Cisco Technology, Inc.

Other

Patrick Wetterwald

Pascal Thubert

Eric Michel Levy-Abegnoli

Jean-Philippe Vasseur

Vincent Jean Ribiere

Marco Molteni

Jonas Zaddach

Huimin She

Domenico Ficara

Amine Choukir

Alessandro Erta

Jerome Henry

Ole Troan

Ijsbrand Wijnands

Billy Gayle Moon

Akram Ismail Sheriff

Maik Guenter Seewald

Feiliang Wang

Patrick Grossetete

David Charlton Forster

Massimo Villari

Stephane Labetoulle

Shmuel Shaffer

Eric Albin Voit

Johannes Petrus Kruys

Xuechen Yang

Rudolph Benedict Klecka

Jianzhou Chen

Paul Bernard Duffy

Eric Levy- Abegnoli

Jp Vasseur

Paul Didier

James Pylakutty Mundenmaney

Mark Grayson

Jonathan W Hui

Srinath Gundavelli

Norman William Finn

Malcolm Muir Smith

Alpesh S Patel

Robert J Friday

Bretton Lee Douglas

Neal Dante Castagnoli

Abhay Kumar Roy

Li Zhao

Andrew Frederick Myles

Arthur Gerald Howarth

Prasad Miriyala

Thomas Davies

Maurizio Portolani

Roland Arthur Saville

Navneet Agarwal

Xiaoguang Jason Chen

Ramakrishnan Chokkanathapuram Sundaram

Gabriel Bouvigne

David Auerbach

Rekha Ramachandran

Jonathan Martin

Yves Louis

Stefano Alessandro Crosta

Chandroadya Prasad

Johannes Petrus (Jan) Kruys

Eric Levy Abegnoli

In one embodiment, a method includes identifying, using a Static Context Header Compression (SCHC) rules engine, one or more packets matching a rule, selecting a firewall decision based on the identified one or more packets and the rule, and applying the firewall decision to the one or more identified packets.

System and method for providing SCHC-based edge firewalling

Techniques for using Network Address Translation (NAT), Mobile Internet Protocol (MIP), and/or other techniques in conjunction with Domain Name System (DNS) to anonymize server-side addresses in data communications and verify an authenticity of a client device attempting to use a virtual IP (VIP) address. Rather than having DNS provide a client device with an IP address of an endpoint device, such as a server, the DNS instead returns a VIP address that is mapped to the client device and the endpoint device. The client device may then communicate data packets to the server using the VIP address as the destination address, and a virtual network service that works in conjunction with DNS can verify an authenticity of the client device and convert the VIP address to the actual IP address of the server using NAT and forward the data packet onto the server.

Client device verification

In one embodiment, a controller for an overhead mesh of access points in an area receives an indication from one or more access points of the overhead mesh that a client device is present in the area. The controller determines movements of the client device within the area. The controller selects a set of access points of the overhead mesh to support communications between the client device and the overhead mesh, based on the movements of the client device determined by the controller. The controller causes the controller, the set of access points to form communication schedules to support communications with the client device that do not require a prior association exchange with the client device.

Ceiling-controlled communication scheduling in an overhead mesh of access points

In one embodiment, a supervisory device in a network forms a virtual access point (VAP) for a node in the network. A set of access points (APs) in the network are mapped to the VAP as part of a VAP mapping and the node treats the APs in the VAP mapping as a single AP for purposes of communicating with the network. The supervisory device receives measurements from the APs in the VAP mapping regarding communications associated with the node. The supervisory device identifies a movement of the node based on the received measurements from the APs in the VAP mapping. The supervisory device adjusts the set of APs in the VAP mapping based on the identified movement of the node.

Transparent roaming in virtual access point (VAP) enabled networks

A first address resolution request may be received by a first access switch from a first device and the address resolution request may be resolved by the first access switch with a central database of a network. Then a second address resolution request may be sent to a sensor by the first access switch in response to resolving the first address resolution request. An address resolution response may then be sent by the sensor to the first device in response to the sensor determining that the first device is a bad endpoint. A session may then be established between the sensor and the first device in response to the sensor sending the address resolution response. The first device may then be prompted by the sensor via the established session to resolve issues that lead the sensor to determine that the first device is a bad endpoint.

Network access control for devices in a software defined access (SDA) fabric

This disclosure describes techniques for device to device authentication. For instance, a first device may detect a second device, such as when a user physically attaches the second device to the first device or when the second device wireless communicates with the first device. A component of the first device and/or an authentication entity may then determine to authenticate the second device. In some instances, the component determines to authenticate the second device using information associated with an environment of the second device. To authenticate the second device, the authentication entity may send a request to a user, receive a response from the user, and then verify the response. After the authentication, the first device may determine that the second device includes a trusted device and establish a connection with the second device.

Techniques for device to device authentication

Techniques for adjusting a duration of an authenticated user device session. A baseline session duration is determined for a session for which a user account is authorized in response to a request for authentication. A first session is established on behalf of a user device associated with the user account based at least in part on the user account performing a first authentication. A posture associated with the user device is determined. The baseline duration is then adjusted to a dynamic duration based at least in part upon the posture associated with the user device. Based at least in part on the dynamic duration the user can be required to re-authenticate.

Determining session duration for device authentication

In one embodiment, an illustrative method herein may comprise: receiving, at a first edge device, a direct indication from a second edge device that a mobile device has moved from the first to the second edge device; determining, based on the direct indication, a first time at which the mobile device attached to the second edge device; receiving a network routing update message indicative of a routing update for the mobile device having moved to the second edge device; determining, based on the network routing update message, a second time at which convergence completed at the first edge device; and calculating a convergence time for the mobile device to be detected as having moved to the second edge device based on a difference between the first time and the second time.

Observing virtual connectivity reactivity upon mobility events

In one embodiment, an access point of an overhead mesh of access points in an area selects a range of client identifiers. The access point sends, via a beam cone transmitted in a substantially downward direction towards a floor of the area, a trigger signal that includes the range of client identifiers and prompts client devices having identifiers in that range to send best effort transmissions towards the overhead mesh. The access point detects a collision between the best effort transmissions of the client devices. The access point adjusts the range of client identifiers so as to avoid future collisions between the best effort transmissions of the client devices.

Coordinating best effort traffic to an associationless, overhead mesh of access points

In one embodiment, a controller identifies access points forming an overhead mesh of access points in an area, each access point comprising one or more directional transmitters each configured to transmit a beam cone in a substantially downward direction towards a floor of the area. The controller determines coverage areas on the floor of the area for the one or more directional transmitters of the access points in the overhead mesh. The controller generates, based on the coverage areas, alternating communication schedules for the access points such that a client device at any given location on the floor of the area is within range of a plurality of receiving access points in the overhead mesh and at least one transmitting access point in the overhead mesh at a certain point in time. The controller sends the communication schedules to the access points.

Scheduling time-diced uplinks and downlinks in a dense overhead mesh of access points

Systems, methods and computer-readable storage media are provided for determining critical flow characteristics and predicting the network resources to compute time-based p-routes that satisfy different SLAs. Critical flows within a set of nodes organized in a DODAG are monitored and assessed according to applicable SLAs and relevant networking KPIs to generate a forecast of the traffic flow and the overall SLAs for these critical flows. These overall SLAs, KPIs, and the generated forecast are used by a PCE associated with the network to compute p-routes through the set of nodes in the DODAG that satisfy the overall SLAs for the critical flows.

Systems and methods for Internet-of-Things network predictive topology switching

Techniques for varying locations of virtual networks associated with endpoints using Network Address Translation (NAT), Mobile Internet Protocol (MIP), and/or other techniques in conjunction with Domain Name System (DNS). Rather than having DNS provide a client device with an IP address of an endpoint device, such as a server, the DNS instead returns a virtual IP (VIP) address that is mapped to the client device and the endpoint device. The VIP address may be selected based on a number of factors (e.g., power usage, privacy requirements, virtual distances, etc.). In this way, IP addresses of servers are obfuscated by a virtual network of VIP addresses that can be periodically rotated and/or load balanced. The client device may then communicate data packets to the server using the VIP address as the destination address, and a virtual network service that works in conjunction with DNS can convert the VIP address to the actual IP address of the server using NAT and forward the data packet onto the server.

Virtual server address selection

In one embodiment, a device registers with a controller for a mesh of overhead access points. The device receives, from the controller, a communication schedule for the device. The device generates a message to be sent to the mesh of overhead access points. The device transmits, according to the communication schedule, the message as a beam cone directed substantially upward relative to the device towards the mesh of overhead access points. The message is received and relayed by one or more particular access points in the mesh without the device previously performing a wireless association exchange with those one or more particular access points.

Associationless wireless communications using an overhead mesh

In one embodiment, a controller identifies access points forming an overhead mesh of access points in an area, each access point comprising one or more directional transmitters each configured to transmit a beam cone in a substantially downward direction towards a floor of the area. The controller assigns the access points to access point groups. The controller generates communication schedules for the access points such that each access point in an access point group is on a common channel and only one of neighboring directional transmitters of access points in that group is able to transmit at any given time. The controller sends the communication schedules to the access points forming the overhead mesh of access points in the area.

Semi-distant time-sliced antennas in an associationless overhead mesh of access points

In one embodiment, a client device enters an area having an overhead mesh of access points, each access point comprising one or more directional transmitters each configured to transmit a beam cone in a substantially downward direction towards a floor of the area. The client device obtains an area-dependent communication schedule for the overhead mesh that is exclusive or partially-exclusive to the client device for the area. The client device sends, during an arbitrary timeslot of the area-dependent communication schedule, a pull request. The client device receives, from a particular access point in the overhead mesh, a packet in response to the pull request.

Client-controlled communication scheduling with an overhead mesh of access points

Growing community of inventors

Mouans Sartoux, France

Patrick Wetterwald