Cisco Technology, Inc.

Feiliang Wang

Huimin She

Pascal Thubert

Chuanwei Li

Yinfang Wang

Patrick Wetterwald

Li Zhao

Lele Zhang

Yajun Xia

Jianzhou Chen

The present disclosure provides a hierarchical method of identifying unauthorized network traffic in a network by applying, at one of a first plurality of nodes of a network, a first level of network traffic analysis to identify received network traffic as one of authorized or suspicious network traffic, the one of the first plurality of nodes having a first path for traffic routing and a second path to one of a second plurality of nodes of the network, the second path being used for forwarding the suspicious network traffic to the one of the second plurality of nodes; tagging the received network traffic as the suspicious network traffic; and sending the suspicious network traffic to the one of the second plurality of nodes over the second path, the second network node applying a second level of network analysis to determine if the received network traffic is authorized, unauthorized or remains suspicious.

SASE based method of preventing exhausting attack in wireless mesh networks

In one embodiment, a method comprises: generating, by a constrained low power and lossy network (LLN) device that is localized within a subregion of an LLN, a thin destination oriented directed acyclic graph (DODAG) having up to a prescribed limit of attached LLN devices at each hop of the thin DODAG based on generating a DODAG information object (DIO) message specifying an instruction for limiting attachment at each hop of the thin DODAG to the prescribed limit; and causing, by the constrained LLN device, multicast-only transmissions via the thin DODAG based on inserting into the DIO message a multicast-only transmission mode via the thin DODAG and outputting the DIO message, the DIO message causing each neighboring LLN device to selectively attach to the constrained LLN device as an attached child LLN device based on the instruction and execute the multicast-only transmissions via the thin DODAG.

Multicast-only thin DODAG in low power and lossy network

In one embodiment, a technique comprises monitoring data transfer over a radio frequency (RF) link between a first device and a second device in a mesh network where the second device is a descendent node and the first device is a parent node. The technique further transfers the data over a power link communication (PLC) when the RF link is inactive. The method also includes broadcasting, by the second device, RF link availability to at least a third device in the mesh network when the RF link with the first device is inactive where the third device has an active link with the second device and the third device is a descendent node of the second device. The method then includes communicating, between the second device and the third device, through the active RF link.

Increasing throughput for multi-PHY networks

In one embodiment, a method comprises: receiving, by a root network device providing a DAG topology in a low power and lossy network (LLN), one or more multicast registration messages from an LLN device and identifying distinct properties of the LLN device; receiving, by the root network device, one or more multicast address group identifiers of one or more multicast streams to which the LLN device has subscribed, and associating the one or more multicast address group identifiers with the distinct properties; receiving a multicast message specifying one of the multicast address group identifiers; and generating, by the root network device, a directed multicast message having a multi-dimensional addressing data structure comprising a selected one of the distinct properties and the one multicast address group identifier, causing parent network devices in the DAG topology to selectively retransmit based on determining a child network device has the selected one distinct property.

Directed multicast based on multi-dimensional addressing relative to identifiable LLN properties

In one embodiment, a method comprises: determining, by a network device in a wireless data network, a past throughput of broadcast data packets transmitted at broadcast transmission intervals of a prescribed broadcast schedule over a selected measurement interval, the broadcast transmission intervals each adjacent to unicast transmission intervals allocated in the wireless data network, each of the broadcast transmission intervals in the prescribed broadcast schedule initially set at a prescribed duration; predicting, by the network device, a predicted throughput of a future broadcast transmission interval of the prescribed broadcast schedule, for transmission of at least a future broadcast data packet, based on executing a trendline prediction of the predicted throughput using the past throughput over the selected measurement interval; and adjusting the corresponding prescribed duration of the future broadcast transmission interval, relative to the corresponding adjacent unicast transmission interval following the future broadcast transmission interval, based on the predicted throughput.

Mesh network device adjusting broadcast dwell interval based on trendline prediction of future throughput

In one embodiment, a parent device in an unaligned wireless network may determine a superframe comprising a header timeslot followed by a plurality of sub timeslots. The parent device may transmit, to a plurality of child devices in the unaligned wireless network, a beacon during the header timeslot, wherein the beacon comprises i) synchronization information used by the plurality of child devices to synchronize to the header timeslot and ii) reservation information that indicates one or more reserved sub timeslots of the plurality of sub timeslots. The parent device may receive, from a particular child device of the plurality of child devices, a message during a particular sub timeslot of the plurality of sub timeslots that is different than the one or more reserved sub timeslots.

Synchronization and reservation based on sub timeslots for unaligned wireless communications

In one embodiment, a method comprises determining, by a network device, a hop-by-hop path in a low-power and lossy network having a tree-based topology originated at a root network device, the hop-by-hop path comprising identified network devices for forwarding a data packet from a source network device to a destination device in the tree-based topology; and causing, by the network device, the destination device to initiate generation of a locally-optimized tree that bypasses the root network device and optimizes forwarding of the data packet from the source network device to the destination device, based on confined advertisements within the tree-based topology relative to the identified network devices.

Peer-to-peer optimization in existing tree-based topology based on generating locally-optimized tree using confined advertisements

In one embodiment, a device receives data indicative of a routing topology of a network. The network includes a root node and each node in the network has an associated network depth relative to the root. The device selects a first subset of timeslots from a slotframe of a communication schedule based on the network depth of a particular node in the network. The device selects a second subset of timeslots from the first subset, based on a media access control (MAC) address of the particular node. The device assigns the second subset of timeslots to the particular node for reception in the slotframe of the communication schedule. The device sends the communication schedule to one or more nodes in the network.

Time multiplexed channel hopping for LLNs

In one embodiment, a device receives data indicative of a routing topology of a network. The network includes a root node and each node in the network has an associated network depth relative to the root node in the routing topology. The device assigns the nodes in the network to timeslots of a channel-hopping communication schedule in order of their associated network depths. The device assigns transmit and receive actions to the timeslots of the communication schedule for a particular time such that parent-to-child and child-to-parent communications alternate with network depth in the timeslots. The device sends the communication schedule with the node and action assignments to one or more of the nodes in the network.

Vertical collision avoidance in LLNs

A network device establishes a depth-aware communication schedule for one or more nodes in a data network having a routing topology comprising a root node, the establishing including selecting from a slotframe of the depth-aware communication schedule a first subset of timeslots based on the depth, and allocating to each timeslot in the first subset an exclusive role (a transmit operation, a receive operation, or an idle state) for one or more of the nodes at the corresponding depth; the network device identifies one or more idle states in the depth-aware communication schedule, and selects a second subset of timeslots from the idle states as in-case-of-emergency timeslots, based on the network device identifying in the second subset a corresponding timeslot at a neighboring depth being allocated a corresponding transmit operation or receive operation; the network device causes selective transmission of a prioritized data packet in an allocated in-case-of-emergency timeslot.

Emergency packet transmission allocation within time multiplexed channel hopping for LLNs

A network device receives a data packet sourced from a root of a tree-based topology and including a data structure identifying transmitted data packets transmitted by the root; in response to determining one or more absent transmitted data packets based on the data structure, the network device starts a deferred transmission timer requiring the network device to wait a first half of a selected minimum contention interval before attempting transmission to a parent at a randomized position within a second half of the selected minimum contention interval, the selected minimum contention interval based on the distance to the root and at least twice that of the parent; the network device selectively transmits a control message to the parent to request the absent transmitted data packets only if, upon reaching the corresponding randomized position of the deferred transmission timer, the network device has not received the absent transmitted data packets.

Growing community of inventors

Shanghai, China

Feiliang Wang