Cisco Technology, Inc.

Intertrust Technologies Corporation

Intel Corporation

Mark John Baugher

David A McGrew

David R Oran

Brian Eliot Weis

Jan Vilhuber

Robert A Marshall

Mark Tait

Stu Farnham

Stephen C Hemminger

Wen-hsiung Chen

Allen Huotari

Francois Le Faucheur

Ali C Begen

Plamen Nedeltchev

Philip Clifford Jacobs

Michael Pereira

Saul Adler

William C Melohn

Ema Y Patki

Subha Dhesikan

Luka Perkov

Tara K Thimmanaik

Allen J Huotari

An example method for zero touch deployment of multi-tenant services in a home network environment is provided and includes receiving router configuration information of a home router located in a home network, the router configuration information including at least one slice setting for a service deployment at the home router, and configuring the slice setting on the home router for the service from a remote network separate from the home network. The slice setting can logically divide the home router to enable separation of the service from other services provisioned and configured on the home router. In specific embodiments, the method further includes receiving a request for the service from a service user entity, sending a slice provisioning request to a router manager for provisioning the service in the home router, and receiving a slice provisioned response comprising the router configuration information from the router manager.

Zero touch deployment of multi-tenant services in a home network environment

In one embodiment, a method that receives at a cache server device a request from a client device for a first representation of a content chunk; determines whether the first representation is available at the cache server device; responsive to determining that the first representation is available at the cache server device, provides the first representation to the client device; responsive to determining that the first representation is unavailable at the cache server device, determines whether a congestion-like condition is present in an upstream network; and responsive to determining that the congestion-like condition is present in the upstream network, provides a second representation of the content chunk.

Reducing fetching load on cache servers in adaptive streaming

A method and apparatus for mixing first and second video content portions is described. The method may comprise overlapping at least one frame of a first content portion comprising multiple frames with at least one frame of a second content portion comprising multiple frames to produce a composite video content. At least one reference frame comprising a frame of the first or second content portion prior to the overlapping may be designated. The composite video content and the reference frame may then be transmitted, for example, to a client device. The client device may use the reference frame to at least reduce an effect of the overlapping.

Mixing of video content

Systems, methods, and other embodiments associated with processing secure network traffic are described. One example method includes determining whether a device is a preconfigured member of a group key system. If the device is not a preconfigured member then the method selectively establishes membership in the group key system by requesting membership from a group controller. The example method may also include receiving a set of keys from the group controller and being assigned a role by the group controller. The method may further include processing secure network traffic as an inspection point, a rewriting point, and/or a validation point based on the received set of keys and the assigned role(s).

Inspection and rewriting of cryptographically protected data from group VPNs

A system for determining security associations using binary output sequences is described. In an example systematic embodiment, a first device is coupled over a network to a second device. Each device includes a processor and an indicator mechanism coupled to the processor. The indicator mechanism is configured to output a binary representation of a security state established between the devices to a user in perceivable proximity to at least one of the devices. A computer readable storage medium is coupled to the processor and includes executable instructions for the processor. The instructions when executed by the processor initiate a security transaction between the devices. The security transaction includes a protocol that uses one or more public keys to establish a security state between the devices. The indicator mechanism then outputs the binary representation to the user based on the established security state.

Determining security states using binary output sequences

Methods and systems of providing security backup services to a home network are described. In one embodiment, the gateway for a home network is registered with a service provider. A network device is enrolled with the home network, and periodically reenrolls. The device detects whether the gateway has been replaced between enrolling and reenrolling, and if it has been replaced, determines whether the new network gateway has been endorsed by the service provider.

System and method for providing security backup services to a home network

In one embodiment, a method includes receiving gap information from an entertainment content source configured to provide an entertainment stream associated with a contributing source information providing a source of the entertainment stream and a chronological order to render the entertainment stream, the entertainment stream being encrypted and having an associated first decryption key multiplexed into a key distribution system, the gap information identifying a gap in the entertainment stream where an ad may be one of inserted or substituted, synchronizing a target ad from an advertisement stream to a time base corresponding to the gap, decrypting the entertainment stream using the first decryption key selected from the key distribution system based on the contributing source information, and rendering the entertainment stream and the target ad as a composite stream based on the chronological order, the target ad being rendered during the gap in the entertainment stream.

Customized advertisement splicing in encrypted entertainment sources

Accumulated proof-of-work approaches for protecting network resources against denial-of-service attacks are disclosed. A client computer or other requester is required to perform work, such as repeatedly hashing a message until a specified number of bits is zero, as a condition for accessing a resource. Proof of the work performed by a legitimate requester is accumulated across multiple requests, so that established users of a resource are not penalized when proof-of-work is used to prevent a denial of service attack. Requesters who cannot show accumulated work greater than a specified threshold are required to perform additional work. In certain embodiments, work may be accumulated only within a specified time window, and the threshold may vary according to resource capacity or loading. Proof-of-work values may be communicated between the user and the resource in cookies.

Preventing network denial of service attacks using an accumulated proof-of-work approach

Methods and devices for controlling access to a service over a network are described. A credential is provided to a device. The credential indicates the device is enrolled in the network. The credential is stored in non-volatile memory on the device. The credential binds the device to the network and prevents the device from accessing another network. The device presents the credential to a provider, and the provider uses the credential to authenticate and authorize the device. Upon authorization, the device is provided access to the service.

Using a network-service credential for access control

Methods and devices allowing distribution of content that resides in a source device on a local area network (LAN) are described. A gateway between the LAN and a wide area network (WAN) receives from a sink device a request for an instance of content. The request is sent over the WAN. Distribution of the item of content within the LAN uses a first digital rights management (DRM) protocol that prevents the item of content from being distributed outside the LAN. For the item of content, the gateway converts from the first DRM protocol to a second DRM protocol that can be used for transmitting content over the WAN. The item of content can then be forwarded to the sink device according to the second DRM protocol.

Remote access to local content using transcryption of digital rights management schemes

Methods and devices controlling access to content are described. For example, a request to enroll a device is received at a localization hub. The localization hub is associated with a subscriber that is authorized to access the content. A credential is issued to the device. The credential demonstrates that the device is enrolled in the local area network and is authorized to receive the content.

System and method for localizing data and devices

One embodiment of an inventive networking environment includes clients called sending clients because they send network content through a network, and clients called receiving clients because they receive the network content from the sending clients through the network. Both sending clients and receiving clients are 'clients' in that they rely on a management server to orchestrate the secure transfer of information from sending clients to receiving clients.

Network content management

Group key management techniques are applied to generating pair-wise keys for point-to-point secure communication applications. Nodes participating in a secure communication group each receive a group key and associated policy information. When a first node wishes to establish a secure point-to-point connection to a second node, the first node derives a pairwise key from the group key and policy information, for example, by hashing the group key and information identifying the two nodes. As a result, a pairwise key is generated without exchanging negotiation messages among the two nodes and without expensive asymmetric cryptographic computation approaches.

Growing community of inventors

Portland, OR, United States of America

Mark John Baugher