Cisco Technology, Inc.

Paul Wells

Clarence Filsfils

Peter Psenak

Ketan Jivan Talaulikar

Alvaro E Retana

Hasmit S Grover

Madhukar Anand

Michael Barnes

In one embodiment, a method by an apparatus of a Border Gateway Protocol-Link State (BGP-LS) environment includes receiving an attestation token from a first component and encoding the attestation token in a BGP-LS signaling message. The method further includes sending the BGP-LS signaling message with the encoded attestation token to a second component of the BGP-LS environment.

Applying attestation to BGP-LS

In one embodiment, an apparatus includes one or more processors and one or more computer-readable non-transitory storage media coupled to the one or more processors. The one or more computer-readable non-transitory storage media include instructions that, when executed by the one or more processors, cause the apparatus to perform operations including receiving a first type-length-value (TLV) associated with a winning flexible algorithm definition (FAD) from a first element of a network. The operations also include determining a security level for the winning FAD based on the TLV. The operations further include determining a data transmission route through a plurality of elements of the network based on the security level for the winning FAD.

Systems and methods for determining secure network elements using flexible algorithm technology

In one embodiment, a method includes receiving an OSPF hello message including an attestation token from a second network apparatus, determining that the attestation token is valid for the second network apparatus at a current time, establishing an adjacency to the second network apparatus in response to the determination, computing, based at least on the attestation token, a trust level for a first link from the first network apparatus to the second network apparatus and a trust level for first prefixes associated with the first link, and sending an LSA comprising the trust level for the first link and the trust level for the first prefixes to neighboring network apparatuses, where the trust level for the first link and the trust level for the prefixes are used by the network apparatuses in the network to compute a routing table of the network.

Applying attestation tokens to the open shortest path first (OSPF) routing protocol

In one embodiment, a method includes receiving an ISIS hello message including an attestation token from a second network apparatus, determining that the attestation token is valid for the second network apparatus at a current time, establishing an adjacency to the second network apparatus in response to the determination, computing, based at least on the attestation token, a trust level for a first link from the first network apparatus to the second network apparatus and a trust level for first prefixes associated with the first link, and sending an LSP comprising the trust level for the first link and the trust level for the first prefixes to neighboring network apparatuses, where the trust level for the first link and the trust level for the prefixes are used by the network apparatuses in the network to compute a routing table of the network.

Applying attestation tokens to the intermediate system to intermediate system (ISIS) routing protocol

A link state information correction scheme is implemented by the present disclosure. In one embodiment, the correction scheme is implemented by a reload logic module that cooperates with link state protocol logic configured on a reload routing element (or routing element that has reloaded or hard restarted). The reload logic module is configured to receive a database descriptor message at a reload routing element, where the database descriptor message is received from a neighbor routing element during an adjacency formation. The reload logic module is also configured to determine whether the database descriptor message identifies a stale version of a link state advertisement (LSA), where the LSA is self-originated by the reload routing element. The reload logic module is also configured to generate a new version of the LSA during the adjacency formation.

Technique to minimize traffic loss on a router reload/restart

In one embodiment, a method and apparatus of controlling transmission of data packets in a communications network includes designating all networking devices in a portion of the communications network as either hubs or spokes, communicating a link-state advertisement to each connected hub and spoke in the portion of the communications network, computing a shortest path tree at all the hubs and the spokes based on the link-state advertisement, the computing including truncating the shortest path tree at the hubs only for links leading from the spoke to the hub, creating a routing table at each of the hub and the spoke based on the truncated shortest path tree, and transmitting the data packets in the communications network based on the link-state advertisement. The shortest path tree includes all data transmission routes in the tree except links leading from a spoke to a hub.

Transit prevention in hub-and-spoke topologies using link state protocols

In one embodiment, a technique is used by a routing system to generate a link state identifier for a link state advertisement message. The routing system generates the link state advertisement message. A prefix length is read from the link state advertisement message. Further, a prefix is read from the link state advertisement message. A hash function is performed on the prefix and the length to produce a result by appending the length to the prefix to generate a combined value, inputting the combined value to a hash algorithm, and using at least a portion of an output of the hash algorithm as the result. The link state identifier is determined from the result of the hash function.

Growing community of inventors

Eden Prairie, MN, United States of America

Paul Wells