Cisco Technology, Inc.

Cisco Systems Inc.

Security Together Corporation

Andrew George Harvey

Leo Pereira

Hsuan-Chung Lee

Shankar Natarajan

Vipin Rawat

Kenneth Durazzo

Petre Dini

Cosmin Nicu Dini

Manuela Ionelia Popescu

Ikramullah Mohammad

John Ng

Tohru Kao

Paul M Quinn

Robert E Gleichauf

Richard Mandfred Pruss

Frederick Juergens Baker

Sudha Sundaresan

Satish K Gannu

Saravanakumar Rajendran

Thomas J Newman

Andrew J Valencia

Balachander Chandrasekaran

Masum Z Hasan

Shoou Jiah Yiu

Dean Cheng

Sanjay Aiyagari

Anthony Joseph Vargas

Gilbert Rouse Woodman, Iii

Barry Raveendran Greene

Anand Patel

Anand M Pandharikar

Pokman Perry Leung

Ashwin Baindur

Kenneth Tallo

Vikram Sharma

Gregory Verissimo

David Brian Petree

Mukunda Murthy

In various example embodiments disclosed herein, a Dynamic Security Architecture Environment (DSAE) security architecture is provided in an externally connectable endpoint device (the security device), which can be connected to an existing host endpoint device, such as a computer, laptop, tablet, phone, vehicle, medical device, Industrial Control System (ICS), or other electronic or Internet connected device. The example embodiments can implement the DSAE security architecture in the security device that connects to a host endpoint device to make the host endpoint device more secure by enabling the security device to combat cyber attacks targeted toward the host device. The example embodiments described herein also provide details for creating a security device that leverages the DSAE architecture, wherein the security device is configured to connect via a wired or wireless medium for data communication with a host endpoint device to make the host device more secure.

Systems and methods for providing security to a host endpoint device

In one embodiment, an apparatus can include a service broker configured to: (i) register a service classifier, and to provide context information to the service classifier; and (ii) register a plurality of service nodes. The service broker can also receive capability and service requests from the service classifier. Further, the context information can include a service header, a reachability indication, and an encapsulation, where the service header and the encapsulation may be attached or related to a packet in the service classifier. In addition, the service classifier can use this information to redirect the packet to a first service node.

Service insertion architecture

Particular embodiments provide power usage management for network devices according to historical traffic pattern data. Network traffic statistics for traffic flowing through a network device may be determined. Traffic pattern for a time period based on the traffic flowing through the network device is then determined. The network device may then manage power based on the pattern. For example, when a pattern indicates that traffic flowing through the network device is light during a time period, then the network device may operate in a lower power mode, such as a standby mode and when it indicates that there is higher usage, the network device may operate in a normal power mode. A power usage policy may be determined based on the historical traffic patterns and is automatically enforced by the network device. The power usage policy also may be dynamically adjusted over time based on network traffic statistics.

Dynamic power usage management based on historical traffic pattern data for network devices

A feedback-based adaptive network is described wherein at least a portion of the network elements report operating information relating to network conditions to a centralized data store. The information which is reported to the data store is analyzed by a policy engine, and updated control information may be generated. The updated control information may be fed back to selected network elements to thereby affect operation of the selected elements. In this way, the dynamic and automatic feedback control of network elements is provided. Events relating to changing conditions in the network may also be reported to selected elements. Additionally the adaptive, feedback-based network may include a network quality monitoring system for evaluating performance characteristics or other aspects of the network. If it is determined that a particular characteristic of the network does not conform with the standards established for that characteristic, the policy which controls that particular characteristic of the network may be automatically and dynamically modified to thereby affect the network performance.

Technique for providing dynamic modification of application specific policies in a feedback-based, adaptive data network

Particular embodiments provide power usage management for network devices according to historical traffic pattern data. Network traffic statistics for traffic flowing through a network device may be determined. A traffic pattern for a time period based on the traffic flowing through the network device is then determined. The network device may then manage power based on the pattern. For example, when a pattern indicates that traffic flowing through the network device is light during a time period, then the network device may operate in a lower power mode, such as a standby mode and when it indicates that there is higher usage, the network device may operate in a normal power mode. In one embodiment, a power usage policy may be determined based on the historical traffic patterns and is automatically enforced by the network device. The power usage policy may also be dynamically adjusted over time based on network traffic statistics.

A method of controlling access to a computer network, the method comprising the steps of receiving a request for network access from an end station device; receiving a unique identifier of the end station device; determining that the unique identifier is not within a set of authorized identifiers; assigning a short-term, non-routable network address to the end station device; receiving an authorization code from the end station device, wherein the authorization code has been previously issued in response to a purchase of goods or services from a merchant associated with the computer network; attempting to validate the authorization code; if the authorization code is validated, then assigning a longer-term, routable network address to the end station device.

Method of controlling network access that induces consumption of merchant goods or services

A feedback-based adaptive network is described wherein at least a portion of the network elements report operating information relating to network conditions to a centralized data store. The information is analyzed by a policy engine which includes a plurality of specific plug-in policies for analyzing selected information from the data store and for computing updated control information which is fed back to affect operation of selected network elements. In this way the dynamic and automatic feedback control of network elements is provided to allow the network to adapt to events relating to changing conditions. The adaptive, feedback based network may include a network quality monitoring system for evaluating performance characteristics based upon predetermined standard or criteria. If it is determined that a particular characteristic of the network does not conform, the policy which control that particular characteristic of the network may be automatically and dynamically modified to affect network performance.

In one embodiment, a licensing authority receives a rehost ticket indicating proof of removal of a license from a first device. The licensing authority receives a request for a license for a second device. The licensing authority validates the rehost ticket to ensure that the license on the first device has been removed from the first device. The licensing authority provides a license for the second device if the rehost ticket is successfully validated, wherein the license that has been removed from the first device and the license for the second device provide the same license capabilities. The first device and the second device are associated with the same customer. Payment has been received for the license associated with the first device but payment has not been received for a separate license capable of being applied to the second device.

Mechanism for secure rehosting of licenses

A method and system for role-based access control enforced by an Operating System filesystem are provided. A file representing a resource is created and stored in the Operating System filesystem. A user requests access to the resource and provides user-identifying information and a resource identifier. An access identifier is created based on the user-identifying information and the resource identifier, and is formatted as the file attribute used by the Operating System to manage file access. A system call to the Operating System is made to perform an operation on the file representing the resource, where the system call uses the access identifier to gain access to the file. The user is granted access to the resource only if the operating system successfully performs the operation on the file representing the resource.

Role-based access control enforced by filesystem of an operating system

A feedback-based adaptive network is described wherein at least a portion of the network elements report operating information relating to network conditions to a centralized data store. The information which is reported to the data store is analyzed by a policy engine which includes a plurality of application specific plug-in policies for analyzing selected information from the data store and for computing updated control information based upon the analysis of the information. The updated control information is fed back to selected network elements to thereby affect operation of the selected elements. Typically, when the operation of a network element has been affected, its corresponding operating information will change. The new or changed network element operating information is then reported to the data store and analyzed by the policy engine. The policy engine may then generate new or updated control information for affecting the operation of selected elements in the network. In this way, the dynamic and automatic feedback control of network elements is provided in order to allow the network to adapt to changing conditions. Events relating to changing conditions in the network may be reported to selected elements in the network using an event notification service. Additionally the adaptive, feedback-based network of the present invention may include a network quality monitoring system for evaluating performance characteristics or other aspects of the network based upon predetermined standards or criteria. If it is determined that a particular characteristic of the network does not conform with the standards established for that characteristic, the policy which controls that particular characteristic of the network may be automatically and dynamically modified to thereby affect the network performance.

Systems and methods are provided for generating an Internetworking Operating System (IOS) Command Line Interface (CLI) configuration model and a logical topology from an IOS CLI configuration base. The method includes representing structure and cross-CLI dependencies in a formal specification format, such as Extended Backus-Naur Form (EBNF), and translating the representation into a machine-processable structure and code referred to as the IOS CLI Dependency Tree (ICDT). The ICDT is the configuration model. The ICDT optionally may be manipulated to generate configuration models in other formats, such as Java classes or XSD (eXtensible markup language Schema Definition). The method further includes generating the logical topology from the ICDT.

Auto-generation of configuration and topology models

A system and an apparatus are disclosed for carrying out automatic network device provisioning and configuration. A configuration service receives a request from a network device to provide configuration information. The configuration service retrieves a template describing the device configuration, where the template associates one symbolic reference to one parameter that may receive values specific to particular devices. Based at least on the symbolic reference and the request, the configuration service retrieves a value of the parameter that is specific to the network device. A device-specific instance of the configuration information is created and stored based at least one the template and the value of the parameter. The configuration information is stored in XML format and conforms to an XML DTD.

Method and apparatus for provisioning network devices using instructions in Extensible Markup Language

A method is disclosed for adaptively coupling processing components in a distributed system. In one aspect, a second component requests an interaction with a first component by sending a service access request to access a first service of the first component. The service access request specifies parameters relating to a proposed level of coupling between the first component and the second component. The second component receives a service response from the first component; the service response specifies counter-proposed parameters relating to a proposed level of coupling between the first component and the second component. The second component determines whether the service response indicates that the first service may be provided. If so, then an agreed-upon level of coupling is established between the first component and second component, and the components interact to receive the service. The level of coupling among the components may be re-negotiated at any time by exchanging values in a coupling context. As a result, a component can selectively and with fine granularity allow other components to access its data or services.

Method and apparatus for adaptively coupling processing components in a distributed system

A method is disclosed for reverting to a recovery configuration in response to device faults. A change to the configuration is received. The change may be in the form of configuration instructions that comprise input from a user identifying changes to be made to the configuration information reflecting the configuration of cards or interface devices in the device. A user, an IT administrator or the like can provide configuration instructions. The device may change its current configuration to a new configuration based upon the configuration instructions. If a loss of connectivity resulting from the configuration change is detected, the device will recover from the loss of connectivity by reverting to a recovery configuration.

Growing community of inventors

Pleasanton, CA, United States of America

Andrew George Harvey