In accordance with an embodiment, a network device has an input port for receiving input packets, and an output port for sending output packets, where the input packets and output packets have context layer information. The network device also includes a processor configured to process the input packets and output packets using a network protocol having a context layer.

System and method for a context layer switch

We present Dionysus, a system for fast, consistent network updates in software-defined networks. Dionysus encodes as a graph the consistency-related dependencies among updates at individual switches, and it then dynamically schedules these updates based on runtime differences in the update speeds of different switches. This dynamic scheduling is the key to its speed; prior update methods are slow because they pre-determine a schedule, which does not adapt to runtime conditions. Testbed experiments and data-driven simulations show that Dionysus improves the median update speed by 53--88% in both wide area and data center networks compared to prior methods.

/pdf/dynamic-scheduling-of-network-updates-1fmucv9mvs.pdf

Dynamic scheduling of network updates

In a system and method for accessing messages in a data store in a gateway, a data frame request, which is a structured SQL query, is received at the gateway. The received data frame request is applied to the gateway data store, which stores messages. A data frame is generated that comprises messages from the data store that are responsive to the received data frame request, the data frame having a format that is readable by a character editor.

System and method for exchanging information among exchange applications

A highly scalable application network appliance is described herein. According to one embodiment, a network element includes a switch fabric, a first service module coupled to the switch fabric, and a second service module coupled to the first service module over the switch fabric. In response to packets of a network transaction received from a client over a first network to access a server of a data center having multiple servers over a second network, the first service module is configured to perform a first portion of OSI (open system interconnection) compatible layers of network processes on the packets while the second service module is configured to perform a second portion of the OSI compatible layers of network processes on the packets. The first portion includes at least one OSI compatible layer that is not included in the second portion. Other methods and apparatuses are also described.

Highly scalable architecture for application network appliances

Techniques to support emergency voice-over-Internet Protocol (VoIP) calls are described. The techniques may be used for various 3GPP and 3GPP2 networks, various location architectures, and various types of User Equipment (UE). A UE communicates with a visited network to send a request to establish an emergency VoIP call. The UE interacts with a location server instructed by the visited network to obtain a first position estimate for the UE. The UE performs call setup via the visited network to establish the emergency VoIP call with a PSAP, which may be selected based on the first position estimate. The UE may thereafter perform positioning with the location server to obtain an updated position estimate for the UE, e.g., if requested by the PSAP.

Voip emergency call support

One embodiment of the invention is directed to managing access of a host computer to a network. A first communication session with the host computer may be conducted to authenticate the host computer's identity. A second communication session with the host computer may be conducted to determine the health status of the host computer.

Controlling network access

A method and system are provided for implementing a firewall architecture in a network device. The firewall architecture includes a plurality of network layers, a first firewall engine, and one or more callout modules. The layers send packets and packet information to the first firewall engine, maintain and pass packet context to subsequent layers, and process the packets. The first firewall engine compares the packet information to one or more installed filters and returns an action to the layers indicating how to treat the packet. The callouts provide additional functionality such as intrusion detection, logging, and parental control features.

Multi-layered firewall architecture

A method and system are provided for adding, removing, and managing a plurality of network policy filters in a network device. Filters are installed in a framework and designated as active or disabled. Each filter has a priority. When a new filter is to be installed into the framework, it is compared to installed filters to determine if a conflict exists. If no conflict exists, the new filter is added as an active filter. If a conflict exists, a higher priority conflicting filter is added as active and a lower priority filter is added as inactive.

Method for managing network filter based policies

Embodiments of the invention authenticate devices and establish secure connections between devices using static Diffie-Hellman key pairs. A first device obtains in a trusted manner a static DH public key of a second device prior to negotiation. The second device negotiates a secure connection to the first device using a shared secret created from the static DH public key, which serves as both a claim on the second device's identity and an encryption key. The static DH public key can be used to establish subsequent secure, authenticated communications sessions.

Use of static Diffie-Hellman key with IPSec for authentication

A system and method for ensuring that machines having invalid or corrupt states are restricted from accessing host resources are provided. A quarantine agent (QA) located on a client machine acquires statements of health from a plurality of quarantine policy clients. The QA packages the statements and provides the package to a quarantine enforcement client (QEC). The QEC sends the package to a quarantine Health Certificate Server (HCS) with a request for a health certificate. If the client provided valid statements of health, the HCS grants the client health certificate that may be used in IPsec session negotiation.

Paul G. Mayfield

Papers

Controlling network access

Multi-layered firewall architecture

Method for managing network filter based policies

Use of static Diffie-Hellman key with IPSec for authentication

System and methods for providing network quarantine using IPSEC