Cisco Technology, Inc.

Brian Eliot Weis

David A McGrew

Scott Roy Fluhrer

Eliot Lear

Srinath Gundavelli

Mohamed Khalid

Warren Scott Wainner

Rajiv Asati

W Scott Wainner

James Neil Guichard

Pradeep Kumar Kathail

Jan Vilhuber

Sheela Dixit Rowles

Aamer Saeed Akhter

Michael Lee Sullenberger

Lewis Chen

Rashmikant B Shah

Pascal Thubert

Blake Harrell Anderson

Fabio Rodolfo Maino

Shree N Murthy

Max Pritikin

Kavitha Kamarthy

Thamilarasu Kandasamy

Eric Michel Levy-Abegnoli

Alvaro E Retana

Paul M Quinn

Nancy Cam-Winget

Toerless Eckert

Peter Geoffrey Jones

John William Evans

Vina Ermagan

Rakesh Chopra

Mark John Baugher

Pratima Pramod Sethi

Kannan Kumar

Hugo J W Vliegen

Dhananjay Shrikrishna Patki

Christopher Stanley Steck

Shashi Sastry

Manoj Kumar Nayak

Kuralvanan Arangasamy

Gonzalo A Salgueiro

Charles Calvin Byers

Keyur Patel

Joseph Michael Clarke

Russell Ivan White

Abhay Kumar Roy

M David Hanes

Shuxian Lou

Joseph Salowey

Francois Le Faucheur

Anantha Ramaiah

Jie Chu

Maik Guenter Seewald

Johannes Petrus Kruys

James L Ng

Frederick Juergens Baker

Chandramouli Radhakrishnan

Eric G Vyncke

Sina Mirtorabi

Jose Antonio Liste

Darrel Jay Lewis

John Mullooly

Richard Lee Barnes, Ii

Horia Miclea

Geoffrey Huang

David Mark Carrel

Frederic R P Detienne

Ruben Gerald Lobo

Mahesh Jethanandani

Panagiotis Theodorou Kampanakis

Mihail L Sichitiu

Stan Ratliff

Saurabh Mohan

Marius Horia Miclea

David Mcgrew

Hong Xu

Mordechai Alon

Florin T Coras

Lingyan Huang

Luc Billot

Pascal Delprat

Frederic Rp Detienne

Pengywan Wang

Mohammed Khalid

Padmakumar Ampady Vasudevan Pillai

David A Mcgrew

Frederic RP Detienne

A method is provided to anonymize the media access control (MAC) address of a client device. The method involves generating a plurality of media access control (MAC) addresses for use by a client device in a network. Policies are defined that determine which one of the plurality of MAC addresses is to be used by the client device. The plurality of MAC addresses allocated for use by the client device are registered with a management entity in the network.

Media access control (MAC) address anonymization based on allocations by network controller elements

In one embodiment, a device in a network receives an access policy and a class behavioral model for a node in the network that are associated with a class asserted by the node. The device applies the access policy and class behavioral model to traffic associated with the node. The device identifies a deviation in a behavior of the node from the class behavioral model, based on the application of the class behavioral model to the traffic associated with the node. The device causes performance of a mitigation action in the network based on the identified deviation in the behavior of the node from the class behavioral model.

Validating a device class claim using machine learning

Techniques for providing secure modification of manufacturer usage description (MUD) files based on device applications are provided. In one embodiment, a method for secure modification of MUD files may include obtaining a request for one or more applications from a device. The method also includes providing to the device the one or more applications and a certification that includes an updated MUD identifier determined based on the one or more applications requested. The updated MUD identifier is associated with a concatenated MUD file that comprises individual MUD file portions for each of the one or more applications requested. The device is configured to request an updated device identifier using the certification. The updated device identifier includes the updated MUD identifier that is associated with the concatenated MUD file.

Secure modification of manufacturer usage description files based on device applications

Multiple authenticated identities for a single wireless association may be provided. First, an Access Point (AP) may provide an association with a client device. The AP may then establish, on the association, a first authenticated session for the client device based on a first media access control (MAC) address and a first identity. Next, the AP may establish, on same the association, a second authenticated session for the client device based on a second MAC address and a second identity.

Multiple authenticated identities for a single wireless association

In one embodiment, a device in a network inserts a profile tag into an address request sent by an endpoint node in the network to a lookup service. The lookup service is configured to identify one or more addresses with which the endpoint node is authorized to communicate based on a profile for the endpoint node associated with the inserted profile tag. The device receives an address response sent from the lookup service to the endpoint node that indicates the set of one or more addresses with which the endpoint node is authorized to communicate. The device determines whether a communication between the endpoint node and a particular network address is authorized using the set of one or more addresses with which the endpoint node is authorized to communicate. The device blocks the communication based on a determination that the particular network address is not in the set of one or more addresses with which the endpoint node is authorized to communicate.

Dynamic device isolation in a network

In one embodiment, a monitoring process identifies a set of counters maintained by a networking device by comparing a configuration of the networking device to an object relationship model. The monitoring process obtains counter values from the identified set of counters maintained by the networking device. The monitoring process detects an anomaly by using the obtained counter values as input to a machine learning-based anomaly detector. The monitoring process generates an anomaly detection alert for the detected anomaly.

Anomaly detection for a networking device based on monitoring related sets of counters

At a network device configured to control access to a network, a client device authentication request is received from a client device. The request includes identity credentials and a temporary media access control (MAC) address of the client device. The client device is successfully authenticated based on the identity credentials. After authentication, a new MAC address is established in the client device. A data frame is received from at the network device. It is determined whether the client device is using the new MAC address based on the received data frame. If it is determined that the client device is using the new MAC address, the client device is permitted access the network.

Allocation of local MAC addresses to client devices

A source virtual private network (VPN) gateway supports a local source subnet and communicates over a wide area network (WAN) with a destination VPN gateway that supports a local destination subnet. The source VPN gateway receives from the local source subnet an Internet Protocol (IP) packet destined for the local destination subnet, determines a security association (SA) based on a source IP address and a destination IP address of the IP packet, and encapsulates the IP packet with tunnel encapsulation including a tunnel protocol header and a tunnel outer IP header, to produce a clear-text tunnel packet. The source VPN gateway encrypts the IP packet and the tunnel protocol header but not the tunnel outer IP header using an encryption key and a security parameter index for the SA, to produce an encrypted tunnel packet, and tunnels it to the destination VPN gateway over the WAN.

Encryption for gateway tunnel-based VPNs independent of wan transport addresses

Techniques are presented for encryption key rollover synchronization in a network. In one embodiment, a method includes generating a new set of public-key encryption keys for a first network element. Based on the new set of public-key encryption keys, a set of new security associations between the first network element and each other network element in the network is generated. The method includes providing a new public key from the new set of public-key encryption keys to a network controller and using security associations associated with a previous set of public-key encryption keys for encrypted communication between the first network element and each other network element. Upon obtaining, from a second network element, traffic protected by a security association from the set of new security associations, the method includes using the new security associations for subsequent encrypted communication between the first network element and the second network element.

Techniques for encryption key rollover synchronization in a network

In one embodiment, a classification device in a computer network analyzes data from a given device in the computer network, and classifies the given device as a particular type of device based on the data. The classification device may then determine whether a manufacturer usage description (MUD) policy exists for the particular type of device. In response to there being no existing MUD policy for the particular type of device, the classification device may then determine patterns of the analyzed data, classify the patterns into context-based policies, and generate a derived MUD policy for the particular type of device based on the context-based policies. The classification device may then apply one of either the existing or derived MUD policy for the given device within the computer network.

Online generation and updates of IoT mud policies

Growing community of inventors

San Jose, CA, United States of America

Brian Eliot Weis