Cisco Technology, Inc.

Thomas Szigeti

David John Zacks

Jerome Henry

Walter Theodore Hulick, Jr

Carlos M Pignataro

Robert E Barton

Robert Edgar Barton

Nagendra Kumar Nainar

Akram Ismail Sheriff

Frank Michaud

Guy Keinan

Peter Geoffrey Jones

Darryl E Sladden

Walter Hulick

Malcolm Muir Smith

Maik Guenter Seewald

Anoop Vetteth

Brian C Powell

Roland Arthur Saville

Hans F Ashlock

Vikram Vikas Pendharkar

Ruben Gerald Lobo

Alan Robert Lynn

Rachana A Soni

Stefano Giorcelli

Laurent Jean Charles Hausermann

Hemamalini Subash

Daniel R Behrens

Zsolt Varga

Shannon McFarland

Peter Turi

Hanoch Haim

Gonzalo A Salgueiro

Sudhir Kumar Jain

Sebastian Jeuk

David Tedaldi

Hazim Hashim Dahir

Prakash Kaligotla

Tal Maoz

David Hanes

Jeff Apcar

Andrew Pletcher

Jon Michael Snyder

Daniel Eckstein

Prapanch Ramamoorthy

Shawn Michael Wargo

Mark Montanez

Gangadharan Byju Pulanikkal

Oliver Boehmer

Vikram Vikas Pendhar

Tzahi Peleg

Praveen T Chandra

David J Zacks

Techniques are described herein for dynamic service extension to provide risk mitigation upon detecting a threat. In embodiments, such techniques may be performed by a service provider platform and may comprise receiving information about a security threat, identifying one or more components susceptible to the security threat, determining, based on a software bill of materials, at least one data flow that includes a point of delivery (pod) associated with the one or more components, identifying at least one additional service determined to mitigate the security threat, and implementing the at least one additional service in relation to the at least one data flow.

Dynamic security service extension based on software bill of materials

This disclosure describes techniques for providing information associated with an inter-cluster segment. For instance, system(s) may determine dependencies for first services associated with a first cluster and second dependencies for second services associated with a second cluster. The system(s) may then determine information for interconnections between the first cluster and the second cluster. The information may include at least dependencies for third services included in the inter-cluster segment and/or performance information for the third services. The system(s) may then generate a user interface that includes the first dependencies for the first services, the second dependencies for the second services, and the information for the inter-cluster segment. This way, a user is able to use the user interface to identify both problems occurring within the clusters and/or problems that are caused by the third services in the inter-cluster segment.

Techniques for providing inter-cluster dependencies

Methods are provided in which a domain name system (DNS) service obtains a lookup request for information about a source of a traffic flow being transmitted to a network resource external of a service cluster and performs, based on the lookup request, a lookup operation for a microservice that is the source of the traffic flow, among a plurality of microservices of the service cluster registered with the DNS service. The methods further include providing information about the microservice based on the lookup operation. The information includes at least a name of the microservice for visibility of the microservice external of the service cluster.

Microservice visibility and control

This disclosure describes techniques for redirecting data traffic based on endpoint risk. An example method includes determining a risk associated with a first endpoint connected to a redirection point; determining that the risk exceeds a threshold; and based on determining that the risk exceeds the threshold, causing the redirection point to direct data traffic to a second endpoint and to refrain from directing the data traffic to the first endpoint.

Redirecting data traffic to endpoints based on risk

In one embodiment, an agent executed by a device intercepts webpage code for a website sent from an application server to a client of the website. The agent identifies a portion of the webpage code as being used for webpage analytics. The agent forms modified webpage code by disabling the portion of the webpage code, based on one or more performance metrics associated with the website. The agent sends the modified webpage code to the client of the website.

Dynamic web content management system

Provided herein are techniques to facilitate enhanced cloud access security broker (CASB) functionality via in-band application observability in which a CASB can be implemented in-line between the client device and an embedded application security service. In one instance, a method may include, obtaining, by a CASB from a client device, a first message for an application transaction involving an application operating via the client device. The first message can be augmented to include first security metadata and can be forwarded to trigger one or more actions by an embedded application security service associated with the application. The CASB may obtain a second message from the embedded application security service that includes second security metadata, and one or more actions can be triggered at the CASB based, at least in part, on the second security metadata included in the second message.

Enhanced cloud access security broker functionality utilizing in-band application observability

Method for application control and Quality of Service (QoS) handling may be provided. A request may be received for scheduling a communication between an Access Point (AP) and a user device for sending data of an application. It may be determined that the request does not comprise network characteristics of the application. In response to determining that the request does not comprise the network characteristics of the application, the network characteristics may be requested from a Wireless Local Area Network (WLAN) controller. The network characteristics may be received from the WLAN controller. Schedules for the application may be determined based on the network characteristics. The schedules may be enabled.

Method for application control and adaptive quality of service (QoS) handling

In an embodiment, a device controller determines a deliberate change to be made within a network, and generates a profile of a behavioral update that an analytics engine should expect to see based on the deliberate change. The device controller then transmits, to the analytics engine, the profile of the behavioral update to cause the analytics engine to proactively expect the behavioral update in response to the deliberate change.

Intelligent closed-loop device profiling for proactive behavioral expectations

In one embodiment, a service determines authentication credentials for a web application transaction. The service determines one or more performance metrics regarding the web application transaction. The service generates an enhanced web token comprising the one or more performance metrics regarding the web application transaction. The service sends the enhanced web token and the authentication credentials along a path of the web application transaction, the path including one or more services configured to use the one or more performance metrics sent in addition to the authentication credentials to process the web application transaction.

Web tokens for enhanced microservice observability

According to one or more embodiments of the disclosure, the techniques herein are directed toward a dynamic transaction-aware web application authentication using call intercepts. In one embodiment, a method comprises: intercepting, by a monitoring process, calls made for transactions within an executing application; determining, by the monitoring process, whether a particular intercepted call triggers an enhanced user authentication requirement for a particular transaction; initiating, by the monitoring process in response to the particular intercepted call triggering the enhanced user authentication requirement, a corresponding challenge to adequately authenticate a user for the particular transaction; and allowing, by the monitoring process, the particular intercepted call to proceed for the particular transaction in response to an adequately authenticated user for the particular transaction.

Dynamic transaction-aware web application authentication using call intercepts

In one embodiment, a device obtains testing parameters used by a plurality of agents in a network to perform testing with respect to an online application. The device identifies overlapping parameters among the testing parameters and generates a consolidated set of testing parameters for the overlapping parameters. The device configures the plurality of agents such that a singular testing agent performs testing with respect to the online application using the consolidated set of testing parameters instead of multiple testing agents performing testing with respect to the online application using the overlapping parameters.

Cloud native observability migration and assessment

Methods are provided to perform a name resolution triggered monitoring agent selection for full stack observability. The methods involve obtaining a name resolution request for an enterprise service to be accessed by an endpoint device. A plurality of service instances are configured to provide the enterprise service. The methods further involve determining, based on the name resolution request, a monitoring agent from a plurality of monitoring agents of a monitoring service that monitors performance of the enterprise service and selecting a service instance, from the plurality of service instances, that is associated with the monitoring agent in a name resolution record. The methods further involve providing, to the endpoint device, location information for accessing the service instance and provisioning the monitoring agent to monitor the performance of the enterprise service executed by the service instance for the endpoint device.

Name resolution triggered monitoring agent selection

In one embodiment, a device instruments an application to generate OpenTelemetry trace data during execution of the application. The device identifies, based on where the application was instrumented, a particular method of the application. The device determines that a circuit breaker is to be inserted for the particular method of the application. The device inserts a circuit breaker for the particular method.

OpenTelemetry-based circuit breaker automation

Techniques for expressing, communicating, de-conflicting, and enforcing consistent access policies between an IBN architecture and a Cloud-Native architecture. Generally, network administrators and/or users of a Cloud-Native architecture and an IBN architecture express access policies independently for the two different domains or architectures. According to the techniques described herein, a Network Service Endpoint (NSE) of the Cloud-Native architecture may exchange access policies with a network device of the IBN architecture. After exchanging access policies, conflicts between the sets of access policies may be identified, such as differences between allowing or denying communications between microservices and/or applications. The conflicts may be de-conflicted using various types of heuristics or rules, such as always selecting an access policy of the IBN architecture when conflicts arise. After the access policies have been de-conflicted, the IBN architecture and Cloud-Native architecture may then apply consistent access policies for traffic and communications in their respective network architectures.

Resolving access policies between intent-based network architectures and cloud native architectures

Disclosed are methods, systems, and non-transitory computer-readable media for utilizes a collaboration application to provide data beneficial to the authentication of the user. The present application discloses receiving at least one item of personal identifying information for a user from a primary multi-factor authentication device. The present application further discloses receiving at least one item of personal identifying information for a user from a conferencing service in which the user is engaged in a conference. The present application also discloses determining whether to authenticate the user based on the items of personal identifying information from the primary multi-factor authentication device and from the conferencing service.

Collaboration application integration for user-identity verification

Growing community of inventors

Vancouver, Canada

Thomas Szigeti