Cisco Technology, Inc.

Other

Cisco Tecnology, Inc.

Jayaraman R Iyer

Anand K Oswal

Timothy Peter Stammers

Kent Kinchu Leung

Flemming Andreasen

Biswaranjan Panda

Mark Grayson

Parviz Yegani

Laurent Andriantsiferana

Bhaskar Bhupalam

Michel Khouderchah

Kevin Shatzkamer

Chris O'Rourke

Viren K Malaviya

Marco Cesare Centemeri

Jonathan David Rosenberg

Kaartik Viswanath

Wen-Lin Tsao

David Lindert

John Gary Waclawsky

Michael Lindsay Shannon

Subharthi Paul

Ashish A Chandwadkar

Saman Taghavi Zargar

Navan Narang

Louis F Menditto

Venkateshwara Sastry

Vivek Kansal

Hy Quoc Pham

Weimin Ma

Hari Shankar

Robert A Mackie

Arghya T Mukherjee

Xun Wang

Richard Kyle Forster

Bruce Albert Thompson

Hien Thi Thai

Wei-Jen Hsu

Andrew Wan-yeung Au

Sanjay Dixit

Pranav Bhargava

Andrew G Gasson

Gary B Mahaffey

James Neil Guichard

Rajesh S Pazhyannur

Abhijit Patra

Paul M Quinn

Nagaraj Bagepalli

Prashanth Patil

Robert Michael Batz

Surendra M Kumar

Joseph Salowey

Francois Le Faucheur

Malcolm M Smith

Chiu Ngok Eric Wong

Jianxin Wang

Ahmed Refaat Bashandy

John A MacPherson

Andrew E Ossipov

Alan H Huggins

Eric Philippe Hamel

Samir Dilipkumar Saklikar

Milind Kulkarni

Liming Wei

Kushal A Patel

Peter P Zhu

Morteza Ansari

Robert M Broberg

Richard Gray

Faisal Mushtaq

Humberto M Tavares

Donovan O'Hara

Robin Edgard Martherus

Rafael Mantilla Montalvo

John Stanley Starzynski

Jigar Shah

Manas Barooah

Jin Teng

Jyoti Verma

Richard Christopher Hayes

Venkatanarayana Muppala

Dennis L Lantz, Jr

Keith R Erb

Nishant S Jadhav

Kevin D Shatzkarner

Anand Padmanabha Iyer

Thilan Niroshaka Ganegedara

Francois L Le Faucheur

Flemming S Andreasen

David P Lindert

Lauren H Andriantsiferana

Presented herein are methodologies for implementing application security. A method includes generating an extraction vector based on a plurality of application security rules to be enforced, transmitting the extraction vector to a first agent operating on a first network device and to a second agent operating on a second network device; receiving, separately, from the first agent and from the second agent, first metadata generated by the first agent and second metadata generated by the second agent by the agents applying the extraction vector to network traffic passing, respectively, through the first network device and the second network device. The first metadata includes a transaction ID assigned by the first agent, and the second metadata includes the same transaction ID. The method further includes correlating the first metadata with the second metadata based on the transaction ID to construct a transactional service graph for the network traffic.

Lightweight distributed application security through programmable extraction of dynamic metadata

One or more lower-level attributes of a first network policy are translated to one or more higher-level attributes of the first network policy, and one or more lower-level attributes of a second network policy are translated to one or more higher-level attributes of the second network policy. The first network policy controls how first network traffic is handled, and the second network policy controls how second network traffic is handled. The one or more higher-level attributes of the first network policy are compared with the one or more higher-level attributes of the second network policy. Based on the comparing, it is determined whether the first network traffic and the second network traffic are handled in a functionally equivalent manner. If not, the first network policy is dynamically updated to generate an updated first network policy that causes the first network traffic to be handled in the functionally equivalent manner.

Network policy architecture

In one example embodiment, a network management device generates a first script defining a first function for detecting a first customizable network event in a sequence of customizable network events indicative of a security threat to a network. The network management device activates the first script at a first network device in the network so as to cause the first network device to execute the first function for detecting the first customizable network event, and obtains, from the first network device, one or more indications that the first network device has detected the first customizable network event. Based on the one or more indications, the network management device determines whether to activate a second script defining a second function for detecting a second customizable network event in the sequence at a second network device in the network capable of detecting the second customizable network event.

Hierarchical activation of scripts for detecting a security threat to a network using a programmable data plane

In one embodiment, a centralized controller maintains a plurality of hierarchical behavioral modules of a behavioral model, and distributes initial behavioral modules to data plane entities to cause them to apply the initial behavioral modules to data plane traffic. The centralized controller may then receive data from a particular data plane entity based on its having applied the initial behavioral modules to its data plane traffic. The centralized controller then distributes subsequent behavioral modules to the particular data plane entity to cause it to apply the subsequent behavioral modules to the data plane traffic, the subsequent behavioral modules selected based on the previously received data from the particular data plane entity. The centralized controller may then iteratively receive data from the particular data plane entity and distribute subsequently selected behavioral modules until an attack determination is made on the data plane traffic of the particular data plane entity.

Hierarchical activation of behavioral modules on a data plane for behavioral analytics

A method is provided in one example embodiment and includes receiving a data packet transported on a backhaul link at a first network element; de-capsulating the data packet; identifying whether the data packet is an upstream data packet; identifying whether the data packet matches an internet protocol (IP) access control list (ACL) or a tunnel endpoint identifier; and offloading the data packet from the backhaul link. In more specific embodiment, the method can include identifying that the data packet does not match the IP ACL or the tunnel endpoint identifier; and communicating the data packet to a second network element. In other examples, the method can include identifying that the data packet is a downstream data packet; identifying a service to be performed for the data packet that cannot be performed at the first network element; and communicating the data packet to a second network element.

System and method for offloading data in a communication system

Systems and methods are used for receiving a video request from a user equipment for video to be downloaded; determining a link bandwidth status associated with the user equipment; in response to the link bandwidth status associated with the user equipment, determining whether to implement one or more additional processing functions associated with the video delivery; during the video delivery, repeating the determining such that the one or more additional processing functions associated with the video delivery can be implemented or not implemented at different times during the video delivery. These processing functions can include transrating, HTTP optimization, TCP optimization, and video pacing.

Wireless TCP link state monitoring based video content adaptation and data delivery

User equipments can download a video file by instantiating multiple video requests, each request specifying different parts of the video file. If each video request initiates a separate transmission control protocol (TCP) session, which is the case with an hypertext transfer protocol (HTTP) partial get request, then a network device in a communications network would be oblivious of contextual information, which indicates that the TCP sessions download different portions of the same video file. This disclosure provides systems and methods for correlating multiple TCP sessions so that a network device in a communications network can be aware of the contextual information.

Systems and methods for correlating multiple TCP sessions for a video transfer

A system is disclosed for measuring data utilization attributable to use by an application being executed on a mobile device. The system has a server operable to register the application and transmit information to establish a connection between the application and a proxy server. The system also has a proxy server operable to establish a first connection with the application, receive direction to establish a second connection with a target endpoint, establish the second connection between the proxy server and the target endpoint, pass data between the target endpoint and the application using the established connections, and measure the amount of data passed between the target endpoint and the application.

Client app service on mobile network

A method is provided in one example embodiment and includes communicating a message from a network element to a remote data plane element in order to request a data plane resource for hosting a session for a particular subscriber. The remote data plane element is designated to host a data plane function for a particular mobile network subscriber and the data plane resource comprises at least one of memory space and processor allocation. The method further includes discovering nodes capable of supporting the control plane functions; discovering nodes capable of supporting the data plane functions for the session; and performing a system-specific internal configuration to support separation of the data plane functions and the control plane functions.

System and method for exchanging information in a mobile wireless network environment

A method is provided and may include receiving a request for a network content delivery service from an access device; directing the access device to a network service provider for authentication for the network content delivery service; receiving a network authorization token from the access device, where the network authorization token is associated with the access device; obtaining a network access token from the network service provider; and binding the network access token to a content access token.

Content service on demand

In one embodiment, a method includes receiving capability information from an end host at a centralized security matrix in communication with a firewall and a plurality of end hosts, verifying at the centralized security matrix, a trust level of the end host, assigning at the centralized security matrix, a firewall function to the end host based on the trust level and capability information, and notifying the firewall of the firewall function assigned to the end host. Firewall functions are offloaded from the firewall to the end hosts by the centralized security matrix. An apparatus and logic are also disclosed herein.

Method and apparatus for federated firewall security

A system includes a media optimizer that adaptively generates and transmits a modified manifest file based on an original manifest file corresponding to an associated media asset from a content provider in response to a media content request from a client for the associated media asset. The original manifest file specifies bitrates. The media optimizer extracts parameters associated with the media content request and applies bitrate policies based on the extracted parameters to adaptively modify the original manifest file to generate the modified manifest file. The media optimizer is further configured to transmit the modified manifest file to the client for selection by the client of a bitrate associated with delivery of the associated media asset.

Adaptive bitrate modification of a manifest file

Presented herein are service-function chaining techniques. In one example, a service controller in a network comprising a plurality of service nodes receives one is configured to identify one or more service-functions hosted by each of the service nodes. The service controller defines a service-function chain in terms of service-functions to be applied to traffic in the network and provides information descriptive of the service-function chain to a classifier node.

Defining service chains in terms of service functions

Growing community of inventors

San Jose, CA, United States of America

Jayaraman R Iyer