Cisco Technology, Inc.

Future Wei Technologies, Inc.

Dell Products Inc.

Shree N Murthy

Robert Andrews

Jerome Henry

Carlos M Pignataro

Nagendra Kumar Nainar

Srinath Gundavelli

Sudhir Kumar Jain

Sanjay Kumar Hooda

Navindra Yadav

Gnanaprakasam Pandian

Shyamsundar Nandkishor Maniyar

Jie Cheng Jiang

Sri Gundavelli

Vrushali Ashtaputre

Johnson Leong

Mark Grayson

Jun Xu

Brian Eliot Weis

Malcolm Muir Smith

Indermeet Singh Gandhi

Pradeep Kumar Kathail

Stephen Michael Orr

Akshay Sunil Dorwat

Sonal Prem Kumar Chhabria

Anand K Oswal

Kenneth Durazzo

Rajesh S Pazhyannur

Vimal Srivastava

Domenico Ficara

Arun G Khanna

Amine Choukir

Roberto Muccifora

Vijayaraghavan Doraiswami

Ian Foo

Kedar Krishnanand Gaonkar

Roberto Mitsuo Kobo

Ravikumar Sivasankar

Murali Duvvury

Kannan Narayanan

Sudhakar Padavala

David A McGrew

Rajiv Asati

Louis Gwyn Samuel

David Sheldon Stephenson

Vinay Sawal

Allan Thomson

Prakash C Jain

Bart A Brinckman

Abhay Kumar Roy

Mohamed Khalid

Subhasri Dhesikan

Oliver James Bull

Peter Geoffrey Jones

Pauline Shuen

Vivek Dharmadhikari

Sangram Kishore Lakkaraju

Karthik Krishnamurthy

Suresh Katukam

Anirban Karmakar

Kavitha Kamarthy

Einar Nilsen-Nygaard

Sunil Cherukuri

Ugo Mario Campiglio

Pugalendran Rajendran

Thomas Vegas

Rajagopal Venkatraman

Scott Thomas Fanning

Andrew Persaud

Pradeep S Sudame

Parthiv Shah

Timothy Thinh Mai

Zheng Li

Mirko Raca

Thirunavukkarasu Suresh

Antonio Trifilo

Maria Carpen Amarie

Sonal Chhabria

Gopala Krishna Andagunda

Nalin Mistry

Stephen Collen

Ashwin Kumar Jayaraman

Group identity assignment and policy enforcement may be provided. A User Defined Network Identifier (UDN ID) defining a group of client devices may be received. Next, a client identifier (ID) associated with a source client device that is associated with the group of client devices may be received. The UDN ID and the client ID may be encoded in an Extended Local Identifier (ELI) Media Access Control (MAC) address associated with the source client device. A source MAC address of a packet received from the source client device may then be substituted with the ELI MAC address. Then the packet may be forwarded.

Group identity assignment and policy enforcement for devices within the same network

Methods are provided that support media access control (MAC) address rotation (RCM) by generating a passcode for associating a user defined network by one or more endpoint devices instead of using MAC addresses for their respective device identity. In these methods, a computing device obtains a registration request for establishing a user defined network (UDN) and generates a unique UDN identifier and a unique passcode associated with the unique UDN identifier. The unique passcode enables an authentication of one or more endpoint devices to connect to the UDN. The authentication is independent of the MAC address of a respective endpoint device. The computing device provides the UDN identifier and the unique passcode such that the UDN identifier and the unique passcode are for connecting the one or more endpoint devices to the UDN.

User defined network access that supports address rotation

A method is provided to anonymize the media access control (MAC) address of a client device. The method involves generating a plurality of media access control (MAC) addresses for use by a client device in a network. Policies are defined that determine which one of the plurality of MAC addresses is to be used by the client device. The plurality of MAC addresses allocated for use by the client device are registered with a management entity in the network.

Media access control (MAC) address anonymization based on allocations by network controller elements

In one embodiment, dynamic user private networks are virtually segmented within a shared virtual network. A network control system maintains the dynamic logical segmentation of the shared virtual network. User entities (e.g., user devices and/or services) are communicatively coupled to respective personal virtual networks via endpoints of access devices. Each of these endpoints is associated with a corresponding user private network. Responsive in real-time to automated processing of a received electronic particular user request, the network control system automatically modifies the dynamic logical segmentation of the shared virtual network to move a particular user entity on the shared virtual network to newly being on the first dynamic user private network without being disconnected from the shared virtual network. One embodiment uses different user private network identifiers (UPN-IDs) associated with endpoints and received packets to identify their respective user private network.

Dynamic user private networks of a shared virtual network

Aspects described herein include a method of automated grouping of client devices for a user-defined network (UDN). The method includes receiving, from a client device an authentication request to join an access provider network. The authentication request includes a unique identifier of the client device for a federation-based network. The method further includes transmitting the unique identifier to a UDN cloud, transmitting the authentication request to an identity provider, and receiving, responsive to the identity provider authenticating the authentication request, a list of one or more UDNs from the UDN cloud that are associated with the unique identifier. The method further includes joining the client device with one or more other client devices present on the access provider network listing a same UDN.

Onboarding client device to user-defined network using federation-based network identity

Techniques for authenticating and enforcing differentiated policies for a virtual machine (VM) executing in bridge mode on a wireless host device in a media access control (MAC)-based authentication network are described. In an example method a wireless host device is authorized to join a fabric enabled wireless network. A VM executes in bridge mode on the wireless host device. At the fabric edge, a source MAC address of the VM is determined. A session is created between the VM and an authentication server. The VM is authenticated. A policy for the VM is determined. A source internet protocol (IP) address is assigned to the VM to create a MAC-IP binding. A data-plane device in the fabric enabled wireless network is programmed to apply the policy to traffic communicated with the VM. Finally, the data-plane device applies the policy for the VM based at least in part on the MAC-IP binding.

Authentication and enforcement of differentiated policies for a bridge mode virtual machine behind a wireless host in a MAC-based authentication network

Techniques for analyzing traffic originating from a host device in a wireless network to identify one or more virtual machines (VMs) running on the host device and connected to the network via the host device in bridge mode. When a VM is created in bridge mode behind a host device, the traffic originated by the VM will have the source Media Access Layer (MAC) address of the host device. According to techniques described herein, devices and/or components associated with the network may profile the traffic to identify an address of the VM, such as by analyzing dynamic host configuration protocol (DHCP) packets to determine the Internet Protocol (IP) address of the VM. Once the IP address and the MAC address of the VM is known, the components and/or devices may apply security policies to the VM that may be different than security policies applied to the host device.

Security policy enforcement for resources in bridge mode

A network management center includes a Dynamic Host Configuration Protocol (DHCP) server. The network management center obtains from an identity server, client information indicating authentication of a client device in a wireless network that is connected to a network fabric. The network management center obtains from an edge node in the network fabric an Internet Protocol (IP) address request for the client device. The IP address request including a fabric domain identifier associated with the edge node. The network management center allocates an IP address for the client device based on the client information obtained from the identity server and the fabric domain identifier contained in the IP address request obtained from the edge node. The network management center provides to the edge node an Identifier Locator Addressing (ILA) address based on the IP address.

Identifier locator addressing for IPV6-based software defined fabric

Certain embodiments disclose systems and methods for creating a user private network (UPN) based on 11ay technology. Methods of the present disclosure include creating a personal basic service set (PBSS) having a service device and one or more 11ay devices, the service device configured to wirelessly communicate with the one or more 11ay devices in the PBSS, creating a UPN having an access point located in communicative proximity with the service device, and associating at least one 11ay device of the one or more 11ay devices with the UPN, wherein the at least one 11ay device is configured to establish a wireless connection with the one or more 11ay devices using the service device when within a coverage area of the PBSS, and to establish a wireless connection with the one or more 11ay devices using the access point when outside the coverage area of the PBSS.

Creating a user private network based on 802.11ay Wi-Fi technology

This disclosure describes techniques for selecting network protocols using heatmaps. For instance, a system may receive radio frequency information from one or more sources located within an environment. The system may then generate heatmaps using the radio frequency information, where the heatmaps represent characteristics associated with different network protocols. The characteristics may include signal strengths, throughputs, data packet drop rates, data packet retry rates, and/or the like for various locations within the environment. A user device may then receive the heatmaps from the system. Using a location of the user device and the heatmaps, the user device may determine to communicate using a network protocol from the different network protocols. The user device may then establish a connection using the network protocol.

Techniques for selecting network protocols

Embodiments are presented for collaborative device address generation between a wireless client device and a network infrastructure component, such as a wireless access point. The wireless client device and network infrastructure component share information to facilitate collaborative generation of a sequence of device addresses. This shared information includes, in some embodiments, key information and moving factor information. The key information and moving factor information is used to generate a token. A sequence of tokens is generated by updating the moving factor as each token is generated. A corresponding sequence of device addresses are then derived based on the sequence of tokens. Since the wireless client device and the network infrastructure device apply equivalent methods to generate respective sequences of addresses, the network infrastructure is able to efficiently identify a source wireless client device when observing a new device address on a wireless network.

Collaborative device address rotation

Methods for extending cell broadcast notifications to various access technologies and enterprise communication infrastructure. A method includes obtaining, by a controller, a cellular broadcast message of a public warning system and identifying, by the controller, at least one network entity, from among a plurality of network entities operating in a private radio network, based on the at least one network entity being within a location area specified in the cellular broadcast message. The method further includes providing, by the controller to the at least one network entity, the cellular broadcast message.

Extending cell broadcast notification to other communication technologies

Growing community of inventors

San Jose, CA, United States of America

Shree N Murthy