Cisco Technology, Inc.

Rajiv Asati

Carlos M Pignataro

Nagendra Kumar Nainar

Mohamed Khalid

Om Prakash Suthar

Aamer Saeed Akhter

John T Chapman

Ijsbrand Wijnands

Brian Eliot Weis

Ralph Droms

Vivek Agarwal

Gregory J Shepherd

Aeneas Sean Dodd-Noble

Christian J Martin

Pratima Pramod Sethi

James Neil Guichard

Nitin Kumar

Mankamana Prasad Mishra

Akram Ismail Sheriff

David Delano Ward

Daniel George Wing

Keyur Patel

Toerless Eckert

Alon Shlomo Bernstein

Ian James Wells

K Tirumaleswar Reddy

Russell Ivan White

Humberto Jose La Roche

Wojciech Dec

Luca Martini

Ryo Watanabe

Arghya T Mukherjee

Gabriele Maria Galimberti

Eric Colin Friedrich

Kenneth Durazzo

Hendrikus G P Bosch

Stewart Frederick Bryant

Alvaro E Retana

Paul M Quinn

George Swallow

Shree N Murthy

John H W Bettink

Santanu Dasgupta

Haseeb Sarwar Niazi

Manikchand Roopchand Bafna

Raghavendra Vidyashankar Suryanarayanarao

Vijay Bollapragada

Anwin P Kallumpurath

Edward Albert Warnicke

Kavitha Kamarthy

Scott Thomas Fanning

Anil Bhikuayya Jangam

Luc De Ghein

Ciprian Pompiliu Popoviciu

Yichen Wang

Arvind Tiwari

Randy Zhang

Jason Guy

Chandragupta Ganguly

Vinod Pandarinathan

Ajay Kalambur

John Wei-I Wu

Warren Scott Wainner

Naiming Shen

Donnie Van Savage

Samir Parikh

Enke Chen

Yiqun Cai

Christopher Metz

Anil Thomas

Khalil A Jabr

Stephane Litkowski

Christian Cassar

Sunil Cherukuri

Frank Michaud

Sheela Dixit Rowles

Ankush Ganpatrai Arora

Yixing Ruan

Nagendra B Kumar

Mark L Hendrickson

Walid Wakim

Nagendra Kumar

Alan Robert Lynn

Justin James Muller

Richard Montgomery Plane

Atahar Khan

Amit Dhamija

Amarnath Sury Arvind

Errol Fenton Roberts

Shashidhar P Patil

Shashi Sastry

Alejandro Alberto Eguiarte Salazar

Ariel Shuper

Greg Shepherd

Kenneth A Patton

Greg Thompson

Alejandro Eguiarte

Naveen Eranoor

Chandrashekar Vasudevan

Suresh Kumar Shanmugam

Techniques are described herein for managing access to sensitive data detected within an electronic communication. In some embodiments, such techniques may comprise receiving, from a sender, an electronic communication directed toward a first recipient. The techniques may then comprise identifying one or more pieces of sensitive data within the electronic communication, providing a content of the one or more pieces of sensitive data to a data hosting device to be stored in a memory location and first information associated with the first recipient used to access the memory location, updating the electronic communication to replace the one or more pieces of sensitive data with a reference to the memory location, and transmitting the electronic communication to the first recipient.

Techniques for protecting sensitive data within electronic communications

Blockchain technology is used to provide distributed authentication, entitlements and trust among different virtual Radio Access Network (vRAN) elements. An enterprise blockchain with interfaces enables multi-vendor vRAN deployment across multiple service providers. In another embodiment, a method is provided for authenticating entities in a virtualized radio access network to ensure various entitles are in fact entitled to participate in various radio access network operations.

Authenticating radio access network components using distributed ledger technology

Embodiments provide for assuring policy based alerting, via clustering, via a first neural network, operational data reported from a network into a plurality of anomalies organized into several clusters; correlating, via the first neural network, alerts received from devices in the network according to the several clusters; determining, via the second neural network, anomaly impacts in the several clusters from the filtered alerts; in response to determining that the anomaly impacts for a first cluster exceed an alerting threshold: identifying a first shared node in the first cluster; identifying a second cluster including a second shared node matching the first shared node that has not been determined to exceed the alerting threshold; and transmitting an alert for the first cluster and the second cluster; and in response to receiving a response to the alert, updating, via the second neural network, the first neural network.

Assurance of policy based alerting

A method of managing data streaming processes may include at a processing device, computing hypertext transmission protocol version 3 (HTTP/3) header of a first message received at a first network interface controller (NIC) into a first control message and a second control message, and transmitting the first control message to the first NIC associated with the processing device. The method may further include transmitting the second control message to a second NIC associated with the processing device, and with the first control message and the second control message, transmitting data directly between the first NIC and the second NIC.

Hardware-accelerated service mesh

In one embodiment, a method comprises: receiving, by a process, an executed function flow of a daisy chained serverless function-as-a-service (FaaS) function, the executed function flow having been injected with a particular trace identifier in response to an initial event trigger and span identifiers having been injected by each service that was executed; generating, by the process, a serverless flow graph associated with the particular trace identifier based on linking a path of serverless functions according to correlation of the span identifiers between the serverless functions; performing, by the process, a trace-based analysis of the serverless flow graph through comparison to a baseline of expectation; detecting, by the process, one or more anomalies in the serverless flow graph according to the trace-based analysis; and mitigating, by the process, the one or more anomalies in the serverless flow graph.

Mitigating security threats in daisy chained serverless FaaS functions

This disclosure describes techniques for policy validation techniques relating to data traffic routing among network devices. The techniques may include processing a validation request from a controller. A validation request may include information related to a computed path for routing data traffic in a computing network. The processing may include sending one or more path requests to one or more redundant controllers, and comparing computed paths from the redundant controller(s) to the originally computed path. The techniques may include generating a validation response based on comparing the computed paths. In some examples, the techniques may further include determining a health score for the controller. Policy validation techniques may improve data traffic routing among network devices by helping to ensure valid policies are produced.

Policy validation

This disclosure describes using a dynamic proxy for securing communications between a source within a cloud environment and an application container. The techniques include intercepting traffic directed to an application container, analyzing the traffic and traffic patterns, and allowing or preventing the traffic from being delivered to the application container based on the analysis. A traffic analysis engine may determine whether the traffic is considered safe and is to be allowed to be delivered to the application container, or whether the traffic is considered unsafe and is to be prevented from being delivered to the application container, According to some configurations, the address(es) to the network interfaces (e.g., WIFI or Eth0) are abstracted to help ensure security of the application containers.

Dynamic proxy response from application container

This disclosure describes techniques for configuring an edge router of a communication provider network, the edge router coupled to communicate with a plurality of media streaming playback devices. Based at least in part on an indication of characteristics associated with the plurality of media streaming playback devices, a first multicast join for the edge router is configured to the communication provider network such that one or more media servers delivers a first plurality of media streams to the edge router via the communication provider network. Based at least in part on an indication of a request for an additional media stream not included in the first plurality of media streams, a second multicast join for the edge router is configured to the communication provider network such that the one or more media servers delivers the additional media stream to the edge router via the communication provider network.

Hybrid static and dynamic multicast configuration for media serving environment

A solution for selecting an optimal user Plane entity (with Control and User Plane Separation (CUPS)) per UE during seamless roaming. In one embodiment, a method is provide that is performed by a control plane entity in a mobile core network that supports inter public land mobile network (PLMN) roaming among two or more PLMNs. The method includes obtaining a create session request from an entity in a second PLMN to which a user equipment has roamed from a first PLMN; selecting a particular user plane entity among a plurality of user plane entities based on one or more user equipment related parameters; and establishing a session with the particular user plane entity to serve user plane traffic in the mobile core network for the user equipment.

Efficient user plane function selection with S10 roaming

The present technology is directed to a system and method for automatic triggering of relevant code segments corresponding to a sequence of code segments or function codes having a preferred execution order. The automatic triggering action is based on the snooping of a response generated from an execution of a previous code segment. Information with respect to the next code segment in the preferred execution order may be obtained by directing a network proxy, such as Envoy to snoop the Uniform Resource Identifier (URI) field of a response packet being forwarded to a client entity. In this way, a network proxy may preemptively spawn and instantiate the following function codes (pointed to by the snooped Uniform Resource Identifier) prior to receiving the corresponding client request. As such, by the time a client request for the subsequent function code is received the code ready for execution.

In situ triggered function as a service within a service mesh

A system is provided that includes one management cluster to manage network function virtualization infrastructure (NFVI) resources lifecycle in more than one edge POD locations, where resources include hardware and/or software, and where software resources lifecycle includes software development, upgrades, downgrades, logging, monitoring etc. Methods are provided for decoupling storage from compute and network functions in each virtual machine (VM)-based NFVI deployment location and moving it to a centralized location. Centralized storage could simultaneously interact with more than one edge PODs, and the security is built-in with periodic key rotation. Methods are provided for increasing NFVI system viability by dedicating (fencing) CPU core pairs for specific controller operations and workload operations, and sharing the CPU cores for specific tasks.

Virtual infrastructure manager enhancements for remote edge cloud deployments

Techniques for adaptive thresholding are provided. A first data point in a data stream is received, and a first plurality of data points from the data stream is identified, where the first plurality of data points corresponds to a timestamp associated with the first data point. At least a first cluster is generated for the first plurality of data points, and a predicted value for the first data point is generated based at least in part on data points in the first cluster. A deviation is computed between the predicted value for the first data point and an actual value for the first data point. Upon determining that the deviation exceeds a first predefined threshold, the first data point is labeled as anomalous, and reallocation of computing resources is facilitated based on labeling the first data point as anomalous.

Multi-domain service assurance using real-time adaptive thresholds

A method is performed at a mobile core, including assigning a first cache servicing a client device in response to a first request for a media content item based at least in part on a first IP address of the client device associated with a first edge location. The method further includes providing a first portion of the media content item from the first cache. The method additionally includes triggering a plurality of caches at edge locations proximate to the first edge location to retrieve a second portion of the media content item. The method also includes receiving a continuation request from the client device with a second IP address associated with a second edge location. The method further includes selecting a second cache from the plurality of caches based at least in part on the second IP address and continuing providing the media content item from the second cache.

Methods and apparatuses for content delivery over mobile networks with multi-access edge computing (MEC) control and user plane separation (CUPS)

Growing community of inventors

Morrisville, NC, United States of America

Rajiv Asati