Cisco Technology, Inc.

Lionel Florit

Robert W Klessig

Francois Edouard Tallet

Pauline Shuen

Chennakesava Reddy Gaddam

Amjad Sayedrasul Inamdar

Eric Albin Voit

Samer Salam

Sujal Sheth

Carlos M Pignataro

Nagendra Kumar Nainar

David A McGrew

Norman William Finn

William Mark Townsley

Shwetha Subray Bhandari

Scott Roy Fluhrer

Jose Antonio Liste

Annu Singh

Gaurav Kumar

Systems and methods are provided for quantum-resistant secure key distribution between a peer and an EAP authenticator by using an authentication server. The systems and methods include receiving requests for a COMMON-SEED and a quantum-safe public key from a peer and an EAP authenticator. The COMMON-SEED is encrypted using the quantum-safe public key of the peer and the quantum-safe public key of the EAP authenticator, and the encrypted COMMON-SEED is sent to the peer along with a request for a PPK_ID from the peer to complete authentication of the peer. The PPK_ID is received from the peer, and the encrypted COMMON-SEED and PPK_ID is sent to the EAP authenticator. A quantum-resistant secure channel is established between the peer and the EAP authenticator when the peer and the EAP authenticator share the same COMMON-SEED and the same PPK-ID.

Set up and distribution of post-quantum secure pre-shared keys using extendible authentication protocol

Systems and methods are provided for quantum-resistant secure key distribution between a peer and an EAP authenticator by using an authentication server. The systems and methods include receiving requests for a COMMON-SEED and a quantum-safe public key from a peer and an EAP authenticator. The COMMON-SEED is encrypted using the quantum-safe public key of the peer and the quantum-safe public key of the EAP authenticator, and the encrypted COMMON-SEED is sent to the peer along with a request for a PPK ID from the peer to complete authentication of the peer. The PPK ID is received from the peer, and the encrypted COMMON-SEED and PPK ID is sent to the EAP authenticator. A quantum-resistant secure channel is established between the peer and the EAP authenticator when the peer and the EAP authenticator share the same COMMON-SEED and the same PPK-ID.

Presented herein are methodologies for establishing secure communications in a post-quantum computer context. The methodology includes receiving, from a first communications device, at a second communications device, a secret seed value, or otherwise obtaining the secret seed value; initializing a session key service with the secret seed value; receiving, from the first communications device, at the second communications device, a pre-shared key identifier; querying the session key service for a pre-shared key corresponding the pre-shared key identifier; receiving, from the session key service, the pre-shared key; deriving a session key based, at least in part, on the pre-shared key; receiving from the first communications device, at the second communications device, data encrypted with the session key; and decrypting the data at the second communications device using the session key.

Session key distribution independent of third parties

A first computing node configures for communication with a second computing node according to a secure Media Access Layer (MAC) layer communication protocol. The first computing node transmits a first message, to the second computing node. The first message includes at least a first indication that the first computing node is capable of communicating according to the secure MAC layer communication protocol based on a pre-shared secret key. The first computing nodes determines to communicate with the second computing node according to the secure MAC layer communication protocol based on one of a pre-shared secret key or a distributed shared key. The first computing node, at least in part based on the determining, transmits a second message to the second computing node according to the secure MAC layer communication protocol based on the one of the pre-shared secret key or the distributed shared key.

Pre-shared secret key capabilities in secure MAC layer communication protocols

Systems, methods, and computer-readable for managing an Internet of Things (IoT) network include identifying an IoT device which is not connected to one or more communication layers of a IoT network, where the IoT network includes one or more intermediate nodes for connecting an IoT application to the IoT device. A virtual device is provided in at least one communication layer of at least one intermediate node, where the virtual device is used for modeling behavior of the IoT device. Using the virtual device as a proxy for the IoT device, operations at the at least one intermediate node while the IoT device is not connected to the at least one layer. The operations can include Operations, Administration, and Maintenance (OAM) functions. The virtual device can be withdrawn or disabled in the at least one intermediate node upon the IoT device establishing connection to the at least one layer.

Virtual devices in internet of things (IoT) nodes

Systems, methods, and computer-readable media for Operations, Administration, and Maintenance (OAM) in Internet of Things (IoT) network include an maintaining a list of one or more IoT devices connected to an IoT gateway in the IoT network. At least a subset of the one or more IoT devices are classified as belonging to an active list based on receiving traffic from at least the subset of the one or more IoT devices, and OAM probes are suppressed to at least the subset of the one or more IoT devices in the active list. A message can be received in response to the OAM probe from the at least one IoT device, and upon receiving the message, the at least one IoT device is classified as belonging to the active list.

Traffic aware operations, administration, and maintenance (OAM) solutions for internet of things (IoT) networks

In one embodiment, a broker device receives device-identifying data to identify a device in a computer network. An ontology associated with the device-identifying data is then identified by the broker device and in response to identifying the ontology, interpretation instructions related to the identified ontology are determined. The broker device receives data from the identified device and interprets the received data based on the interpretation instructions.

Semantic data broker for dynamic association between devices and applications

Various systems and methods for integrating ring-protocol-compatible devices into network configurations that also include non-ring-protocol-compatible devices are disclosed. One such method, which can be performed by a network node that supports a ring protocol, involves generating a ring protocol packet and sending that ring protocol packet to a neighboring node. The ring protocol packet includes information, and the presence of this information within the packet causes a network device that receives the ring protocol packet to drop the ring protocol packet unless the network device supports a ring protocol. The information can include a reserved address (e.g., in the destination address field of the packet) as well as a ring protocol identifier.

System and method for integrating ring-protocol-compatible devices into network configurations that also include non-ring-protocol compatible devices

Various systems and method of preventing data traffic connectivity between endpoints of a network segment are disclosed. One method involves receiving a segment protocol message from a first segment port within a network segment, which includes a plurality of network devices. In response to receipt of the segment protocol message, which can indicate whether connectivity is present between the segment endpoints via the network segment, a second segment port can be operated in a blocked state. Operating the second segment port in the blocked state prevents data plane connectivity via the network segment.

Preventing data traffic connectivity between endpoints of a network segment

A method is provided in one example embodiment and includes generating a test port in a network environment, positioning the test port on a network element, associating the test port with a bridge domain, and configuring a maintenance point (MP) on the test port. The method further includes using the MP on the test port for connectivity fault management (CFM) operations at a test level.

System and method for providing testing in an Ethernet network environment

Various systems and methods for implementing virtual ports within ring networks are disclosed. For example, one method involves allocating a logical port that corresponds to a first port and a second port and instantiating a spanning tree protocol instance. The first port and the second port are both assigned to a first ring network. The spanning tree protocol instance selectively blocks the logical port; however, the spanning tree protocol instance is unable to block the first port independently of blocking the second port. Events (e.g., link failures and recoveries) that occur within the ring network are communicated to spanning tree by transitioning the state of the logical port in response to receiving a ring protocol control packet. The spanning tree protocol instance initiates a bridge protocol data unit (BPDU) exchange from the logical port in response to a transition in the state of the logical port.

System and method for implementing multiple ring networks using a common link

An endpoint for determining a frame loss ratio is provided. The endpoint includes a processor and a memory coupled with the processor. The memory stores instructions that are executable to generate a number of synthetic frames, and insert the number of synthetic frames into a stream of data frames, the synthetic frames being transmitted to a responder endpoint address designated in the synthetic frames. The memory may also store instructions that are executable to determine a number of lost synthetic frames; and calculate a synthetic frame loss ratio as a function of the number of lost synthetic frames and the number of synthetic frames inserted into the stream of data frames.

Synthetic frame loss ratio

In some ring protocols, control messages are exchanged among ring nodes in order to implement certain behaviors, such as loop-free behavior and/or failure recovery, within the ring. A segment of a ring can be replaced by another network, effectively turning the ring into a daisy chain. If the intervening network does not allow transmission of the control messages used by the ring protocol, certain control messages may be blocked, causing the ring to operate in undesirable ways. Reflector ports can be implemented at each end of the daisy chain in order to prevent these control messages from being blocked.

System and method for implementing reflector ports within hierarchical networks

Methods and systems for distributing multicast messages in a network are disclosed. The use of such a method or system in an Ethernet network can result in a reduction in the number of flooded multicast messages. One method can involve receiving a companion message, which includes a multicast address, at a network device and extracting the multicast address from the companion message. The multicast address can then be associated with a VLAN and an interface of the network device. Another method involves receiving a join message, which identifies a multicast group being joined, and generating a companion message corresponding to the join message. The companion message includes an address of the multicast group.

Growing community of inventors

Greenbrae, CA, United States of America

Lionel Florit