Cisco Technology, Inc.

Srinath Gundavelli

Vimal Srivastava

Mark Grayson

Indermeet Singh Gandhi

Timothy Peter Stammers

Sangram Kishore Lakkaraju

Sudhir Kumar Jain

Pradeep Kumar Kathail

Shree N Murthy

Kent Kinchu Leung

Louis Gwyn Samuel

Oliver James Bull

Aeneas Sean Dodd-Noble

Brian Eliot Weis

Abhishek Dhammawat

Ravi Kiran Guntupalli

Rajesh S Pazhyannur

Arun G Khanna

Fabio Rodolfo Maino

Alberto Rodriguez Natal

Bart A Brinckman

Abhijit Kumar Choudhury

Rohit Kumar Suri

Bhavannarayana Nelakanti

Venkatesh Kanagasabapathy

Dhananjay Shrikrishna Patki

Pascal Thubert

Jerome Henry

Carlos M Pignataro

Nagendra Kumar Nainar

Alpesh S Patel

Malcolm Muir Smith

John Martin Graybeal

Vojislav Vucetic

Mahesh Satyanarayana

Kirk McBean

Vivek Pise

Eric Michel Levy-Abegnoli

Anand K Oswal

Frank Brockners

Flemming Andreasen

David A Maluf

Mickael James Graham

Anal Srivastava

Sachin G Gorde

Nalini Sankaranarayanan

Ramachandra Srinivasa Murthy

Shwetang Sureshkumar Acharya

Raghavendra Kankanhalli Sudheendra

Rajaguru Veluchamy

Nandini Ganesh

Patrick Wetterwald

Ali Sajassi

Eric Albin Voit

Daniel George Wing

Sanjay Kumar

Robert Michael Batz

Ian McDowell Campbell

Rajeev Koodli

Irfan Ali

Stephen Michael Orr

Ali C Begen

Warren Scott Wainner

Arun C Alex

Rajesh P Velandy

Gaetan Feige

Steve W Wood

Wenxing Zheng

Rakesh Sai Srirambhatla

Jason D Dachtler

Jason G Dachtler

Chinari Santosh Kumar Patra

David McNamee

Paulina Dung Tran

Sonal Chhabria

Techniques for using Network Address Translation (NAT), Mobile Internet Protocol (MIP), and/or other techniques in conjunction with Domain Name System (DNS) to anonymize server-side addresses in data communications. Rather than having DNS provide a client device with an IP address of an endpoint device, such as a server, the DNS instead returns a random IP address that is mapped to the client device and the endpoint device. In this way, IP addresses of servers are obfuscated by a random IP address that cannot be used to identify the endpoint device or service. The client device may then communicate data packets to the server using the random IP address as the destination address, and a gateway that works in conjunction with DNS can convert the random IP address to the actual IP address of the server using NAT and forward the data packet onto the server.

Randomizing server-side addresses

In one embodiment, an apparatus comprising networking circuitry adapted to receive, at a mobile network operated by an SP, flows associated with enterprise applications executing on device(s) in an enterprise network, the device(s) including a CPE and/or one or more devices behind the CPE, and processing circuitry adapted to vary, during a duration in which there is IP connectivity between the CPE and the mobile network, a pool of dedicated bearers for binding the flows, in response to at least part of changes occurring during the duration with respect to the flows, wherein the changes include variations during the duration in number of the flows and/or differences during the duration in detected characteristics of the flows, the detected characteristics of the flows having been detected based on inspection of respective packet(s) of the flows, and bind at least part of the flows to respective dedicated bearers included in the pool.

Adaptive quality of service for enterprise traffic

Techniques are provided for operator specific customization of a network service configuration. In some embodiments, an operator defines a mapping between an application executing on a user equipment (UE) and a network service configuration. In some embodiments, the network service configuration indicates whether the application is to be supported via a UPF instance located within the core network or deployed at a network edge. The mapping is then provided to the UE, and passed back to the core network, for example, when the UE establishes a connection on behalf of the UE application. The core network then supports the UE application consistent with the configuration specified by the mapping.

Techniques for binding operator-defined network service configurations to applications

A user plane function (UPF) node may receive a packet for traffic associated with a user equipment (UE). During packet classification, the UPF node may identify that a packet filter for the packet is not found in a packet filter set of an existing Quality of Service (QoS) Flow. In response, the UPF node may configure the packet filter in the packet filter set of the QoS Flow based on a flow tuple of the packet. The UPF node may send, to a control plane function node, a message which indicates a request for adding the flow tuple to the QoS Flow. The message may be for triggering communication of a message which indicates a session modification command for receipt by the UE, for adding an uplink packet filter that is based on the flow tuple for the QoS Flow.

Packet flow management for quality of service (QoS) flows in a private 5G network

Techniques for network communications are disclosed. These techniques include receiving a cryptographically generated device identifier (CGDI) and a public key relating to a wireless station (STA). The techniques further include determining a first hash based on decrypting the CGDI using the public key, and validating the first hash for an access network. The techniques further include identifying the STA in the access network using the CGDI based on binding the CGDI to a session associated with the STA and the access network.

Cryptographically generated device identifiers

Presented herein are techniques to facilitate delivering standalone non-public network (SNPN) credentials from an enterprise authentication server to a user equipment (UE) using an Extensible Authentication Protocol (EAP) process. In one example, a method may include determining, by an authentication server of an enterprise, that a UE for the enterprise is to receive credentials to enable the UE to connect to a SNPN of the enterprise in which the determining is performed based, at least in part, on connection of the UE to an access network that is different than the SNPN for the enterprise; and performing an authentication process with the UE by the authentication server in which the authentication process includes providing the credentials to the UE via a first authentication message and obtaining confirmation from the UE via a second authentication message that indicates successful provisioning of the credentials for the UE.

Delivering standalone non-public network (SNPN) credentials from an enterprise authentication server to a user equipment over extensible authentication protocol (EAP)

Presented herein are techniques to provide an operator-encrypted application specific user equipment (UE) route selection policy (URSP) to a UE via different network elements and/or distribution techniques. In one example, a method may include obtaining, by a network element, a policy object from a policy function of a mobile network operated by a mobile network operator, wherein the policy object comprises an application specific user equipment route selection policy (URSP) for an application in which the application specific URSP is encrypted by the policy function; and providing, by the network element, the policy object to a user equipment that has at least one session established with the mobile network, wherein the user equipment is to decrypt the application specific URSP to facilitate network communications for the application via the user equipment.

Providing an operator-encrypted partial user equipment route selection policy to user equipment

Presented herein are techniques to facilitate fast roaming between a mobile network operator-public (MNO-public) wireless wide area (WWA) access network and an enterprise private WWA access network. In one example, a method is provided that may include generating, by an authentication node, authentication material for a user equipment (UE) based on the UE being connected to a public WWA access network, wherein the public WWA access network is associated with a mobile network operator, and the authentication node and the UE are associated with an enterprise entity; obtaining, by the authentication node, an indication that the UE is attempting to access a private WWA access network associated with the enterprise entity; and providing, by the authentication node, the authentication material for the UE, wherein the authentication material facilitates connection establishment between the UE and the private WWA access network.

Techniques to facilitate fast roaming between a mobile network operator public wireless wide area access network and an enterprise private wireless wide area access network

Presented herein are techniques to facilitate providing slice attribute information to a user equipment (UE) for one or more slice types with which the user equipment is allowed to establish one or more session(s). In one example, a method may include obtaining, by a network element, a registration request for connection of a UE to a mobile network; performing an authentication for connection of the UE to the mobile network; and upon successful authentication, providing, by the network element, a registration response to the UE, wherein the registration response identifies one or more network slice types with which the UE is authorized to establish a session and the registration response identifies one of: attribute information for each of the one or more network slice types or network location information from which attribute information for each of the one or more network slice types is to be obtained.

Providing slice attribute information to user equipment in a mobile network environment

A Radio Access Network (RAN) element provides an internet indication to a User Equipment (UE) to enable the UE to quickly obtain internet access. The RAN element determines that the RAN element is connected to at least one gateway that provides public internet access, and broadcasts an internet indication. The RAN element determines that the UE has requested public internet access via the RAN element and provides the UE with public internet access.

Internet access indication in private LTE networks and neutral host networks

A method is provided to anonymize the media access control (MAC) address of a client device. The method involves generating a plurality of media access control (MAC) addresses for use by a client device in a network. Policies are defined that determine which one of the plurality of MAC addresses is to be used by the client device. The plurality of MAC addresses allocated for use by the client device are registered with a management entity in the network.

Media access control (MAC) address anonymization based on allocations by network controller elements

This disclosure describes techniques for performing multi-factor authentication (MFA) by utilizing user generated authenticating gestures. The techniques may include establishing and monitoring peer-to-peer communication links between user devices. The techniques may include monitoring channel properties for fluctuations in the channel properties associated with the user generated authenticating gesture passing through signals of the communication links. The techniques may further include comparing a gesture performed by a user to a predefined authenticating gesture. The techniques may include determining a pattern of fluctuations in the channel properties associated with the predefined authenticating gesture. The techniques may include determining a confidence score associated with comparing the gesture performed and the predefined authenticating gesture. The techniques may further include determining a proximity of the user and/or the gesture to the user device. The techniques may further include granting or denying the user based at least in part on the proximity and/or the comparison.

Multi-factor authentication using gestures

Adaptive transition between an inactive state and an idle state may be provided. An end node device may be configured with an end node device upper threshold. Next, it may be determined that that client devices are inactive preferred. Then the client devices determined to be inactive preferred may be assigned to a Radio Resource Control (RRC) inactive state and to the end node device. One or more of the client devices previously assigned to the RRC inactive state may be assigned to an RRC idle state and to an intermediate device until a number of the client devices assigned to the end node device is less than or equal to the end node device upper threshold.

Providing adaptive transition between an inactive state and an idle state

Presented herein are techniques to provide a network-initiated group disconnect for wireless devices belonging to one or more device group(s). In one example, a method may include determining, by a control element of a network, that at least one device group is to be disconnected from the network, wherein the at least one device group comprises a plurality of wireless devices connected to the network; identifying one or more access network radios through which the plurality of wireless devices are connected to the network; and triggering a disconnect command for the at least one device group to be broadcast from each of the one or more access network radios to trigger the plurality of wireless devices to disconnect from the network.

Network-initiated group disconnect for wireless devices

Presented herein are techniques to facilitate wireless wide area (WWA) virtualized Radio Access Network (vRAN) (e.g., 5G) to wireless local area (WLA) RAN (e.g., Wi-Fi) steering or WLA RAN to WWA vRAN steering for one or more UE. In one example, a method may include obtaining first performance metrics associated with links of a WWA vRAN (e.g., fronthaul, midhaul, and backhaul links); obtaining second performance metrics associated with links WLA RAN (e.g., backhaul links); and in response to determining that one of the WWA vRAN is experiencing degraded performance based on the first performance metrics or the WLA RAN the second performance metrics, activating a steering event that causes, at least in part, an indication to be communicated to a UE to cause the UE to connect to the WWA vRAN or the WLA RAN that is not experiencing degraded performance.

User equipment steering across a wireless wide area disaggregated virtualized radio access network and a wireless local area radio access network

Growing community of inventors

San Jose, CA, United States of America

Srinath Gundavelli