Cisco Technology, Inc.

International Business Machines Corporation

Other

Eric Michel Levy-Abegnoli

Pascal Thubert

Patrick Wetterwald

Jean-Philippe Vasseur

Jonas Zaddach

Marc Lamberton

Jerome Henry

Patrice Bellagamba

Dirk Anteunis

Vincent Jean Ribiere

Francois Le Faucheur

Robert Edgar Barton

Pradeep Kumar Kathail

Daniel Manuel Dias

David A Maluf

Marco Molteni

Arun Kwangil Iyengar

Eric Albin Voit

Pierre Secondo

Akram Ismail Sheriff

Huimin She

Eric C Rosen

Daniel C Tappan

Jakob Heitz

Luc Louis Revardel

Parag Kumar Jain

Massimo Villari

Stephane Labetoulle

Srinath Gundavelli

Kent Kinchu Leung

John Albert Toebes

Brian Eliot Weis

Paul Michael Dantzig

James R H Challenger

Eliot Lear

Ole Troan

Xuechen Yang

Olivier Bertin

Rudolph Benedict Klecka

David Charlton Forster

Patrick M P Wetterwald

Jp Vasseur

Nagendra Kumar Nainar

Donald W Schmidt

Ijsbrand Wijnands

Ali Sajassi

Robert E Barton

Jeffrey Mark Nick

Richard Harold Boivie

Alpesh S Patel

Donna N Dillenberger

Colin George Harrison

Michael E Baskey

Kiyoshi Maruyama

Maik Guenter Seewald

German Sergio Goldszmidt

Govind Prasad Sharma

Ajay Kumar Modi

Sridhar Vallepalli

Laurent Nicolas

Xiaoguang Jason Chen

Jean A Lorrain

Olivier Maurel

Junehwa Song

Guerney Douglass Holloway Hunt

Ramakrishnan Chokkanathapuram Sundaram

Patrick Grossetete

Matthew Lawrence King

Jean-Paul Chobert

Rekha Ramachandran

Guerney Douglass Hunt

Ratko Kovacina

Jean-Jacques Legoll

Shweta Choudaha

Daniel Georges Jean-Marie Mauduit

Julien Grobbelaar

Ghislaine Couland

Denis Jean Albert Chevalier

Philippe Michel Bazot

Christophe Benejean

Patrick Michel Pierre Wetterwald

Richard Gayraud

Pascal Pol Marie Thubert

Gilles Rhéal Roy

Eric Montagnon

In one embodiment, a method includes identifying, using a Static Context Header Compression (SCHC) rules engine, one or more packets matching a rule, selecting a firewall decision based on the identified one or more packets and the rule, and applying the firewall decision to the one or more identified packets.

System and method for providing SCHC-based edge firewalling

Techniques for using Network Address Translation (NAT), Mobile Internet Protocol (MIP), and/or other techniques in conjunction with Domain Name System (DNS) to anonymize server-side addresses in data communications and verify an authenticity of a client device attempting to use a virtual IP (VIP) address. Rather than having DNS provide a client device with an IP address of an endpoint device, such as a server, the DNS instead returns a VIP address that is mapped to the client device and the endpoint device. The client device may then communicate data packets to the server using the VIP address as the destination address, and a virtual network service that works in conjunction with DNS can verify an authenticity of the client device and convert the VIP address to the actual IP address of the server using NAT and forward the data packet onto the server.

Client device verification

In one embodiment, a supervisory device in a network forms a virtual access point (VAP) for a node in the network. A set of access points (APs) in the network are mapped to the VAP as part of a VAP mapping and the node treats the APs in the VAP mapping as a single AP for purposes of communicating with the network. The supervisory device receives measurements from the APs in the VAP mapping regarding communications associated with the node. The supervisory device identifies a movement of the node based on the received measurements from the APs in the VAP mapping. The supervisory device adjusts the set of APs in the VAP mapping based on the identified movement of the node.

Transparent roaming in virtual access point (VAP) enabled networks

Techniques for using Network Address Translation (NAT), Mobile Internet Protocol (MIP), and/or other techniques in conjunction with Domain Name System (DNS) to anonymize server-side addresses in data communications. Rather than having DNS provide a client device with an IP address of an endpoint device, such as a server, the DNS instead returns a virtual IP (VIP) address that is mapped to the client device and the endpoint device. In this way, IP addresses of servers are obfuscated by a virtual network of VIP addresses. The client device may then communicate data packets to the server using the VIP address as the destination address, and a virtual network service that works in conjunction with DNS can convert the VIP address to the actual IP address of the server using NAT and forward the data packet onto the server.

Anonymizing server-side addresses

In one embodiment, an access point is configured with a plurality of resource units (RUs). Each RU is configured to use a frequency range that differs from frequency ranges used by the other RUs. The access point determines a pattern of recurring signal performance over time. For each RU of the plurality of RUs, the pattern indicates the recurring signal performance with respect to a station when the station is located in a given physical location. The access point allocates one or more of the RUs for communicating with the station. The pattern is used for avoiding allocation of any of the RUs for which the station is predicted to experience strong multipath fading or other destructive interference.

Allocating a resource unit to a station

This disclosure describes techniques for device to device authentication. For instance, a first device may detect a second device, such as when a user physically attaches the second device to the first device or when the second device wireless communicates with the first device. A component of the first device and/or an authentication entity may then determine to authenticate the second device. In some instances, the component determines to authenticate the second device using information associated with an environment of the second device. To authenticate the second device, the authentication entity may send a request to a user, receive a response from the user, and then verify the response. After the authentication, the first device may determine that the second device includes a trusted device and establish a connection with the second device.

Techniques for device to device authentication

Techniques for adjusting a duration of an authenticated user device session. A baseline session duration is determined for a session for which a user account is authorized in response to a request for authentication. A first session is established on behalf of a user device associated with the user account based at least in part on the user account performing a first authentication. A posture associated with the user device is determined. The baseline duration is then adjusted to a dynamic duration based at least in part upon the posture associated with the user device. Based at least in part on the dynamic duration the user can be required to re-authenticate.

Determining session duration for device authentication

In one embodiment, an illustrative method herein may comprise: receiving, at a first edge device, a direct indication from a second edge device that a mobile device has moved from the first to the second edge device; determining, based on the direct indication, a first time at which the mobile device attached to the second edge device; receiving a network routing update message indicative of a routing update for the mobile device having moved to the second edge device; determining, based on the network routing update message, a second time at which convergence completed at the first edge device; and calculating a convergence time for the mobile device to be detected as having moved to the second edge device based on a difference between the first time and the second time.

Observing virtual connectivity reactivity upon mobility events

Systems, methods and computer-readable storage media are provided for determining critical flow characteristics and predicting the network resources to compute time-based p-routes that satisfy different SLAs. Critical flows within a set of nodes organized in a DODAG are monitored and assessed according to applicable SLAs and relevant networking KPIs to generate a forecast of the traffic flow and the overall SLAs for these critical flows. These overall SLAs, KPIs, and the generated forecast are used by a PCE associated with the network to compute p-routes through the set of nodes in the DODAG that satisfy the overall SLAs for the critical flows.

Systems and methods for Internet-of-Things network predictive topology switching

Techniques for varying locations of virtual networks associated with endpoints using Network Address Translation (NAT), Mobile Internet Protocol (MIP), and/or other techniques in conjunction with Domain Name System (DNS). Rather than having DNS provide a client device with an IP address of an endpoint device, such as a server, the DNS instead returns a virtual IP (VIP) address that is mapped to the client device and the endpoint device. The VIP address may be selected based on a number of factors (e.g., power usage, privacy requirements, virtual distances, etc.). In this way, IP addresses of servers are obfuscated by a virtual network of VIP addresses that can be periodically rotated and/or load balanced. The client device may then communicate data packets to the server using the VIP address as the destination address, and a virtual network service that works in conjunction with DNS can convert the VIP address to the actual IP address of the server using NAT and forward the data packet onto the server.

Virtual server address selection

Techniques for using Network Address Translation (NAT), Mobile Internet Protocol (MIP), and/or other techniques in conjunction with Domain Name System (DNS) to anonymize server-side addresses in data communications. Rather than having DNS provide a client device with an IP address of an endpoint device, such as a server, the DNS instead returns a random IP address that is mapped to the client device and the endpoint device. In this way, IP addresses of servers are obfuscated by a random IP address that cannot be used to identify the endpoint device or service. The client device may then communicate data packets to the server using the random IP address as the destination address, and a gateway that works in conjunction with DNS can convert the random IP address to the actual IP address of the server using NAT and forward the data packet onto the server.

Randomizing server-side addresses

In one embodiment, a method comprises identifying, by a path computation element, essential parent devices from a nonstoring destination oriented directed acyclic graph (DODAG) topology as dominating set members belonging to a dominating set; receiving, by the path computation element, an advertisement message specifying a first dominating set member having reachability to a second dominating set member, the reachability distinct from the nonstoring DODAG topology; and generating, by the path computation element based on the advertisement message, an optimized path for reaching a destination network device in the nonstoring DODAG topology via a selected sequence of dominating set members, the optimized path providing cut-through optimization across the nonstoring DODAG topology.

Path optimization based on reducing dominating set membership to essential parent devices

The present disclosure is directed to systems and methods for first hop security in a multi-site and multi-vendor cloud. The method may include receiving, at a first hop security (FHS) device located within a defined security perimeter, a message from a first host; validating a security of the message; signing the message with a signature to prove validation of the message, the signature comprising at least a Crypto-ID Parameters Option (CIPO) and a Neighbor Discovery Protocol Signature Option (NDPSO); and transmitting the signed message to one or more network FHS devices within the security perimeter.

First hop security in multi-site multi-vendor cloud

Systems and methods may include sending, to a network registrar, an extended duplicate address request (EDAR) message including a first nonce generated by a host computing device, and receiving, from the network registrar, an extended duplicate address confirmation (EDAC) message including a second nonce and a first signature, a first nonce pair including the first nonce and the second nonce being signed by the network registrar via a first key pair of the network registrar via the first signature. The systems and methods may further include sending a first neighbor advertisement (NA) message to the host computing device including the second nonce. The second nonce and a public key of the network registrar verifies the first signature from the network registrar, the verification of the first signature indicating that a router through which the host computing device connects to a network is not impersonating the network.

Network security from host and network impersonation

Growing community of inventors

Valbonne, France

Eric Michel Levy-Abegnoli