Cisco Technology, Inc.

Alcatel Lucent

Sape Jurrien Mullender

Hendrikus G P Bosch

David Delano Ward

Karl Georg Hampel

Ijsbrand Wijnands

Timothy Peter Stammers

William Mark Townsley

Alessandro Duminuco

Jeffrey Michael Napper

Aeneas Sean Dodd-Noble

Paul Anthony Polakos

Andre Surcouf

Peter Bosch

Julien Barbot

Jim McKie

Vinny Parla

Vladimir Y Kolesnikov

Syed Khalid Raza

Ahmed Bakry Helmy Ahmed

Humberto Jose La Roche

Konstantin Livanos

Subhasri Dhesikan

Hendrikus Gp Bosch

David Richard Barach

Hubert Rae McLellan, Jr

John Shamilian

Philippe Guillaume Dobbelaere

Aaron Troy Woland

Keith Burns

Georg Hampel

Koen Daenen

Noah Evans

Bart Antoon Rika Theeten

Jan Sacha

James Mckie

Henning Schild

This disclosure describes techniques including, by a domain name service (DNS), receiving a name resolution request from a client computing device and, by the DNS, providing a nonce to the client computing device, wherein a service is configured to authorize a connection request from the client computing device based at least in part on processing the nonce. This disclosure further describes techniques include a method of validating a connection request from a client computing device, including receiving the connection request, the connection request including a nonce. The techniques further include determining that the nonce is a valid nonce. The techniques further include, based at least in part on determining that the nonce is a valid nonce, authorizing the connection request and disabling the nonce.

Nonce-based enterprise security policy enforcement

Operations include transmitting, on behalf of a first application, a first request to a first service provider, the first request requesting first services from the first service provider, intercepting, at a local agent, a first redirect message from the first service provider to an identity provider, receiving an identity provider cookie from the identity provider based on a validation of credentials during the authentication process, storing a copy of the identity provider cookie, transmitting, on behalf of a second application, a second request to a second service provider, the second request requesting second services from the second service provider, intercepting a second redirect message from the second service provider to the identity provider, adding the identity provider cookie to the second redirect message, and receiving validation to access the second service provider from the identity provider based on the identity provider cookie stored by the local agent.

Per-device single sign-on across applications

This disclosure describes techniques for dynamically changing a user authorization with a service provider during an ongoing user session. The changing user authorization may be used to address changing confidence in an identity of a user consuming a service provided by the service provider. The changing user authorization may also be used to adjust a scope of a service to which a user has access. The present techniques may allow single-sign-on type protocols to accomplish the flexible and dynamic change-of-authorization functionality of some traditional protocols to handle ongoing client-server sessions, rather than simply revoking authorization for access to the service. For this reason, the present techniques are able to integrate advantages of traditional protocols with newer, single-sign-on-type protocols.

Dynamic user authorization with a service provider

Techniques for utilizing an enterprise traffic interception service (TIS) to enforce policies that mandate how clients access software as a service (SaaS) offered by service providers and selectively intercept enterprise network traffic utilizing a domain name service (DNS) and a single sign-on (SSO) service on a per-client per-service basis. The TIS may include a DNS server, an identity provider service, a TLS inspecting proxy, and/or a policy server. The DNS server may handle requests to resolve an address of a service, and identify a policy, stored in the policy server, to redirect the client based on the identity of the client and the service. The identity provider service may later query the policy server during client authorization for the service to verify that the client request is in line with the policy and allow or deny access to the service.

Selective policy-driven interception of encrypted network traffic utilizing a domain name service and a single-sign on service

Techniques for using a single sign-on (SSO) service as a software defined networking (SDN) controller for a virtual private network environment. The techniques disclosed herein may include receiving, at a first authentication service, first data including a first request to authenticate a user of a client device to access an application. The techniques may also include sending, to the client device, second data representing a second request configured to prompt a second authentication service to authenticate the user of the client device. Additionally, the first authentication service may receive an indication that the user was authenticated by the second authentication service and determine, based at least in part on an attribute associated with at least one of the client device or the application, whether the client device is to access the application using an unsecured connection or, alternatively, access the application using a secured connection.

Steering traffic on a flow-by-flow basis by a single sign-on service

Systems, methods, and computer-readable storage media are provided for managing application traffic. A routing policy defines the data flow path between the client device (which uses a virtual private network (VPN) client) and the appropriate network-based service. Based on various factors associated with the user, the client device, and the destination (e.g. network-based service), the routing policy will direct the VPN client to communicate with either a public DNS (via the public Internet) or to a private DNS (via the private Intranet). The resulting IP addresses will be used to establish a particular route (either over a public Internet or private Intranet) between the client device and the network-based service in accordance to the routing policy.

Method for policy-driven, classifying, and routing traffic using the domain name system

Disclosed are concepts for provided for managing application traffic. A method includes receiving a request to access a service from an application, confirming an entity of a user of the application and, based on the confirmation, generating, via an authentication service, a routing policy for data flows between the application and the service. The routing policy defines a mandated path between the application and the service. The method also can include storing proof-of-transit data in the traffic flow for tracking an actual path from the application to the service and determining whether the data path complies with the mandated path defined in the policy. When the determination indicates that the actual path followed the mandated path defined in the routing policy, the method includes granting access to the user for the service. When the actual path differs from the mandated path, the method includes denying access to the user.

System and method of verifying network communication paths between applications and services

A baseboard management controller (BMC) can physically partition the computing resources of a physical host into different resource groups for concurrently running a different operating system per resource group. The BMC can allocate a first processor of the host to a first resource group and a second processor of the host to a second resource group. The BMC can separate the memory of the host into a first memory range for the first processor and a second memory range for the second processor, and the BMC can limit access to the first memory range to the first processor and limit access to the second memory range to the second processor. The BMC can also distribute physical or virtual peripheral devices of the host between the first processor and the second processor.

Physical partitioning of computing resources for server virtualization

A method is provided in one example embodiment and may include receiving, by a mobility management frontend, an attach request for a user equipment (UE) to attach the UE to a core network slice type for a mobile core Software Defined Network (SDN) infrastructure, wherein a plurality of core network slice types are available for the mobile core SDN infrastructure to receive traffic from a plurality of UEs; determining a particular core network slice type within the mobile core SDN infrastructure to serve the UE based on subscriber information associated with the UE; selecting a particular slice instance of the particular core network slice type to receive traffic for the UE; and forwarding traffic for the UE between a Radio Access Network (RAN) and the particular slice instance by the mobility management frontend.

System and method to facilitate slice management in a network environment

A method is disclosed for routing packets in an intermediate node between a mobile node and a correspondent node in a packet-switched network, only one of said nodes being macro-mobility enabled, comprising at the intermediate node: &#x2014;exchanging lower-layer-address-update-related messages with said macro-mobility enabled node; &#x2014;mapping source address, destination address and potentially protocol parameters of lower-layer packets exchanged between the mobile node and the correspondent node in such a way that the macro-mobility enabled node can communicate with the other node as if the other node is also macro-mobility enabled, and such that the other node can communicate with the intermediate node as if the intermediate node is a non-macro-mobility-enabled node. Also associated devices, update methods for devices, and servers are disclosed.

Method and system for optimising routing between two network nodes, at least one of which is mobile

A service-based networking capability is presented. The service-based networking capability replaces traditional networking connections between endpoints with service connections between endpoints. The service-based networking capability supports establishment and use of a service connection between endpoints, where the service connection between endpoints may be provided below the application layer and above the transport layer. The establishment and use of a service connection between endpoints may be provided using a connected services stack, which may include a connected services layer that is configured to operate below the application layer and above the transport layer.

Service-based networking

The invention pertains to a method for providing access to a mobile communication network comprising at least one base transceiver station, wherein the communication network is being visited by a piece of user equipment having a home operator in a home network. The method comprises at the base transceiver station: receiving a channel request from said user equipment, creating a virtual machine associated with said home operator of said user equipment, establishing a channel using said virtual machine, and allocating channel resources of said at least one base station to accommodate said channel. The invention also pertains to a base station system to carry out the method of the invention.

Method and base station system for providing access to a mobile communication network

The present invention provides improved security in a virtual machine. By extending the capabilities of modern secure processors, privacy of computation is provided from both the owner of the equipment and other users executing on the processor, which is an advantageous feature for rentable, secure computers. In addition to the hardware extensions required to secure a virtualizable computer, an infrastructure for the deployment of such processors is also provided. Furthermore, a signaling flow to establish the various relationships between the owner, user and manufacturer of the equipment is disclosed.

Growing community of inventors

Amsterdam, Netherlands

Sape Jurrien Mullender