Cisco Technology, Inc.

Pratima Pramod Sethi

Mohamed Khalid

Rajiv Asati

Frederic R P Detienne

Brian Eliot Weis

Warren Scott Wainner

Scott Roy Fluhrer

Kavitha Kamarthy

Kousik Nandy

Sheela Dixit Rowles

Manikchand Roopchand Bafna

Ijsbrand Wijnands

Eric Albin Voit

Alvaro E Retana

Aamer Saeed Akhter

Jan Vilhuber

Donnie Van Savage

Haseeb Sarwar Niazi

Shashidhar P Patil

Haseeb Naizi

The present disclosure provides protection of customer data traveling across a network. A reverse cryptographic map (also referred to herein as a reverse crypto map) can be defined for a customer, where the reverse crypto map indicates how customer data should be protected. A reverse crypto map for a customer is applied to an interface of an edge device that is coupled to that customer's private subnet (or customer-facing interface). A reverse crypto map can be configured by a network administrator on a provider edge device, or can be pushed from a key server as part of group policy. A provider edge device can protect customer data by encrypting and decrypting the customer data according to the reverse crypto map. A provider edge device can also be configured with virtual routing and forwarding (VRF) tables that can be used to forward the VPN traffic flow across a provider network.

Simplified mechanism for multi-tenant encrypted virtual networks

Upon detection of a new traffic flow, a registration node can dynamically register the new traffic flow with a key server policy manager by sending a registration request on behalf of the new traffic flow. A registration request indicates the new traffic flow should be protected by a security group. A registration request may also include a request to dynamically generate a new security group to protect the traffic flow. The registration request is received by a key server policy manager, which performs authentication and authorization checks of the requesting registration node, and determines whether to accept or reject the registration request. If accepted, the key server policy manager registers the new traffic flow by including a description of the traffic flow in a group policy of an existing security group or a newly created security group, depending on the registration request.

Dynamic group creation and traffic flow registration under a group in a group key infrastructure

A system and method directed to carrying out dynamic secured group communication is provided. The method includes: obtaining a first packet that includes a first header; forming a frame that includes the first header in encrypted form; combining the first header and the frame to form a second packet and forming a second header; encapsulating the second packet with the second header to form a third packet, and communicating the third packet into the second network from the second source node for termination to the second-destination node. The first header includes a first source address of a first source node of a first network, and a first destination address of a first destination node of the first network. The second header includes a second source address of a second source node of a second network, and a second destination address of a second destination node of the second network.

Method and system for dynamic secured group communication

Various embodiments of the disclosed subject matter provide methods and systems for improved efficiency in spoke-to-spoke network communication. Embodiments provide systems and methods for registering a spoke with a hub, updating at least one database with spoke registration information at the hub, and advertising the spoke registration information to other spokes using a single control plane that includes transport security, peer discovery, and unicast routing information.

System and method for improving spoke to spoke communication in a computer network

A method and system for learning network information through a plurality of network devices is provided. The plurality of network devices are configured for IPsec. The method enables negotiation between the network devices to set up a security association and provide network information between the configured network devices. This network information includes a plurality of sub-network routes.

Method and system for learning network information

In one embodiment, a QoS manager process that receives, at an EzVPN server device, connection speed data from an EzVPN client device. In addition, the QoS manager process processes, at the EzVPN server device, the connection speed data to determine a QoS policy for a communications session between the EzVPN client device and the EzVPN server device. Furthermore, the QoS manager process applies, at the EzVPN server device, the QoS policy to the communications session between the EzVPN client device and the EzVPN server device as determined by the processing of the connection speed data.

Adaptive quality of service in an easy virtual private network environment

Systems and methods for using routing protocol extensions to improve spoke to spoke communication in a computer network are disclosed. Embodiments provide systems and methods to establish a tunnel between a first spoke and a hub, exchange routing information between the first spoke and the hub using a routing protocol, extend the routing protocol and an associated database to include next hop mapping information, and establish a tunnel between the first spoke and a second spoke according to information in the database.

System and method for using routing protocol extensions for improving spoke to spoke communication in a computer network

A system and method directed to carrying out dynamic secured group communication is provided. The method includes obtaining a first packet that includes a first header. The first header includes a first source address of a first source node of a first network, and a first destination address of a first destination node of the first network. The method also includes forming a frame that includes the first header in encrypted form, combining the first header and the frame to form a second packet, and forming a second header. This second header includes a second source address of a second source node of a second network, and a second destination address of a second destination node of the second network. The method further includes encapsulating the second packet with the second header to form a third packet, and communicating the third packet into the second network from the second source node for termination to the second-destination node.

An end machine (connected to one end of secure connection) may reliably continue to use the security association (SA) even if the self_address (usually the address of the interface) of the end machine changes. The end machine includes the new IP address in the payload of a packet (e.g., an address update message) sent to another end machine at the other end of the connection. The payload can be encrypted and authenticated to avoid third party attacks. As a result, connectivity can restored for user applications reliably and quickly without requiring substantial computations and/or data exchanges.

Reliably continuing a secure connection when the address of a machine at one end of the connection changes

Network devices can detect whether a tunnel is available (e.g., usable to convey traffic in both directions) by implementing a tunnel detection protocol that uses a combination of idle timers and multiple types of probes. In this protocol, the device at one end of the tunnel is configured as an active device, while the device at the other end of the tunnel is configured as a passive device. The tunnel detection protocol is asymmetric; the active device sends probes to the passive device, but the passive device does not send probes to the active device. By using at least two types of probes, the active device can inform the passive device about the availability of the path from the passive device to the active device. Since the passive device does not need to send probes or process probe replies, control plane processing on the passive device can be reduced.

Tunnel availability detection with reduced control plane overhead

A system transmits, to a hub from a first spoke, first routing information associated with the first spoke. The system receives, at the first spoke, from the hub, second routing information associated with a plurality of spokes in communication with the hub. The plurality of spokes includes a second spoke. The system resolves, at the first spoke, a next hop determination for the packet based on the second routing information received from the hub. The system routes the packet from the first spoke to the second spoke using the next hop determination.

Methods and apparatus for providing an enhanced dynamic multipoint virtual private network architecture

A method and apparatus for using a service provider network that supports point-to-point channels is disclosed. One or more encryption parameters are associated with a channel from among a set of one or more predefined point-to-point channels provided by the service provider to connect customer points for a customer different than the service provider. Payloads for a particular flow of one or more data packets directed through the channel are encrypted at a first customer point, using the set of encryption parameters associated with the particular channel, to generate a set of one or more encrypted payloads. The encrypted payloads are inserted in the particular flow sent through the channel of the service provider network. The encrypted payloads are decrypted at a second customer point connected to the first customer point by the channel.

Growing community of inventors

Bengaluru, India

Pratima Pramod Sethi