知搜-全球专利检索

  1. Login
  2. Sign Up

Search Results

14 records (took 0.018 seconds)

    DYNAMIC SECURITY ACTIONS FOR NETWORK TUNNELS AGAINST SPOOFING
    1.
    发明申请
    DYNAMIC SECURITY ACTIONS FOR NETWORK TUNNELS AGAINST SPOOFING 有权

    公开(公告)号：US20210203688A1

    公开(公告)日：2021-07-01

    申请号：US16732140

    申请日：2019-12-31

    Applicant: Juniper Networks, Inc.

    Inventor： Ashish Suresh Ghule ,  Jagadish Narasimha Grandhi

    IPC: H04L29/06 ,  H04L29/12 ,  H04L12/823

    Abstract: An example network device receives an encapsulated network packet via a network tunnel; extracts IPv6 header information from the encapsulated network packet; extracts IPv4 header information from the encapsulated network packet; determines that the encapsulated network packet is a spoofed network packet based on the IPv6 header information and the IPv4 header information; and in response to detecting the spoofed network packet, transmits a message to a Tunnel Entry Point (TEP) device, the message including data representing the IPv6 header information and IPv4 header information. A tunnel entry point (TEP) device may receive the message and use the message to detect spoofed IPv6 traffic, e.g., when an IPv6 header and an IPv4 header of an encapsulated packet matches the IPv6 header and the IPv4 header specified in the message. In this manner, the TEP device may block, rate limit, or redirect spoofed network traffic.

    Internet protocol (IP) version 6 fragmentation and reassembly optimization for port-aware IP translators
    2.
    发明授权
    Internet protocol (IP) version 6 fragmentation and reassembly optimization for port-aware IP translators 有权

    公开(公告)号：US12170647B2

    公开(公告)日：2024-12-17

    申请号：US17849036

    申请日：2022-06-24

    Applicant: Juniper Networks, Inc.

    Inventor： Ashish Suresh Ghule ,  Alex Baban ,  Pratik Pradip Vyas

    IPC: H04L9/40 ,  H04L45/74 ,  H04L61/251

    Abstract: A network device may receive IPv6 fragments of a flow. Source and/or destination port information may be encoded into an upper sixteen bits of an identification number of an IPv6 fragment header of each of the IPv6 fragments. The network device may extract the source and/or destination port information from the IPv6 fragments, and may perform a spoof check of the IPv6 fragments. The network device may drop any of the IPv6 fragments that fail the spoof check, to generate remaining IPv6 fragments, and may translate the remaining IPv6 fragments into IPv4 fragments based on the source and/or destination port information. The network device may forward the IPv4 fragments toward an IPv4 cloud network.

    Packet fragment forwarding without reassembly
    3.
    发明授权
    Packet fragment forwarding without reassembly 有权

    公开(公告)号：US11736399B2

    公开(公告)日：2023-08-22

    申请号：US17247950

    申请日：2020-12-31

    Applicant: Juniper Networks, Inc.

    Inventor： Ashish Suresh Ghule ,  Pankaj Malviya ,  Jagadish Narasimha Grandhi

    IPC: H04L45/745 ,  H04L47/625

    CPC classification number: H04L45/745 ,  H04L47/625 ,  H04L2212/00

    Abstract: A network device may forward fragments of an IPv4 network packet encapsulated in IPv6 network packets from an IPv6 network to an IPv4 network without reassembling the IPv4 network packet. The network device may receive and buffer the one or more fragments of a fragment flow associated with the IPv4 network packet until it receives a fragment of the fragment flow that includes an indication of the source port of the IPv4 network packet. When the network device receives the fragment that includes the indication of the source port of the IPv4 network packet, the network device may dispatch each fragment of the fragment flow that it has received to the IPv4 network.

    ANTI-SPOOF CHECK OF IPV4-IN-IPV6 FRAGMENTS WITHOUT REASSEMBLY
    4.
    发明申请
    ANTI-SPOOF CHECK OF IPV4-IN-IPV6 FRAGMENTS WITHOUT REASSEMBLY 有权

    公开(公告)号：US20210144173A1

    公开(公告)日：2021-05-13

    申请号：US16682882

    申请日：2019-11-13

    Applicant: Juniper Networks, Inc.

    Inventor： Ashish Suresh Ghule ,  Jagadish Narasimha Grandhi

    IPC: H04L29/06 ,  H04L12/721 ,  H04L12/823 ,  H04L29/12 ,  H04L12/861 ,  H04L12/751

    Abstract: A network device may receive, from a first network, one or more fragments of a first network packet of a first network packet type, where the first network packet encapsulates a second network packet of a second network packet type. The network device may buffer the one or more fragments in. The network device may, upon receiving a fragment of the first network packet that includes an indication of a source network address and a source port for the second network packet, perform an anti-spoof check of the fragment flow without assembling the first network packet. The network device may, based on the fragment flow passing the anti-spoof check, in response to receiving all fragments of the first network packet: assemble the first network packet, decapsulate the second network packet from the assembled first network packet, and forward, to a second network, the second network packet.

    PACKET FRAGMENT FORWARDING WITHOUT REASSEMBLY
    5.
    发明申请
    PACKET FRAGMENT FORWARDING WITHOUT REASSEMBLY 有权

    公开(公告)号：US20210126863A1

    公开(公告)日：2021-04-29

    申请号：US17247950

    申请日：2020-12-31

    Applicant: Juniper Networks, Inc.

    Inventor： Ashish Suresh Ghule ,  Pankaj Malviya ,  Jagadish Narasimha Grandhi

    IPC: H04L12/741 ,  H04L12/863

    Abstract: A network device may forward fragments of an IPv4 network packet encapsulated in IPv6 network packets from an IPv6 network to an IPv4 network without reassembling the IPv4 network packet. The network device may receive and buffer the one or more fragments of a fragment flow associated with the IPv4 network packet until it receives a fragment of the fragment flow that includes an indication of the source port of the IPv4 network packet. When the network device receives the fragment that includes the indication of the source port of the IPv4 network packet, the network device may dispatch each fragment of the fragment flow that it has received to the IPv4 network.

    PACKET FRAGMENT FORWARDING WITHOUT REASSEMBLY
    6.
    发明申请
    PACKET FRAGMENT FORWARDING WITHOUT REASSEMBLY 审中-公开

    公开(公告)号：US20190356591A1

    公开(公告)日：2019-11-21

    申请号：US15983457

    申请日：2018-05-18

    Applicant: Juniper Networks, Inc.

    Inventor： Ashish Suresh Ghule ,  Pankaj Malviya ,  Jagadish Grandhi

    IPC: H04L12/741 ,  H04L12/863

    Abstract: A network device may forward fragments of an IPv4 network packet to an IPv6 network without reassembling the IPv4 network packet. The network device may receive and buffer one or more fragments of a fragment flow associated with the IPv4 network packet until it receives a fragment of the fragment flow that includes an indication of the destination port of the IPv4 network packet. When the network device receives the fragment that includes the indication of the destination port of the IPv4 network packet, the network device may encapsulate each fragment of the fragment flow that it has received into respective IPv6 network packets to the IPv6 network.

    DYNAMIC SECURITY ACTIONS FOR NETWORK TUNNELS AGAINST SPOOFING
    8.
    发明申请
    DYNAMIC SECURITY ACTIONS FOR NETWORK TUNNELS AGAINST SPOOFING 有权

    公开(公告)号：US20230130595A1

    公开(公告)日：2023-04-27

    申请号：US18145788

    申请日：2022-12-22

    Applicant: Juniper Networks, Inc.

    Inventor： Ashish Suresh Ghule ,  Jagadish Narasimha Grandhi

    IPC: H04L9/40 ,  H04L47/32 ,  H04L61/2592 ,  H04L69/22

    Abstract: An example network device receives an encapsulated network packet via a network tunnel; extracts IPv6 header information from the encapsulated network packet; extracts IPv4 header information from the encapsulated network packet; determines that the encapsulated network packet is a spoofed network packet based on the IPv6 header information and the IPv4 header information; and in response to detecting the spoofed network packet, transmits a message to a Tunnel Entry Point (TEP) device, the message including data representing the IPv6 header information and IPv4 header information. A tunnel entry point (TEP) device may receive the message and use the message to detect spoofed IPv6 traffic, e.g., when an IPv6 header and an IPv4 header of an encapsulated packet matches the IPv6 header and the IPv4 header specified in the message. In this manner, the TEP device may block, rate limit, or redirect spoofed network traffic.

    Dynamic security actions for network tunnels against spoofing
    9.
    发明授权
    Dynamic security actions for network tunnels against spoofing 有权

    公开(公告)号：US11570207B2

    公开(公告)日：2023-01-31

    申请号：US16732140

    申请日：2019-12-31

    Applicant: Juniper Networks, Inc.

    Inventor： Ashish Suresh Ghule ,  Jagadish Narasimha Grandhi

    IPC: H04L29/06 ,  H04L9/40 ,  H04L47/32 ,  H04L61/2592 ,  H04L69/22 ,  H04L12/46 ,  H04L101/686

    Abstract: An example network device receives an encapsulated network packet via a network tunnel; extracts IPv6 header information from the encapsulated network packet; extracts IPv4 header information from the encapsulated network packet; determines that the encapsulated network packet is a spoofed network packet based on the IPv6 header information and the IPv4 header information; and in response to detecting the spoofed network packet, transmits a message to a Tunnel Entry Point (TEP) device, the message including data representing the IPv6 header information and IPv4 header information. A tunnel entry point (TEP) device may receive the message and use the message to detect spoofed IPv6 traffic, e.g., when an IPv6 header and an IPv4 header of an encapsulated packet matches the IPv6 header and the IPv4 header specified in the message. In this manner, the TEP device may block, rate limit, or redirect spoofed network traffic.

Patent Agency Ranking