Cisco Technology, Inc.

Atheros Communications, Inc.

Nancy Cam-Winget

Joseph Salowey

Mark Krischer

Robert B O'Hara, Jr

Jianxin Wang

Shahriar I Rahman

Hao Zhou

Jerome Henry

David Sheldon Stephenson

Allan Thomson

Patrice R Calhoun

Pok Wong

Chetin Ersoy

Vanaja Ravi

David A McGrew

Eric Albin Voit

Brian Eliot Weis

Sudhir Kumar Jain

Flemming Andreasen

Prashanth Patil

Hari Shankar

David A Maluf

Aamer Saeed Akhter

Jeremy Stieglitz

Eliot Lear

Darrin Joseph Miller

Hazim Hashim Dahir

Xuechen Yang

Nathan Sowatskey

Haseeb Sarwar Niazi

Esteban Raul Torres

Einar Nilsen-Nygaard

Morteza Ansari

Jazib Frahim

Saman Taghavi Zargar

Susan Elizabeth Thomson

Klaas Wierenga

Aun Raza

Dieter Derek Weber

Padmanabha C Jakkahalli

Robert Frederick Albach

Rajvardhan Somraj Deshmukh

David Jones

Pascal Thubert

David Delano Ward

Robert E Barton

Kyle Andrew Donald Mestery

Blake Harrell Anderson

Vincent E Parla

Toerless Eckert

Timothy S Olson

Sheausong Yang

Raghuram S Sudhaakar

Pauline Shuen

Max Pritikin

Ajit Sanzgiri

Tao-Fei Samuel Ng

Subharthi Paul

Gregory Lawrence Chesson

Richard Lee Barnes, Ii

Abhishek Bhattacharyya

Jagdish Girimaji

Bhawani Sapkota

Sanjay Agarwal

Oleg Bessonov

Donovan O'Hara

Kevin Neal Hayes

Kalyan Dharanipragada

Shayne Miel

Rahul Dasgupta

David William Matteson

James W Kasper

Greg Chesson

Jesse Daniel Backman

Andrew Michael McPhee

Josh Matz

Brian Lindauer

Joshua Terry

Mark Steven Knellinger

Simone Arena

Sreejith Avikkal

Lizbeth Berenice Guerra Martinez

Natasha Wong

Jessica Lynne Poole

Srikanth Ranganamyna

Jen Bammel

Courtney Irwin

Tom Koenig

Damodharam Ammepalli

Shabriar I Rahman

David A Mcgrew

Thomas Koenig

Srikanth Ranganamya

Jr Robert B O'HARA

Joseph A Salowey

The present technology provides for receiving communications at an authentication service, and the communication is indicative of a change in a security posture of an authenticated session between a user device and a secure service. The authentication service can then determine that the change in the security posture of the authenticated session impacts the trust level associated with the user device and causes the trust level to fall below the threshold. The authentication service can then send an enforcement signal to a security agent on a network device that provides remedial actions that a user can undertake to improve the security posture of the authenticated session.

Mid-session trust assessment

Techniques are described for managing QUIC connections. The techniques include identifying a first QUIC connection between a first and second device. Determining, from the connection, a first IP address and port number of the first device, a second IP address and port number of the second device, and a first CID. Storing an association between the first and second IP addresses, port numbers and first CID. Identifying a second QUIC connection between the first device and another device. Identifying, from the second connection, the first IP address and port number, a second CID, and a third IP address and port number. Determining if two of the following are met: the second IP address corresponds to the third IP address, the second port number corresponds to the third port number, the second CID corresponds to the first CID, if two are met, the first and second QUIC connections are the same.

Method for identifying and managing QUIC connections for middleboxes

Embodiments identify a station that rotates an over the air station address. As address rotation was not originally designed into wireless networks, the rotation can introduce communication challenges for the station. The embodiments derive that traffic referencing two different over the air station addresses are associated with a single common station. This is accomplished by determining a similarity between properties of two sets of traffic. A first set of traffic references the first over the air station address and a second set of traffic references the second over the air station address. If the properties common across the two sets of traffic indicate sufficient similarity, the embodiments determine that both sets of traffic are associated with a single device. Network configuration of the device is then adjusted based on the determination.

Dynamic media access control addresses in a wireless network

In one embodiment, methods for monitoring devices within a network by a controller are described. The method may include receiving a first request from a first device to authenticate a role of the first device as a grandmaster in a precision time protocol (PTP). Additionally, the method may include granting the first request designating the role of the first device as the grandmaster. The method may further include receiving a second request from a second device to authenticate that a clock announce message is from an authorized grandmaster. Additionally, the method may include determining whether the first device is authorized to send the clock announce message to the second device and, based on the determining, sending a message granting or denying permission for the first device to sync with the second device.

Method to eliminate clock synchronization from undesired clock sources

To improve adaptation of network infrastructure to address rotations performed by wireless client device, embodiments provide for an exchange of a stable machine identifier (SMI) between a network access device and an authentication service. Some embodiments define a new SMI attribute that is included in a authentication service access-request and/or access-accept message. When a network access device obtains an SMI for a particular wireless client device, the network access device passes the SMI to the authentication service. Similarly, if an authentication service obtains a SMI value for a wireless client device, this information is provided to a network access device.

Authentication service with address rotation support

Techniques for encoding metadata representing a policy into a QUIC connection ID are described herein. A metadata-aware network including one or more enforcement nodes, a policy engine, and/or a connection datastore may be utilized to enforce a policy and route communications on a QUIC connection. The policy engine may be configured to encode metadata representing one or more network policies into a QUIC source connection ID (SCID) and/or may store a mapping between the SCID and a corresponding destination connection ID (DCID) in the connection datastore. The policy engine may communicate with a QUIC application server and/or one or more QUIC proxy nodes to encode the SCID into a QUIC packet. The enforcement nodes may access the metadata and enforce the policies via a connection ID included in a QUIC header of a QUIC packet or by performing a lookup in the connection datastore using the connection ID.

Policy expressions using QUIC connection identifiers

Presented herein is a system, device and method that involve creating a policy model and policy rule structure for a policy enforcement point to support policies adapt to rapid changing external conditions in addition to traditional policies that are static. The system facilitates the use of attributes that are either or both dynamically (at run-time) created and/or defined as ephemeral. A new policy attribute may be created dynamically (at run-time). The policy attribute may be mapped as being static or ephemeral. The methodology further involves facilitating evaluation of an attribute as an atomic or programmed set of functions.

Adaptive network controls for IoT and other applications

Techniques for maintaining geographic-based data privacy rules in networked environments. An example method includes receiving a request from a user device; generating, based on the request, a query for data associated with fulfilling the request; transmitting, to a data controller, the query; transmitting, to the data controller, an indication of a geographic region in which at least one device implementing the entity is located; and receiving, from the data controller, a portion of the data associated with fulfilling the request.

Enforcing location-based data privacy rules across networked workloads

A non-transitory computer readable medium comprising instructions stored thereon, the instructions effective to cause at least one processor to: establish trustworthiness of an application installed on a endpoint, the established trustworthiness is sufficient for an enterprise security infrastructure to treat the application installed on the endpoint and the endpoint as a trusted application and a trusted endpoint; negotiate with the trusted endpoint to determine a traffic inspection method for traffic flows originating at the trusted application that is destined for a service, the traffic inspection method is determined based on at least the trusted application, and the service; and instruct the trusted application of the determined traffic inspection method.

Collaborative security for application layer encryption

Techniques are presented herein for engagement and disengagement of Transport Layer Security proxy services with encrypted handshaking. In one embodiment, a first initial message of a first encrypted handshaking procedure for a first secure communication session between a first device and a second device is intercepted at a proxy device. The first initial message includes first key exchange information for encrypting the first encrypted handshaking procedure. A copy of the first initial message is stored at the proxy device. A second initial message of a second encrypted handshaking procedure for a second secure communication session between the proxy device and the second device is sent from the proxy device to the second device. The second initial message includes second key exchange information for encrypting the second encrypted handshaking procedure. The proxy device determines, based on the second encrypted handshaking procedure, whether to remain engaged or to disengage.

Engagement and disengagement of transport layer security proxy services with encrypted handshaking

Systems, methods, and computer-readable media for assessing reliability and trustworthiness of devices across domains. Attestation information for an attester node in a first domain is received at a verifier gateway in the first domain. The attestation information is translated at the verifier gateway into translated attestation information for a second domain. Specifically, the attestation information is translated into translated attested information for a second domain that is a different administrative domain from the first domain. The translated attestation information can be provided to a verifier in the second domain. The verifier can be configured to verify the trustworthiness of the attester node for a relying node in the second domain by identifying a level of trust of the attester node based on the translated attestation information.

Attestation service gateway

A trained model may be deployed to an Internet-of-Things (IOT) operational environment in order to ingest features and detect events extracted from network traffic. The model may be received and converted into a meta-language representation which is interpretable by a data plane engine. The converted model can then be deployed to the data plane and may extract features from network communications over the data plane. The extracted features may be fed to the deployed model in order to generate event classifications or device state classifications.

Intrusion detection model for an internet-of-things operations environment

In one embodiment, a gateway device receives, from a centralized broker device, a data-access policy for a given computer network, the data-access policy defining which of one or more accessing entities are granted access to specific elements of data within the given computer network. When the gateway device then receives, from a particular accessing entity, a request for one or more particular elements of data from within the given computer network, it may determine, based on the data-access policy, whether the particular accessing entity has been granted access to each of the one or more particular elements of data of the request. As such, the gateway device may prevent access for the particular accessing entity to any of the one or more particular elements of the data request to which the particular accessing entity has not been granted access.

Broker-coordinated selective sharing of data

In one embodiment, functionality is disclosed for commissioning a target device based, at least in part, on providing identifying information that identifies a target device, where that identifying information is configured to be included in a request for authorization to commission the target device, and that request for authorization to commission the target device comprises one or more requested commissioning actions; receiving a commissioning authorization, where the commissioning authorization comprises information regarding one or more authorized commissioning actions for which a license is available, where the one or more authorized commissioning actions were selected from among the one or more requested commissioning actions; and performing the one or more authorized commissioning actions.

Secure confirmation exchange for offline industrial machine

Growing community of inventors

Mountain View, CA, United States of America

Nancy Cam-Winget