Cisco Technology, Inc.

Shrirang Arvind Bage

Anantha Ramaiah

Amol Khare

Mitesh Dalal

Keyur Patel

Shwetha Subray Bhandari

Lin Han

Swapna Yelamanchi

Selvaraj Mani

Rakesh Reddy Kandula

Amarender R Musku

Deep Preet Singh

John C Wong

In one embodiment, a sleep proxy device identifies one or more services offered by a first node in the network. The sleep proxy device announces the one or more identified services to a second node in the network on behalf of the first node. The sleep proxy device intercepts an attempt by the second node to use the one or more services offered by the first node. The sleep proxy device causes the first node to switch from a low power state to an awake state, based on the intercepted attempt.

Intelligent network sleep proxy for low power sleeping devices

A method and non-transitory computer-readable medium are disclosed for extending a hold timer that binds an application-layer session when a transport-layer out-of-order message queue includes an out-of-order message for the application-layer session. An application receives an application-layer message from transport protocol logic that is configured to deliver in-order application-layer messages to the application. The received application-layer message is a next in-order application-layer message for an application-layer session that is bound by a hold timer. After an amount time has passed, the application detects an expiration of the hold timer. In response, rather than immediately tearing down the application-layer session, the application inspects an out-of-order queue of the transport protocol logic. The hold timer is extended when the out-of-order queue includes an out-of-order application-layer message for the application-layer session. In one aspect, the transport protocol logic includes an application programming interface that provides the application with access to the out-of-order queue.

Extending application-layer sessions based on out-of-order messages

Approaches for preventing TCP RST attacks intended to cause denial of service in packet-switched networks are disclosed. In one approach, upon receiving a TCP RST packet, an endpoint node determines whether the TCP segment contains valid authentication information. The TCP RST segment is accepted and the TCP connection is closed only when the authentication information is valid. Authentication information may comprise a reset type values, and either initial sequence numbers of both endpoints, or a copy of a TCP header and options values previously sent by the endpoint node that is performing the authentication. Thus, attacks are thwarted because an attacker cannot know or reasonably guess the required authentication information.

Preventing network reset denial of service attacks using embedded authentication information

Approaches are disclosed for switching transport protocol connection keys. A method of automatically changing a message authentication key at each of two endpoints of a connection in a telecommunications network comprises testing a sequence value received in each of a plurality of data segments on the connection; and selecting a next message authentication key, from among a plurality of stored message authentication keys, for use in authenticating subsequently received data segments, when the sequence value matches a specified characteristic.

Approaches for automatically switching message authentication keys

Growing community of inventors

Fremont, CA, United States of America

Shrirang Arvind Bage