Cisco Technology, Inc.

Avaya Inc.

Owen Brendan Friel

John Joseph Costello

Max Pritikin

Eliot Lear

Pandit Panburana

Jason Cresswell

Patrick Hession

Richard Lee Barnes, Ii

Oliver William Fagan

Tony McCormack

Neil O'Connor

Cullen F Jennings

Arik Elberse

Andrew H West

Cullen Frishman Jennings

Ollie Fagan

Richard Lee Ii Barnes

This disclosure describes techniques for allowing an organization to manage user identities. In some examples, the management of user identities may be serverless. In some examples, serverless identity management may be enabled through a distributed application on user devices of the organization. The application may generate and/or store information related to the user identities on the user devices. Serverless identity management may further include storing at least some of the information at a location that is easily accessible to the user devices, such as a cloud computing location, while maintaining security for private data. Serverless identity management may therefore provide an organization with greater operational flexibility.

Serverless identity management

A provisioning client obtains an identifier from a public server and a one-time password from a trusted server. The provisioning client combines the one-time password with the identifier to create an activation code for a client device and presents the activation code to the client device. The activation code enables the client device to download trusted cryptographic information from the trusted server in a communication session that is secured using the one-time password.

Secure bootstrapping of client device with trusted server provided by untrusted cloud service

This technology uses a bootstrap key ('BSK') to securely onboard a computing device to a network. A unique BSK associated with an onboarding computing device is used to verify for various deployment models () that the computing device has proof the computing device is connecting to the correct wired or wireless network and () that the network has proof the computing device is trusted. The BSK may be an associated BSK or an embedded BSK. A computing device receives a signed voucher from the manufacturer authorized signing authority ('MASA') before the computing device may onboard to a network. The MASA will issue a voucher to a Bootstrapping Remote Secure Key Infrastructure (&#x201c;BRSKI&#x201d;) registrar if the registrar proves knowledge of the computing device's BSK to the MASA or the registrar has an established trust relationship with the MASA.

Flexible device onboarding via bootstrap keys

In one embodiment, an endpoint in a network sends a Session Initiation Protocol (SIP) registration request to a device. The device generates a first key using information included in the SIP registration request. The device also writes the first key to a storage location accessible by a Traversal Using Relays around Network address translators (TURN) server. The endpoint generates a second key based on the information included in the SIP registration request. The endpoint sends an allocate request to the TURN server that includes the second key. The TURN server authenticates the endpoint based in part by comparing the second key to the first key. The endpoint receives an allocate response from the TURN server, after the TURN server authenticates the endpoint.

Turn authentication using SIP channel discovery

This disclosure describes techniques for providing manufacturer usage description (MUD) solution to automatically update network access policy for client application software. The method may include embedding metadata in the application binary. The metadata may include MUD uniform resource identifiers (URIs) that may point to MUD files describing the application's network access requirements. The MUD files may be hosted by application vendor's MUD servers. The system may include a network policy server that is able discover the MUD URIs. The MUD URIs may be discovered based on extracting the MUD URIs from the metadata and/or being provision with the set of MUD URIs for trusted applications. The method may include enterprise wide policy and individual host policy for implementation of the MUD files.

Software usage description (SUD) for installable applications

A trusted server receives a request for an activation code, which includes an identifier associated with the trusted server and a one-time password, for a client device. The trusted server obtains the identifier from a public server, generates the one-time password, and combines the one-time password with the identifier to create the activation code. The trusted server provides the activation code to a provisioning client, which presents the activation code to the client device. The trusted server and client device secure a communication session using the one-time password as a shared secret. The trusted server downloads trusted cryptographic information to the client device over the secure communication session.

Seamless guest access to spaces and meetings may be provided. A trusted user device may send an identity object and may receive an identifier and an authorization token in response to sending the identity object. Then the trusted user device may send a request to add a guest user associated with the identifier to a collaboration event and may receive, in response to sending the request to add the guest user, location data associated with the collaboration event. The trusted user device may then send collaboration space data to a guest user device associated with the guest user. The collaboration space data may comprise the authorization token, the location data, and an application indicator associated with the collaboration event.

Seamless guest access to spaces and meetings

An authorized local domain service (ALDS) is deployed in a local network and is authorized to provision endpoints with a cloud-based service on behalf of an organization. The ALDS receives, from a local domain service (LDS) deployed in the local network and configured to connect with and register endpoints in the local network for communications on behalf of the organization, an identity of an endpoint acquired by the LDS when the endpoint registered with the LDS. The ALDS identifies for the organization an account associated with the identity, creates in the cloud-based service for the organization an association between the identity and the account, and notifies the endpoint via the local domain service to onboard against the cloud-based service for access to the cloud-based service.

Zero-touch bootstrap of an endpoint without admin pre-provisioning

A method includes establishing an application layer transport layer security (ATLS) connection between a network device and a cloud server by sending, from the network device, TLS records in transport protocol (e.g., HTTP) message bodies to the cloud server, the ATLS connection transiting at least one transport layer security (TLS) proxy device, receiving, from the cloud server via the ATLS connection, an identifier for a certificate authority, establishing a connection with the certificate authority associated with the identifier and, in turn, receiving from the certificate authority credentials to access an application service different from the cloud server and the certificate authority, and connecting to the application service using the credentials received from the certificate authority.

Enabling zero-touch bootstrap for devices across network perimeter firewalls

This technology uses a bootstrap key ('BSK') to securely onboard a computing device to a network. A unique BSK associated with an onboarding computing device is used to verify for various deployment models (1) that the computing device has proof the computing device is connecting to the correct wired or wireless network and (2) that the network has proof the computing device is trusted. The BSK may be an associated BSK or an embedded BSK. A computing device receives a signed voucher from the manufacturer authorized signing authority ('MASA') before the computing device may onboard to a network. The MASA will issue a voucher to a Bootstrapping Remote Secure Key Infrastructure (&#x201c;BRSKI&#x201d;) registrar if the registrar proves knowledge of the computing device's BSK to the MASA or the registrar has an established trust relationship with the MASA.

In one embodiment, a method includes associating a user with a collaboration group at a collaboration server, tracking activity of participants in the collaboration group at the collaboration server, processing a message received in the collaboration group at the collaboration server, assigning a priority to the message for the user based on the activity of the participants in the collaboration group, and presenting a notification of the message to the user based on the priority of the message. An apparatus and logic are also disclosed herein.

Prioritization of collaboration messages and groups

A client device bootstraps against a trusted server by obtaining an activation code that includes an identifier and a one time password. The client device sends a message to a public server requesting an address of a trusted server associated with the identifier. The client device receives the address of the trusted server from the public server and initiates a communication session with the trusted server at the address provided by the public server. The one time password is used as a shared secret to secure the communication session. The client device downloads cryptographic information from the trusted server.

Some known Contact Centers rely on a Network Level Router to determine which of a number of available Contact Centers should deal with a given contact. This decision is made by the NLR based on real time information provided by the Contact Centers. However, the format of such information is proprietary which means that the NLR must translate and collate this information. This invention seeks to use session initiation protocol (SIP) Presence for such information transfer which enables improved decision making and further enables additional functionality to be added to the Contact Center system. The invention provides a SIP enabled Contact Center () comprising a Contact Center server arranged to send SIP messages to one or more other SIP enabled nodes in a SIP communications network, said SIP messages comprising SIP presence information about the current state of the Contact Center.

Method of operating a contact center

Statistics relating to the operation of physical, logical and software components of a contact center are generated by or on behalf of the components themselves rather than by a statistics engine based on event notifications from the components. In this way, the locally generated statistical information can be communicated as part of presence information for such components. By subscribing to a presence service for presence information for the components of interest, a statistics service can collect the locally produced statistics coming from each component. This provides a less centralised, more dynamic and adaptable way of managing statistical information in a contact center and provides in addition alternative methods of generating alarms and alerts.

Growing community of inventors

Salthill, Ireland

Owen Brendan Friel