Cisco Technology, Inc.

Stephen Michael Orr

Jerome Henry

Robert E Barton

Robert Edgar Barton

Malcolm Muir Smith

Craig Thomas Hill

Michael Alan Kowal

Scott A Morrison

Brian Donald Hart

Domenico Ficara

Shree N Murthy

Amine Choukir

Roberto Muccifora

Ugo Mario Campiglio

Aaron Troy Woland

Peiman Amini

Srinath Gundavelli

Santosh Ghanshyam Pandey

Juan Carlos Zuniga

Sudhir Kumar Jain

Adam J O'Donnell

Anthony H Grieco

Sachin Dinkar Wakudkar

Vivek Santuka

Binh Don Ha

Venkataprasad Chirreddy

Kapildeep Singh Bakshi

Steven M Carter

Raymond Allan Blair

Gerard Ian McGarry

Catalina Kowal

Group identity assignment and policy enforcement may be provided. A User Defined Network Identifier (UDN ID) defining a group of client devices may be received. Next, a client identifier (ID) associated with a source client device that is associated with the group of client devices may be received. The UDN ID and the client ID may be encoded in an Extended Local Identifier (ELI) Media Access Control (MAC) address associated with the source client device. A source MAC address of a packet received from the source client device may then be substituted with the ELI MAC address. Then the packet may be forwarded.

Group identity assignment and policy enforcement for devices within the same network

Fine Time Measurement (FTM) Location Configuration Information (LCI) protection and, specifically, FTM LCI protection with authentication and selective client enablement may be provided. To perform FTM LCI protection, a controller may first obtain a key-pair including a public key and a private key from a Certificate Authority (CA). The controller my determine a venue location where an Access Point (AP) is located. The controller may send a Certificate Signing Request (CSR) with the venue location to the CA. In response to sending the CSR, the controller may receive a public key certificate from the CA, wherein the public key certificate includes the venue location. The AP may receive a request for Location Configuration Information (LCI) from a Station (STA), wherein the LCI includes an AP location. The AP creates a hash of LCI of the AP using the private key and sends the LCI and the hash to the STA.

Fine time measurement location configuration information protection

Methods are provided to determine validity of a MAC address. The methods involve obtaining a media access control (MAC) address validity message that indicates a plurality of valid MAC addresses in the wireless network using a fully-exploded format or a probabilistic data structure and determining whether a MAC address is valid based on the MAC address validity message. Other methods involve obtaining a query regarding a validity of a media access control (MAC) address, determining whether the MAC address is a value included in a data set of expected values of a probabilistic data structure. The data set represents a list of MAC addresses. The other methods involve determining whether the MAC address is valid in the wireless network based on determining whether the MAC address is the value included in the data set and providing a response indicating whether the MAC address is valid.

Preventing abuse of media access control addresses by rogue devices

A method comprising: at a multi-link device (MLD) configured for multi-link operation: establishing a first Internet Protocol (IP) stack of a first IP type and configured with a first IP address of the first IP type, wherein the first IP stack is associated to a first MLD media access control (MAC) address of a first station of the MLD; establishing a second IP stack of a second IP type and configured with a second IP address of the second IP type, wherein the second IP stack exists concurrently with the first IP stack and is associated to a second MLD MAC address of a second station of the MLD; and exchanging, with a peer MLD, IP traffic using one or more of (i) the first IP stack and the first MLD MAC address, and (ii) the second IP stack and the second MLD MAC address.

Seamless MAC address rotation in multi-link device using multiple IP stacks

Backscatter Device (BKD) onboarding may be provided. BKD onboarding may begin with an AP receiving an identifier associated with a BKD. The AP may determine to onboard the BKD and transmit to the BKD an onboarding excitation signal to request data from a memory bank of the BKD. The AP may then receive a response to the onboarding excitation signal from the BKD. The AP may verify the BKD is valid based on the identifier and the response. Finally, the AP may onboard the BKD based on verifying the BKD is valid.

Backscatter device onboarding

A client device may receive, from a computing device, a message indicating that a session duration of a current session is nearly over. The client device may close the current session as soon as the client device is idle for more than a configurable interval. A new session may be started with the computing device by the client device.

Non-disruptive session timeout

Methods are provided that support media access control (MAC) address rotation (RCM) by generating a passcode for associating a user defined network by one or more endpoint devices instead of using MAC addresses for their respective device identity. In these methods, a computing device obtains a registration request for establishing a user defined network (UDN) and generates a unique UDN identifier and a unique passcode associated with the unique UDN identifier. The unique passcode enables an authentication of one or more endpoint devices to connect to the UDN. The authentication is independent of the MAC address of a respective endpoint device. The computing device provides the UDN identifier and the unique passcode such that the UDN identifier and the unique passcode are for connecting the one or more endpoint devices to the UDN.

User defined network access that supports address rotation

Techniques herein facilitate a device address rotation management protocol that may be implemented for a wireless local area network (WLAN), which can be used to influence when wireless client devices or stations may rotate their Media Access Control (MAC) addresses, how to perform such rotations, and/or the like. In one example, a method may include providing, by an access point (AP), a first communication indicating that the AP supports a MAC address rotation management protocol; obtaining, by the AP, a second communication from a wireless station (STA) indicating that the STA intends to perform a MAC address rotation; and transmitting, by the AP, a third communication to influence the MAC address rotation of the STA, the third communication comprising a rotation status indicator and timing information.

Device address rotation management protocol for a wireless local area network

Techniques for ensuring that geographic location specific security policies are enforce for an agent or agent device. An Agent service of an agent device accesses an Agent Authentication Service for a key to initiate one or more functions of the agent device. The Agent Authentication Service determines the location of the agent device and determines whether the agent device is within an approved geographic location based on geographic location specific security policies. If the agent device is within the approved geographic location, the Agent Authentication Services accesses a Key Management Service for a cryptographic key and delivers the cryptographic key to the Agent. If the Agent Authentication Service determines that the Agent device is outside of the approved location, access to the cryptographic key is denied.

Secure distribution of cryptographic keys and policy attributes based on geographic trusted location

Techniques herein facilitate policy-based wireless infrastructure-initiated device address rotations for wireless devices of a wireless local area network (WLAN). In one example, a method may include obtaining device information for a plurality of wireless devices connected to the wireless network infrastructure; associating a first wireless device of the plurality of wireless devices with a Media Access Control (MAC) address rotation policy based on device information obtained for the first wireless device; determining that a MAC address rotation is to be performed for the first wireless device based on the MAC address rotation policy; and triggering the MAC address rotation for the wireless device via the wireless network infrastructure.

Policy-based wireless infrastructure-initiated device address rotations for a wireless local area network

A method comprises, at a wireless network controller of wireless access points through which wireless client devices that are wireless communicate with the controller: upon receiving, from a wireless client device, a dynamic host configuration protocol (DHCP) request having a media access control (MAC) address, determining whether the wireless client device rotated its MAC address from a previous MAC address to the MAC address; when the wireless client device rotated its MAC address, forwarding, to a DHCP service, the DHCP request with a notification of a MAC address rotation to cause the DHCP service to reassign a previously assigned Internet Protocol (IP) address to the wireless client device; and upon receiving, from the DHCP service, a DHCP offer asserting the previously assigned IP address, forwarding the DHCP offer to the wireless client device.

Address rotation aware dynamic host control protocol

Techniques are provided for verifying Access Points (APs) using crowd sourcing. In one example, a STA establishes a first non-verified connection, based on security material, with a source AP in a wireless infrastructure. A target AP in a wireless infrastructure obtains an indication that the STA is attempting to establish a second non-verified connection with the target AP. In response, the target AP establishes the second non-verified connection based on the security material.

Access point verification using crowd-sourcing

A method is provided that is performed for a wireless network that includes one or more wireless client devices that may rotate their media access control (MAC) address used for wireless communication with one or more wireless access point devices in the wireless network. The method includes determining an impact of MAC address rotation by the one or more wireless client devices on operational resources of one or more networking devices or networking processes in a network infrastructure associated with the wireless network. The method further includes scheduling MAC address rotation by the one or more wireless client devices according to the impact on operational resources of the one or more networking devices or networking processes in the network infrastructure.

Central scheduling for enterprise wireless randomizing changing/rotating MAC address

Rotation of a wireless client device address is based on an encryption key and a nonce value. Key information and nonce value information are shared between a wireless client device and a network infrastructure component over a secure communication channel. The wireless client device encrypts the nonce value using the key information and encodes the encrypted value as a device address. The wireless client device then identifies itself via a source address value in a message transmitted over a wireless network. Upon receiving the message, the network infrastructure component decrypts information derived from the source address value and compares the resulting data to the nonce value. If a match is identified, the network infrastructure identifies the wireless client device as a source of the message. In some embodiments, the nonce value is updated with each rotation to provide for improved entropy of generated device addresses.

Growing community of inventors

Wallkill, NY, United States of America

Stephen Michael Orr