Cisco Technology, Inc.

Eric G Vyncke

Carlos M Pignataro

Joseph Michael Clarke

Benoit Claise

Harjinder Singh

Mioljub Jovanovic

Frank Brockners

Shwetha Subray Bhandari

Andrew Yourtchenko

Venkata Krishna Sashank Dara

William Mark Townsley

Andre Surcouf

Pierre Pfister

Nagendra Kumar Nainar

David A McGrew

Stefano Benedetto Previdi

Daniel George Wing

Brian Eliot Weis

Cullen F Jennings

Yoann Desmouceaux

Francois Le Faucheur

Reshad Rahman

Andre Jean-Marie Surcouf

Frederick Juergens Baker

Guillaume Ruty

Marcel Paul Sosthène Enguehard

Mark Townsley

Luc Billot

Pascal Delprat

David A Mcgrew

A method is performed at one or more entities configured to configure and provide assurance for a service enabled on a network. The service is configured as a collection of subservices on network devices of the network. A definition of the service is decomposed into a subservice dependency graph that indicates the subservices and dependencies between the subservices that collectively implement the service. Based on the subservice dependency graph, the subservices are configured to record and report subservice metrics indicative of subservice health states of the subservices. The subservice metrics are obtained from the subservices, and the subservice health states of the subservices are determined based on the subservice metrics. A health state of the service is determined based on the subservice health states. One or more of the subservices are reconfigured based on the health state of the service.

Closed loop automation for intent-based networking

The present technology provides a system, method and computer readable medium for steering a content request among plurality of cache servers based on multi-level assessment of content popularity. In some embodiments a three levels of popularity may be determined comprising popular, semi-popular and unpopular designations for the queried content. The processing of the query and delivery of the requested content depends on the aforementioned popularity level designation and comprises a acceptance of the query at the edge cache server to which the query was originally directed, rejection of the query and re-direction to a second edge cache server or redirection of the query to origin server to thereby deliver the requested content. The proposed technology results in higher hit ratio for edge cache clusters by steering requests for semi-popular content to one or more additional cache servers while forwarding request for unpopular content to origin server.

Efficient and flexible load-balancing for clusters of caches under latency constraint

A method comprises configuring a service as a collection of subservices on network devices of a network, and decomposing a definition of the service into a subservice dependency graph that indicates the subservices and dependencies between the subservices that implement the service. The method further comprises, based on the subservice dependency graph, configuring a subservice among the subservices to record and report a subservice metric as an indicator of subservice performance. The method further comprises determining a rate at which to obtain values of the subservice metric from the subservice, determining a confidence interval for the values of the subservice metric, and obtaining the values of the subservice metric from the subservice at the rate, to produce values for monitoring the subservice. The method also includes determining whether at least one of the values for monitoring the subservice is within the confidence interval.

Baselining service-tagged data from subservices of a service for service assurance

Techniques and mechanisms to enable a Bidirectional Forwarding Detection (BFD) Echo function to be used for IP multi-hop paths using IP encapsulation. A source device may encapsulate one or more BFD Echo packets as payloads in IP packets. The resulting IP packets may then be sent from a source device to a destination device over a multi-hop path such that one or more intermediary devices forward the IP packets onto the destination device. Upon receiving the IP packets, the destination device may echo back the one or more BFD Echo packets in the forwarding plane to indicate connectivity of the forwarding path between the devices. However, if the BFD Echo packets are not echoed back to the source device, the source device may determine that the multi-hop path has experienced a fault, and that traffic is to be rerouted through other paths.

Determining connectivity between compute nodes in multi-hop paths

A message is received which indicates a request for a client-specific service address for service or content provided by a service provider. In response to the request, a client-specific service address may be generated and sent to the client. The address may be used as a destination address in one or more subsequent client requests for service or content. A first portion of the address comprises an IPv6 service prefix assigned to a service network of the service provider. A second portion of the address comprises semantic information having a first portion of encrypted private information and a second portion of unencrypted service information. The encrypted private information may be generated by encrypting private information based on a cryptographic key, where the cryptographic key is derived based on a secret key associated with the service provider and an IP client prefix assigned to the client.

Facilitating user privacy in communications involving semantic-bearing IPv6 addresses

A method is performed to provide assurance for a service enabled on a network. A definition of the service is received. The definition includes a service type, a service instance, and configuration information used to enable the service. From the service type and the service instance, a service tag that is unique to the service is generated so as to distinguish the service from other services on the network. Based on the definition, the service is decomposed into a subservice dependency graph of subservices and dependencies between the subservices. Based on the subservice dependency graph, the subservices are configured to record and report subservice metrics indicative of health states of the subservices. The subservice metrics are obtained from the subservices. The service tag is applied to the subservice metrics to produce service-tagged subservice metrics. The service-tagged subservice metrics are analyzed to determine a health state of the service.

Service tagging optimization for intent-based networking

A method includes configuring services as respective collections of subservices on network devices of a network, and decomposing definitions of the services into subservice dependency graphs each indicating the subservices and dependencies between the subservices that collectively implement a respective one of the services. The method further includes traversing the subservice dependency graphs to identify, at one or more intersections of the subservice dependency graphs, one or more shared subservices among the subservices of the services, wherein the one or more shared subservices are shared by the services. The method also includes monitoring subservice health states of the one or more shared subservices, and determining health states of the services based on the subservice health states of the one or more shared subservices.

Intelligent selection of vantage points for monitoring subservices based on potential impact to services

A method for routing a request for content from a content provider through an IPv6 network is described, the IPv6 network being an information centric network (ICN) in which content is directly addressed using at least a portion of an IPv6 address. The method includes receiving, at an IPv6 network, a request for content, determining that the request does not comprise an ICN address. The method further includes intercepting the request, and translating the request into an IPv6 address in which at least a portion of the address is directed to or associated with the piece of content. Systems and methods described herein address problems arising from the interaction between IP and ICN networking models.

Mapping between classical URLs and ICN networks

Content distribution system cache management may be provided. First, a sync packet may be received by a cache server from a first server. The sync packet may include a list indicating a cache server where a chunk is to be stored and the address for the chunk. Next, an address for the chunk may be obtained by the cache server by parsing the sync packet. The cache server may then determine that the chunk is not stored on the cache server by using the address for the chunk. Next, in response to determining that the chunk is not stored on the cache server, a connection may be opened between the first server and the cache server. The cache server may then receive the chunk over the connection and cache the chunk on the cache server.

Content distribution system cache management

A system and methods are provided for verifying proof of transit of network traffic through a plurality of network nodes in a network. Information is obtained about a packet at a network node in a network. The information may include in-band metadata of the packet. Verification information is read from in-band metadata of the packet. Updated verification information is generated from the verification information read from the packet and based on configuration information associated with the network node. The updated verification information is written back to the in-band metadata in the packet. The packet is forwarded from the network node in the network.

Network path proof of transit using in-band metadata

A system and methods are provided herein for verifying proof of transit of traffic through a plurality of network nodes in a network. In one embodiment, a method is provided in which information is obtained about a packet at a network node in a network. The information includes in-band metadata. Verification information is read from the in-band metadata. The verification information for use in verifying a path of the packet in the network. Updated verification information is generated from the verification information read from the packet. The updated verification information is written to the in-band metadata of the packet, and the packet is forwarded from the network node in the network.

Transport mechanism for carrying in-band metadata for network path proof of transit

A system and methods are provided for verifying proof of transit of network traffic through a plurality of network nodes in a network. In one embodiment, each network node reads a first value and a second value from in-band metadata of packet, and generates, using a cryptographic key that is unique to each respective network node, an encryption result based on the first value. An updated second value is generated based on the second value read from the packet and the encryption result. Each network node writes the updated second value to the in-band metadata of the packet, and forwards the packet in the network. In another embodiment, a secret sharing scheme is employed by each network node computes a portion of verification information using a unique share of a secret and based on the packet specific information.

Cumulative schemes for network path proof of transit

In one embodiment, an apparatus associated with securing a Resource Reservation Protocol (RSVP) with dynamic group keying is provided. The apparatus may include a group key logic that interacts with a dynamic group key management logic. The dynamic group key management logic provides a group key to members of a set of RSVP-capable devices. The apparatus also includes an RSVP authentication logic to determine whether a received RSVP message was provided by a member of the set of RSVP-capable devices. The determination is made using implicit authorization that depends on the group key and that does not depend on a challenge/response protocol. In one embodiment the apparatus is a router.

Growing community of inventors

Aleur, Belgium

Eric G Vyncke