Cisco Technology, Inc.

Frank Brockners

Shwetha Subray Bhandari

Carlos M Pignataro

Eric Albin Voit

Sujal Sheth

William F Sulzen

Nagendra Kumar Nainar

David Delano Ward

Flemming Andreasen

Atri Indiresan

Thomas Michel-Ange Feltin

Jerome Henry

Vojislav Vucetic

Eric G Vyncke

Saiprasad Reddy Muchala

Tal Maoz

Rakesh Reddy Kandula

Santhosh N

Venkata Krishna Sashank Dara

Andrew Yourtchenko

Wenqin Shao

Clarence Filsfils

Mark Grayson

Srinath Gundavelli

Kent Kinchu Leung

Robert Edgar Barton

Zafar Ali

Wojciech Dec

Reshad Rahman

Marcelo Yannuzzi

Craig Thomas Hill

Trevor Smith

Hervé Muyal

Benjamin William Ryder

Selvaraj Mani

Akshay Sunil Dorwat

Jean Andrei Diaconu

Russell Paul Gyurek

Pablo Garcia Del Valle

Marco Trinelli

Carlos Goncalves Pereira

Aviad Rom

Parisa Foroughi

Ijsbrand Wijnands

Ali Sajassi

Robert E Barton

Nitin Kumar

Hendrikus G P Bosch

Samer Salam

Louis Gwyn Samuel

Domenico Ficara

Pradeep Kumar Kathail

Alessandro Duminuco

Indermeet Singh Gandhi

Jeffrey Michael Napper

Rakesh Gandhi

Enzo Fenoglio

Arun G Khanna

Surendra M Kumar

Andre Surcouf

Alessandro Erta

Humberto Jose La Roche

Vincent Cuissard

Eliot Lear

Sape Jurriën Mullender

Luca Bisti

Robert Goguen

Einar Nilsen-Nygaard

Richard Manfred Pruss

Chennakesava Reddy Gaddam

Cesar Obediente

Matthew Lawrence King

Srihari Raghavan

Akshaya Nadahalli

Wayne Roiger

Matthias Falkner

Pallavi Kalapatapu

Huw Jones

Mankamana Mishra Prasad

Tamás Galló

Rafael Machado Da Silva

Sashank Venkata Krishna Dara

Sándor Szilárd Magyari

Leo Marche

Richard Mandred Pruss

Dennis Clare

Andrei M Iourtchenko

In one embodiment, a network device along a path in a network receives a schedule that controls when the networking device is to insert telemetry data into data traffic passing through the networking device. The networking device generates the telemetry data for insertion into the data traffic passing through the networking device. The networking device inserts, according to the schedule, the telemetry data into a particular packet of the data traffic passing through the networking device. The networking device sends the particular packet to a next hop along the path in the network.

Method and apparatus for cross-layer, in-band monitoring of tunnels by insertion of telemetry data into a packet

A method for providing a symbiotic network orchestrator utilized to automatically commission edge computing devices on corporate computing networks and edge site computing networks is presented. The method includes receiving an indication of a potential connection of an edge computing device to one or more computing networks associated with the orchestrator. The one or more computing networks includes a corporate computing network and an edge site computing network. The method further includes determining, based on the corporate computing network, the edge site computing network, and a predetermined set of rules, an intent for commissioning the edge computing device, reconfiguring, based on the intent, the corporate computing network and the edge site computing network, and commissioning the edge computing device on one or more of the corporate computing network or the edge site computing network in accordance with the reconfiguring.

Symbiotic network orchestrator for computing networks

In one embodiment, an observability and assurance service, associated with various clusters of application services for an application that are executed in a data mesh, may configure a data compliance filter for a particular application service in one of the clusters of application services according to a data compliance policy. The observability and assurance service may monitor the data and traffic associated with the particular application service, wherein the data compliance filter is applied to the traffic to restrict sensitive data in the traffic from being processed by the particular application service. The observability and assurance service may make a determination that the data compliance policy has been violated by the particular application service. The observability and assurance service may modify, based on the determination, the data compliance filter for the particular application service.

Automated data compliance and observability

In one embodiment, a method may use one or more Representational State Transfer (REST) Application Programming Interfaces (APIs) to receive data associated with a web application from a first user interface (UI) client device. The method may use the one or more REST APIs to determine a stateless operation by performing stateless pre-processing on the data associated with the web application and one or more contextual features associated with the stateless operation. The method may determine an augmented notification by applying an augmentation operation on the one or more contextual features and the stateless operation. The method may determine a stateful operation using the augmented notification. The method may receive a request for an update on the data associated with the web application from a second UI client device. In response to receiving the request, the method may communicate the stateful operation to the second UI client device.

High scalability and end-to-end consistency for web applications in distributed environments

A verifier peer system transmits a request to an application of another peer system to obtain integrity data of the application. In response to the request, the verifier peer system obtains a response that includes kernel secure boot metrics of the other peer system and integrity data of the application and of any application dependencies. If the verifier peer system determines that the response is valid, the verifier peer system evaluates the integrity data and the kernel secure boot metrics against a set of Known Good Values to determine whether the integrity data and the kernel secure boot metrics are valid. If the integrity data and the kernel secure boot metrics are valid, the verifier peer system determines that the other peer system is trustworthy.

Attestation-based scheme for validating peering setups for critical infrastructure protocols

Techniques and mechanisms are described for enabling a user to run heavy deep learning workloads on standard edge networks without off-loading computation to a cloud, leveraging the available edge computing resources, and efficiently partitioning and distributing a Deep Neural Network (DNN) over a network. The techniques enable the user to split a workload into multiple parts and process the workload on a set of smaller, less capable compute nodes in a distributed manner, without compromising on performance, and while meeting a Service Level Objective (SLO).

Partitioning and placement of models of models at a network edge

Novel techniques and mechanisms enable processing of heavy deep learning workloads on standard edge network devices to optimize the overall inference throughput of the network while meeting Service Level Agreement(s) (SLAs). The techniques can include receiving a deep learning model, determining a graph structure of the deep learning model including neurons organized in layers (the layers including an input layer, a plurality of hidden layers, and an output layer), assigning to a first IP subnet, at least a part of a first hidden layer of the plurality of hidden layers, assigning to a second IP subnet, at least a part of a second hidden layer of the plurality of hidden layers, and deploying the parts of the first and second hidden layers to edge devices as containerized applications with assigned IP addresses, which may be hidden from the user and/or third party application.

Hidden-layer routing for disaggregated artificial neural networks

A method is performed by a network controller that is configured to control routers configured to forward a multicast flow downstream from a first hop router that is a root of a multicast tree formed by the routers to last hop routers that terminate branches of the multicast tree, respectively. The method includes collecting operational configuration information from the routers and constructing a topological view of the multicast tree based on the operational configuration information; causing the routers to forward multicast probes downstream from the first hop router along all of the branches toward the last hop routers to trace the multicast tree; receiving, from particular ones of the last hop routers that received the multicast probes, indications that the multicast probes were received; and detecting failures in the multicast tree based on the indications and the topological view.

In-situ operations, administration, and maintenance extension to trace multicast tree and identify failure node

In one embodiment, a device may obtain a location of an endpoint that communicates with an application service. The device may match the location of the endpoint to a data compliance policy. The device may identify sensitive data within the application service to which the data compliance policy applies. The device may configure the application service to permit the endpoint to at least one of access or send the sensitive data when permitted by the data compliance policy.

Dynamic resolution and enforcement of data compliance

Systems, methods, and computer-readable media for assessing reliability and trustworthiness of devices operating within a network. An ARP responder can receive an ARP request from an ARP requestor for performing address resolution between the ARP requestor and the ARP responder in a network environment. The ARP responder can build an ARP response including attestation information of the ARP responder. Further, the ARP responder can provide, to the ARP requestor, the attestation information for verifying the ARP responder using the ARP response and the attestation information of the ARP responder.

Verifying the trust-worthiness of ARP senders and receivers using attestation-based methods

This disclosure describes various methods, systems, and devices related to identifying path changes of data flows in a network. An example method includes receiving, at a node, a packet including a first signature. The method further includes generating a second signature by inputting the first signature and one or more node details into a hash function. The method includes replacing the first signature with the second signature in the packet. The packet including the second value is forwarded by the node.

Path signatures for data flows

A method for unjoining and rejoining clusters of computing nodes in edge site computing networks to reduce the impact of interruption to connectivity between computing nodes is presented. The method includes accessing a cluster of computing nodes executing on an edge site computing network. The cluster of computing nodes includes a plurality of follower computing nodes and a leader computing node. The method further includes detecting an interruption to connectivity established between the leader computing node and one or more of the plurality of follower computing nodes. In response to detecting the interruption to connectivity, the method includes bifurcating the cluster of computing nodes into a first subcluster of computing nodes and a second subcluster of computing nodes. In response to detecting a restoration of connectivity, the method includes recombining the first subcluster of computing nodes and the second subcluster of computing nodes.

Unjoining and rejoining clusters in computing networks

Techniques to facilitate verification of in-situ network telemetry data of data packet of data traffic of packet-switched networks are described herein. A technique described herein includes a network node obtaining a data packet of data traffic of a packet-switched network. The data packet includes an in-situ network telemetry block. The network node obtains telemetry data and cryptographic key. The cryptographic key confidentially identifies the network node. The node encrypts at least a portion of the telemetry data based on the cryptographic key to produce signed telemetry data and updates telemetry-data entry of the in-situ network telemetry block. The telemetry data and signed telemetry data is inserted into the telemetry-data entry. The node forwards the data packet with the updated telemetry-data entry to another network node of the packet-switched network.

Verification of in-situ network telemetry data in a packet-switched network

This disclosure describes techniques for selectively placing and maintaining sensitive workloads in subsystems that achieve a minimum level of trustworthiness. An example method includes identifying at least one trustworthiness requirement associated with an application and transmitting, to a first subsystem, a request for at least one trustworthiness characteristic of the first subsystem and at least one second subsystem connected to the first subsystem. A response indicating the at least one trustworthiness characteristic is received from the first subsystem. The example method further includes determining that the at least one trustworthiness characteristic satisfies the at least one trustworthiness requirement; and causing the application to operate on a mesh comprising the first subsystem and the at least one second subsystem.

Achieving minimum trustworthiness in distributed workloads

Growing community of inventors

Cologne, Germany

Frank Brockners