Cisco Technology, Inc.

Roberto Muccifora

Domenico Ficara

Amine Choukir

Salvatore Valenza

Leo Caldarola

Vincent Cuissard

Sachin Dinkar Wakudkar

Ugo Mario Campiglio

Jerome Henry

Sudhir Kumar Jain

Anirban Karmakar

Davide Cuda

Shiva Prasad Maheshuni

Mirko Raca

Fnu Sandesh

Robert E Barton

Bart A Brinckman

Shree N Murthy

Arun G Khanna

Stephen Michael Orr

Pratap Pereira

Thomas Vegas

Lorenzo Granai

Francisco Sedano Crippa

Shankar Sthanuretnam

Antonio Trifilo

Andriani Stylianou

Group identity assignment and policy enforcement may be provided. A User Defined Network Identifier (UDN ID) defining a group of client devices may be received. Next, a client identifier (ID) associated with a source client device that is associated with the group of client devices may be received. The UDN ID and the client ID may be encoded in an Extended Local Identifier (ELI) Media Access Control (MAC) address associated with the source client device. A source MAC address of a packet received from the source client device may then be substituted with the ELI MAC address. Then the packet may be forwarded.

Group identity assignment and policy enforcement for devices within the same network

Methods are provided to determine validity of a MAC address. The methods involve obtaining a media access control (MAC) address validity message that indicates a plurality of valid MAC addresses in the wireless network using a fully-exploded format or a probabilistic data structure and determining whether a MAC address is valid based on the MAC address validity message. Other methods involve obtaining a query regarding a validity of a media access control (MAC) address, determining whether the MAC address is a value included in a data set of expected values of a probabilistic data structure. The data set represents a list of MAC addresses. The other methods involve determining whether the MAC address is valid in the wireless network based on determining whether the MAC address is the value included in the data set and providing a response indicating whether the MAC address is valid.

Preventing abuse of media access control addresses by rogue devices

Techniques and architecture are described for determining an identity of a client device and utilizing security policies associated with the client device provided by a device identity entity. For example, a tag associated with security policies is created for use in enforcing the security policies by a security policy enforcement entity associated with a cloud network. The techniques and architecture also allow for identification of a particular user on a client device that may be shared by multiple users based at least in part on the user accessing an application. Also, the techniques and architecture described herein provide a generic and agnostic approach to enforcing security policies for users and/or client devices.

Dynamically enforcing security policies on client devices using a device identity entity and a security policy enforcement entity

Presented herein are techniques for extending Target Wake Time (TWT) to provide for randomizing and changing media access control (MAC) address (RCM) signaling. According to certain embodiments, a client device operating in a wireless network determines a TWT for the client device. Next, the client device determines that it will change from using a first MAC address to a using second MAC address. Finally, the client device generates, for transmission to an access point device that serves wireless communication in the wireless network, a TWT signaling message. The TWT signaling message indicates the TWT for the client device and the second MAC address.

Extending target wake time for randomized and changing media access control address signaling

Techniques are provided that rotate a device address used to identify a wireless client device on a wireless network. The wireless client device and at least one network infrastructure component identify a plurality of device addresses associated with the wireless client device. In some embodiments, the plurality of device addresses are generated via a corresponding plurality of invocations of a stateful random number generator, such as a cryptographically secure pseudorandom number generator.

Seamless device address rotation

A method is provided that is performed in a wireless network to detect a rogue wireless device. The method comprises detecting a suspect wireless device in the wireless network based on messages transmitted by the suspect wireless device using a first Media Access Control (MAC) address that is also used by a valid wireless device in the wireless network. When a suspect wireless device is detected, the method next includes sending to the valid wireless device in the wireless network a request configured to cause the valid wireless device to change its MAC address. After the valid wireless device has changed its MAC address, the method involves observing messages transmitted by the suspect wireless device in the wireless network. The method then includes determining that the suspect wireless device is a rogue device when the suspect wireless device continues to transmit messages using the first MAC address.

Identifying rogue wireless devices using MAC address rotation techniques

Aspects described herein include a method of automated grouping of client devices for a user-defined network (UDN). The method includes receiving, from a client device an authentication request to join an access provider network. The authentication request includes a unique identifier of the client device for a federation-based network. The method further includes transmitting the unique identifier to a UDN cloud, transmitting the authentication request to an identity provider, and receiving, responsive to the identity provider authenticating the authentication request, a list of one or more UDNs from the UDN cloud that are associated with the unique identifier. The method further includes joining the client device with one or more other client devices present on the access provider network listing a same UDN.

Onboarding client device to user-defined network using federation-based network identity

A method for providing multicast frames in a Multi-Dwelling Unit (MDU) is provided herein. An Access Point (AP) can receive a join request from a first client device. The AP can generate a Group Master Key (GMK) from the Pre-Shared Key (PSK) associated with a Basic Service Set (BSS) that includes the first client device. The AP can then derive a Group Transient Key (GTK) from the GMK. The AP may then send the GTK to the first client device. Thereinafter, the AP can send multicast frames to the first client device encrypted by the GTK. The first client device can decrypt the multicast frames with the GTK. However, a second client device, that does not share the PSK, may receive the multicast frame but cannot decrypt the multicast frames.

Multicast containment in a multiple pre-shared key (PSK) wireless local area network (WLAN)

Techniques are described for automatically generating a consistent configuration state version 2 for a network device with no or minimal help from a user and/or from a provider of the network device when updating from a configuration state version 1 to the configuration state version 2. The techniques and architecture also provide for migration from configuration state version 1 to configuration state version 2 when at least some of a configuration state are located in text files that are applied to the network device at start-up of the network device.

Automatic resolution of configuration inconsistencies

In one embodiment, a method in a multi-tenant wireless network comprises determining a first user private network (UPN) for a first device of a first user. The first UPN provides discovery, by the first device, of other devices on the wireless network to a first subset of other devices on the wireless network. The method further comprises determining a second UPN for the first device of the first user. The second UPN provides discovery, by the first device, of other devices on the wireless network to a second subset of other devices on the wireless network. The method further comprises providing discovery of the first subset and second subset of other devices on the wireless network to the first device of the first user. Discovery of the second subset is provided dynamically based on a current location of the first device.

Dynamic control and creation of user private networks

A method for establishing a VPN with a client device is provided. In the method, an AP can receive an access request directed to an OpenRoaming (OR) Service Set Identifier (SSID) from the client device. The AP can send the access request to an OR connector. In response to the access request, the AP may receive an access response from the OR connector. The access response can include an attribute indicating an address to connect to a company Virtual Private Network (VPN) headend. The AP may then use the attribute to establish the VPN connection with the company VPN headend.

Openroaming based remote worker

A method is provided in a wireless local area network controller in a wireless communication network. The wireless communication network includes one or more virtual networks identified with virtual network IDs, VNIDs. A request is received from a wireless client to onboard onto the network and the wireless client is mapped to an onboarding VNID. The onboarding VNID is associated with an onboarding virtual network that does not require an authentication of the wireless client. An Internet Protocol address assignment is forwarded to the wireless client. The wireless client is remapped from the onboarding VNID to the destination VNID after authenticating the wireless client. The wireless client maintains the assigned IP address after moving from the onboarding VNID to the destination VNID. Access to the wireless client on a virtual network identified by the destination VNID is provided via the assigned IP address.

Growing community of inventors

Ropraz, Switzerland

Roberto Muccifora