Cisco Technology, Inc.

Warren Scott Wainner

Brian Eliot Weis

Scott Roy Fluhrer

Kavitha Kamarthy

Sheela Dixit Rowles

Mohamed Khalid

Lewis Chen

David A McGrew

James Neil Guichard

Aeneas Sean Dodd-Noble

Paul M Quinn

Scott C Labrozzi

Stinson Samuel Mathai

Pratima Pramod Sethi

Mahesh Viveganandhan

Mahesh Vittal

Guan Deng

Jean-Philippe Vasseur

Srinath Gundavelli

Stefano Benedetto Previdi

Rajiv Asati

Hendrikus G P Bosch

Vimal Srivastava

Kevin Shatzkamer

Surendra M Kumar

Shuxian Lou

Giovanna Carofiglio

Luca Muscariello

Plamen Nedeltchev

Aamer Saeed Akhter

Doron Oz

Chandrasekar Krishnamurthy

Michael Lee Sullenberger

Khalil A Jabr

Haseeb Sarwar Niazi

Jordan Augé

Nir Ben-Dvora

Mahesh Chakravarthy Vittal Viveganandhan

Dinesh Ranjit

Scott Thomas Fanning

Sarel Altshuler

Tanya Roosta

Alistair H Woodman

Haseeb Naizi

John T Manville

Thomas C Redman

Scott Christopher Labrozzi

Viveganandhan Mahesh Vittal

In one example, an Access Point (AP) configures a first mapping of a first cellular network connection to a first local access network group, and further configures a second mapping of a second cellular network connection to a second local access network group. The AP determines whether a user device is authorized to use the first cellular network connection or the second cellular network connection. If the user device is authorized to use the first cellular network connection, the AP associates, for the user device, a first user device identifier with the first local access network group. If the user device is authorized to use the second cellular network connection, the AP associates, for the user device, a second user device identifier with the second local access network group.

Applying network policies on a per-user basis

A networked electronic device produces a data object comprising content and assigns a location-independent application-level name to the data object. The location-independent application-level name is independent of any network location at which the content is available. The networked electronic device maps the location-independent application-level name to an IP address, generates a DNS resource record specifying the mapping of the location-independent application-level name to the IP address, and provides the DNS resource record to a DNS network node.

Location-independent data-object name mapping

A source virtual private network (VPN) gateway supports a local source subnet and communicates over a wide area network (WAN) with a destination VPN gateway that supports a local destination subnet. The source VPN gateway receives from the local source subnet an Internet Protocol (IP) packet destined for the local destination subnet, determines a security association (SA) based on a source IP address and a destination IP address of the IP packet, and encapsulates the IP packet with tunnel encapsulation including a tunnel protocol header and a tunnel outer IP header, to produce a clear-text tunnel packet. The source VPN gateway encrypts the IP packet and the tunnel protocol header but not the tunnel outer IP header using an encryption key and a security parameter index for the SA, to produce an encrypted tunnel packet, and tunnels it to the destination VPN gateway over the WAN.

Encryption for gateway tunnel-based VPNs independent of wan transport addresses

Various techniques that allow group members to detect the use of stale encryption policy by other group members are disclosed. One method involves receiving a message from a first group member via a network. The message is received by a second group member. The method then detects that the first group member is not using a most recent policy update supplied by a key server, in response to information in the message. In response, a notification message can be sent from the second group member. The notification message indicates that at least one group member is not using the most recently policy update. The notification message can be sent to the key server or towards the first group member.

Detection of stale encryption policy by group members

A system and methods for providing dynamic transcoder rate adaption for an adaptive bit streaming function is described. In a first embodiment, a client may select from all available bit rates during the encoding session, wherein the bit rates are provided to the client via a manifest file from a media gateway. In a second embodiment, a subset of the bit rates are provided to the client, from which a client chooses a selected bit rate. The encoding session continues until a request for a new bit rate is received from the client, at which time a new subset of bit rates are generated. This new subset of bit rates is presented to the client, and this loop continues until the termination of the encoding session.

System and methods for dynamic transcoder rate adaption for adaptive bit rate streaming

A method is provided in one example embodiment and includes receiving at a node of a transitive IP network a data packet including a Network Services Header ('NSH'); accessing by the transitive IP network node context contained in the NSH, wherein the context may be used by the transitive IP network node to perform an enhanced network service in connection with the received data packet; performing by the transitive IP network node the enhanced network service in connection with the received data packet using the accessed context; and, subsequent to the performing, forwarding the received packet to a next node.

Authenticated group context in transitive IP network domains

A first virtual machine is established in a virtual private service chain to provide a first network service to virtual private service chain traffic. A second virtual machine is also established the virtual private service chain to provide a second network service to the virtual private service chain traffic. The virtual private service chain traffic is encrypted for transmission within the virtual private service chain from the first virtual machine to the second virtual machine, wherein the encryption uses a key shared by the first and second virtual machines.

End-to-end security for virtual private service chains

Techniques are presented for optimizing secure communications in a network. As disclosed herein, a key server is configured to provision a plurality of routers that are part of a virtual private network. The key server selects a counter value that is part of a security association and calculates a key value. The key server sends the key value, together with the security association, to the plurality of routers that are part of the virtual private network to enable them to exchange encrypted packets with each other in the virtual private network using the key value and the security association. The key server then increments the counter value to a value within a range of counter values capable of being predicted by the plurality of routers that received the key value.

Group member recovery techniques

A slave resource router may receive a client request. The slave resource router may be the nearest representation of an Anycast IP address in a network to a client sending the client request in the network. The slave resource router may then determine that the slave resource router has been authorized to cache content for a delivery service corresponding to the client request. Next, the slave resource router may determine that content corresponding to the client request is cached locally in a blind cache. Then the slave resource router may provide the client with the content from the blind cache.

Content distributed through blind-cache instantiation

A first customer edge network device receives an encapsulated packet that includes inner headers comprising source address information for a first service running on a first computing apparatus in a first home cloud and destination address information for a second service running on a second computing apparatus in a second home cloud. The customer edge network device inserts a predetermined portion of bits of a virtual domain identifier of the encapsulated packet into a label to form a virtual domain label for label-based routing. The virtual domain label is appended to the encapsulated packet. The encapsulated packet is sent to a first provider edge network device of a provider network. The first provider edge network device appends an virtual private network label to the encapsulated packet, and sends the encapsulated packet to a provider network device for label-based routing in the provider network.

Large scale residential cloud based application centric infrastructures

Techniques are presented herein for optimizing secure communications in a network. A router in a virtual private network determines whether or not it has successfully registered with a key server that provides cryptographic keys for routers in the virtual private network. The router stores state information that is indicative of whether or not the router has successfully registered with the key server.

Synchronizing a routing-plane and crypto-plane for routers in virtual private networks

Consistent with embodiments of the present invention, a system may be provided to provide per-subscriber stream management comprising: a client capable of receiving a playlist containing a subset of segments associated with a video asset; a video application server to request subscriber state information and to build state representations in a subscriber database on a per-subscriber basis; a media segmenter capable of providing the video asset in multiple bit rates; a subscriber state manager capable of managing the current state of one or more subscribers in a subscriber database; and a stream manager capable of requesting the assignment of bandwidth from a wireless infrastructure on a per-subscriber basis.

Unique subscriber states for adaptive stream management

System, method, and computer program product to perform an operation, the operation comprising capturing, at one or more peering routers, parameters for a plurality of data packets sent by a client device and specifying a destination network address, identifying which peering router captured the parameters for each of the plurality of data packets, determining, based on the identified peering routers, a first peering router nearest to the client, relative to the other peering routers, identifying a first content cache, of a plurality of content caches in a content distribution network, nearest to the first peering router, and fulfilling a content request from the client device using content stored on the first content cache.

Optimized content routing distribution using proximity based on predictive client flow trajectories

Techniques are presented for optimizing secure communications in a network. A first router receives from a second router an encrypted packet with an unknown security association. The first router examines the packet to determine whether the counter value is in a range of predicted counter values. Additionally, a key server is configured to provision routers that are part of a virtual private network. The key server selects a counter value that is part of a security association and calculates a key value. The key server sends the key value together with the security association to enable routers to exchange encrypted packets with each other in the virtual private network using the key value and the security association. The key server increments the counter value to a value within a range of counter values capable of being predicted by the routers.

Growing community of inventors

Sterling, VA, United States of America

Warren Scott Wainner