Cisco Technology, Inc.

Marcelo Yannuzzi

Hervé Muyal

Jean Andrei Diaconu

Carlos M Pignataro

Joel Abraham Obstfeld

Benjamin William Ryder

Nagendra Kumar Nainar

Eric Albin Voit

Frank Brockners

Carlos Goncalves Pereira

Gonzalo A Salgueiro

Joseph Michael Clarke

Tao Zhang

Bart A Brinckman

Yi Zheng

Helder F Antunes

Hitesh S Saijpal

Pascal Thubert

Louis Gwyn Samuel

Oliver James Bull

Pete Rai

Andrew Pletcher

Marco Trinelli

Vikas S Murthy

Anuj Jain

Franciscus Johannes Marcellus Van Lingen

In one embodiment, a device obtains program code of an application that defines annotations denoting a plurality of data types handled by the application. The device determines, for each of the plurality of data types, an association between that data type and a category of sensitive data. The device creates, based on the association for each of the plurality of data types, a protection binding that defines a data handling scope bonded to the association between that data type and its associated category of sensitive data. The device causes data compliance policies to be applied to the application according to its corresponding associations and protection bindings.

Data compliance based on automated annotations and protection bindings

Described herein are embodiments related to systems, methods, and processes for sharing sustainability-related attributes and data across multiple domains. More specifically, some embodiments describe a sustainability aggregation device which may include a controller or other processor, and a memory. The memory includes a sustainability aggregation logic that can receive telemetry data associated with a first network domain, and in response, generate a multi-layer topology graph for the first network domain. In response to the graph being generated, it can be augmented with one or more sustainability-related attributes. However, the device can prune the augmented multi-layer topology graph based on one or more export policies and export the pruned augmented multi-layer topology graph to a second network domain. The multi-layer topology graph may also be utilized within a closed-loop system to monitor various aspects of the network domain and adjust one or more configurations as needed based on the received data.

Sustainable cross-domain data distribution infrastructure

A network of devices can be stabilized by administering an energy-aware topology that corresponds to a desired state derived in part from one or more sustainability metrics. Devices suitable for stabilization can include a processor, a memory, a plurality of elements, a communication port coupled with one or more neighboring devices, and an energy-aware topology logic. The energy-aware topology logic can monitor incoming traffic from one or more neighboring devices, receive current state data associated with the plurality of elements, and receive update data from the one or more neighboring devices via a sustainability-related augmented IGP. Also, the energy-aware topology logic can generate a desired state for the device based on at least the received current state data and update data. One or more of the plurality of elements may be modified in response to the generated desired state, wherein the modification involves changing one or more sustainability-related capabilities.

Energy-aware topology

In one embodiment, a device may receive a request for training data that is based on application data generated by an application executed at a data collection node, wherein the application data is associated with metadata identifiers. The device may determine one or more training data constraints that restrict use of the application data as training data. The device may generate the training data in part by excluding application data of a particular type from being included in the training data based on a match between its metadata identifier and the one or more training data constraints. The device may provide the training data to be used to train a machine learning model.

Constraint-based training data generation

In one embodiment, an observability and assurance service, associated with various clusters of application services for an application that are executed in a data mesh, may configure a data compliance filter for a particular application service in one of the clusters of application services according to a data compliance policy. The observability and assurance service may monitor the data and traffic associated with the particular application service, wherein the data compliance filter is applied to the traffic to restrict sensitive data in the traffic from being processed by the particular application service. The observability and assurance service may make a determination that the data compliance policy has been violated by the particular application service. The observability and assurance service may modify, based on the determination, the data compliance filter for the particular application service.

Automated data compliance and observability

In one embodiment, a device may obtain a location of an endpoint that communicates with an application service. The device may match the location of the endpoint to a data compliance policy. The device may identify sensitive data within the application service to which the data compliance policy applies. The device may configure the application service to permit the endpoint to at least one of access or send the sensitive data when permitted by the data compliance policy.

Dynamic resolution and enforcement of data compliance

Energy-aware configurations can be utilized to operate a network based on sustainability-related metrics. In many embodiments, a suitable device includes a processor, a memory commutatively coupled to the processor, a plurality of elements, a communication port, and an energy-aware topology logic configured to collect topology data from one or more network devices, wherein each of the one or more network devices include a plurality of elements. The energy-aware topology logic can receive power source data and power usage data related to plurality of elements and generate an element energy coefficient (EEC) for a plurality of elements. Subsequently, the energy-aware topology logic can also generate an energy-aware configuration for at least one of the one or more network devices, and then pass the generated energy-aware configuration to the at least one network device, wherein the energy-aware configuration is configured to steer traffic based on at least one sustainability-related metric.

Energy-aware traffic forwarding and loop avoidance

In one embodiment, a device may determine a compliance status of a communication of a type of data between a first workload and a second workload based on a data compliancy policy and a verified node location of at least one of the first workload and the second workload. The device may send, based on the compliance status of the communication, an instruction for handling the communication to at least one of a node executing the first workload and a node executing the second workload.

Compliant data transfers

In one embodiment, a control tower device obtains, first state information from sensing or reporting systems or devices at a particular location via a first communication channel. The control tower device makes, based on the first state information, an evaluation regarding the particular location using one or more digital twins representing one or more entities of the particular location. The control tower device obtains second state information from one or more trusted verifiers for the particular location via a second communication channel. The control tower device verifies, based on the second state information, the evaluation regarding the particular location.

Reliable observability in control towers based on side-channel queries

Presented herein are techniques for verifying data. A method can include obtaining, from an oracle, a first data set associated with a distributed ledger. The method further includes obtaining a plurality of data sets from a plurality of sources. The method further includes generating a confidence level regarding the first data set for validating the first data set, based on comparing the first data set to the plurality of data sets. The method further includes storing the first data set in the distributed ledger based on the confidence level indicating that the plurality of data sets concurs with the first data set. The method further includes taking a remedial action without storing the first data set in the distributed ledger based on the confidence level indicating a discrepancy between the plurality of data sets and the first data set.

Systems and methods for providing confidence in an oracle

In one embodiment, a device may obtain an identifier of a proof of location process (PLP) and an identifier of a node where the PLP is executed. The device may receive a query from a compliance engine for a proof of location of the node where the PLP is executed. The device may identify, based on the identifier of the PLP and the identifier of the node, a physical location of the node. The device may provide, to the compliance engine, a response to the query that is indicative of the physical location of the node, wherein the compliance engine enforces one or more data compliance policies with respect to a workload executed by the node and based on the physical location of the node.

Compliant node identification

In one embodiment, a code authentication service maintains a mapping of uniform resource locators and key information embedded into codes. The code authentication service receives, from a requesting device, a domain name system resolution request for a particular uniform resource locator. The code authentication service determines, based on the mapping, whether the domain name system resolution request is associated with valid key information for the particular uniform resource locator. The code authentication service provides, to the requesting device, a domain name system resolution response that indicates an address associated with the particular uniform resource locator, when the code authentication service determines that the domain name system resolution request includes valid key information for the particular uniform resource locator.

URL validation and redirection for scannable codes

According to one or more embodiments of the disclosure, a service deploys a first service connector to a first deployment network of a first organization and a second service connector to a second deployment network of a second organization. The service receives a selected visibility offering by the first organization and a selected visibility intent for the second organization. The service determines a data sharing policy by matching the selected visibility offering by the first organization to the selected visibility intent for the second organization. The service configures the first service connector to capture data specified by the data sharing policy from the first deployment network and provide that data to the second service connector.

Item identity federation and visibility as a service using a data sharing policy determined based on a visibility offering and a visibility intent

A method includes receiving, at an access node, a connection request from a device and in response to the connection request, establishing a connection with an identity provider. The device, the access node, the local network, and the identity provider are members of an identity federation. The method also includes, after the device is authenticated with the identity provider, sending or receiving, to or from the identity provider and by the access node, data linking the device to an item and an owner of the device.

Growing community of inventors

Vufflens-la-Ville, Switzerland

Marcelo Yannuzzi