Cisco Technology, Inc.

Selvaraj Mani

Shwetha Subray Bhandari

Deep Preet Singh

Frank Brockners

Swapna Yelamanchi

Rakesh Reddy Kandula

Amarender R Musku

Pascal Thubert

Eric Albin Voit

Sujal Sheth

William F Sulzen

Eliot Lear

Saiprasad Reddy Muchala

Shrirang Arvind Bage

Mahendra Kumar Samarya

Swapna Gopalkrishna Shingre

Srinivasu Angadala

Sri Hari Kumaran Masilamani

Systems, methods, and computer-readable media are disclosed for measurement of trustworthiness of network devices prior to their configuration and deployment in a network. In one aspect of the present disclosure, a method for pre-configuration of network devices includes receiving, at a dynamic host configuration server, a first request from a network device for configuration data, the configuration data including at least an IP address; sending, by the dynamic host configuration server, a second request to the network device for attestation information; verifying, by the dynamic host configuration server, the network device based on the attestation information; and assigning, by the dynamic host configuration server, the configuration data to the network device upon verifying the network device.

Systems and methods for pre-configuration attestation of network devices

Technologies for attestation techniques, systems, and methods to confirm the integrity of a device for service discovery and more specifically, for proving trustworthiness of particular service devices and/or mDNS controller/network elements with respect to DNS/mDNS service discovery. Such attestation techniques may implement canary stamps (e.g., tokens or metadata elements containing or reflecting security measures taken at the device).

Verifying service advertisements using attestation-based methods

In one embodiment, a service configured to execute on trusted participant devices authenticates network service devices each having identifying information and one or more offered services, and creates an entry into a secure digital ledger for each authenticated network service device and associated offered services, each entry based on the identifying information and the one or more offered services for a corresponding network service device. Upon receiving an advertisement for an advertised service from an advertising device attached to a given trusted participant device, the service then requests and may receive an authentic ledger entry from the secure digital ledger for the advertised service. In response to either validating or failing to validate authenticity of the advertised service based on the authentic ledger entry, registration at the given trusted participant device of the advertised service for the received advertisement from the advertising device may either be permitted or denied, respectively.

Authenticated service discovery using a secure ledger

In one embodiment, a device in a network gathers characteristics of a container application on the device. The device provides the gathered characteristics of the container application for security assessment. The device receives an indication of the security assessment based on the provided characteristics of the container application. The device controls execution of the container application based on the received indication of the security assessment.

Secure and policy-driven computing for fog node applications

In one embodiment, a server receives an authentication request from a device in a computer network, and authenticates the device. Then, upon receiving a service announcement from the authenticated device, the server determines authenticity of the service announcement from the authenticated device, and redistributes the service announcement into the computer network only when the service announcement from the authenticated device is an authentic service announcement.

Restricting fake multicast service announcements

In one embodiment, a method comprises generating, by a network device in a network, a Bloom filter bit vector representing services provided by service provider devices in the network; and the network device executing a service discovery operation based on identifying, relative to the Bloom filter bit vector, whether an identified service in a received message is executed in the network.

Service discovery optimization in a network based on bloom filter

In one embodiment, a sleep proxy device identifies one or more services offered by a first node in the network. The sleep proxy device announces the one or more identified services to a second node in the network on behalf of the first node. The sleep proxy device intercepts an attempt by the second node to use the one or more services offered by the first node. The sleep proxy device causes the first node to switch from a low power state to an awake state, based on the intercepted attempt.

Growing community of inventors

Milpitas, CA, United States of America

Selvaraj Mani