Cisco Technology, Inc.

United States of America as Represented by the Administrator of Nasa

Cap Epsilon, Inc.

David A Maluf

Pradeep Kumar Kathail

Raghuram S Sudhaakar

Eric Albin Voit

Pascal Thubert

Eric Michel Levy-Abegnoli

David Delano Ward

Ali Sajassi

Yuri O Gawdiak

Vijaynarayanan Subramanian

Mohana M Gurram

Srinath Gundavelli

John George Apostolopoulos

Nancy Cam-Winget

Sri Gundavelli

Shesha Bhushan Sreenivasamurthy

Amr Elnakeeb

Khai Peter B Tran

Jerome Henry

Yi Bin Wang

John F Schipper

Jan Medved

Alon Shlomo Bernstein

Indermeet Singh Gandhi

Paul Anthony Polakos

Sateesh Kumar Addepalli

Herbert Michael Wildfeuer

Plamen Nedeltchev

John Burns

Ashok Krishnaji Moghe

Ashutosh Arwind Malegaonkar

Yajun Zhang

Sanjiv Doshi

Huy Phuong Tran

Matthew Stephen MacPherson

David G Bell

Rajamathangi Subramanian

Todd M Baker

Avinash Kalyanaraman

Haihua Xiao

James D Stanley, Iii

Andrew Michael McPhee

Alexander X Ke

Frank Michaud

Jairon C Moh Hashim

Shu-Chun Y Lin

Tracy T La

Luis A Mederos

Hemil N Patel

Chen-Jung Hsu

Anh Ngoc Trinh

Vu Hoang Tran

Takeshi Okimura

Christopher D Knight

Klement Sekera

Techniques for using Locator ID Separation Protocol (LISP), Mobile Internet Protocol (MIP), and/or other techniques in conjunction with Domain Name System (DNS) to obfuscate server-side addresses in data communications. Rather than having DNS provide a client device with an IP address of an endpoint device, such as a server, the DNS instead returns an endpoint identifiers (EID) that is mapped to the client device and at least one routing locator (RLOC) of the endpoint device. In this way, IP addresses of servers are obfuscated by a network mapping of EIDs and RLOCs. The client device may then communicate data packets to the server using the EIDs as the destination address, and a virtual network service that works in conjunction with DNS can encapsulate the data packet with the RLOC using LISP and forward the data packet onto the server.

Obfuscating server-side addresses

A method of continuous multi-factor authentication may include executing wireless sensing based at least in part on execution of a continuous multi-factor authentication (CMFA) application at a computing device, collecting channel state information (CSI) data from a network device communicatively coupled to the computing device, transmitting the CSI data to a CMFA device, and receiving a trust score from the CMFA device based on the CSI data.

Continuous multi-factor authentication using wireless sensing data

In one embodiment, a processor of a vehicle detects a difference between a physical characteristic of the vehicle predicted by a first machine learning-based model and a physical characteristic of the vehicle indicated by telemetry data generated by a sub-system of the vehicle. The processor forms a packet payload of an update packet indicative of the detected difference, based in part on a relevancy of the physical characteristic to the first machine learning-based model. The processor applies a synchronization strategy to the update packet, to synchronize the update packet with a second machine learning-based model executed by a receiver. The processor sends the update packet to the receiver via a network, to update the second machine learning-based model.

Telemetry reporting in vehicle super resolution systems

Techniques for using Network Address Translation (NAT), Mobile Internet Protocol (MIP), and/or other techniques in conjunction with Domain Name System (DNS) to anonymize server-side addresses in data communications. Rather than having DNS provide a client device with an IP address of an endpoint device, such as a server, the DNS instead returns a random IP address that is mapped to the client device and the endpoint device. In this way, IP addresses of servers are obfuscated by a random IP address that cannot be used to identify the endpoint device or service. The client device may then communicate data packets to the server using the random IP address as the destination address, and a gateway that works in conjunction with DNS can convert the random IP address to the actual IP address of the server using NAT and forward the data packet onto the server.

Randomizing server-side addresses

The disclosed technology addresses the need in the art for systems and methods of dynamic but stateless NAT encryption and decryption. The disclosed technology provides a robust encryption/decryption algorithm for concurrently obfuscating source and destination IPv6 addresses for SNAP deployments with 100% reversal and zero collisions, thereby providing protection to both the source and destination IPv6 simultaneously.

Method to achieve dynamic NAT66 encryption and decryption

In one aspect, a method of IP obfuscation of a user device includes receiving, over an Extendible Authentication Protocol (EAP) session between a user device and a network access point, location preferences of the user device, generating, based on the location preferences or a network policy, a geohash for the user device, identifying, for the user device, an IP anchor, sending, over the EAP session, the geohash to the user device, and receiving, from the user device, network traffic, wherein the network access point utilizes the geohash and the IP anchor to route the network traffic for the user device and obfuscate IP address of the user device from third-party access.

Technique for eliminating ingress-proxy in the multi-relay approach for privacy

Stateless network address privacy may be provided. A data packing may be received with an obfuscated destination address and an un-obfuscated source address. An un-obfuscated destination address may be determined based on the obfuscated destination address. An obfuscated source address may be determined based on the un-obfuscated source address. The obfuscated destination address may be replaced with the un-obfuscated destination address and the un-obfuscated source address may be replaced with the obfuscated source address. The packet may be forwarded.

Stateless network address privacy (SNAP)

Techniques for using Network Address Translation (NAT), Mobile Internet Protocol (MIP), and/or other techniques in conjunction with Domain Name System (DNS) to anonymize server-side addresses in data communications. Rather than having DNS provide a client device with an IP address of an endpoint device, such as a server, the DNS instead returns a virtual IP (VIP) address that is mapped to the client device and the endpoint device. In this way, IP addresses of servers are obfuscated by a virtual network of VIP addresses. The client device may then communicate data packets to the server using the VIP address as the destination address, and a virtual network service that works in conjunction with DNS can convert the VIP address to the actual IP address of the server using NAT and forward the data packet onto the server.

Anonymizing server-side addresses

Correcting for antennae spatial distortions in Radio Frequency (RF) localization may be provided. A plurality of actual locations associated with a plurality of Access Point (APs) may be received. Then a plurality of signal strengths associated with the plurality of APs may be received. Based on the plurality of signal strengths, a model may be created that models a plurality of inference errors respectively corresponding to the plurality of APs between a plurality of inferred locations respectively corresponding to the plurality of APs and the plurality of actual locations. The model may then be used in determining a location of a device.

Correcting for antennae spatial distortions in radio frequency (RF) localizations

Stateless address translation at an Autonomous System (AS) boundary for host privacy may be provided. An address associated with a host device in the AS may be received. The address may comprise a network prefix and an interface identifier (ID). Then a cypher value may be assigned to a cypher bit range in the network prefix. The cypher value may be associated with a first cypher algorithm of a plurality of cypher algorithms. Next, the address may be encoded wherein encoding the address comprises applying the first cypher algorithm to encode a coding bit range in the address that is less significant than the cypher bit range. The encoded address may then be used for flows from the host that egress the AS.

Stateless address translation at an autonomous system (AS) boundary for host privacy

Embodiments include detection of physical events associated with a wireless network, where the detected physical events are associated with the measurable effects on radio signals between devices in the wireless network. The detected physical event and associated radio signal information is used to provide precise low cost time synchronization for a device in a network.

Continuous synchronization of multiple radio devices to physical time

Growing community of inventors

Mountain View, CA, United States of America

David A Maluf