Cisco Technology, Inc.

Qnx Software Systems Limited

Pradeep Kumar Kathail

Srinath Gundavelli

Eric Albin Voit

Pascal Thubert

David A Maluf

Ali Sajassi

Eric Michel Levy-Abegnoli

Brian Eliot Weis

Fabio Rodolfo Maino

Indermeet Singh Gandhi

Shree N Murthy

Andrew J Valencia

Arman Rezaee

Saswat Praharaj

Michael R Smith

Louis Gwyn Samuel

Dileep Kumar Devireddy

Subhasri Dhesikan

Chandrashekhar Appanna

Stephen Paul Belair

Saravanakumar Rajendran

Sri Gundavelli

Jeffrey Ym Wang

Sebastien Marineau-Mes

Carl D Sutton

Dhananjay Shrikrishna Patki

Alberto Rodriguez Natal

Haresh Kheskani

Nandini Ganesh

David Delano Ward

Timothy Peter Stammers

Frank Brockners

Vimal Srivastava

Sudhir Kumar Jain

Samir D Thoria

Michael Brian Galles

Elango Ganesan

Peter H Van Der Veen

Alessandro Erta

Prashant Gandhi

Oliver James Bull

Mukesh Taneja

Sangram Kishore Lakkaraju

David Richard Barach

Navneet Agarwal

Samer M Salam

Mark Ammar Rayes

Einar Nilsen-Nygaard

Shoou Jiah Yiu

David Wayne Mills

Zhanhe Shi

Claude Alan Cartee

Alberto Rodriguez-Natal

Lorand Jakab

Sachin Vijay Vishwarupe

Joel P Bion

Bruce McDougall

Kirk Stewart Lougheed

Balaji R Venkatraman

Albert Meng Fong

Avinash Kalyanaraman

Vignesh Dayanand Shetty

Peter Panburana

Srinivas Vundru

Arthur B Stine

Philip Winterfield

Hao Zhou

Steve Belair

Srinivas Podila

Srinivis Podila

Michael Smith

Prashant P Gandhi

This disclosure describes techniques for emulating the operations of a computer network. In some cases, a method includes receiving first configuration data associated with a first device and second configuration data associated with a second device in a network; determining a first device representation associated with the first device based on the first configuration data and a second device representation associated with the second device based on the second configuration data; determining, based on the first and the second device representations, a first device cluster, wherein the first device cluster comprises a plurality of clustered devices comprising the first device and the second device; determining a first device model associated with the first device cluster, wherein the first device model represents a first device behavior that is common across the plurality of clustered devices; and generating, based on the first device model, an emulation environment associated with the network.

Computer network emulation using network device clusters

Techniques for using Network Address Translation (NAT), Mobile Internet Protocol (MIP), and/or other techniques in conjunction with Domain Name System (DNS) to anonymize server-side addresses in data communications. Rather than having DNS provide a client device with an IP address of an endpoint device, such as a server, the DNS instead returns a random IP address that is mapped to the client device and the endpoint device. In this way, IP addresses of servers are obfuscated by a random IP address that cannot be used to identify the endpoint device or service. The client device may then communicate data packets to the server using the random IP address as the destination address, and a gateway that works in conjunction with DNS can convert the random IP address to the actual IP address of the server using NAT and forward the data packet onto the server.

Randomizing server-side addresses

Personal network Software Defined-Wide Area Networks (SD-WANs) with attested permissions may be provided. A first one of a plurality Personal Area Network (PAN) devices in a PAN may seed a routing table entry for at least one application that the first one of the plurality PAN devices supports. The routing table entry may include at least one characteristic associated with an egress link between the first one of the plurality PAN devices and a device outside of the PAN. The routing table entry may be exchanged among the plurality of PAN devices in the PAN. Then data may be routed, based on the exchanged routing table entry, in the PAN through the first one of the plurality PAN devices through the egress link to the device outside of the PAN.

Personal network software defined-wide area networks (SD-WANs) with attested permissions

In one aspect, a method of IP obfuscation of a user device includes receiving, over an Extendible Authentication Protocol (EAP) session between a user device and a network access point, location preferences of the user device, generating, based on the location preferences or a network policy, a geohash for the user device, identifying, for the user device, an IP anchor, sending, over the EAP session, the geohash to the user device, and receiving, from the user device, network traffic, wherein the network access point utilizes the geohash and the IP anchor to route the network traffic for the user device and obfuscate IP address of the user device from third-party access.

Technique for eliminating ingress-proxy in the multi-relay approach for privacy

Techniques for using Network Address Translation (NAT), Mobile Internet Protocol (MIP), and/or other techniques in conjunction with Domain Name System (DNS) to anonymize server-side addresses in data communications. Rather than having DNS provide a client device with an IP address of an endpoint device, such as a server, the DNS instead returns a virtual IP (VIP) address that is mapped to the client device and the endpoint device. In this way, IP addresses of servers are obfuscated by a virtual network of VIP addresses. The client device may then communicate data packets to the server using the VIP address as the destination address, and a virtual network service that works in conjunction with DNS can convert the VIP address to the actual IP address of the server using NAT and forward the data packet onto the server.

Anonymizing server-side addresses

Disclosed are systems, apparatuses, methods, and computer-readable media for providing security postures for a service provided by a heterogenous system. A method for verifying trust by a service node includes receiving a request for a security information of the service node from a client device, wherein the request includes information identifying a service to receive from the service node, identifying a related node to communicate with the service node based on the service, after identifying the related node, requesting a security information of the related node, generating a composite security information from the security information of the service node and the security information of the related node, and sending the composite security information to the client device. The composite security information provides security claims for a service implemented by a heterogenous devices that have different trusted execution environments.

Verifying trust postures of heterogeneous confidential computing clusters

According to an embodiment, a node comprises one or more processors operable to execute instructions to cause the node to perform operations. The operations comprise determining a link quality associated with each satellite link of a plurality of satellite links and applying load balancing to the plurality of satellite links. The load balancing is based at least in part on the respective link quality associated with each satellite link. The load balancing comprises determining which of the satellite links to include in an active set selected to communicate data to or from the node and, for each satellite link in the active set, determining a portion of the data to communicate via the respective satellite link. The operations further comprise transmitting or receiving the data via the satellite links in the active set. Each satellite link in the active set communicates its respective portion of the data.

Adaptive load balancing in a satellite network

Systems, methods, and computer-readable media are provided for inter-network messaging among private and public 5G networks. For instance, a first server on a public 5G mobile network can receive a first message directed to a first wireless device associated with a first network identity. The first server can determine, based on the first network identity, that the first wireless device is associated with a second network identity, wherein the second network identity is used to identify the first wireless device on a private 5G mobile network. The first server can send a copy of the first message to a second server on the private 5G mobile network for transmission to the first wireless device through the private 5G mobile network based on the second network identity.

Inter-network short message service among private and public 5G networks

A method is provided to anonymize the media access control (MAC) address of a client device. The method involves generating a plurality of media access control (MAC) addresses for use by a client device in a network. Policies are defined that determine which one of the plurality of MAC addresses is to be used by the client device. The plurality of MAC addresses allocated for use by the client device are registered with a management entity in the network.

Media access control (MAC) address anonymization based on allocations by network controller elements

Techniques for automating traffic optimizations for egress traffic of an application orchestration system that is being sent over a network to a remote service. In examples, the techniques may include receiving, at a controller of the network, an egress traffic definition associated with egress traffic of an application hosted on the application orchestration system, the egress traffic definition indicating that the egress traffic is to be sent to the remote service. Based at least in part on the egress traffic definition, the controller may determine a networking path through the network or outside of the network that is optimized for sending the egress traffic to the remote service. The controller may also cause the egress traffic to be sent to the remote service via the optimized networking path.

Egress traffic optimization

Provided is an infrastructure for enforcing target service level parameters in a network. In one example, a network service level agreement (SLA) registry obtains one or more input service level parameters for at least one service offered by an application. Based on the one or more input service level parameters, the network SLA registry provides one or more target service level parameters to a plurality of network controllers. Each network controller of the plurality of network controllers is configured to enforce the one or more target service level parameters in a respective network domain configured to carry network traffic associated with the application.

Infrastructure for enforcing per-application target service level parameters in multi-domain networks

A system and method for adaptive encryption for SD-WAN includes identifying an encrypted conversational flow and determining whether a duration of the encrypted conversational flow exceeds a threshold. The method also includes selecting a header-less tunnel for the encrypted conversational flow when the duration is more than the threshold. The method further includes transmitting the encrypted conversational flow to an egress router over the selected header-less tunnel.

System and method for adaptive encryption for SD-WAN

Techniques for informing a network of an application's service-level agreement (SLA) objective(s) so the network can ensure the SLA is met end-to-end, thereby allowing core network support of deterministic SLA and application-based routing without using network-based application recognition (NBAR) and/or compromising user privacy. The techniques may include receiving a first connection request to establish a network-domain connection between different network domains that meets or exceeds a service level objective. Based on the first connection request, the network-domain connection may be established between the different network domains to meet or exceed the service-level objective. In some examples, a second connection request may be received to establish a tunnel between a source application and a destination application, which are disposed in the different network domains. Based on the second connection request, the techniques may include establishing the tunnel between the source application and the destination application utilizing the network-domain connection.

Core network support for application requested network service level objectives

Growing community of inventors

Los Altos, CA, United States of America

Pradeep Kumar Kathail