Cisco Technology, Inc.

Cariden Technologies, Inc.

Luna Xio, Inc.

Alan Gous

Arman Maghbouleh

Clarence Filsfils

Andre Hentz

Arash Afrakhteh

Jeffrey Bazar

Thomas F Telkamp

Francois Clad

Eleni Palkopoulou

Pierre Francois

Eleni Palopoulou

An example intermediary system allows a control system to securely identify and communicate with a device. The device uses master secret and time data shared with the control system to generate and advertise a time-dependent device identifier and potentially an encrypted device message. The intermediary system augments the received device data with a message (e.g., an estimate of the device's location) encrypted using the time-dependent device identifier as an encryption key. Furthermore, it hashes the time-dependent device identifier for additional security. The augmented data is provided for retrieval and processing by the control system. The owner uses the shared master secret, time data and hash function to generate a hashed time-dependent device identifier used to retrieve matching augmented data from the server. The retrieved message data is decrypted using the reverse of the encryption operations.

Remote authorization of gateway device

An example method for the remote authorization of a gateway to communicate with a device includes accessing time interval data, specified by an owner of the device, the time interval data specifying an access authorization time interval. A calculation is performed, using at least one processor, to generate authorization data that is specific to the device and valid for the access authorization time interval. The authorization data is accessed using the gateway. A scanning function is performed using the gateway, the scanning function to locate the device. A control request is sent to device to control the device.

An example intermediary system allows an owner computer system to securely identify and communicate with an end device. The end device uses master secret and time data shared with the owner computer system to generate and advertise a time-dependent device identifier and potentially an encrypted device message. The intermediary system augments the received device data with a message (e.g., an estimate of the device's location) encrypted using the time-dependent device identifier as an encryption key. Furthermore, it hashes the time-dependent device identifier for additional security. The augmented data is forwarded to a server for retrieval and processing by the owner computer system. The owner uses the shared master secret, time data and hash function to generate a hashed time-dependent device identifier used to retrieve matching augmented data from the server. The retrieved message data is decrypted using the reverse of the encryption operations.

Secure communication with an end device through an intermediary system

In one embodiment, a method includes obtaining a request to route traffic from a source to a destination in a network, where the request is associated with a setup bandwidth criterion. The method includes: identifying a plurality of candidate tunnel paths from the source to the destination; and, for each of the plurality of candidate tunnel paths, determining whether or not at least one of the candidate tunnel paths satisfies the setup bandwidth criterion. In response to determining that the plurality of candidate tunnel paths fail to satisfy the setup bandwidth criterion, the method includes: determining a congestion metric for each of a plurality of candidate tunnel paths from the source to the destination; and instantiating a tunnel from the source to the destination according to a candidate tunnel path with the lowest congestion metric.

Soft constrained shortest-path tunneling

A method and related apparatus for providing latency optimized segment routing tunnels is described herein and includes obtaining a latency metric for each segment that links respective pairs of nodes in a network, determining a tunnel through the network between a first endpoint and a second endpoint that is optimized for latency, and, once such a tunnel is determined, causing a packet to travel along the tunnel that is optimized for latency by encoding the packet with segment routing instructions for the network, wherein the network is configured to provide shortest paths according to a metric other than latency.

Latency optimized segment routing tunnels

Soft constrained shortest-path first tunneling

An example method for segment routing based wide area network (WAN) orchestration in a network environment is provided and includes monitoring a segment routing (SR) enabled WAN environment in at least near real-time by a path computation element (PCE) located outside the WAN, receiving an event notification at the PCE, and performing traffic engineering using SR to reroute traffic off shortest paths. In one embodiment, where a current state of the WAN is not pre-computed, performing traffic engineering comprises optimizing routes to remove violation of any utilization policies, deploying the optimized routes in the WAN, re-optimizing routes for other parameters, and further deploying the re-optimized routes in the WAN. In another embodiment, performing traffic engineering comprises optimizing routes to remove violation of any utilization policies and for other parameters, and deploying the optimized routes in the WAN. In another embodiment, performing traffic engineering comprises deploying optimized routes in the WAN.

Segment routing based wide area network orchestration in a network environment

A method to reconfigure a connection-oriented network from an existing configuration to a desired configuration includes generating a sequence of configuration specifications for the connection-oriented network. The sequence specifies a plurality of intermediate configurations between the existing and the desired configurations. The sequence of configuration specifications is implemented within the connection-oriented network by, for each configuration specification, issuing at least one instruction to an element of the connection-oriented network to modify configuration information maintained at the element to thereby instantiate respective configurations. The implementing includes issuing a specific instruction to instantiate a subsequent configuration specification only if an acknowledgment is received that a preceding configuration has been successfully instantiated.

Methods and systems to generate and implement a changeover sequence to reconfigure a connection-oriented network

A method is performed to optimize metrics associated with links of a network that is routed utilizing a shortest-path-first (SPF) routing method. The method includes identifying at least one failure scenario applicable to the network and identifying at least one bandwidth level scenario applicable to point-to-point demands routed through the network. A metric is automatically calculated for each of a plurality of links of a network, such that routings of demands through the network are optimized for the at least one failure scenario, and for the at least one bandwidth level.

Metric optimization for traffic engineering in a metric-routed network

A method of communicating predicted network behavior includes generating network topology structure data describing at least part of a topology of a first network. Demand structure data is generated, the demand structure data describing at least some traffic demands relating to a source in the first network and a destination in a second network, wherein there are a plurality of network links between the first network and the second network. Traffic routing change data, describing at least one change scenario which would require a change of traffic routing, is generated. This data is then used to calculate change data that describes a routing of traffic through each of the plurality of network links between the first network and the second network for the at least one change scenario. The change data is transmitted to the second network.

Method and system for communicating predicted network behavior between interconnected networks

A system, to migrate a shortest-path-first (SPF) routed network from a first routing state to a second routing state, includes a changeover module to generate a sequence of intermediate network plans, each of which modifies a preceding network state according to a preceding network plan, such that a routing of at least one demand in the network changes. The sequence of intermediate network plans migrates the network from the first routing state to the second routing state. A network controller sequentially configures the network according to the sequence of intermediate network plans to migrate the network from the first routing state to the second routing state. Each intermediate network plan of the sequence configures the network to operate within at least one predetermined constraint.

Growing community of inventors

Palo Alto, CA, United States of America

Alan Gous