Cisco Technology, Inc.

Roberto Muccifora

Domenico Ficara

Amine Choukir

Salvatore Valenza

Leo Caldarola

Vincent Cuissard

Sachin Dinkar Wakudkar

Sudhir Kumar Jain

Anirban Karmakar

Ugo Mario Campiglio

Davide Cuda

Shiva Prasad Maheshuni

Mirko Raca

Fnu Sandesh

Jerome Henry

Robert E Barton

Shree N Murthy

Bart A Brinckman

Arun G Khanna

Pratap Pereira

Thomas Vegas

Lorenzo Granai

Shankar Sthanuretnam

Antonio Trifilo

Francisco Sedano Crippa

Andriani Stylianou

Techniques and architecture are described for determining an identity of a client device and utilizing security policies associated with the client device provided by a device identity entity. For example, a tag associated with security policies is created for use in enforcing the security policies by a security policy enforcement entity associated with a cloud network. The techniques and architecture also allow for identification of a particular user on a client device that may be shared by multiple users based at least in part on the user accessing an application. Also, the techniques and architecture described herein provide a generic and agnostic approach to enforcing security policies for users and/or client devices.

Dynamically enforcing security policies on client devices using a device identity entity and a security policy enforcement entity

Presented herein are techniques for extending Target Wake Time (TWT) to provide for randomizing and changing media access control (MAC) address (RCM) signaling. According to certain embodiments, a client device operating in a wireless network determines a TWT for the client device. Next, the client device determines that it will change from using a first MAC address to a using second MAC address. Finally, the client device generates, for transmission to an access point device that serves wireless communication in the wireless network, a TWT signaling message. The TWT signaling message indicates the TWT for the client device and the second MAC address.

Extending target wake time for randomized and changing media access control address signaling

Techniques are provided that rotate a device address used to identify a wireless client device on a wireless network. The wireless client device and at least one network infrastructure component identify a plurality of device addresses associated with the wireless client device. In some embodiments, the plurality of device addresses are generated via a corresponding plurality of invocations of a stateful random number generator, such as a cryptographically secure pseudorandom number generator.

Seamless device address rotation

A method is provided that is performed in a wireless network to detect a rogue wireless device. The method comprises detecting a suspect wireless device in the wireless network based on messages transmitted by the suspect wireless device using a first Media Access Control (MAC) address that is also used by a valid wireless device in the wireless network. When a suspect wireless device is detected, the method next includes sending to the valid wireless device in the wireless network a request configured to cause the valid wireless device to change its MAC address. After the valid wireless device has changed its MAC address, the method involves observing messages transmitted by the suspect wireless device in the wireless network. The method then includes determining that the suspect wireless device is a rogue device when the suspect wireless device continues to transmit messages using the first MAC address.

Identifying rogue wireless devices using MAC address rotation techniques

Aspects described herein include a method of automated grouping of client devices for a user-defined network (UDN). The method includes receiving, from a client device an authentication request to join an access provider network. The authentication request includes a unique identifier of the client device for a federation-based network. The method further includes transmitting the unique identifier to a UDN cloud, transmitting the authentication request to an identity provider, and receiving, responsive to the identity provider authenticating the authentication request, a list of one or more UDNs from the UDN cloud that are associated with the unique identifier. The method further includes joining the client device with one or more other client devices present on the access provider network listing a same UDN.

Onboarding client device to user-defined network using federation-based network identity

A method for providing multicast frames in a Multi-Dwelling Unit (MDU) is provided herein. An Access Point (AP) can receive a join request from a first client device. The AP can generate a Group Master Key (GMK) from the Pre-Shared Key (PSK) associated with a Basic Service Set (BSS) that includes the first client device. The AP can then derive a Group Transient Key (GTK) from the GMK. The AP may then send the GTK to the first client device. Thereinafter, the AP can send multicast frames to the first client device encrypted by the GTK. The first client device can decrypt the multicast frames with the GTK. However, a second client device, that does not share the PSK, may receive the multicast frame but cannot decrypt the multicast frames.

Multicast containment in a multiple pre-shared key (PSK) wireless local area network (WLAN)

Techniques are described for automatically generating a consistent configuration state version 2 for a network device with no or minimal help from a user and/or from a provider of the network device when updating from a configuration state version 1 to the configuration state version 2. The techniques and architecture also provide for migration from configuration state version 1 to configuration state version 2 when at least some of a configuration state are located in text files that are applied to the network device at start-up of the network device.

Automatic resolution of configuration inconsistencies

In one embodiment, a method in a multi-tenant wireless network comprises determining a first user private network (UPN) for a first device of a first user. The first UPN provides discovery, by the first device, of other devices on the wireless network to a first subset of other devices on the wireless network. The method further comprises determining a second UPN for the first device of the first user. The second UPN provides discovery, by the first device, of other devices on the wireless network to a second subset of other devices on the wireless network. The method further comprises providing discovery of the first subset and second subset of other devices on the wireless network to the first device of the first user. Discovery of the second subset is provided dynamically based on a current location of the first device.

Dynamic control and creation of user private networks

A method for establishing a VPN with a client device is provided. In the method, an AP can receive an access request directed to an OpenRoaming (OR) Service Set Identifier (SSID) from the client device. The AP can send the access request to an OR connector. In response to the access request, the AP may receive an access response from the OR connector. The access response can include an attribute indicating an address to connect to a company Virtual Private Network (VPN) headend. The AP may then use the attribute to establish the VPN connection with the company VPN headend.

Openroaming based remote worker

A method is provided in a wireless local area network controller in a wireless communication network. The wireless communication network includes one or more virtual networks identified with virtual network IDs, VNIDs. A request is received from a wireless client to onboard onto the network and the wireless client is mapped to an onboarding VNID. The onboarding VNID is associated with an onboarding virtual network that does not require an authentication of the wireless client. An Internet Protocol address assignment is forwarded to the wireless client. The wireless client is remapped from the onboarding VNID to the destination VNID after authenticating the wireless client. The wireless client maintains the assigned IP address after moving from the onboarding VNID to the destination VNID. Access to the wireless client on a virtual network identified by the destination VNID is provided via the assigned IP address.

Wireless client onboarding and segmentation

Embodiments provide techniques for transmitting data packets across a deterministic Ethernet network. Embodiments receive, at a first device in the deterministic Ethernet network, a deterministic binary schedule specifying timing information for transmitting data fragments relating to a plurality of data flows. Data packets to transmit to a destination device within the deterministic Ethernet network are received at the first device. Embodiments include fragmenting each of the data packets into two or more fragments and encoding at least one of the two or more fragments for each of the data packets with a respective sparse graph code. The encoded fragments are transmitted to the destination device, across multiple paths through the deterministic Ethernet network, according to timing information specified in the deterministic binary schedule.

Sparse graph coding scheduling for deterministic Ethernet

In one embodiment, a method includes receiving packets in a flow at a network device in a deterministic network, wherein at least one of the packets is transmitted from a source out of sync due to collision with another flow at the source, analyzing at the network device, the flow to reconstruct a period of the flow, and processing at the network device, the packets according to the period to synchronize the processing of the packets at the network device with the source and remove jitter from the flow. An apparatus and logic are also disclosed herein.

Growing community of inventors

Ropraz, Switzerland

Roberto Muccifora