Lenovo (singapore) Pte. Ltd.

Lenovo Global Technology (united States) Inc.

Avaya Inc.

Radu Mihai Iorga

Corneliu-Ilie Calciu

George-Andrei Stanescu

Roberto H Jacob Da Silva

Bogdan-Cosmin Chifor

Bogdan Chifor

Gavril-Ioan Florian

Fred Allison Bower, Iii

Chidambaram Bhagavathiperumal

Robert Russell Wolford

Curtis Santos

Dan-Alexandru Calavrezo

Vinay Bapat

Anda-Maria Nicolae

Hari Om Sharma

Mohammed Arakkal Kunju Yasser

Miroslav Halas

Florin Florescu

Sorin Tudor Toderica

Richard Huang

Catalin-eugen Nitipir

Catalin Nitipir

Crina-elena Untea

Eduard Pavel

James Mclean

Alexandru Lazar

Corneliu Ilie Calciu

Gavril Ioan Florian

A method for in-band telemetry rate limiting is disclosed. An apparatus and computer program product also perform the functions of the method. Embodiments of the method include receiving a telemetry packet at an egress node of a data pathway in a data network. The data pathway includes an ingress node, transit nodes and the egress node and the telemetry packet includes a telemetry parameter where the telemetry parameter is for a node in the data pathway. The method includes comparing the telemetry parameter with a previous telemetry parameter from a previous telemetry packet received at the egress node prior to receiving the telemetry packet, and transmitting telemetry data from the telemetry packet to a network controller in response to a telemetry difference exceeding a telemetry parameter threshold. The telemetry difference includes a difference between the telemetry parameter and the previous telemetry parameter.

In-band telemetry rate limiting in cloud environments

Covert monitoring of an attacker host in a software defined perimeter network, includes: authenticating, by an SDP controller, a first and second host in the SDP network, where the first and second host, after authentication, establish an end-to-end encryption communication session; detecting, by the SDP controller, that the first host is an attacker host and the second host is a victim host; establishing, by the SDP controller as a copy of the victim host, a mimic host; and redirecting, by the SDP controller, communication from the attacker host to the mimic host including migrating, without disruption detectable by the attacker host, the communication session from the victim host to the mimic host, where the mimic host monitors communications with the attacker host.

Covert monitoring of an attacker host in a software defined perimeter network

A method for tunning high speed link parameters for cables with a transceiver at each end includes transmitting, in response to establishing a link, an eye pattern bit sequence from a first computing device to a second computing device over a cable with a transceiver connected to each end of the cable. Establishing the link includes establishing a communication link over the cable between the first computing device and the second computing device. The method includes receiving an eye pattern quality message from the second computing device using a device discovery protocol. The eye pattern quality message includes quality information of a received waveform corresponding to the transmitted eye pattern bit sequence. The method includes adjusting transmission parameters for transmission over the cable in response to the quality information, and retransmitting the eye pattern bit sequence using the adjusted transmission parameters.

Tunning high speed link parameters

A method for storage device compression/deduplication layer congestion control includes comparing a level of congestion at a compression/deduplication layer of a storage device with a lower congestion limit. The compression/deduplication layer is configured for data compression and/or data deduplication of a data packet prior to storing data of the data packet. The data packet is received from a computing device using transmission control protocol ('TCP'). The method includes, in response to the level of congestion exceeding the lower congestion limit, marking as congested, in a flow table, a data flow between the computing device and the storage device. The flow table is shared between the compression/deduplication layer and a TCP layer of the storage device.

Storage device compression layer congestion control

Dynamic buffer selection in ethernet controllers including determining, by an ethernet controller, based on a received header of a packet, a length of the packet; selecting, from a plurality of buffers, a buffer of a buffer size based on the length of the packet, wherein the plurality of buffers comprises a plurality of different buffer sizes; and transferring the packet to the selected buffer.

Dynamic buffer selection in ethernet controllers

A method includes receiving, at an unmanaged switch, a link-aggregation control protocol ('LACP') protocol data unit (“PDU”) on each port of two or more connections to be in a link-aggregation group (“LAG”). The ports are in the unmanaged switch, which is unconfigured for LACP and is connected over the connections to a managed switch configured for LACP. The method includes, in response to the ports that received an LACP PDU being unconfigured for LACP, configuring each port receiving an LACP PDU for LACP, creating a LAG that includes the connections of the ports that received the LACP PDUs, and starting an LACP timer. The method includes, in response to determining that the LACP timer has expired, clearing the LACP configuration of the ports configured for LACP. The LACP timer expires in response to the ports in the LAG not receiving additional LACP PDUs prior to expiration of a timer period.

Self-configuring link aggregation control protocol

Secure updating of strong passwords in a composable system, includes: during deployment of the composable system, requesting, by a central controller in the composable system, device information from a device vendor, the device information specifying a number of expected devices for the composable system; checking, by the central controller, a number of discovered devices against the number of expected devices; only upon discovering all the expected devices, updating, by the central controller, a password for all the devices in the composable system; and upon discovering fewer than the total number of expected devices, halting, by the central controller, deployment of the composable system.

Secure updating of strong passwords in a composable system

A method for reducing the number of IP addresses used by VRRP includes creating a VRRP control packet at a router of a plurality of physical routers configured in parallel in a data pathway. The physical routers are configured as a virtual router and the VRRP control packet is configured as an IPv6 control packet. The method includes inserting an IP address of the virtual router in a router address field of a control packet header. The IP address is formatted as an IPv4 address. The method includes inserting, in a reserved field of the control packet, a first value. The first value differs from a default value for the reserved field signifying that IP addresses in the router address field are formatted as IPv6 addresses for IPv6 control packets and the first value signifies that the IP addresses in the router address field are formatted as IPv4 addresses.

Method for reducing the number of IP addresses used when creating a virtual router

Methods, apparatuses, and computer program products for fast resumption of dormant sessions on a client device are disclosed. A client device receives a push notification from a push notification server, the push notification having a payload that includes a datagram packet from an application server that initiated the push notification. A push notification process on the client device extracts the datagram packet from the push notification and injects the datagram packet into a communications protocol stack for at least one application on the client device. The application is awakened from a dormant state and reads the datagram packet. The application may then send a response to the datagram packet to the application server.

Fast resumption of dormant sessions on a client device

A method for reducing transmission of telemetry packets includes receiving, at a network controller, telemetry packets from network nodes in a communication pathway of data packets being transmitted from a sending host to a receiving host and determining from the telemetry packets a number of network nodes in the communication pathway. The method includes setting a network node threshold value equal to the determined number of network nodes in the communication pathway, and transmitting, from the network controller, the network node threshold value to each network node in the communication pathway.

Scalable in-band telemetry metadata extraction

A computer program product and a data storage device including first and second storage controllers operating in active-passive mode with a shared disk. Each storage controller includes a storage device storing program instructions and a processor to process the program instructions and perform various operations. The operations include receiving a task to be performed by the storage device containing the first and second storage controllers, wherein the first storage controller is currently operating as an active storage controller and the second storage controller is currently operating as a passive storage controller. The operations further include determining whether the received task has a high priority or a low priority, performing the received task in response to determining that the received task has a high priority, and delegating the received task to the second storage controller for performance in response to determining that the received task has a low priority.

Delegating low priority tasks to a passive storage controller

Methods, apparatuses, and computer program products for edge device assisted mitigation of publish-subscribe denial of service (DoS) attacks are disclosed. An edge device hosts a virtualized copy of an Internet-of-Things (IoT) device subscribed to one or more publish-subscribe topics. When the edge device receives an indication to activate the virtualized copy of the IoT device, for example, during a DoS attack on the IoT device, the edge device activates the virtualized copy of the IoT device, which receives traffic from the publish-subscribe topic. The virtualized copy of the IoT device applies security policies to incoming traffic received from the subscription topics and transmits to the IoT device sanitized traffic obtained from the received incoming subscription content traffic.

Edge device assisted mitigation of publish-subscribe denial of service (DoS) attacks

A method for link layer authentication includes receiving, at an edge network access node, a link layer authentication packet from a client, seeking network access, using a remote NAS agent running on the edge network access node. The method transmits, using a tunneling connection, the link layer authentication packet to a remote NAS in a link layer authentication process. The link layer authentication process exchanges the link layer authentication packet with an authentication server to authenticate the client. The method includes receiving a link layer authentication packet from the remote NAS over the tunneling connection. The received link layer authentication packet includes a response from the authentication server regarding the transmitted link layer authentication packet. The method includes transmitting the received link layer authentication packet to the client and, in response to link layer authentication packets resulting authorization, authorizing the client for network access through the edge network access node.

Link-layer authentication for legacy network nodes using a remote network access server

An apparatus includes a packet encryption circuit that uses an encryption keys to encrypt each of two or more portions of a data packet. Each portion is encrypted with a different encryption key and includes one or more layers of the data packet. A first portion includes a layer of the data packet with MAC information. The apparatus includes a packet transmitter that transmits, from a source router, an encrypted data packet to an intermediate router between the source router and a destination router. The encrypted data packet includes an encrypted version of the data packet encrypted using the encryption keys. The intermediate router has encryption keys sufficient for a service level agreement of the intermediate router and lacks a portion of the encryption keys. The source and destination routers use a MAC security standard for encryption and decryption of the data packet using the encryption keys.

Selectively disclosing content of data center interconnect encrypted links

Methods, apparatuses, and computer program products for telemetry-based network switch configuration validation are disclosed. An analytics engine captures a first network snapshot including telemetry data received from one or more network switches in a first state. Upon receiving a notice indicating that a network configuration change has been applied, the analytics engine initiates a timer in response to receiving the notice. The analytics engine captures, in response to expiration of the timer, a second network snapshot including telemetry data received from the one or more network switches in a second state and compares the first network snapshot and the second network snapshot. In dependence upon the comparison of the first network snapshot to the second network snapshot, the analytics engine validates the network configuration change.

Growing community of inventors

Bucharest, Romania

Radu Mihai Iorga