Cisco Technology, Inc.

Gonzalo A Salgueiro

Joseph Michael Clarke

Charles Calvin Byers

Sebastian Jeuk

M David Hanes

Carlos M Pignataro

Nagendra Kumar Nainar

Chidambaram Arunachalam

Jerome Henry

Derek William Engi

Robert Edgar Barton

K Tirumaleswar Reddy

Ram Mohan Ravindranath

Kaustubh Inamdar

David Hanes

Santosh Ramrao Patil

Prashanth Patil

Shankar Ramanathan

Robert E Barton

Ralf Rantzau

Akramsheriff Ismailsheriff

Pascal Thubert

James Neil Guichard

Tao Zhang

Keith Griffin

Yi Zheng

Sridar Kandaswamy

Eric Chen

Helder F Antunes

Nikhil Sainath Kale

Rodney Dunn

Muhilan Natarajan

Bradley Wise

Pascale Delaunay

Julie Allen

Md Atiqur Rahman

Ana Peric

David John Zacks

Bob Melander

Andre Jean-Marie Surcouf

Marcelo Yannuzzi

Avraham A Poupko

Yasi Xi

Dmitri Goloubev

Zhaoyi Jin

Paul Brian Giralt

Bhargavkumar Ghanshyamlal Pandya

Jason A Kuhne

Maria Soledad Palmero

Jason Michael Coleman

Rajesh Vargheese

James D Stanley, Iii

Ryan Steve D'Souza

Hongling Cen

Steven Michael Holl

Michael David Hanes

Aparna Vellala

Salini Kumar Bogadapati

Jagadish Chandra Prasad Mynampati

Joel Richard Goergen

Brian Eliot Weis

Blake Harrell Anderson

Thomas Szigeti

Hugo Latapie

Enzo Fenoglio

Akram Ismail Sheriff

John Matthew Swartz

Andre Surcouf

Herbert Michael Wildfeuer

Nitesh Trikha

Ammar Rayes

Frederick Juergens Baker

Hazim Hashim Dahir

Jack Chi Cham

David Prantl

Brooks Stevens Read

Danyang Raymond Zheng

Matthew R Engle

Matthew Henry Birkner

Felipe De Mello

Volodymyr Iashyn

Panagiotis Theodorou Kampanakis

William Nathan Dry

Dmitry Goloubew

Pankaj Srivastava

Rajath Agasthya

Felipe Ignacio Garrido

Matthew Duddles

Vinay Kumar Dharmaraj

Vinit Jain

Howard Steven Nelson

Vijay Pillai

Jorge Martin Garcia Rangel

Matthew L Sommer

Andi Bridgett Cho

Fernando Molina Rodriguez

Ravi Prakash Garg

Goudam Jaganmohan Muralitharan

Rekha Gopikrishnan

Systems, methods, and computer-readable media for orchestrating data center resources and user access to data. In some examples, a system can determine, at a first time, that a user will need, at a second time, access to data stored at a first location, from a second location. The system can identify a node which is capable of storing the data and accessible by a device from the second location. The system can also determine a first service parameter associated with a network connection between the device and the first location and a second service parameter associated with a network connection between the device and the node. When the second service parameter has a higher quality than the first service parameter, the system can migrate the data from the first location to the node so the device has access to the data from the second location through the node.

Orchestration system for migrating user data and services based on user information

In some aspects, the techniques described herein relate to a method including: digitizing a physical visual aid presented in a hybrid collaborative communication session to generate a digitized visual aid and data indicative of content of the physical visual aid; correlating the content of the physical visual aid with participant interactions within the hybrid collaborative communication session; and generating hybrid collaborative communication session content based upon the correlating the content of the physical visual aid with the participant interactions within the hybrid collaborative communication session.

Collaboration and cognitive analysis for hybrid work visual aid sessions

In one embodiment, a device may obtain a media topology of nodes involved in a collaboration session. The device may cause each of a plurality of probes to be provisioned to a corresponding node of the nodes involved in the collaboration session to perform a test of a corresponding segment of the media topology, and each of the plurality of probes may be associated to a session identifier of the collaboration session. The device may determine observability information based on results of the plurality of probes for each segment of the media topology, and the results may include an indication of the session identifier. The device may correlate the observability information to the collaboration session based on the indication of the session identifier.

Testing media topology for collaboration sessions

In one embodiment, an illustrative method herein may comprise: obtaining, by a device, a plurality of indications of errors experienced by a bot performing tasks, wherein each of the plurality of indications includes contextual information of a corresponding error; determining, by the device, correlated errors among the errors experienced by the bot; aggregating, by the device, contextual information of each of the correlated errors into aggregated contextual data; and providing, by the device, the aggregated contextual data with an error notification for a particular correlated error.

Error context for bot optimization

Techniques are described herein for implementing and using a secure access service edge (SASE) exchange system to allow SASE providers to share SASE services with other providers. A SASE exchange system may be used by any number of SASE providers to support SASE roaming by user endpoints between different SASE providers. A user endpoint may use SASE roaming to access additional sets of SASE services and capabilities that cannot be provided by a home SASE provider and/or other current SASE provider(s) of the user endpoint. In some examples, a SASE exchange system may be used to transition user endpoints from one SASE provider to another. Additionally or alternatively, the SASE exchange system may determine a combination of SASE providers that can be used to provide different subsets of shared SASE services/capabilities to a user endpoint.

Exchange engine for secure access service edge (SASE) provider roaming

Methods are provided in which a network device hosts distinct network access resources that are managed by different entities. The method includes obtaining a request for partitioning one or more network resources of an on-premise network device for connecting one or more endpoints to a first network managed by a first entity. The on-premise network device connects one or more endpoints to a second network managed by a different entity. The method further involves partitioning, based on the request, the one or more network resources and connecting the one or more endpoints to the first network using the one or more network resources. The one or more network resources are managed by the first entity while at least one other network resource of the on-premise network device is managed by the different entity and is associated with connecting the one or more endpoints to the second network.

Multitenant network orchestration

Methods are provided in which a collaboration server connects at least two participants via respective user devices to a collaboration session. The collaboration server further distributes, to the respective user devices, media stream data and one or more customized graphical items that are distinguishably displayed in the collaboration session. The one or more customized graphical items are displayed in a foreground or a background associated with a collaboration space of first participant of the at least two participants. The collaboration server further detects a selection, by one of the respective user devices, of a graphical item from the one or more customized graphical items displayed in the collaboration space and performs at least one action associated with the graphical item during the collaboration session based on detecting the selection of the graphical item.

Adaptive background in video conferencing

A device receives a video stream, where one or more frames of the video stream include embedded metadata that is embedded directly into the one or more frames. The device extracts the embedded metadata from the one or more frames. The device makes an authentication determination regarding the video stream, based on whether the embedded metadata includes a digital signature associated with a sender of the video stream. The device controls, based on the authentication determination, presentation of the video stream to a recipient user.

In-band metadata for authenticity and role-based access in enterprise video streaming services

Techniques for associating manufacturer usage description (MUD) security profiles for Internet-of-Things (IoT) device(s) with secure access service edge (SASE) solutions, providing for automated and scalable integration of IoT devices with SASE frameworks. A MUD controller may utilize a MUD uniform resource identifier (URI) emitted by an IoT device to fetch an associated MUD file from a MUD file server associated with a manufacturer of the IoT device. The MUD controller may determine that a security recommendation included in the MUD file is to be implemented by a cloud-based security service provided by the SASE service and cause the IoT device to establish a connection with a secure internet gateway associated with the cloud-based security service. Additionally, or alternatively, the MUD file may include SASE extensions indicating manufacturer recommended cloud-based security services. Further, cloud-based security services may be implemented if local services are unavailable.

Manufacturer usage description (MUD) extensions for secure access service edge (SASE) services

Techniques described herein relate to automatically generating standard network device configurations. In one example, one or more groups of network device configuration blocks may be obtained. An analysis of the one or more groups of network device configuration blocks may be performed, including identifying respective frequencies associated with respective network device configuration blocks of the one or more groups of network device configuration blocks. Based on the respective frequencies, one or more network device configuration blocks of the one or more groups of network device configuration blocks may be automatically aggregated into a standard network device configuration.

Automated generation of standard network device configurations

In one embodiment, a device including a processor, and a memory to store data used by the processor, wherein the processor is operative to run a manufacturer usage description (MUD) controller operative to obtain a MUD profile of an Internet of Things (IoT) device from a MUD server, the MUD profile of the IoT device including: access rights of the IoT device, and any one or more of the following a default device username and/or a default device password of the IoT device, a recommended/required device password complexity of the IoT device, at least one service that should be enabled/disabled on the IoT device, and/or allowed security protocols and/or ciphers for communication to and/or from the IoT device, enforce security of the IoT device according to the MUD profile of the IoT device. Related apparatus and methods are also described.

Internet of things security system

This disclosure describes techniques for authenticating a user. For instance, a system may initially generate and then store authentication data for later authenticating the user. The authentication data may include biometrics data (e.g., facial recognition data), credentials data (e.g., a username, password, etc.), and/or environmental data (e.g., object(s) located within an environment). Later, the system may receive image data generated by a user device of the user. In some examples, the system may then analyze the image data using one or more facial recognition techniques in order to identify the user. The system may then use the authentication data, such as the environmental data, to determine that the image data further represents the object(s). Based on determining that the image data further represents the object(s), the system may then verify the user for access to a resource.

Techniques for authenticating a user

Systems, methods, and computer-readable media are provided for dynamic allocation of network security resources and measures to network traffic between end terminals on a network and a network destination, based in part on an independently sourced reputation score of the network destination. In one aspect, a method includes receiving, at a cloud network controller, a request from an end terminal for information on a network destination; determining, at the cloud network controller, a reputation score for the network destination; determining, at the cloud network controller, one or more security measures to be applied when accessing the network destination, based on the reputation score; and communicating, by the cloud network controller, the one or more security measures to the end terminal, wherein the end terminal communicates the one or more security measures to a third-party security service provider for applying to communications between the end terminal and the network destination.

Dynamic resource allocation for network security

Techniques for a network controller associated with a firewall service to determine a network policy based on operational tolerances associated with a device, and cause the network policy to be provisioned at the firewall service where control commands, such as, for example, supervisory control and data acquisition (SCADA) commands, may be allowed or denied transmission to the device based on the operational tolerance(s) associated with the device. In some examples, the network controller may be configured as a manufacturer usage description (MUD) controller configured to transmit a MUD uniform resource identifier (URI), emitted by the device, to a MUD file server associated with the manufacturer of the device. The MUD file may be enhanced to include the operational tolerances associated with the device and transmitted back to the MUD controller where it may be parsed to determine a corresponding network policy.

Cloud-delivered firewall rules for controlling commands sent to devices based on operational tolerance limits

Techniques for a context-aware secure access service edge (SASE) engine for generating security profile(s) associated with endpoint device(s) accessing the network and using the security profile(s) to evaluate a traffic flow from the endpoint device(s). The SASE engine may execute on an edge device of a computing resource network and may be configured to maintain a security profile database including an endpoint security profile mapping. Endpoint device(s) accessing the network may share endpoint, application, and/or user specific information with the SASE engine so that the SASE engine may generate a security profile specific to the endpoint, application, and/or user. Additionally, an enterprise network, associated with endpoint device(s) accessing the network, may provide default SASE security profile templates to the SASE engine. Further, a feedback loop may be established between the SASE engine and the endpoint device(s), enabling the SASE engine with the ability to autonomously and dynamically update security profiles.

Context-aware secure access service edge (SASE) engine

Growing community of inventors

Holly Springs, NC, United States of America

Gonzalo A Salgueiro