Cisco Technology, Inc.

Maik Guenter Seewald

Jerome Henry

Robert Edgar Barton

Robert E Barton

Ruben Gerald Lobo

Laurent Jean Charles Hausermann

Pascal Thubert

Patrick Wetterwald

Daniel R Behrens

Thomas Szigeti

Michael Alan Kowal

Matthias Falkner

André Guérard

Eric Michel Levy-Abegnoli

Brian Eliot Weis

Muthurajah Sivabalan

William Sterling Alexander

Laetitia Pot

Gulian Lorini

Tony Clifford Allen

Joshua Austin Knestaut

According to one or more embodiments of the disclosure, a networking device receives a policy for an endpoint in a network. The policy specifies one or more component tags and one or more activity tags that were assigned to the endpoint based on deep packet inspection of traffic associated with the endpoint. The networking device identifies a set of tags for a particular traffic flow in the network associated with the endpoint. The set of tags comprises one or more component tags or activity tags associated with the particular traffic flow. The networking device makes a determination that the particular traffic flow violates the policy based on the set of tags comprising a tag that is not in the policy. The networking device initiates, based on the determination that the particular traffic flow violates the policy, a corrective measure with respect to the particular traffic flow.

Telemetry collection and policy enforcement using asset tagging

According to one or more embodiments of the disclosure, a device in a network identifies a packet sent via the network towards an endpoint as being a control packet for the endpoint. The device extracts one or more control parameter values from the control packet. The device compares the one or more control parameter values to a policy associated with the endpoint. The device initiates a corrective measure, based on a determination that the one or more control parameter values violate the policy associated with the endpoint.

Intent-based security for industrial IoT devices

Methods are provided in which a user device connects a participant to a collaboration session in which the participant communicates with at least one other participant using audio and/or video, which is distributed in a media stream to the at least one other participant via a respective user device. In these methods, the user device detects at least one of an object within a space that is included in the video and an audio signal and selectively filters the media stream to exclude the object or a portion of the audio signal based on at least one of participant list information, learned background information, or learned voices of participants of the collaboration session.

Selective privacy filtering for online conferences

Time Sensitive Networking (TSN) in wireless environments may be provided. First, a Radio Frequency (RF) profile associated with a station may be received by a computing device. Next, a number of Transmit Opportunities (TxOPs) to use for transmitting data between an Access Point (AP) and the station based on the received RF profile may be determined. The determined number of TxOPs may then be provided to a wireless controller associated with the AP.

Time sensitive networking (TSN) in wireless environments

According to one or more embodiments of the disclosure, an asset inventory service executed by one or more devices receives telemetry data collected passively by a sensor application regarding a node in a network. The asset inventory service requests, after receiving the telemetry data, that the sensor application perform active discovery of nodes in the network. The asset inventory service receives active discovery data collected by the sensor application via active discovery of nodes in the network. The asset inventory service generates, based on the telemetry data and the active discovery data, an identity profile for the node.

Identifying devices and device intents in an IoT network

According to one or more embodiments of the disclosure, a device obtains one or more System Configuration Description Language files regarding a power utility automation network. The device also obtains traffic data regarding traffic in the power utility automation network. The device trains, using the one or more System Configuration Description Language files and the traffic data, a behavioral model for the power utility automation network that models traffic in the power utility automation network. The device initiates use of the behavioral model in the power utility automation network to identify anomalous traffic behavior in the power utility automation network.

Behavioral modeling for power utility automation networks

Cloud services are provided by a distributed network including a number of geographically distributed datacenters, to client devices in accordance with data sovereignty requirements. A server within the distributed network may receive a service request and determine whether it complies with the data sovereignty requirements of the client. When the geographic location of the server does not comply with the client's data sovereignty requirements, the server may determine and transmit back to the client device a set of alternative datacenters within the distributed network that comply with the client's data sovereignty requirements. The client device may use network probes to select an alternative datacenter, and the cloud service request of the client device may be migrated from the server to the selected datacenter.

Cloud service datacenter selection based on data sovereignty policies

The disclosed technology provides solutions that enable scalable and secure data retrieval between microservices by using microservice attributes to encrypt container based data stores. A process of the technology can include steps for: instantiating a first microservice and a second microservice in a cloud environment, wherein the first microservice is associated with a first attribute label and the second microservice is associated with a second attribute label, generating a first key based on the first attribute label and a second key based on the second attribute label, associating a first data store with the first microservice, wherein the first data store is encrypted using the first key, and associating a second data store with the second microservice, wherein the second data store is encrypted using the second key. Systems and machine readable media are also provided.

Attribute-based encryption for microservices

According to one or more embodiments, a first router receives a latency measurement indicative of latency associated with traffic sent from the first router to a second router. The first router calculates an asymmetrical latency as a difference between the latency measurement and a latency associated with traffic sent from the second router to the first router. The first router determines, based on the asymmetrical latency, a symmetrical latency target. The first router sends, to the second router, an indication of the symmetrical latency target. The first router and the second router adjust their respective de-jitter buffers to achieve the symmetrical latency target between the first router and the second router.

Automatically ensuring symmetrical latency in teleprotection systems

A server, in communication with a plurality of microservices in a microservices mesh environment, obtains data about inbound communications to a first microservice and outbound communications from the first microservice of the plurality of microservices. The server analyzes the data to learn an operational behavior of the first microservice and determine a firewall rule set to be applied associated with the first microservice based on the operational behavior learned for the first microservice. The server causes a micro-firewall to be instantiated for the first microservice. The micro-firewall is configured to apply the firewall rule set to inbound communications to the first microservice and outbound communications from the first microservice.

Micro-firewalls in a microservice mesh environment

A network controller automatically adjusts a computer network based on the operational information of an industrial device. The network controller receives a notification from a network element in the computer network that the industrial device attached to the network element has an administrative shell. The administrative shell includes operational information describing the operation of the industrial device. The network controller retrieves the administrative shell from the industrial device. The network controller parses the operational information in the administrative shell to determine an intent for the industrial device, and adjusts the computer network based on the intent of the industrial device.

Intent-based networking using device administrative shell

In one embodiment, a network policy engine obtains a substation configuration description for a substation, indicative of intelligent electronic devices (IEDs), associated network communication devices, and related communication configuration information. The network policy engine then creates a mapping of the IEDs and the associated network communication devices based on the substation configuration description, associating each of the IEDs to a corresponding network port of the associated network communication devices. The network policy engine may then further create network control parameters based on the substation configuration description, which comprise defined communication flows for the IEDs and associated security group tags (SGTs) for the defined communication flows. The techniques herein may then cause the SGTs to be imposed at mapped network ports of the network communication devices for the IEDs according to security group access (SGA)-based network control to thereby establish secure network communication for the IEDs within the particular substation.

Growing community of inventors

Nuremberg, Germany

Maik Guenter Seewald