2014-06-17 Microsoft Corporation Synchronizing state among load balancer components
US9065866B2 (en) 2010-12-29 2015-06-23 Citrix Systems, Inc. Systems and methods for policy based integration to horizontally deployed WAN optimization appliances
US8477730B2 (en) 2011-01-04 2013-07-02 Cisco Technology, Inc. Distributed load management on network devices
WO2012097015A2 (en) 2011-01-11 2012-07-19 A10 Networks Inc. Virtual application delivery chassis system
JP5743589B2 (en) 2011-02-18 2015-07-01 キヤノン株式会社 Web service system, the server management device and the Web service providing method
US8732267B2 (en) 2011-03-15 2014-05-20 Cisco Technology, Inc. Placement of a cloud service using network topology and infrastructure performance
CN102143075B (en) 2011-03-28 2013-08-07 中国人民解放军国防科学技术大学 Method and system for achieving load balance
KR101246889B1 (en) 2011-04-15 2013-03-25 서강대학교산학협력단 Method and system of controlling data transfer rate for downward vertical handover in overlayed network environment
EP2628281B1 (en) 2011-04-18 2017-08-16 Nec Corporation Terminal, control device, communication method,communication system, communication module, program, and information processing device
US9154577B2 (en) 2011-06-06 2015-10-06 A10 Networks, Inc. Sychronization of configuration file of virtual application distribution chassis
US8804620B2 (en) 2011-10-04 2014-08-12 Juniper Networks, Inc. Methods and apparatus for enforcing a common user policy within a network
US8885463B1 (en) 2011-10-17 2014-11-11 Juniper Networks, Inc. Path computation element communication protocol (PCEP) extensions for stateful label switched path management
US8897154B2 (en) 2011-10-24 2014-11-25 A10 Networks, Inc. Combining stateless and stateful server load balancing
US8918501B2 (en) 2011-11-10 2014-12-23 Microsoft Corporation Pattern-based computational health and configuration monitoring
US9788362B2 (en) 2011-11-23 2017-10-10 Telefonaktiebolaget L M Ericsson Methods and arrangements for improving transmission control protocol performance in a cellular network
US8660006B2 (en) 2011-11-29 2014-02-25 Hughes Network Systems, Llc Method and system for traffic management and resource allocation on a shared access network
US9386088B2 (en) 2011-11-29 2016-07-05 A10 Networks, Inc. Accelerating service processing using fast path TCP
US9094364B2 (en) 2011-12-23 2015-07-28 A10 Networks, Inc. Methods to manage services over a service gateway
US8874790B2 (en) 2011-12-30 2014-10-28 Verisign, Inc. DNS package in a partitioned network
US9380635B2 (en) 2012-01-09 2016-06-28 Google Technology Holdings LLC Dynamic TCP layer optimization for real-time field performance
JP2013152095A (en) 2012-01-24 2013-08-08 Sony Corp Time control device, time control method and program
US10044582B2 (en) 2012-01-28 2018-08-07 A10 Networks, Inc. Generating secure name records
KR101348739B1 (en) 2012-02-22 2014-01-08 유대영 LED Lighting apparatus and LED Lighting system having the same
US9386128B2 (en) 2012-03-23 2016-07-05 Qualcomm Incorporated Delay based active queue management for uplink traffic in user equipment
CN104246738B (en) 2012-04-19 2017-02-01 英派尔科技开发有限公司 Local migration
US9027129B1 (en) 2012-04-30 2015-05-05 Brocade Communications Systems, Inc. Techniques for protecting against denial of service attacks
US8782221B2 (en) 2012-07-05 2014-07-15 A10 Networks, Inc. Method to allocate buffer for TCP proxy session based on dynamic network conditions
EP2888853B1 (en) 2012-08-23 2016-12-28 Telefonaktiebolaget LM Ericsson (publ) Tcp proxy server
US9843484B2 (en) 2012-09-25 2017-12-12 A10 Networks, Inc. Graceful scaling in software driven networks
US10002141B2 (en) 2012-09-25 2018-06-19 A10 Networks, Inc. Distributed database in software driven networks
WO2014052099A2 (en) 2012-09-25 2014-04-03 A10 Networks, Inc. Load distribution in data networks
US10021174B2 (en) 2012-09-25 2018-07-10 A10 Networks, Inc. Distributing service sessions
US9338225B2 (en) 2012-12-06 2016-05-10 A10 Networks, Inc. Forwarding policies on a virtual service network
US9106561B2 (en) 2012-12-06 2015-08-11 A10 Networks, Inc. Configuration of a virtual service network
US9531846B2 (en) 2013-01-23 2016-12-27 A10 Networks, Inc. Reducing buffer usage for TCP proxy session based on delayed acknowledgement
US9900252B2 (en) 2013-03-08 2018-02-20 A10 Networks, Inc. Application delivery controller and global server load balancer
US20140258465A1 (en) 2013-03-11 2014-09-11 Cisco Technology, Inc. Identification of originating ip address and client port connection to a web server via a proxy server
US9992107B2 (en) 2013-03-15 2018-06-05 A10 Networks, Inc. Processing data packets using a policy based network path
WO2014165538A2 (en) 2013-04-01 2014-10-09 Nebula, Inc. Update management for a distributed computing system
US10027761B2 (en) 2013-05-03 2018-07-17 A10 Networks, Inc. Facilitating a secure 3 party network session by a network device
US10038693B2 (en) 2013-05-03 2018-07-31 A10 Networks, Inc. Facilitating secure network traffic by an application delivery controller
US9225638B2 (en) 2013-05-09 2015-12-29 Vmware, Inc. Method and system for service switching using service tags
US9319476B2 (en) 2013-05-28 2016-04-19 Verizon Patent And Licensing Inc. Resilient TCP splicing for proxy services
US9461967B2 (en) 2013-07-18 2016-10-04 Palo Alto Networks, Inc. Packet classification for network routing
US10230770B2 (en) 2013-12-02 2019-03-12 A10 Networks, Inc. Network proxy layer for policy-based application proxies
US9825808B2 (en) 2014-02-24 2017-11-21 Red Hat Israel, Ltd. Network configuration via abstraction components and standard commands
US9942152B2 (en) 2014-03-25 2018-04-10 A10 Networks, Inc. Forwarding data packets using a service-based forwarding policy
US9942162B2 (en) 2014-03-31 2018-04-10 A10 Networks, Inc. Active application response delay time
US9806943B2 (en) 2014-04-24 2017-10-31 A10 Networks, Inc. Enabling planned upgrade/downgrade of network devices without impacting network sessions
US9917851B2 (en) 2014-04-28 2018-03-13 Sophos Limited Intrusion detection using a heartbeat
US9906422B2 (en) 2014-05-16 2018-02-27 A10 Networks, Inc. Distributed system to determine a server's health
US9986061B2 (en) 2014-06-03 2018-05-29 A10 Networks, Inc. Programming a data network device using user defined scripts
US10129122B2 (en) 2014-06-03 2018-11-13 A10 Networks, Inc. User defined objects for network devices
US20170048356A1 (en) 2015-08-12 2017-02-16 A10 Networks, Inc. Transmission Control of Protocol State Exchange for Dynamic Stateful Service Insertion
US10243791B2 (en) 2015-08-13 2019-03-26 A10 Networks, Inc. Automated adjustment of subscriber policies

Patent Citations (25)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5958053A (en) * 1997-01-30 1999-09-28 At&T Corp. Communications protocol with improved security
US6047268A (en) * 1997-11-04 2000-04-04 A.T.&T. Corporation Method and apparatus for billing for transactions conducted over the internet
US6321338B1 (en) * 1998-11-09 2001-11-20 Sri International Network surveillance
US7010605B1 (en) * 2000-08-29 2006-03-07 Microsoft Corporation Method and apparatus for encoding and storing session data
US6772334B1 (en) * 2000-08-31 2004-08-03 Networks Associates, Inc. System and method for preventing a spoofed denial of service attack in a networked computing environment
US20020103916A1 (en) * 2000-09-07 2002-08-01 Benjie Chen Thwarting connection-based denial of service attacks
US7398317B2 (en) * 2000-09-07 2008-07-08 Mazu Networks, Inc. Thwarting connection-based denial of service attacks
US6779033B1 (en) * 2000-12-28 2004-08-17 Networks Associates Technology, Inc. System and method for transacting a validated application session in a networked computing environment
US7301899B2 (en) * 2001-01-31 2007-11-27 Comverse Ltd. Prevention of bandwidth congestion in a denial of service or other internet-based attack
US7370353B2 (en) * 2001-11-05 2008-05-06 Cisco Technology, Inc. System and method for managing dynamic network sessions
US7512980B2 (en) * 2001-11-30 2009-03-31 Lancope, Inc. Packet sampling flow-based detection of network intrusions
US20030135625A1 (en) * 2002-01-15 2003-07-17 International Business Machines Corporation Blended SYN cookies
US7254133B2 (en) * 2002-07-15 2007-08-07 Intel Corporation Prevention of denial of service attacks
US7430755B1 (en) * 2002-09-03 2008-09-30 Fs Networks, Inc. Method and system for providing persistence in a secure network access
US7506360B1 (en) * 2002-10-01 2009-03-17 Mirage Networks, Inc. Tracking communication for determining device states
US7552323B2 (en) * 2002-11-18 2009-06-23 Liquidware Labs, Inc. System, apparatuses, methods, and computer-readable media using identification data in packet communications
US7269850B2 (en) * 2002-12-31 2007-09-11 Intel Corporation Systems and methods for detecting and tracing denial of service attacks
US20050240989A1 (en) * 2004-04-23 2005-10-27 Seoul National University Industry Foundation Method of sharing state between stateful inspection firewalls on mep network
US7391725B2 (en) * 2004-05-18 2008-06-24 Christian Huitema System and method for defeating SYN attacks
US20060023721A1 (en) * 2004-07-29 2006-02-02 Ntt Docomo, Inc. Server device, method for controlling a server device, and method for establishing a connection using the server device
US20060069804A1 (en) * 2004-08-25 2006-03-30 Ntt Docomo, Inc. Server device, client device, and process execution method
US20060280121A1 (en) * 2005-06-13 2006-12-14 Fujitsu Limited Frame-transfer control device, DoS-attack preventing device, and DoS-attack preventing system
US20070019543A1 (en) * 2005-07-06 2007-01-25 Fortinet, Inc. Systems and methods for detecting and preventing flooding attacks in a network environment
US20070185998A1 (en) * 2006-02-06 2007-08-09 Cisco Technology, Inc. Supporting options in a communication session using a TCP cookie
US20070195792A1 (en) * 2006-02-21 2007-08-23 A10 Networks Inc. System and method for an adaptive TCP SYN cookie with time validation

Cited By (46)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
USRE47296E1 (en) * 2006-02-21 2019-03-12 A10 Networks, Inc. System and method for an adaptive TCP SYN cookie with time validation
US9497201B2 (en) 2006-10-17 2016-11-15 A10 Networks, Inc. Applying security policy to an application session
US9219751B1 (en) 2006-10-17 2015-12-22 A10 Networks, Inc. System and method to apply forwarding policy to an application session
US9253152B1 (en) 2006-10-17 2016-02-02 A10 Networks, Inc. Applying a packet routing policy to an application session
US9270705B1 (en) 2006-10-17 2016-02-23 A10 Networks, Inc. Applying security policy to an application session
US9960967B2 (en) 2009-10-21 2018-05-01 A10 Networks, Inc. Determining an application delivery server based on geo-location information
US9215275B2 (en) 2010-09-30 2015-12-15 A10 Networks, Inc. System and method to balance servers based on server load status
US9961135B2 (en) 2010-09-30 2018-05-01 A10 Networks, Inc. System and method to balance servers based on server load status
US9961136B2 (en) 2010-12-02 2018-05-01 A10 Networks, Inc. Distributing application traffic to servers based on dynamic service response time
US10178165B2 (en) 2010-12-02 2019-01-08 A10 Networks, Inc. Distributing application traffic to servers based on dynamic service response time
US9609052B2 (en) 2010-12-02 2017-03-28 A10 Networks, Inc. Distributing application traffic to servers based on dynamic service response time
US9906591B2 (en) 2011-10-24 2018-02-27 A10 Networks, Inc. Combining stateless and stateful server load balancing
US9270774B2 (en) 2011-10-24 2016-02-23 A10 Networks, Inc. Combining stateless and stateful server load balancing
US9386088B2 (en) 2011-11-29 2016-07-05 A10 Networks, Inc. Accelerating service processing using fast path TCP
US9094364B2 (en) 2011-12-23 2015-07-28 A10 Networks, Inc. Methods to manage services over a service gateway
US9979801B2 (en) 2011-12-23 2018-05-22 A10 Networks, Inc. Methods to manage services over a service gateway
US10044582B2 (en) 2012-01-28 2018-08-07 A10 Networks, Inc. Generating secure name records
US9596286B2 (en) 2012-05-25 2017-03-14 A10 Networks, Inc. Method to process HTTP header with hardware assistance
US9843521B2 (en) 2012-05-25 2017-12-12 A10 Networks, Inc. Processing packet header with hardware assistance
US9602442B2 (en) 2012-07-05 2017-03-21 A10 Networks, Inc. Allocating buffer for TCP proxy session based on dynamic network conditions
US9154584B1 (en) 2012-07-05 2015-10-06 A10 Networks, Inc. Allocating buffer for TCP proxy session based on dynamic network conditions
US8977749B1 (en) 2012-07-05 2015-03-10 A10 Networks, Inc. Allocating buffer for TCP proxy session based on dynamic network conditions
US10021174B2 (en) 2012-09-25 2018-07-10 A10 Networks, Inc. Distributing service sessions
US9705800B2 (en) 2012-09-25 2017-07-11 A10 Networks, Inc. Load distribution in data networks
US9843484B2 (en) 2012-09-25 2017-12-12 A10 Networks, Inc. Graceful scaling in software driven networks
US10002141B2 (en) 2012-09-25 2018-06-19 A10 Networks, Inc. Distributed database in software driven networks
US9544364B2 (en) 2012-12-06 2017-01-10 A10 Networks, Inc. Forwarding policies on a virtual service network
US9338225B2 (en) 2012-12-06 2016-05-10 A10 Networks, Inc. Forwarding policies on a virtual service network
US9531846B2 (en) 2013-01-23 2016-12-27 A10 Networks, Inc. Reducing buffer usage for TCP proxy session based on delayed acknowledgement
US9979665B2 (en) 2013-01-23 2018-05-22 A10 Networks, Inc. Reducing buffer usage for TCP proxy session based on delayed acknowledgement
US9900252B2 (en) 2013-03-08 2018-02-20 A10 Networks, Inc. Application delivery controller and global server load balancer
US9992107B2 (en) 2013-03-15 2018-06-05 A10 Networks, Inc. Processing data packets using a policy based network path
US10027761B2 (en) 2013-05-03 2018-07-17 A10 Networks, Inc. Facilitating a secure 3 party network session by a network device
US10038693B2 (en) 2013-05-03 2018-07-31 A10 Networks, Inc. Facilitating secure network traffic by an application delivery controller
US10230770B2 (en) 2013-12-02 2019-03-12 A10 Networks, Inc. Network proxy layer for policy-based application proxies
US10020979B1 (en) 2014-03-25 2018-07-10 A10 Networks, Inc. Allocating resources in multi-core computing environments
US9942152B2 (en) 2014-03-25 2018-04-10 A10 Networks, Inc. Forwarding data packets using a service-based forwarding policy
US10257101B2 (en) 2014-03-31 2019-04-09 A10 Networks, Inc. Active application response delay time
US9942162B2 (en) 2014-03-31 2018-04-10 A10 Networks, Inc. Active application response delay time
US9806943B2 (en) 2014-04-24 2017-10-31 A10 Networks, Inc. Enabling planned upgrade/downgrade of network devices without impacting network sessions
US10110429B2 (en) 2014-04-24 2018-10-23 A10 Networks, Inc. Enabling planned upgrade/downgrade of network devices without impacting network sessions
US9906422B2 (en) 2014-05-16 2018-02-27 A10 Networks, Inc. Distributed system to determine a server's health
US10129122B2 (en) 2014-06-03 2018-11-13 A10 Networks, Inc. User defined objects for network devices
US9986061B2 (en) 2014-06-03 2018-05-29 A10 Networks, Inc. Programming a data network device using user defined scripts
US9992229B2 (en) 2014-06-03 2018-06-05 A10 Networks, Inc. Programming a data network device using user defined scripts with licenses
US10243791B2 (en) 2015-08-13 2019-03-26 A10 Networks, Inc. Automated adjustment of subscriber policies

Also Published As

Publication number Publication date
US7675854B2 (en) 2010-03-09
USRE47296E1 (en) 2019-03-12
US20070195792A1 (en) 2007-08-23

Similar Documents

Publication Publication Date Title
Katz et al. Bidirectional forwarding detection (BFD)
US7610487B2 (en) Human input security codes
US7325133B2 (en) Mass subscriber management
Al Fardan et al. Lucky thirteen: Breaking the TLS and DTLS record protocols
Baker et al. RSVP cryptographic authentication
US7254237B1 (en) System and method for establishing a secure connection
Maruyama et al. Stream control transmission protocol (SCTP) dynamic address reconfiguration
KR101055861B1 (en) Communication system, communication apparatus, communication method and a communication program for realizing it,
US7552323B2 (en) System, apparatuses, methods, and computer-readable media using identification data in packet communications
JP4527358B2 (en) Do not use a key escrow, authenticated individual cryptographic system
US8144874B2 (en) Method for obtaining key for use in secure communications over a network and apparatus for providing same
AU743258B2 (en) Improved network security device
Bellovin et al. Defending against sequence number attacks
US7366170B2 (en) Communication connection method, authentication method, server computer, client computer and program
US7290141B2 (en) Authentication of remotely originating network messages
US7949875B2 (en) Message authentication
US7039713B1 (en) System and method of user authentication for network communication through a policy agent
Moskowitz et al. Host identity protocol
US7254133B2 (en) Prevention of denial of service attacks
Aiello et al. Just fast keying: Key agreement in a hostile internet
US7058718B2 (en) Blended SYN cookies
US6779033B1 (en) System and method for transacting a validated application session in a networked computing environment
Kaufman Internet key exchange (IKEv2) protocol
US20020076054A1 (en) Session shared key sharing method, wireless terminal authentication method, wireless terminal, and base station device
Rigney et al. Remote authentication dial in user service (RADIUS)

Legal Events

Date Code Title Description
AS Assignment

Owner name: A10 NETWORKS, INC., CALIFORNIA

Free format text: CHANGE OF ADDRESS;ASSIGNOR:A10 NETWORKS, INC.;REEL/FRAME:031075/0954

Effective date: 20130822

AS Assignment

Owner name: ROYAL BANK OF CANADA, AS COLLATERAL AGENT, CANADA

Free format text: SECURITY INTEREST;ASSIGNOR:A10 NETWORKS, INC.;REEL/FRAME:031485/0284

Effective date: 20130930

AS Assignment

Owner name: A10 NETWORKS, INC., CALIFORNIA

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:CHEN, LEE;SZETO, RONALD WAI LUN;HWANG, SHIH-TSUNG;REEL/FRAME:038101/0358

Effective date: 20060217

MAFP

Free format text: PAYMENT OF MAINTENANCE FEE, 8TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1552)

Year of fee payment: 8