Cisco Technology, Inc.

Juniper Networks, Inc.

Intel Corporation

Netlogic Microsystems, Inc

Elango Ganesan

Michael Freed

Nazar A Zaidi

Lawrence Rolfe Kreeger

Ramesh Panwar

Frederick R Gruner

Robert G Hathaway

Ricardo Ramirez

Yen C Lee

Mark Bryers

Sankar Ramanoorthi

John Phillips

Yuhong Zhou

Gregory G Spurrier

Jerome Henry

David T Hass

Abbas Rashid

Swapna Anandan

Rituraj Kirti

Brian Yoshiaki Uchino

Mark Vilas

Siva M Vaddepuri

Joe Joseph Karimundackal

Chau Anh Ngoc Nguyen

Thomas James Edsall

Robert E Barton

Flemming Andreasen

Shubhashree Venkatesh

Taqi Hasan

Laurent Plumelle

Silvano Gai

Michael J Morrison

Vinay Saini

Scott Taft Potter

Sanjay Kumar Hooda

Ali Sajassi

Anand K Oswal

Robert Edgar Barton

Jim Chen Chou

Paul M Quinn

Pradeep Kumar Kathail

Sanjay Sane

Michael Brian Galles

Alessandro Erta

Ramana Mellacheruvu

Arijit Mukherji

Gaurav Singh

Darrin Joseph Miller

Ramesh Nethi

Brian Hang Wai Yang

Michael H Kim

Guido Jouret

Arman Rezaee

Soei-Shin Hang

Michael Y Chow

Massimiliano Ardica

Rajesh Tarakkad Venkateswaran

John William Phillips

Brian A Apgar

Song Lu

Arif I Khan

Ruben Erick Escolero

Christopher M Eccles

Madeline Y Bernstein

Ian Mcdowell Campbell

Chau Ahn Ngoc Nguyen

Geetha Dabir

Samir C Vora

Arvind Prabhudev

Maged Khalil

A method of cross-domain policy orchestration may include executing, with a cross-domain automation (CDA) controller, a macro-segmentation of a plurality of domains based at least in part on metadata defining a mapping to a corresponding plurality of domain controllers, and executing, with the CDA controller, a micro-segmentation of policies within a group based at least in part on a merged policy matrix obtained from policies of the domain controllers.

Cross-domain policy orchestration

In one embodiment, a device determines a hierarchy of layers of a network comprising a plurality of networking devices. The device configures, in response to a request by a client to access remotely a particular endpoint in the network, a proxy chain of remote access agents executed by a plurality of networking devices in the network to allow the client to access remotely the particular endpoint. Each of those networking devices proxies traffic between different layers of the hierarchy. The device determines an access policy for the particular endpoint indicative of which commands may be sent to the particular endpoint by the client, based in part on where the particular endpoint is in the hierarchy. The device controls, based on the access policy, whether a command sent by the client is transmitted via the proxy chain to the particular endpoint.

Cloud-based security controls for multi-level hierarchal equipment access

In one embodiment, a remote access manager receives an access request from a client to remotely access a device on a local network. The remote access manager generates a universally unique identifier for the access request. The remote access manager sends a response to the client having a one-time use domain name system name that is based on the universally unique identifier. The remote access manager communicates with a web proxy to authorize the client to remotely access the device.

Secure remote access to devices on overlapping subnets

Embodiments relate to a method for enhancing and prioritizing operation technology (OT) control systems in a safety instrumented system (SIS) environment by incorporating safety levels. The method includes receiving network packets associated with OT systems by network interface. From network packets, OT systems associated with safety integrity level (SIL) values are identified. In response to identifying OT control systems associated with SIL values, determining priority levels from SIL values of OT systems. The method includes identifying, among OT control systems, network packets associated with a critical OT system associated with a SIL value having a higher priority level. The critical OT system may be prioritized that comprises encoding the network packets of the critical OT system, with corresponding SIL value. The prioritized critical OT system may be prioritized based on SIL value and classified into a network group associated with a network tag to deliver traffic with higher priority.

Method and system for network segmentation using safety integrity level (SIL)

A zero-touch deployment (ZTD) manager receives a first request to issue a first cryptographic token to a constrained device for establishing a communications session between the constrained device and a secured resource. The ZTD manager evaluates identity information corresponding to the constrained device and determines whether the identity information is valid. If so, the ZTD manager returns the first cryptographic token to the constrained device, where it is stored in cache memory. The ZTD manager receives a second request to obtain a second cryptographic token from the secured resource. When the second cryptographic token is provided to the secured resource, the secured resource uses this second cryptographic token to validate the first cryptographic token and to facilitate the communications session with the constrained device.

Method and apparatus for providing strong mutual authentication, encryption, and integrity for constraint devices without secure storage and PKI support

Automatic onboarding of a device onto a cellular network may be provided through a Wireless Local Area Network (WLAN). Subsequent to a device connecting to a first network (e.g., the WLAN), information associated with the device and the first network may be received. One or more tags may be generated and an intent profile may be defined for the device based on the received information, where the intent profile may indicate at least a second network (e.g., the cellular network) that the device is enabled to connect with and one or more policies associated with the connection. The tags and intent profile may be transmitted to a service provider platform, and an onboarding profile template identified using the tags and the intent profile may be received from the service provider platform. The onboarding profile template may be provided to the device to enable connection to the second network.

Cellular network onboarding through wireless local area network

In one embodiment, a service receives a device registration request sent by an endpoint device, wherein the endpoint device executes an onboarding agent that causes the endpoint device to send the device registration request via a cellular connection to a private access point name (APN) associated with the service. The service verifies that a network address of the endpoint device from which the device registration request was sent is associated with an integrated circuit card identifier (ICCID) or international mobile equipment identity (IMEI) indicated by the device registration request. The service identifies a tenant identifier associated with the ICCID or IMEI. The service sends, based on the tenant identifier, a device registration response to the endpoint device via the private APN.

Zero-touch deployment (ZTD) of cellular IoT devices and associated trust model

A method includes determining a corresponding level of a security model associated with each device of a plurality of devices connected to a network, each level of the security model having a corresponding tag; applying, to each of the plurality of devices, the corresponding tag based on the corresponding level of the security model with which each of the plurality of devices are associated; receiving, over a network connection, network traffic from at least one of the plurality of devices and the corresponding tag; analyzing the corresponding tag associated with the network traffic; determining a destination for the network traffic; applying one or more security measures to the network traffic based on the corresponding tag for the at least one device and a corresponding tag of the destination for the network traffic; and sending the network traffic to the destination with the corresponding tag of the destination.

Industrial security model as a SASE service

In one embodiment, an earthbound transceiver in a low earth orbit (LEO) satellite network establishes a connection with a first LEO satellite from a first set of LEO satellites. The first set of LEO satellites are distributed across a first plurality of orbits including first neighboring LEO satellites of the first LEO satellite, and the first neighboring LEO satellites have a fixed or semi-fixed position relative to the first LEO satellite. The earthbound transceiver determines first signal strength values associated with the first set of LEO satellites and second signal strength values associated with a second set of LEO satellites. The earthbound transceiver then periodically compares the first signal strength values to the second signal strength values. At an optimal handoff time, the earthbound transceiver initiates the handoff operation from the first LEO satellite to a second LEO satellite from the second set of LEO satellites.

Optimization of communications in a low earth orbit (LEO) satellite network

In one embodiment, the system may identify a virtual network, the virtual network including a plurality of virtual entities and connections among the plurality of virtual entities. The system may automatically map each of the plurality of virtual entities to one or more resources or resource pools such that the virtual network is mapped to a physical network, wherein mapping includes allocating one or more resources or resource pools to a corresponding one of the plurality of virtual entities.

Physical resource life-cycle in a template based orchestration of end-to-end service provisioning

In one embodiment, a device in a network receives data from one or more other devices in the network via one or more protocol adaptors. The device transforms the received data into a common data model. The device executes a containerized application. The device exposes the transformed data to the application.

Distributed application hosting environment to mask heterogeneity

A method is provided in one example embodiment and includes generating a first document and a second document associated with video data that includes a group of pictures (GOPs). The method also includes hashing a plurality of video frames associated with the video data. Additionally, the method includes appending each of the video frames' respective hash and respective display times to the first document, and appending each of a plurality of I-frames' respective hash and respective display times to the second document. The method further includes communicating the first document and the second document in a reliable manner over a network to a next destination.

System and method for providing cryptographic video verification

Growing community of inventors

Palo Alto, CA, United States of America

Elango Ganesan