Lenovo (singapore) Pte. Ltd.

Lenovo Global Technology (united States) Inc.

George-Andrei Stanescu

Radu Mihai Iorga

Corneliu-Ilie Calciu

Bogdan Chifor

Bogdan-Cosmin Chifor

Roberto H Jacob Da Silva

Vlad Marian Spoiala

Catalin Nitipir

Catalin-eugen Nitipir

A method for in-band telemetry rate limiting is disclosed. An apparatus and computer program product also perform the functions of the method. Embodiments of the method include receiving a telemetry packet at an egress node of a data pathway in a data network. The data pathway includes an ingress node, transit nodes and the egress node and the telemetry packet includes a telemetry parameter where the telemetry parameter is for a node in the data pathway. The method includes comparing the telemetry parameter with a previous telemetry parameter from a previous telemetry packet received at the egress node prior to receiving the telemetry packet, and transmitting telemetry data from the telemetry packet to a network controller in response to a telemetry difference exceeding a telemetry parameter threshold. The telemetry difference includes a difference between the telemetry parameter and the previous telemetry parameter.

In-band telemetry rate limiting in cloud environments

A method for tunning high speed link parameters for cables with a transceiver at each end includes transmitting, in response to establishing a link, an eye pattern bit sequence from a first computing device to a second computing device over a cable with a transceiver connected to each end of the cable. Establishing the link includes establishing a communication link over the cable between the first computing device and the second computing device. The method includes receiving an eye pattern quality message from the second computing device using a device discovery protocol. The eye pattern quality message includes quality information of a received waveform corresponding to the transmitted eye pattern bit sequence. The method includes adjusting transmission parameters for transmission over the cable in response to the quality information, and retransmitting the eye pattern bit sequence using the adjusted transmission parameters.

Tunning high speed link parameters

Dynamic buffer selection in ethernet controllers including determining, by an ethernet controller, based on a received header of a packet, a length of the packet; selecting, from a plurality of buffers, a buffer of a buffer size based on the length of the packet, wherein the plurality of buffers comprises a plurality of different buffer sizes; and transferring the packet to the selected buffer.

Dynamic buffer selection in ethernet controllers

A method includes receiving, at an unmanaged switch, a link-aggregation control protocol ('LACP') protocol data unit (“PDU”) on each port of two or more connections to be in a link-aggregation group (“LAG”). The ports are in the unmanaged switch, which is unconfigured for LACP and is connected over the connections to a managed switch configured for LACP. The method includes, in response to the ports that received an LACP PDU being unconfigured for LACP, configuring each port receiving an LACP PDU for LACP, creating a LAG that includes the connections of the ports that received the LACP PDUs, and starting an LACP timer. The method includes, in response to determining that the LACP timer has expired, clearing the LACP configuration of the ports configured for LACP. The LACP timer expires in response to the ports in the LAG not receiving additional LACP PDUs prior to expiration of a timer period.

Self-configuring link aggregation control protocol

A method for reducing the number of IP addresses used by VRRP includes creating a VRRP control packet at a router of a plurality of physical routers configured in parallel in a data pathway. The physical routers are configured as a virtual router and the VRRP control packet is configured as an IPv6 control packet. The method includes inserting an IP address of the virtual router in a router address field of a control packet header. The IP address is formatted as an IPv4 address. The method includes inserting, in a reserved field of the control packet, a first value. The first value differs from a default value for the reserved field signifying that IP addresses in the router address field are formatted as IPv6 addresses for IPv6 control packets and the first value signifies that the IP addresses in the router address field are formatted as IPv4 addresses.

Method for reducing the number of IP addresses used when creating a virtual router

Methods, apparatuses, and computer program products for fast resumption of dormant sessions on a client device are disclosed. A client device receives a push notification from a push notification server, the push notification having a payload that includes a datagram packet from an application server that initiated the push notification. A push notification process on the client device extracts the datagram packet from the push notification and injects the datagram packet into a communications protocol stack for at least one application on the client device. The application is awakened from a dormant state and reads the datagram packet. The application may then send a response to the datagram packet to the application server.

Fast resumption of dormant sessions on a client device

Methods, apparatuses, and computer program products for edge device assisted mitigation of publish-subscribe denial of service (DoS) attacks are disclosed. An edge device hosts a virtualized copy of an Internet-of-Things (IoT) device subscribed to one or more publish-subscribe topics. When the edge device receives an indication to activate the virtualized copy of the IoT device, for example, during a DoS attack on the IoT device, the edge device activates the virtualized copy of the IoT device, which receives traffic from the publish-subscribe topic. The virtualized copy of the IoT device applies security policies to incoming traffic received from the subscription topics and transmits to the IoT device sanitized traffic obtained from the received incoming subscription content traffic.

Edge device assisted mitigation of publish-subscribe denial of service (DoS) attacks

A method for detecting network mis-cabling includes receiving, from a discovery process, an original remote device identifier ('ID') and remote port ID of a port of a remote device connected to a port of a local device and storing the original remote device ID and remote port ID together with a local device ID and a local port ID of the port of the local device. The method includes receiving, from the discovery process, a new remote device ID and remote port ID for a remote device connected to the port of the local device, and comparing the original remote device ID and port ID with the new remote device ID and remote port ID. The method includes, in response to the original remote device ID and the original remote port ID not matching the new remote device ID and the new remote port ID, sending a mismatch alarm.

Method for detecting network mis-cabling

A method for link layer authentication includes receiving, at an edge network access node, a link layer authentication packet from a client, seeking network access, using a remote NAS agent running on the edge network access node. The method transmits, using a tunneling connection, the link layer authentication packet to a remote NAS in a link layer authentication process. The link layer authentication process exchanges the link layer authentication packet with an authentication server to authenticate the client. The method includes receiving a link layer authentication packet from the remote NAS over the tunneling connection. The received link layer authentication packet includes a response from the authentication server regarding the transmitted link layer authentication packet. The method includes transmitting the received link layer authentication packet to the client and, in response to link layer authentication packets resulting authorization, authorizing the client for network access through the edge network access node.

Link-layer authentication for legacy network nodes using a remote network access server

An apparatus includes a packet encryption circuit that uses an encryption keys to encrypt each of two or more portions of a data packet. Each portion is encrypted with a different encryption key and includes one or more layers of the data packet. A first portion includes a layer of the data packet with MAC information. The apparatus includes a packet transmitter that transmits, from a source router, an encrypted data packet to an intermediate router between the source router and a destination router. The encrypted data packet includes an encrypted version of the data packet encrypted using the encryption keys. The intermediate router has encryption keys sufficient for a service level agreement of the intermediate router and lacks a portion of the encryption keys. The source and destination routers use a MAC security standard for encryption and decryption of the data packet using the encryption keys.

Selectively disclosing content of data center interconnect encrypted links

Methods, apparatuses, and computer programs products for connection parameter awareness in an authenticated link-layer network session are disclosed. A client sends, to a network access server (NAS), an initiation packet announcing the initiation of an authentication session. The client establishes an authenticated link-layer session with the NAS. The client receives, from the NAS, a network policy packet including a network policy defined by one or more connection parameters for the link-layer session. The client then enforces the network policy.

Connection parameter awareness in an authenticated link-layer network session

A method for authorization of internet of things ('IoT') identity bootstrapping includes receiving from a device, at a network access server ('NAS') of a user and in response to an attestation request sent to the device, a vendor network address of a vendor server of a vendor and a device identifier for the device. The method includes authenticating the vendor using the vendor network address and, in response to authenticating the vendor, sending the device identifier to the vendor server. The method includes communicating device attestation packets between the vendor server and the device. The device attestation packets validate the device to the vendor server. The method includes receiving device attestation from the vendor server. The device attestation indicating validity status of the device to the NAS. The method includes, in response to the device attestation indicating validity of the device, transmitting a new device identity to the device.

Method for cloud assisted authorization of IoT identity bootstrapping

An apparatus includes a message receiver circuit that receives, at a port of a network node, a message from a neighboring network node. The message includes a maximum transmission unit ('MTU') of the neighboring network node. The network nodes communicate using a layer-2 protocol. The apparatus includes a comparison circuit that determines if the received MTU is larger than an MTU for the port, and an approval circuit that, after determining that the received MTU is larger than the port's MTU, determines if the received MTU is supported by the network node. The method includes an increase circuit that, after determining that the received MTU is supported, changes the MTU of the network node's ports to match the received MTU, and a message circuit that, after determining that the received MTU is supported, sends a message with the MTU to network nodes connected to ports of the network node.

Automatic MTU configuration on a L2 domain

An apparatus for optimization for Spanning Tree Protocol ('STP') data network includes an egress filter setting circuit in a first network node that sets an egress filter to discard data packets at an egress port of the first network node connected to a second network node in response to receiving an egress filter bridge protocol data unit ('BPDU') message from the second network node indicating that a link between the first network node and the second network node is a redundant link. The network nodes are layer-2 STP bridges. The apparatus includes, in the first network node, an egress filter timeout circuit that resets a timer in response to receiving the egress filter BPDU message, and a filter clear circuit that clears the egress filter to allow data packets to be sent from the egress port to the second network node in response to the timer reaching a timeout.

Growing community of inventors

Ilfov, Romania

George-Andrei Stanescu