Cisco Technology, Inc.

Madhusudan Nanjanagud

Gangadharan Byju Pularikkal

Santosh Ramrao Patil

Swaminathan A Anantha

Sourav Chakraborty

Srinivasa Reddy Irigi

RaghavendarRao Kota

Koh Yamashita

Mark Grayson

David A McGrew

Blake Harrell Anderson

Bart A Brinckman

Darrin Joseph Miller

Paul Wayne Bigbee

Pranathi Mamidi

Padumane Kishan

In one embodiment, an IoT server includes: processing circuitry, an I/O module operative to communicate with at least an IoT device and a vendor network server, and an onboarding application and operative to at least: receive an onboarding request from the IoT device via the I/O module, send a confirmation request to the vendor network server via the I/O module, where the confirmation request indicates a request to confirm an identity of the IoT device according to a connection to a network device authenticated by the vendor network server, receive a confirmation response from the vendor network server via the I/O module, where the confirmation response indicates whether the IoT device is connected to the network device, and if the confirmation response is a positive confirmation response that indicates that the IoT device is connected to the network device, onboard the IoT device for participation in an IoT-based system.

Expended trust for onboarding

In one embodiment, a gateway to a zero trust network applies an access control policy to an endpoint device attempting to access a cloud-based application hosted by the zero trust network. The gateway acts as a reverse proxy between the endpoint device and the cloud-based application, based on the access control policy applied to the endpoint device. The gateway captures telemetry data regarding application traffic reverse proxied by the gateway between the endpoint device and the cloud-based application. The gateway detects an anomalous behavior of the application traffic by comparing the captured telemetry data to a machine learning-based behavioral model for the application. The gateway initiates a mitigation action for the detected anomalous behavior of the application traffic.

Machine learning-based application posture for zero trust networking

The present technology pertains to a system that routes application flows. The system can receive an application flow from a device by an active threat detection agent; analyze the application flow for user context, device context, and application context; classify the application flow based on the analysis of the application flow; and direct the application flow according to the classification of the application flow and an application access policy.

Threat detection of application traffic flows

Methods and systems to estimate encrypted multi-path TCP (MPTCP) network traffic include restricting traffic in a first direction (e.g., uplink) to a single path, and estimating traffic of multiple subflows of a second direction (e.g., downlink) based on traffic over the single path of the first direction. The estimating may be based on, without limitation, acknowledgment information of the single path, a sequence of acknowledgment numbers of the single path, an unencrypted initial packet sent over the single path as part of a secure tunnel setup procedure, TCP header information of the unencrypted initial packet (e.g., sequence number, acknowledgment packet, and/or acknowledgment packet length), and/or metadata of packets of the single path (e.g., regarding cryptographic algorithms, Diffie-Helman groups, and/or certificate related data).

Encrypted traffic analytics over a multi-path TCP connection

Techniques for handling requests from a remote device are disclosed. A server receives a first unsolicited activation request from a first device of a plurality of devices. A probabilistic hash filter, associated with a data set, is queried using a first identifier associated with the first device. In response, a first result is received from the probabilistic hash filter indicating that the first device is not ready for activation. In response to receiving the first result, a back-off indication is transmitted to the first device.

Handling unsolicited requests from devices

Extended trust for onboarding

In various implementations, a method includes receiving a request to establish an end-to-end encrypted session between a device in an enterprise network and an external entity that is outside the enterprise network. In some implementations, the end-to-end encrypted session allows encrypted packets to be transmitted between the device and the external entity. In various implementations, the method includes determining whether the request satisfies an enterprise security criterion for establishing the end-to-end encryption session. In various implementations, the method includes in response to determining that the request satisfies the enterprise security criterion, triggering the establishment of the end-to-end encrypted session between the device in the enterprise network and the external entity that is outside the enterprise entity.

Mobile communications over secure enterprise networks

A method is provided in one example and includes determining at least one subscriber session policy, determining at least one current subscriber session analytic data, the current subscriber session analytic data comprising subscriber session analytic data that is indicative of at least one current subscriber session condition, and performing resource allocation based, at least in part, on the subscriber session policy and the current subscriber session analytic data.

System and method for performing resource allocation

A method is provided in one example embodiment and includes querying by a first communications network a database maintained by a second communications network for location data comprising a path typically taken by a mobile device; using the location data to identify network elements of the first communications network located proximate the path; and sending a page request for the mobile device only to the identified network elements. The method may further include mapping a first identifier for the mobile device to the second identifier for the mobile device; and using the second identifier to perform the querying. In certain embodiments, the mapping is initiated responsive to a call received for the mobile device.

Reducing paging delays using location analytics in communications networks

A system includes an interface operable to receive a request to initiate a first connection between a subscriber and a wireless access point using a first network protocol. The system further includes a processor operable to determine whether the subscriber has enhanced Quality of Service (QoS) privileges. In response to determining the subscriber has enhanced QoS privileges, the processor is operable to associate a first port number with traffic associated with the subscriber on a second connection using a second network protocol. In response to determining the subscriber does not have enhanced QoS privileges, the processor is operable to associate a second port number with traffic associated with the subscriber on the second connection using the second network protocol.

Dynamic quality of service for wireless subscribers on a network

Seamless mobility between public and private WLANs may be provided. First a Mobile Node (MN) may be registered for privileged network access via a first access point (AP). Then, a privileged access channel for the MN via a first Mobility Access Gateway (MAG) may be established. Next, a switch by the MN from the first AP to a second AP may be detected. A determination may be made as to whether the second AP is associated with one of the following: the first MAG and a second MAG. Then, when the second AP is associated with the first MAG, the second AP may be established as a new termination point for the privileged access channel. When the second AP is associated with the second MAG, a new privileged access channel may be established through the second MAG.

Growing community of inventors

San Jose, CA, United States of America

Madhusudan Nanjanagud