Cisco Technology, Inc.

Bell Atlantic Network Services, Inc.

Verizon Communications Inc.

Verizon Services Corporation

Verizon Patent and Licensing Inc.

Eric Albin Voit

Shwetha Subray Bhandari

Sujal Sheth

Frank Brockners

Robert Thomas Baum, Jr

William F Sulzen

Robert D Farris

William David Goodman

Patrick E White

David E Young

Edward E Balkovich

Jayant G Gadre

Pradeep Kumar Kathail

Carlos M Pignataro

David Delano Ward

Pascal Thubert

Nagendra Kumar Nainar

Ali Sajassi

Samer Salam

Robert Stephen Rodgers

Lance S Liptak

David A Maluf

Kenneth E Depaul

Larry W Sours

Clarence Filsfils

Alexander Clemm

James E Curry

Reshad Rahman

Thomas John Giuli

John Edward McDowall

Richard Mandfred Pruss

Ludwig Alexander Clemm

Einar Nilsen-Nygaard

Alberto Gonzalez Prieto

Andrew Phillips Thurber

Jeffrey Ian Winter

Jesse Daniel Backman

Eric Michel Levy-Abegnoli

William Mark Townsley

Nancy Cam-Winget

Eliot Lear

Lionel Florit

Jakob Heitz

Sri Gundavelli

Richard Manfred Pruss

Yegnanarayanan Chandramouli

Yves Hertoghs

Chennakesava Reddy Gaddam

Amjad Sayedrasul Inamdar

Joseph Eryx Malcolm

Peter Panburana

Patrick Wetterwald

Srinath Gundavelli

Manoj Kumar

Jan Medved

Dhananjaya Rao

Zafar Ali

Subhasri Dhesikan

Wojciech Dec

Jan Vilhuber

John William Evans

Ashok Krishnaji Moghe

Bruce W Kostreski

Marcelo Yannuzzi

Swadesh Agrawal

Pratima Pramod Sethi

Edward Albert Warnicke

Jonas Zaddach

David Wayne Mills

Matthew Stephen MacPherson

William Michael Hudson, Jr

Pagalavan Krishnamoorthy

Selvaraj Mani

Wayne Roiger

Steve Phillips

Huw Jones

Jyoti Verma

Kenneth DePaul

Avinash Kalyanaraman

Yesu Lu

William G Giles

David C Lapier

Srinivas Vundru

Ian Woo

The disclosed technology addresses the need in the art for systems and methods of dynamic but stateless NAT encryption and decryption. The disclosed technology provides a robust encryption/decryption algorithm for concurrently obfuscating source and destination IPv6 addresses for SNAP deployments with 100% reversal and zero collisions, thereby providing protection to both the source and destination IPv6 simultaneously.

Method to achieve dynamic NAT66 encryption and decryption

A computing device connected to a power source via a combined power/data connection obtains an authentication request from the power source. The authentication request includes a freshness mechanism provided by the power source. The computing device signs an authentication response with a private key associated with a verified identity stored on the computing device. The authentication response includes the freshness mechanism. The computing device provides the authentication response to the power source, and receives power from the power source.

Fast repowering using cryptographically protected identity

In one aspect, a method of IP obfuscation of a user device includes receiving, over an Extendible Authentication Protocol (EAP) session between a user device and a network access point, location preferences of the user device, generating, based on the location preferences or a network policy, a geohash for the user device, identifying, for the user device, an IP anchor, sending, over the EAP session, the geohash to the user device, and receiving, from the user device, network traffic, wherein the network access point utilizes the geohash and the IP anchor to route the network traffic for the user device and obfuscate IP address of the user device from third-party access.

Technique for eliminating ingress-proxy in the multi-relay approach for privacy

Devices and methods that incorporate sustainability data within a header of a data packet to allow for the generation of sustainable configurations for various network devices are disclosed. Power efficiency is obtained at a node-level by including metadata to existing network flows, in an in-band/in-situ configuration. This information may be used for optimum flow placement. Received data packets may be formatted with sustainability data within a metadata shim. The received data packets are processed, and a sustainable configuration is generated for the one or more network devices. The generated sustainable configuration is transmitted to the one or more network devices to enable efficient and effective management of network devices by incorporating sustainability data into the data packets.

In-band sustainable packet management

Disclosed are systems, apparatuses, methods, and computer-readable media for secure network routing. A method includes: receiving, at a network node, an advertisement message for a network route including an IP address prefix; receiving, at the network node, a route origin authorization associated with the IP address prefix, the route origin authorization including a digital signature and a security requirement of a route to a destination that corresponds to the IP address prefix; determining, by the network node, one or more network nodes satisfies the security requirement to yield a determination; and determining, by the network node, to route network traffic to the IP address prefix based on the determination. In one example, the method can include, when the one or more network nodes satisfies the security requirement, advertising the route to the one or more network nodes that satisfies the security requirement.

Advertising BGP destination secure path requirement in global internet

A verifier peer system transmits a request to an application of another peer system to obtain integrity data of the application. In response to the request, the verifier peer system obtains a response that includes kernel secure boot metrics of the other peer system and integrity data of the application and of any application dependencies. If the verifier peer system determines that the response is valid, the verifier peer system evaluates the integrity data and the kernel secure boot metrics against a set of Known Good Values to determine whether the integrity data and the kernel secure boot metrics are valid. If the integrity data and the kernel secure boot metrics are valid, the verifier peer system determines that the other peer system is trustworthy.

Attestation-based scheme for validating peering setups for critical infrastructure protocols

Stateless network address privacy may be provided. A data packing may be received with an obfuscated destination address and an un-obfuscated source address. An un-obfuscated destination address may be determined based on the obfuscated destination address. An obfuscated source address may be determined based on the un-obfuscated source address. The obfuscated destination address may be replaced with the un-obfuscated destination address and the un-obfuscated source address may be replaced with the obfuscated source address. The packet may be forwarded.

Stateless network address privacy (SNAP)

Described herein are devices, systems, methods, and processes for optimizing network traffic distribution across multiple paths in a manner that is energy-efficient and environmental sustainability-aware. This may be achieved by leveraging time-series analytics and capacity planning based on seasonalities. Data associated with the Layer 3 topology of the network can be collected. Bandwidth can be pre-reserved on an energy-aware traffic engineering tunnel. The time-series data can be used to build a capacity plan based on the seasonalities. Nodes may be clustered based on usage patterns and network utilization seasonality. The data can be used to make decisions about when and where to combine or shut down paths for energy efficiency, while maintaining optimal network performance. A hysteresis mechanism may be incorporated to avoid oscillation when changing active links. Power savings can be achieved by fully turning off or depowering certain network components when they are not needed.

Sustainable network-wide optimization service

In one embodiment, a method includes determining a secure path through a first plurality of network nodes within a network and determining an alternate secure path through a second plurality of network nodes within the network. The method also includes routing network traffic through the first plurality of network nodes of the secure path and detecting a failure in the secure path using single-hop BFD authentication. The method further includes rerouting the network traffic through the second plurality of network nodes of the alternate secure path.

Systems and methods for securing network paths

Disclosed are systems, apparatuses, methods, and computer-readable media for providing security postures for a service provided by a heterogenous system. A method for verifying trust by a service node includes receiving a request for a security information of the service node from a client device, wherein the request includes information identifying a service to receive from the service node, identifying a related node to communicate with the service node based on the service, after identifying the related node, requesting a security information of the related node, generating a composite security information from the security information of the service node and the security information of the related node, and sending the composite security information to the client device. The composite security information provides security claims for a service implemented by a heterogenous devices that have different trusted execution environments.

Verifying trust postures of heterogeneous confidential computing clusters

Energy-aware configurations can be utilized to operate a network based on sustainability-related metrics. In many embodiments, a suitable device includes a processor, a memory commutatively coupled to the processor, a plurality of elements, a communication port, and an energy-aware topology logic configured to collect topology data from one or more network devices, wherein each of the one or more network devices include a plurality of elements. The energy-aware topology logic can receive power source data and power usage data related to plurality of elements and generate an element energy coefficient (EEC) for a plurality of elements. Subsequently, the energy-aware topology logic can also generate an energy-aware configuration for at least one of the one or more network devices, and then pass the generated energy-aware configuration to the at least one network device, wherein the energy-aware configuration is configured to steer traffic based on at least one sustainability-related metric.

Energy-aware traffic forwarding and loop avoidance

An enclave manager of a network enclave obtains a request to retrieve configuration information and state information corresponding to compute devices and network devices comprising a network enclave. The request specifies a set of parameters of the configuration information and the state information usable to generate a response to the request. The enclave manager evaluates the compute devices, the network devices, and network connections among these devices within the network enclave to obtain the configuration information and the state information. Based on the configuration information and the state information, the enclave manager determines whether the network enclave is trustworthy. Based on the parameters of the request, the enclave manager generates a response indicating a summary that is used to identify the trustworthiness of the network enclave.

Network enclave attestation for network and compute devices

Techniques for varying locations of virtual networks associated with endpoints using Network Address Translation (NAT), Mobile Internet Protocol (MIP), and/or other techniques in conjunction with Domain Name System (DNS). Rather than having DNS provide a client device with an IP address of an endpoint device, such as a server, the DNS instead returns a virtual IP (VIP) address that is mapped to the client device and the endpoint device. The VIP address may be selected based on a number of factors (e.g., power usage, privacy requirements, virtual distances, etc.). In this way, IP addresses of servers are obfuscated by a virtual network of VIP addresses that can be periodically rotated and/or load balanced. The client device may then communicate data packets to the server using the VIP address as the destination address, and a virtual network service that works in conjunction with DNS can convert the VIP address to the actual IP address of the server using NAT and forward the data packet onto the server.

Virtual server address selection

Described herein are devices, systems, methods, and processes for managing power congestion in multi-path routing systems. Indications may be similar to the ECN, and may be used in network headers, including headers for IPv6, SRv6, NSH, or other tunneling protocols. The indications, namely EOPN, PTE, and ECMP-exclude, can provide a mechanism for managing network power consumption and controlling ECMP routing based on flow priority and characteristics. The power budget can be dynamically adjusted based on the current power source mix, which may help to achieve sustainability goals. Hashing optimizations and signaling can be utilized to manage network power congestion and bandwidth-normalized power efficiency availability. A process may be implemented to ensure there is sufficient capacity to serve the expected traffic for different next-hop paths. Additionally, the ECN can be used to quickly react to congestion, bring capacity back online, and maintain optimal network performance, even in the absence of congestion.

Explicit over-power notification and power-based throttle eligible bits, path selection, and selective discard actions

Techniques for using Network Address Translation (NAT), Mobile Internet Protocol (MIP), and/or other techniques in conjunction with Domain Name System (DNS) to anonymize server-side addresses in data communications. Rather than having DNS provide a client device with an IP address of an endpoint device, such as a server, the DNS instead returns a random IP address that is mapped to the client device and the endpoint device. In this way, IP addresses of servers are obfuscated by a random IP address that cannot be used to identify the endpoint device or service. The client device may then communicate data packets to the server using the random IP address as the destination address, and a gateway that works in conjunction with DNS can convert the random IP address to the actual IP address of the server using NAT and forward the data packet onto the server.

Randomizing server-side addresses

Growing community of inventors

Bethesda, MD, United States of America

Eric Albin Voit