Cisco Technology, Inc.

Gangadharan Byju Pularikkal

Santosh Ramrao Patil

Mark Grayson

Madhusudan Nanjanagud

Sourav Chakraborty

Swaminathan A Anantha

Akram Ismail Sheriff

Jerome Henry

Bart A Brinckman

Kedar Krishnanand Gaonkar

Che-ming Chang

Raghavaiah Avula

Sanjay Kumar Hooda

Anand K Oswal

Muninder Singh Sambi

Mark Allen Webb

Kedar Karmarkar

Matthew Aaron Silverman

David A McGrew

Vivek Agarwal

Blake Harrell Anderson

Mickael James Graham

Saravanan Radhakrishnan

Darrin Joseph Miller

Ajeet Pal Singh Gill

Einar Nilsen-Nygaard

Ravi Sankar Mantha

Huaiyi Wang

Akramsheriff Ismailsheriff

Paul Wayne Bigbee

Mantha Ravi Sankar

Jeffrey Riddel

Shyam Sundar Vaidyanathan

Peter Gaspar

In one embodiment, a method includes receiving one or more 5G software-defined wide area network (SD-WAN) policies, identifying one or more identity-based policies from the one or more 5G SD-WAN policies, communicating the identified one or more identity-based policies to one or more WAN routers, communicating one or more 5G bindings to the one or more WAN routers, and applying the identified one or more identity-based policies to one or more flows between the one or more WAN routers.

System and method for mapping policies to SD-WAN data plane

Secure network segmentation using logical subnet segments is described. A single network segment or subnet provided by a third party is mapped into multiple layer-3 virtual or logical segments without requiring separate subnets. This mapping is accomplished by using virtual routing functions (VRFs) per logical subnet segment while retaining a single subnet across the segments. The logical subnet segments interact with the single network segment provided by the third party (ISP). The layer-3 VRF instances are created without the need for separate IP subnet pools per layer-3 segment. Each VRF instance for the various logical subnet segments is mapped to an identifier and tag.

Micro and macro segmentation in enterprise networks without a per segment layer-3 domain

A method of controlling performance of a wireless device is performed by a node that is in electronic communication with a cellular network. The node includes a processor, a non-transitory memory, and a network interface. The method includes receiving a performance value characterizing a performance of a communication channel between a wireless device and a wireless access point. In some implementations, the wireless device and the cellular network are associated with different radio access technologies (RATs). The method includes determining whether the performance value breaches a performance criterion for the wireless device. The method includes adjusting a first amount of data transmitted to the wireless device from a base station of the cellular network and a second amount of data transmitted to the wireless device from the wireless access point. In some implementations, the combined first and second amounts of data satisfy the performance criterion for the wireless device.

Controlling performance of a wireless device in a heterogeneous network

Various implementations disclosed herein enable controlling access to networks. In various implementations, a method of controlling access to a network is performed by a computing device including one or more processors, and a non-transitory memory. In various implementations, the method includes obtaining an indication that a mobile device having access to a first network utilizing a first radio access technology (RAT) has requested access to a second network utilizing a second RAT. In some implementations, the method includes determining whether the access to the first network satisfies an authentication criterion associated with the second network. In some implementations, the method includes granting the mobile device access to the second network in response to determining that the access to the first network satisfies the authentication criterion associated with the second network. In some implementations, accessing the second network via the authentication criterion satisfies an operating threshold associated with the mobile device.

Controlling access to networks in a heterogeneous network environment

Systems, methods, and computer-readable media for radio resource management in a Citizens Broadband Radio Service (CBRS) network include one or more CBRS devices (CBSDs) which can obtain a group type associated with the CBSDs and their associated Radio Environment Map (REM) reports of one or more frequency channels of the CBRS network. The group type and the REM reports may be provided to a Self-Organizing Network (SON) manager of the CBRS network, where the SON manager may determine and provide to the CBSDs, one or more of a channel utilization information, transmission power, or mobility load management information for the CBSD, based on the group type and the REM reports.

Reducing interference in CBRS networks

Systems, methods, and devices are disclosed for providing a quality of service between nodes. A service provider can receive, from a first node of a customer network to an ingress node of a service provider network, packets bound for a second node on the customer network that is remote from the first node. The packets are mapped to a network segment according to a traffic type based on an identifier associated with the packets that identifies the traffic type of the packets. The packets are sent via their mapped network segment to an egress node with connectivity to the second node of the customer network according to a quality of service associated with the traffic type identified by the identifier.

Mechanism to coordinate end to end quality of service between network nodes and service provider core

In one embodiment, an IoT server includes: processing circuitry, an I/O module operative to communicate with at least an IoT device and a vendor network server, and an onboarding application and operative to at least: receive an onboarding request from the IoT device via the I/O module, send a confirmation request to the vendor network server via the I/O module, where the confirmation request indicates a request to confirm an identity of the IoT device according to a connection to a network device authenticated by the vendor network server, receive a confirmation response from the vendor network server via the I/O module, where the confirmation response indicates whether the IoT device is connected to the network device, and if the confirmation response is a positive confirmation response that indicates that the IoT device is connected to the network device, onboard the IoT device for participation in an IoT-based system.

Expended trust for onboarding

In one embodiment, a gateway to a zero trust network applies an access control policy to an endpoint device attempting to access a cloud-based application hosted by the zero trust network. The gateway acts as a reverse proxy between the endpoint device and the cloud-based application, based on the access control policy applied to the endpoint device. The gateway captures telemetry data regarding application traffic reverse proxied by the gateway between the endpoint device and the cloud-based application. The gateway detects an anomalous behavior of the application traffic by comparing the captured telemetry data to a machine learning-based behavioral model for the application. The gateway initiates a mitigation action for the detected anomalous behavior of the application traffic.

Machine learning-based application posture for zero trust networking

The present technology pertains to a system that routes application flows. The system can receive an application flow from a device by an active threat detection agent; analyze the application flow for user context, device context, and application context; classify the application flow based on the analysis of the application flow; and direct the application flow according to the classification of the application flow and an application access policy.

Threat detection of application traffic flows

Methods and systems to estimate encrypted multi-path TCP (MPTCP) network traffic include restricting traffic in a first direction (e.g., uplink) to a single path, and estimating traffic of multiple subflows of a second direction (e.g., downlink) based on traffic over the single path of the first direction. The estimating may be based on, without limitation, acknowledgment information of the single path, a sequence of acknowledgment numbers of the single path, an unencrypted initial packet sent over the single path as part of a secure tunnel setup procedure, TCP header information of the unencrypted initial packet (e.g., sequence number, acknowledgment packet, and/or acknowledgment packet length), and/or metadata of packets of the single path (e.g., regarding cryptographic algorithms, Diffie-Helman groups, and/or certificate related data).

Encrypted traffic analytics over a multi-path TCP connection

Secure network segmentation using logical subnet segments is described. A single network segment or subnet provided by a third party is mapped into multiple layer-3 virtual or logical segments without requiring separate subnets. This mapping is accomplished by using virtual routing functions (VRFs) per logical subnet segment while retaining a single subnet across the segments. The logical subnet segments interact with the single network segment provided by the third party (ISP). The layer-3 VRF instances are created without the need for separate IP subnet pools per layer-3 segment. Each VRF instance for the various logical subnet segments is mapped to a Virtual Network Identifier (VNI) and Scalable Group Tag (SGT).

A method is performed at a gateway device including one or more processors and a non-transitory memory. The method includes, receiving, from a first wireless network, a first get authentication token request, where the first get authentication token request includes network information of a second wireless network and information of a first user equipment (UE). The method further includes forwarding the first get authentication token request to the second wireless network in response to receiving the first get authentication token request. The method additionally includes receiving a first authentication token from the second wireless network. The method also includes forwarding the first authentication token to the first UE via the first wireless network in order to associate the first UE with the second wireless network.

Access network authentication token broker (ANATB) gateway

Systems, methods, and computer-readable media for dynamically assigning devices to specific channels in the CBRS band. One or more dedicated channels within the CBRS band can be selected and a boost channel device group can be formed by exclusively allocating the one or more dedicated channel to the boost channel device group. Further, a normal channel device group can be formed by allocating, to the normal channel device group, one or more channels in the CBRS band that are separate from the one or more dedicated channels allocated to the boost channel device group. One or more devices communicating in the CBRS band can be selectively assigned to either the boost channel device group or the normal channel device group to selectively control communications in the CBRS band over the one or more dedicated channels utilized by the boost channel device group.

Growing community of inventors

San Jose, CA, United States of America

Gangadharan Byju Pularikkal