Cisco Technology, Inc.

Bell Atlantic Network Services, Inc.

Verizon Communications Inc.

Verizon Services Corporation

Verizon Patent and Licensing Inc.

Fraunhofer Institute for Secure Information Technology

Eric Albin Voit

Shwetha Subray Bhandari

Sujal Sheth

Frank Brockners

Robert Thomas Baum, Jr

William F Sulzen

Pascal Thubert

Robert D Farris

Pradeep Kumar Kathail

William David Goodman

Patrick E White

David E Young

Edward E Balkovich

Jayant G Gadre

Carlos M Pignataro

Nagendra Kumar Nainar

David Delano Ward

Ali Sajassi

David A Maluf

Eric Michel Levy-Abegnoli

Samer Salam

Robert Stephen Rodgers

Lance S Liptak

Kenneth E Depaul

Larry W Sours

Clarence Filsfils

Alexander Clemm

James E Curry

Reshad Rahman

Thomas John Giuli

Richard Mandfred Pruss

John Edward McDowall

Marcelo Yannuzzi

Ludwig Alexander Clemm

Einar Nilsen-Nygaard

Alberto Gonzalez Prieto

Jeffrey Ian Winter

Andrew Phillips Thurber

Jesse Daniel Backman

Patrick Wetterwald

Srinath Gundavelli

William Mark Townsley

Nancy Cam-Winget

Eliot Lear

Lionel Florit

Sri Gundavelli

Jakob Heitz

Jonas Zaddach

Chennakesava Reddy Gaddam

Yegnanarayanan Chandramouli

Richard Manfred Pruss

Amjad Sayedrasul Inamdar

Yves Hertoghs

Peter Panburana

Joseph Eryx Malcolm

Manoj N Kumar

Jan Medved

Zafar Ali

Dhananjaya Rao

John Michael Lake

Subhasri Dhesikan

Wojciech Dec

Salvatore Valenza

Jan Vilhuber

John William Evans

Ashok Krishnaji Moghe

Bruce W Kostreski

Swadesh Agrawal

Pratima Pramod Sethi

Samer M Salam

Edward Albert Warnicke

David Wayne Mills

Kasi Nalamalapu

Matthew Stephen MacPherson

William Michael Hudson, Jr

Selvaraj Mani

Pagalavan Krishnamoorthy

Rajamathangi Subramanian

Wayne Roiger

Huw Jones

Jyoti Verma

Steve Phillips

Avinash Kalyanaraman

Kenneth DePaul

Priyanka Bansal

William G Giles

Richard M Pruss

Ian Woo

David C Lapier

Srinivas Vundru

Yesu Lu

John E Mcdowall

Henk Birkholtz

Andreas Fuchs

John Edward Mcdowall

Alexander L Clemm

Ian Wood

Techniques for using Home Addresses, Mobile Internet Protocol (MIP), and/or other techniques in conjunction with Domain Name System (DNS) to obfuscate server-side addresses in data communications. Rather than having DNS provide a client device with an IP address of an endpoint device, such as a server, the DNS instead returns a Home Address that is mapped to the client device and at least one server IP address of the endpoint device. In this way, IP addresses of servers are obfuscated by a network mapping of the Home Addresses and the server IP addresses. The client device may then communicate data packets to the server using the Home Addresses as the destination address, and a virtual network service that works in conjunction with DNS can encapsulate the data packet with the server IP addresses and forward the data packet onto the server.

Obfuscating server-side addresses

A network of devices can be stabilized by administering an energy-aware topology that corresponds to a desired state derived in part from one or more sustainability metrics. Devices suitable for stabilization can include a processor, a memory, a plurality of elements, a communication port coupled with one or more neighboring devices, and an energy-aware topology logic. The energy-aware topology logic can monitor incoming traffic from one or more neighboring devices, receive current state data associated with the plurality of elements, and receive update data from the one or more neighboring devices via a sustainability-related augmented IGP. Also, the energy-aware topology logic can generate a desired state for the device based on at least the received current state data and update data. One or more of the plurality of elements may be modified in response to the generated desired state, wherein the modification involves changing one or more sustainability-related capabilities.

Energy-aware topology

Techniques for ultra-short-term resource forecasting for a network device are described. A selection of a time series algorithm from a set of time series algorithms for determining capacity right-sizing of a local resource is received, the is selection based at least in part on current local traffic conditions. Based on current local traffic conditions, parameter values to be used in the algorithm are determined, the parameters are associated with the time series algorithm selection. A number of data points for input to the time series algorithm are determined, the data points are a sequence of values representing an amount of the local resource used by the network device at a point in time and are collected at predetermined time intervals. Based on a calculation of the time series algorithm using the number of data points and parameter values, the right-size capacity of the local resource for the network device is determined and provided.

Seasonal parameter provisioning for ultra-short-term forecasts

In one embodiment, methods for monitoring network traffic are described. The method may include receiving network traffic that is flowing through the network. The method further includes generating one or more packets that include metadata representing a monitored characteristic of the network traffic. Additionally, the method may include generating, at least partly by a secure hardware chip of the network device and using a private key, a signature indicating the metadata was generated at the network device and a time at which the metadata was generated at the network device. The method may further include populating the one or more packets with the signature. Additionally, the method may include sending the one or more packets to a collection system associated with a network monitoring system.

Verifying data sources using attestation based methods

Techniques for using Prefix Address Translation (PAT), Mobile Internet Protocol (MIP), and/or other techniques to anonymize server-side addresses in data communications. Rather than allowing a server and/or endpoint have visibility of a client IP address of a client device accessing the server and/or endpoint, a virtual network service instead returns a PAT IP address that is mapped to the client device and/or the endpoint device. In this way, IP addresses of clients devices are obfuscated by the virtual network. The client device may then communicate data packets to the server and/or endpoint using the PAT IP address as the source address, and the virtual network service that works in conjunction with the server and/or endpoints can convert the PAT IP address to the actual IP address of the client for return packets using PAT and forward the return packet onto the client device.

Anonymizing client-side addresses

Devices, systems, methods, and processes for managing network devices through generated predictions and associated confidence levels are described herein. Networks within a floorplan can be operated at full capacity all day in an inefficient way when not adjusted due to traffic patterns and seasonality changes. Data related to the topology of the network, along with historical data can be utilized to generate predictions of various network needs. For example, the overall network throughput capacity needs may be predicted for a series of points in the future. An associated confidence level can be generated as well including one or more confidence intervals. These can be utilized to select a future need for the network and generate a corresponding sustainable network configuration for the network devices and/or their transceivers that can provide sufficient network needs while minimizing the overall power used. This can be automated over time once trust has been established.

Client-aware floorplan management with predicted confidence levels

Techniques for using Network Address Translation (NAT), Mobile Internet Protocol (MIP), and/or other techniques in conjunction with Domain Name System (DNS) to anonymize server-side addresses in data communications. Rather than having DNS provide a client device with an IP address of an endpoint device, such as a server, the DNS instead returns a random IP address that is mapped to the client device and the endpoint device. In this way, IP addresses of servers are obfuscated by a random IP address that cannot be used to identify the endpoint device or service. The client device may then communicate data packets to the server using the random IP address as the destination address, and a gateway that works in conjunction with DNS can convert the random IP address to the actual IP address of the server using NAT and forward the data packet onto the server.

Randomizing server-side addresses

Personal network Software Defined-Wide Area Networks (SD-WANs) with attested permissions may be provided. A first one of a plurality Personal Area Network (PAN) devices in a PAN may seed a routing table entry for at least one application that the first one of the plurality PAN devices supports. The routing table entry may include at least one characteristic associated with an egress link between the first one of the plurality PAN devices and a device outside of the PAN. The routing table entry may be exchanged among the plurality of PAN devices in the PAN. Then data may be routed, based on the exchanged routing table entry, in the PAN through the first one of the plurality PAN devices through the egress link to the device outside of the PAN.

Personal network software defined-wide area networks (SD-WANs) with attested permissions

Techniques for using Network Address Translation (NAT), Mobile Internet Protocol (MIP), and/or other techniques in conjunction with Domain Name System (DNS) to anonymize server-side addresses in data communications and verify an authenticity of a client device attempting to use a virtual IP (VIP) address. Rather than having DNS provide a client device with an IP address of an endpoint device, such as a server, the DNS instead returns a VIP address that is mapped to the client device and the endpoint device. The client device may then communicate data packets to the server using the VIP address as the destination address, and a virtual network service that works in conjunction with DNS can verify an authenticity of the client device and convert the VIP address to the actual IP address of the server using NAT and forward the data packet onto the server.

Client device verification

The disclosed technology addresses the need in the art for systems and methods of dynamic but stateless NAT encryption and decryption. The disclosed technology provides a robust encryption/decryption algorithm for concurrently obfuscating source and destination IPv6 addresses for SNAP deployments with 100% reversal and zero collisions, thereby providing protection to both the source and destination IPv6 simultaneously.

Method to achieve dynamic NAT66 encryption and decryption

A computing device connected to a power source via a combined power/data connection obtains an authentication request from the power source. The authentication request includes a freshness mechanism provided by the power source. The computing device signs an authentication response with a private key associated with a verified identity stored on the computing device. The authentication response includes the freshness mechanism. The computing device provides the authentication response to the power source, and receives power from the power source.

Fast repowering using cryptographically protected identity

In one aspect, a method of IP obfuscation of a user device includes receiving, over an Extendible Authentication Protocol (EAP) session between a user device and a network access point, location preferences of the user device, generating, based on the location preferences or a network policy, a geohash for the user device, identifying, for the user device, an IP anchor, sending, over the EAP session, the geohash to the user device, and receiving, from the user device, network traffic, wherein the network access point utilizes the geohash and the IP anchor to route the network traffic for the user device and obfuscate IP address of the user device from third-party access.

Technique for eliminating ingress-proxy in the multi-relay approach for privacy

Devices and methods that incorporate sustainability data within a header of a data packet to allow for the generation of sustainable configurations for various network devices are disclosed. Power efficiency is obtained at a node-level by including metadata to existing network flows, in an in-band/in-situ configuration. This information may be used for optimum flow placement. Received data packets may be formatted with sustainability data within a metadata shim. The received data packets are processed, and a sustainable configuration is generated for the one or more network devices. The generated sustainable configuration is transmitted to the one or more network devices to enable efficient and effective management of network devices by incorporating sustainability data into the data packets.

In-band sustainable packet management

Disclosed are systems, apparatuses, methods, and computer-readable media for secure network routing. A method includes: receiving, at a network node, an advertisement message for a network route including an IP address prefix; receiving, at the network node, a route origin authorization associated with the IP address prefix, the route origin authorization including a digital signature and a security requirement of a route to a destination that corresponds to the IP address prefix; determining, by the network node, one or more network nodes satisfies the security requirement to yield a determination; and determining, by the network node, to route network traffic to the IP address prefix based on the determination. In one example, the method can include, when the one or more network nodes satisfies the security requirement, advertising the route to the one or more network nodes that satisfies the security requirement.

Advertising BGP destination secure path requirement in global internet

A verifier peer system transmits a request to an application of another peer system to obtain integrity data of the application. In response to the request, the verifier peer system obtains a response that includes kernel secure boot metrics of the other peer system and integrity data of the application and of any application dependencies. If the verifier peer system determines that the response is valid, the verifier peer system evaluates the integrity data and the kernel secure boot metrics against a set of Known Good Values to determine whether the integrity data and the kernel secure boot metrics are valid. If the integrity data and the kernel secure boot metrics are valid, the verifier peer system determines that the other peer system is trustworthy.

Attestation-based scheme for validating peering setups for critical infrastructure protocols

Growing community of inventors

Bethesda, MD, United States of America

Eric Albin Voit