Cisco Technology, Inc.

Govind Prasad Sharma

Sridhar Vallepalli

Javed Asghar

Prabhu Balakannan

Paul M Quinn

Eshwar Rao Yedavalli

James Neil Guichard

Umamaheswararao Karyampudi

Mohammed Javed Asghar

Ashwath Kumar Chandrasekaran

Swapnil Mankar

David Delano Ward

Eric Michel Levy-Abegnoli

Kenneth Durazzo

Hendrikus G P Bosch

Abhijit Patra

Dileep Kumar Devireddy

Dhananjaya Rao

Surendra M Kumar

Vipin Jain

Rex Emmanuel Fernando

Ajay Kumar Modi

Luyuan Fang

Herman Levenson

Gilles Rhéal Roy

Sivakumar Kailas

Techniques for generating a per-packet initialization vector for high bandwidth encryption engines in a multipathing IP network are described herein. In examples, a network switch of a first datacenter site may receive a data packet to be sent to a second datacenter site over a network. The data packet may be encrypted according to a virtual extensible LAN (VxLAN) protocol and to be transmitted in a VxLAN tunnel created for the first datacenter site and the second datacenter site. An encryption engine implemented at the network switch may generate an initialization vector (IV) for the data packet based on a packet number (PN) associated with the data packet. The encryption engine may use the IV and information associated with a security association (SA) assigned to the packet to encrypt the data packet. In some examples, a full 64-bit PN may be used to compute the IV for the data packet.

High bandwidth encryption engines in a multipathing IP network

A Software-Defined Networking (SDN)-based 'upstream' approach is a controller-based solution that provides secure key distribution and management for multi-site data centers. The approach uses an SDN Multi-Site Controller (MSC) that acts as an intermediary between SDN controllers at sites in a multi-site data center and manages the distribution of keys to sites. The approach is not dependent upon any particular routing protocol, such as the Border Gateway Protocol (BGP), and is well suited for multicast stream encryption by allowing the same key to be used for all replicated packets sent to downstream sites from an upstream source site. The approach distributes keys in a secure manner, ensures that data transferred between sites is done in a secure manner, and supports re-keying with error handling.

Upstream approach for secure cryptography key distribution and management for multi-site data centers

Upstream approach for secure cryptography key dist

Methods to secure against IP address thefts by rogue devices in a virtualized datacenter are provided. Rogue devices are detected and distinguished from a migration of an endpoint in a virtualized datacenter. A first hop network element in a one or more network fabrics intercepts a request that includes an identity of an endpoint and performs a local lookup for the endpoint entity identifier. Based on the lookup not finding the endpoint entity identifier, the first hop network element broadcasts a message such as a remote media access address (MAC) query to other network elements in the one or more network fabrics. Based on the received response, which may include an IP address associated with the MAC address, the first hop network element performs a theft validation process to determine whether the request originated from a migrated endpoint or a rogue device.

Endpoint security mechanism to detect IP theft on a virtual machine mobility in switch fabric

A method and apparatus for providing tenant specific encryption is described herein. According to an embodiment, a transmission site receives a data packet for transmission or forwarding. The transmission site determines, based on information in a header of the data packet, that the data packet is to be encrypted before transmission or forwarding. Using the information in the header, the transmission site identifies an encryption key for the data packet. The transmission site generates, for the data packet, an additional header and populates the additional header with a destination port number based on a destination port header value of the data packet. The transmission site overwrites the destination port header value of the packet with data indicating that the data packet is encrypted and then encrypts an encapsulated packet within the data packet using the encryption key prior to transmitting or forwarding the data packet. Upon receipt, the destination port header is used by the receiving site to determine that the packet is encrypted.

Tenant-specific encryption of packets carried in multi-cloud networks

Theft detection in data center networks may be provided. First, a first leaf switch may create an entry in a first distributed secure cache in response to an endpoint appearing on the first leaf switch. The entry may correspond to the endpoint and may be marked as having a tentative state. Then a request message may be sent to a plurality of leaf switches. The request message may comprise data identifying the endpoint. Next, a reply message may be received in response to the request message from a second leaf switch within the plurality of leaf switches. The tentative state may then be removed from the entry in response to the reply message indicating that the endpoint is valid.

Detecting IP address theft in data center networks

Presented herein are techniques for dynamic creation of a unique service path for a service chain. In one example, a service controller and a plurality of service nodes are provided, each service node configured to apply a service function to traffic that passes through the respective service node. The service controller defines a service chain identifying a set of service functions and an order in which they are applied. The service controller receives an indication that the service chain has been instantiated at a classifier, and creates a unique service path for the service chain, wherein the unique service path includes the service chain and the classifier at which the service chain is instantiated.

Dynamic service path creation

A plurality of network nodes are deployed in a network, each network node configured to apply a service function to traffic that passes through the respective network nodes. A controller generates information for a service chain that involves application to traffic of one or more service functions at corresponding ones of the plurality of network nodes along a forward path through the one or more network nodes. The controller identifies one or more of the service functions within the service chain that is stateful. When one or more of the service functions of the service chain is stateful, the controller generates information for a reverse path through the one or more service nodes for the one or more stateful service functions. The controller binds a forward chain identifier for the forward path with a reverse chain identifier for the reverse path for the service chain.

Symmetric service chain binding

In one embodiment, a method at a network device includes receiving a link layer advertisement, comparing information in the link layer advertisement with connectivity information stored at the network device, and based on the comparison, determining if there is a cabling error between the network device and a link peer transmitting the link layer advertisement. An apparatus and logic are also disclosed herein.

Detection of cabling error in communication network

Network security and tracking techniques are provided for intercepting at a first hop switch a neighbor discovery protocol (NDP) message sent from an end node of an Internet Protocol Version 6 (IPV6) network. Address information contained in the NDP message are compared to values stored in a local device tracking cache. As a result of the comparing, end node discovery and learning are performed.

End node discovery and tracking in layer-2 of an internet protocol version 6 network

Network topology independent service deployment techniques, referred to as overlay-based packet steering techniques, are provided. In one example, a server destined packet is intercepted by an in-path network device enabled as a service classifier. The service classifier encapsulates the packet and inserts the packet into a service path to a service virtualization endpoint front ending one or more service nodes. In other words, the service virtualization endpoint receives the service-directed packet on an overlay-based service path. The service-directed packet includes a service header and a service overlay tunnel encapsulation. The service virtualization endpoint inspects the service header in the service-directed packet to identify a first service node to which the service-directed packet should be forwarded and, based on the inspection, forwards the service-directed packet, on the overlay-based service path, to the first service node.

Overlay-based packet steering

As described herein, explicit service ordering information may be associated with each of a plurality of logical services in a service path. A unique sequence number, for example, may be assigned, and associated with each service in the path. The sequence number may be assigned by a service broker in the control plane of a service insertion architecture that provides a platform-independent framework to insert services into a network. The sequence number may represent the relative ordering of the service with respect to the other services in the path. The sequence number, along with a traffic classification identifier, constitutes the shared context that is tagged to the packet injected into the chain which is used in the SIA data plane to virtualize and uniquely select series of services defined in the policy.

Growing community of inventors

Union City, CA, United States of America

Govind Prasad Sharma