Cisco Technology, Inc.

International Business Machines Corporation

Other

Eric Michel Levy-Abegnoli

Pascal Thubert

Patrick Wetterwald

Jean-Philippe Vasseur

Jonas Zaddach

Marc Lamberton

Jerome Henry

Patrice Bellagamba

Dirk Anteunis

Vincent Jean Ribiere

Francois Le Faucheur

Eric Albin Voit

Pradeep Kumar Kathail

David A Maluf

Robert Edgar Barton

Daniel Manuel Dias

Marco Molteni

Arun Kwangil Iyengar

Srinath Gundavelli

Pierre Secondo

Akram Ismail Sheriff

Huimin She

Eric C Rosen

Daniel C Tappan

Jakob Heitz

Luc Louis Revardel

Parag Kumar Jain

Massimo Villari

Stephane Labetoulle

Ali Sajassi

Kent Kinchu Leung

John Albert Toebes

Brian Eliot Weis

Paul Michael Dantzig

James R H Challenger

Eliot Lear

Ole Troan

Xuechen Yang

Olivier Bertin

Rudolph Benedict Klecka

David Charlton Forster

Patrick M P Wetterwald

Jp Vasseur

Nagendra Kumar Nainar

Donald W Schmidt

Ijsbrand Wijnands

Robert E Barton

Jeffrey Mark Nick

Richard Harold Boivie

Alpesh S Patel

Donna N Dillenberger

Colin George Harrison

Michael E Baskey

Kiyoshi Maruyama

Maik Guenter Seewald

German Sergio Goldszmidt

Govind Prasad Sharma

Ajay Kumar Modi

Sridhar Vallepalli

Laurent Nicolas

Xiaoguang Jason Chen

Jean A Lorrain

Olivier Maurel

Junehwa Song

Guerney Douglass Holloway Hunt

Ramakrishnan Chokkanathapuram Sundaram

Patrick Grossetete

Matthew Lawrence King

Jean-Paul Chobert

Rekha Ramachandran

Guerney Douglass Hunt

Ratko Kovacina

Jean-Jacques Legoll

Shweta Choudaha

Daniel Georges Jean-Marie Mauduit

Julien Grobbelaar

Ghislaine Couland

Denis Jean Albert Chevalier

Philippe Michel Bazot

Christophe Benejean

Patrick Michel Pierre Wetterwald

Richard Gayraud

Pascal Pol Marie Thubert

Gilles Rhéal Roy

Eric Montagnon

Techniques for using Prefix Address Translation (PAT), Mobile Internet Protocol (MIP), and/or other techniques to anonymize server-side addresses in data communications. Rather than allowing a server and/or endpoint have visibility of a client IP address of a client device accessing the server and/or endpoint, a virtual network service instead returns a PAT IP address that is mapped to the client device and/or the endpoint device. In this way, IP addresses of clients devices are obfuscated by the virtual network. The client device may then communicate data packets to the server and/or endpoint using the PAT IP address as the source address, and the virtual network service that works in conjunction with the server and/or endpoints can convert the PAT IP address to the actual IP address of the client for return packets using PAT and forward the return packet onto the client device.

Anonymizing client-side addresses

Techniques for using Network Address Translation (NAT), Mobile Internet Protocol (MIP), and/or other techniques in conjunction with Domain Name System (DNS) to anonymize server-side addresses in data communications. Rather than having DNS provide a client device with an IP address of an endpoint device, such as a server, the DNS instead returns a random IP address that is mapped to the client device and the endpoint device. In this way, IP addresses of servers are obfuscated by a random IP address that cannot be used to identify the endpoint device or service. The client device may then communicate data packets to the server using the random IP address as the destination address, and a gateway that works in conjunction with DNS can convert the random IP address to the actual IP address of the server using NAT and forward the data packet onto the server.

Randomizing server-side addresses

In one embodiment, a method includes identifying, using a Static Context Header Compression (SCHC) rules engine, one or more packets matching a rule, selecting a firewall decision based on the identified one or more packets and the rule, and applying the firewall decision to the one or more identified packets.

System and method for providing SCHC-based edge firewalling

Techniques for using Network Address Translation (NAT), Mobile Internet Protocol (MIP), and/or other techniques in conjunction with Domain Name System (DNS) to anonymize server-side addresses in data communications and verify an authenticity of a client device attempting to use a virtual IP (VIP) address. Rather than having DNS provide a client device with an IP address of an endpoint device, such as a server, the DNS instead returns a VIP address that is mapped to the client device and the endpoint device. The client device may then communicate data packets to the server using the VIP address as the destination address, and a virtual network service that works in conjunction with DNS can verify an authenticity of the client device and convert the VIP address to the actual IP address of the server using NAT and forward the data packet onto the server.

Client device verification

In one embodiment, a supervisory device in a network forms a virtual access point (VAP) for a node in the network. A set of access points (APs) in the network are mapped to the VAP as part of a VAP mapping and the node treats the APs in the VAP mapping as a single AP for purposes of communicating with the network. The supervisory device receives measurements from the APs in the VAP mapping regarding communications associated with the node. The supervisory device identifies a movement of the node based on the received measurements from the APs in the VAP mapping. The supervisory device adjusts the set of APs in the VAP mapping based on the identified movement of the node.

Transparent roaming in virtual access point (VAP) enabled networks

Techniques for using Network Address Translation (NAT), Mobile Internet Protocol (MIP), and/or other techniques in conjunction with Domain Name System (DNS) to anonymize server-side addresses in data communications. Rather than having DNS provide a client device with an IP address of an endpoint device, such as a server, the DNS instead returns a virtual IP (VIP) address that is mapped to the client device and the endpoint device. In this way, IP addresses of servers are obfuscated by a virtual network of VIP addresses. The client device may then communicate data packets to the server using the VIP address as the destination address, and a virtual network service that works in conjunction with DNS can convert the VIP address to the actual IP address of the server using NAT and forward the data packet onto the server.

Anonymizing server-side addresses

In one embodiment, an access point is configured with a plurality of resource units (RUs). Each RU is configured to use a frequency range that differs from frequency ranges used by the other RUs. The access point determines a pattern of recurring signal performance over time. For each RU of the plurality of RUs, the pattern indicates the recurring signal performance with respect to a station when the station is located in a given physical location. The access point allocates one or more of the RUs for communicating with the station. The pattern is used for avoiding allocation of any of the RUs for which the station is predicted to experience strong multipath fading or other destructive interference.

Allocating a resource unit to a station

This disclosure describes techniques for device to device authentication. For instance, a first device may detect a second device, such as when a user physically attaches the second device to the first device or when the second device wireless communicates with the first device. A component of the first device and/or an authentication entity may then determine to authenticate the second device. In some instances, the component determines to authenticate the second device using information associated with an environment of the second device. To authenticate the second device, the authentication entity may send a request to a user, receive a response from the user, and then verify the response. After the authentication, the first device may determine that the second device includes a trusted device and establish a connection with the second device.

Techniques for device to device authentication

Techniques for adjusting a duration of an authenticated user device session. A baseline session duration is determined for a session for which a user account is authorized in response to a request for authentication. A first session is established on behalf of a user device associated with the user account based at least in part on the user account performing a first authentication. A posture associated with the user device is determined. The baseline duration is then adjusted to a dynamic duration based at least in part upon the posture associated with the user device. Based at least in part on the dynamic duration the user can be required to re-authenticate.

Determining session duration for device authentication

In one embodiment, an illustrative method herein may comprise: receiving, at a first edge device, a direct indication from a second edge device that a mobile device has moved from the first to the second edge device; determining, based on the direct indication, a first time at which the mobile device attached to the second edge device; receiving a network routing update message indicative of a routing update for the mobile device having moved to the second edge device; determining, based on the network routing update message, a second time at which convergence completed at the first edge device; and calculating a convergence time for the mobile device to be detected as having moved to the second edge device based on a difference between the first time and the second time.

Observing virtual connectivity reactivity upon mobility events

Systems, methods and computer-readable storage media are provided for determining critical flow characteristics and predicting the network resources to compute time-based p-routes that satisfy different SLAs. Critical flows within a set of nodes organized in a DODAG are monitored and assessed according to applicable SLAs and relevant networking KPIs to generate a forecast of the traffic flow and the overall SLAs for these critical flows. These overall SLAs, KPIs, and the generated forecast are used by a PCE associated with the network to compute p-routes through the set of nodes in the DODAG that satisfy the overall SLAs for the critical flows.

Systems and methods for Internet-of-Things network predictive topology switching

Techniques for varying locations of virtual networks associated with endpoints using Network Address Translation (NAT), Mobile Internet Protocol (MIP), and/or other techniques in conjunction with Domain Name System (DNS). Rather than having DNS provide a client device with an IP address of an endpoint device, such as a server, the DNS instead returns a virtual IP (VIP) address that is mapped to the client device and the endpoint device. The VIP address may be selected based on a number of factors (e.g., power usage, privacy requirements, virtual distances, etc.). In this way, IP addresses of servers are obfuscated by a virtual network of VIP addresses that can be periodically rotated and/or load balanced. The client device may then communicate data packets to the server using the VIP address as the destination address, and a virtual network service that works in conjunction with DNS can convert the VIP address to the actual IP address of the server using NAT and forward the data packet onto the server.

Virtual server address selection

In one embodiment, a method comprises identifying, by a path computation element, essential parent devices from a nonstoring destination oriented directed acyclic graph (DODAG) topology as dominating set members belonging to a dominating set; receiving, by the path computation element, an advertisement message specifying a first dominating set member having reachability to a second dominating set member, the reachability distinct from the nonstoring DODAG topology; and generating, by the path computation element based on the advertisement message, an optimized path for reaching a destination network device in the nonstoring DODAG topology via a selected sequence of dominating set members, the optimized path providing cut-through optimization across the nonstoring DODAG topology.

Path optimization based on reducing dominating set membership to essential parent devices

Growing community of inventors

Valbonne, France

Eric Michel Levy-Abegnoli