Cisco Technology, Inc.

Redwood Systems, Inc.

Jeremy Stieglitz

Darran Potter

Arthur Zavalkovsky

Ian Foo

Mark Covaro

Andrew M Clymer

Robert Henig

David Fowler

David Leonard

Nancy Cam-Winget

John Zamick

Jeevan Shashikant Patil

Ami Schieber

Timothy S Olson

Robert B O'Hara, Jr

Patrice R Calhoun

Joseph Salowey

Partha P Bhattacharya

Nancy Cam Winget

Frederick Juergens Baker

Mark Krischer

Hao Zhou

Jason Frazier

Jonathan S Leary

Ilan Frenkel

Pejman D Roshan

Ellis Roland Dobbins

William D Erdman

Patrick Che' Gilbreath

Shripati Acharya

Mark C Wilgus

Saar Gillai

Padmanabha Jakkahalli

Jr Robert B O'HARA

Ronald Stephen Seide

Techniques are disclosed for dynamically mitigating a noncompliant password. The method comprises obtaining a password; generating one or more quality scores for the password using a password policy for an authentication and authorization service; determining whether the password has sufficient score quality; in response to determining that the password does not have sufficient score quality, granting to the user a different level of access to the service than if the password meets the quality criteria; wherein the method is performed by one or more computing devices.

Dynamically mitigating a noncompliant password

A lighting system for areal illumination is disclosed which may include a remote driver and a plurality of fixtures including luminaires. The luminaires may include a light source whose output light level can be adjusted, a light sensor co-located therewith adapted to measure light received from adjacent fixtures. The remote driver may provide power for the light sources of the luminaires.

Group creation in auto-commissioning of lighting systems

A lighting system for areal illumination is disclosed which includes a remote driver and a plurality of fixtures including luminaires, control devices, and/or standalone sensors. The luminaires include a light source whose output light level can be adjusted, a light sensor co-located therewith adapted to measure light received from adjacent fixtures, and a microcontroller capable of transmitting the output of the light sensor over wires to the remote driver. The remote driver is capable of bidirectional communication with the luminaires and provides independently controllable power for the light sources of the luminaires. A movable orb region containing luminaires can also be defined and the light levels of individual luminaires can be set according to their location within the orb region.

Orbing and lighting systems

A method is disclosed for determining the authentication capabilities of a supplicant before initiating an authentication conversation with a client, for example, using Extensible Authentication Protocol (EAP). In one aspect, the method provides for sending, to a supplicant that is requesting access to a computer network subject to authentication of a user of the supplicant, a list of first authentication methods that are supported by an authentication server; receiving, from the supplicant, a counter-list of second authentication methods that are supported by the supplicant; determining how many second authentication methods in the counter-list match the first authentication methods; and performing an authentication policy action based on how many of the second authentication methods match the first authentication methods. Policy actions can include blocking access, re-directing to sources of acceptable authentication methods, granting one of several levels of network access, etc.

Method and apparatus for determining authentication capabilities

A system and method for selectively controlling traffic in a network to improve network performance. The system includes a network controller that includes a first control-traffic prioritizer. An Access Point (AP) includes a second control-traffic prioritizer and communicates with the network controller. One or more clients communicate with the AP. The communications behavior of the client is affected by operations of the first control-traffic prioritizer and the second control-traffic prioritizer.

System and method for selectively manipulating control traffic to improve network performance

A lighting system for areal illumination is disclosed which includes a remote driver and a plurality of fixtures including luminaires, control devices, and/or standalone sensors. A method of commissioning a lighting system is also disclosed which includes causing a light source co-located with each luminaire to emit a signal, detecting the signal at light sensors co-located with each luminaire, converting the signals obtained by the light sensors into distance measurements between luminaires, creating a map recording the relative location of luminaires, and assigning luminaires to groups based on their relative locations in the map. A movable orb region containing luminaires can also be defined.

Lighting systems and methods of auto-commissioning

In one embodiment, a method for facilitating authentication and ease the configuration of authentication includes receiving a credential type selection and selecting one or more authentication types based on the credential type selection and one or more policies set by the administrators. The policies can be preconfigured or dynamically pushed or fetched and updated to the client.

Method and apparatus for selecting an appropriate authentication method on a client

Techniques are disclosed for dynamically mitigating a noncompliant password. The techniques include obtaining a password from a user when the user attempts to access a service; determining whether the password meets quality criteria; and if the password does not meet the quality criteria, performing one or more responsive actions that relate to accessing the service.

A method and apparatus for managing and balancing wireless access based on centralized information is provided. A request to provide service to a wireless client is received from a first access node in a plurality of access node. An access policy, applicable to the first access node, is selected from a plurality of stored policies. The stored policies may include a variety of rules, such as how many or which wireless clients may be serviced by an access node. A centralized manager, such as an AAA server, may perform the selection of the access policy. A determination is made as to whether to allow the first access node to provide service to the wireless client based on the selected access policy. A message that instructs the first access node whether to provide or deny service to the wireless client is transmitted to the first access node.

Balancing wireless access based on centralized information

A method and system is disclosed for creating and tracking network sessions. A request to access a network is received from an entity. The entity is authenticated after the request is received. Authenticated identity information associated with the entity, network address information associated with the entity, and network location information associated with the entity is collected. An information set is created. The information set comprises and binds together the authenticated identity information, the network address information, and the network location information. The information set indicates a present association among the authenticated identity information, the network address information, and the network location information. The information set is stored in a session record in a centralized database. The session record represents a session in which the entity accesses the network. The session record is one of a plurality of session records that are stored in the centralized database. The plurality of session records is used by a data processing system to perform real-time diagnostics of the network.

Method and system for creating and tracking network sessions

Techniques for security protection of a wireless network are provided. An access point is operated in a first mode. The first mode is a mode of operation that allows access to resources of a network. A security event for a client is detected while operating the access point in the first mode. Then, the access point is changed from the first mode of operation to a second mode of operation. The second mode is a restricted mode of operation that restricts access to resources of the network. Analysis may then be performed to determine if the client is an unauthorized client or valid client.

Techniques for providing security protection in wireless networks by switching modes

A method, an apparatus, and a carrier medium carrying computer readable code segments to instruct a processor to execute the method. The method is in a wireless network that includes at least one access point. The method includes, from time-to-time, measuring a first set of at least one property of each access point of a set of at least one classified access point of the wireless network. The method further includes re-classifying each access point based on at least one function of a second set of at least one property of the access point, the second set of properties including the first set of properties. The set of at least one access point is classified according to a set of AP classifications, and the re-classifying is into one of the AP classifications.

Dynamically measuring and re-classifying access points in a wireless network

Techniques are provided for controlling access message flow. The techniques include receiving one or more access messages; determining one or more sets of features, one for each access message; receiving a particular access message; determining a particular set of one or more features for the particular access message; determining whether the particular access message satisfies a particular condition based on the particular set of one or more features and the one or more sets of features; and if the particular access message satisfies the particular condition, performing a responsive action based on the particular condition.

Controlling access message flow

A method, a system, a machine-readable medium, and an apparatus for managing storage on a shared storage space, for example, on an email server, are provided. A plurality of emails is compared. If the content of each of the plurality of emails is the same, then a single copy is stored on the email server. Further, each recipient of the plurality of emails is enabled access to the stored email via a link to the single copy. Additionally, one or more attachments of the plurality of emails are compared. If an attachment is the same in each of the plurality of emails, then it is stored as a single copy. Further, a link is inserted in each of the plurality of emails, enabling access to the attachment from the single copy.

Method and system for managing storage on a shared storage space

A system and method that supports disjoint authentication server farms and disjoint policy or authorization servers for multi-session establishment. The authentication server has global knowledge of authenticators for additional sessions for a supplicant and can split authentication requests as needed to different authentication servers. The split authentication and authorization requests can be aggregated should the other authentication and authorization servers have the capability to handle multiple requests. In the case of server farms, authentication and implied authorization requests can be split to facilitate load balancing.

Growing community of inventors

Menlo Park, CA, United States of America

Jeremy Stieglitz