Cisco Technology, Inc.

Christopher Wiborg

Rajiv Singhal

Ralph Droms

Arthur Gerald Howarth

Lawrence Rolfe Kreeger

Vikas Butaney

Roland Arthur Saville

Sandeep Kumar

Tefcros Anthias

Sunil Potti

Subramanian Srinivasan

Yi Jin

Subramanian N Iyer

Arthur G Howarth

Roland Saville

Gary Dennis Vogel

Some embodiments of the present invention provide middleware functionality integrated into a module of a network device, such as a router or switch, that is configured to provide application-oriented network ('AON') services. Some preferred implementations of the invention provide policy-based application services for RFID data, such as conditional routing, security (encryption, identification, authentication and authorization), data translation and/or transformation, data compression, data caching, etc. Some preferred implementations can interpret an application request and route to an appropriate network address of an RFID reader. Preferably, ALE (application-level event) aggregation and filtering can also be performed on behalf of the application. Some methods of the invention allow event data to be sent to applications (including but not limited to business applications) as request-response messages. Other methods of the invention allow event data to be sent to applications in the form of asynchronous notifications.

Network based device for providing RFID middleware functionality

A method is disclosed for protecting a network against a denial-of-service attack by inspecting application layer messages at a network element. According to one aspect, when a network element intercepts data packets that contain an application layer message, the network element constructs the message from the payload portions of the packets. The network element determines whether the message satisfies specified criteria. The criteria may indicate characteristics of messages that are suspected to be involved in a denial-of-service attack, for example. If the message satisfies the specified criteria, then the network element prevents the data packets that contain the message from being received by the application for which the message was intended. The network element may accomplish this by dropping the packets, for example. As a result, the application's host does not waste processing resources on messages whose only purpose might be to deluge and overwhelm the application.

Network and application attack protection based on application layer message inspection

Methods and devices are provided for identifying, locating and provisioning individual RFID devices in a network with 'personalities' that are appropriate for the roles of the RFID devices. According to some implementations of the invention, a combination of EPC code information and existing networking standards form the basis of identifying and provisioning methods. For example, MAC address information and EPC information can be combined to identify a particular device and its location in a network. For implementations using the Dynamic Host Configuration Protocol ('DHCP'), DHCP Options may be used to pass provisioning information. Some implementations employ Domain Name Service (&#x201c;DNS&#x201d;) and dynamic DNS (&#x201c;DDNS&#x201d;) to allow easy identification of RFID devices.

Methods and devices for assigning RFID device personality

Techniques are provided for performing security functions on a message payload in a network element. According to one aspect, a network element receives one or more data packets. The network element performs a security function on at least a portion of an application layer message that is contained in one or more payload portions of the one or more data packets. According to another aspect, a network element receives a first request that is destined for a first application. The network element sends, to a second application that sent the first request, a second request for authentication information. The network element receives the authentication information and determines whether the authentication information is valid. If the authentication information is not valid, then the network element prevents the first request from being sent to the first application.

Performing security functions on a message payload in a network element

Methods and devices are provided for identifying, locating and provisioning individual RFID devices in a network. According to some implementations of the invention, a combination of EPC code information and existing networking standards form the basis of identifying and provisioning methods. For example, MAC address information and EPC information can be combined to identify a particular device and its location in a network. For implementations using the Dynamic Host Configuration Protocol ('DHCP'), DHCP Options may be used to pass provisioning information. Some implementations employ Domain Name Service ('DNS') and dynamic DNS (&#x201c;DDNS&#x201d;) to allow easy identification of RFID devices.

Methods and devices for locating and uniquely provisioning RFID devices

Methods and devices are provided for identifying and provisioning individual RFID devices in a network. According to some implementations of the invention, a combination of EPC code information and existing networking standards form the basis of identifying and provisioning methods. For example, MAC address information and EPC information can be combined to identify a particular device and its location in a network. For implementations using the Dynamic Host Configuration Protocol ('DHCP'), DHCP Options may be used to pass provisioning information. Some implementations employ Domain Name Service ('DNS') and dynamic DNS (&#x201c;DDNS&#x201d;) to allow easy identification of RFID devices.

Growing community of inventors

Mountain View, CA, United States of America

Christopher Wiborg