Cisco Technology, Inc.

Nxp Usa, Inc.

Xuechen Yang

Rudolph Benedict Klecka

Pascal Thubert

Patrick Wetterwald

Eric Michel Levy-Abegnoli

Nancy Cam-Winget

Rudy Klecka

Allen Huotari

Ruchika Gupta

Jian Wu

Tiefei Zang

Xuelin Shi

Jeffrey Mitchell Goodwin

In one embodiment, functionality is disclosed for commissioning a target device based, at least in part, on providing identifying information that identifies a target device, where that identifying information is configured to be included in a request for authorization to commission the target device, and that request for authorization to commission the target device comprises one or more requested commissioning actions; receiving a commissioning authorization, where the commissioning authorization comprises information regarding one or more authorized commissioning actions for which a license is available, where the one or more authorized commissioning actions were selected from among the one or more requested commissioning actions; and performing the one or more authorized commissioning actions.

Secure confirmation exchange for offline industrial machine

A mechanism for secure enrollment of devices with a cloud platform is provided. This serves as a foundation for securing devices, such as edge computing and internet-of-things gateways, that can be provisioned and managed from the cloud. A public key infrastructure mechanism is provided for enrollment that is split into three phases. The first and second phases of the secure enrollment process authenticate the device and ensure that the device is within agreed to manufacturing limits for the device manufacturer. The third phase of the secure enrollment process provides a long-term operating certification to the device for cloud resource access.

Secure enrollment of devices with cloud platforms

In one embodiment, a system and method are disclosed for receiving a request for authorization to commission a target device based, at least in part, on a plurality of requested commissioning actions; determining whether each of the requested commissioning actions is authorized; sending a commissioning authorization, which includes information identifying the one or more authorized commissioning actions; receiving a commissioning complete confirmation message, which includes information identifying one or more completed commissioning actions; validating the commissioning complete confirmation message, in order to ensure that each of the completed actions had been previously authorized; and if all of the completed commissioning actions were previously authorized, sending an acknowledgement message.

In one embodiment, a device receives control logic programmed within at least one controller included within an industrial network. The device also determines a network topology of the industrial network, and derives a network policy for the industrial network based upon, at least in part, the control logic and the network topology.

Deriving a network policy for an industrial automation network

In one embodiment, a system and method are disclosed for receiving, at a first network routing element, a discovery message sent via a network, where the discovery message comprises identifying information that identifies a physical location of a first network device. The method modifies the identifying information in the discovery message by adding additional information to the identifying information, where the additional information can, for example, identify a physical location of the first network routing element. Subsequent to modifying the identifying information, the method forwards the discovery message to a network element, where the network element can be, for example, either a second network routing element or a server.

Network device identification in an industrial control network

In one embodiment, a virtual firewall is installed on a port of a device that communicates across a zone boundary within an industrial network. The virtual firewall is then configured based on operation of the industrial network, such that the port may then communicate via the firewall to a remote virtual firewall of a remote port of a remote device across the zone boundary.

Configuring firewalls for an industrial automation network

In one embodiment, a device receives a network policy based upon, at least in part, a physical network, and configures a design of an industrial network overlay on the physical network based upon, at least in part, the network policy. The configuring, according to the techniques herein, may generally include: determining a number of virtual local area networks (VLANs) within the industrial network overlay; determining which devices of the physical network are on which VLAN; determining placement of at least one virtual firewall within the industrial network overlay; and determining at least one communication path for the industrial network overlay between at least two devices.

Configuring the design of an industrial automation network

In one embodiment, a system and method are disclosed for sending a discovery message, via a network, from a first network device. The sending is performed in response to the first network device being associated with a first machine. The method involves receiving an offer message via the network, where the offer message includes network name information that indicates a physical location of the device within a topology of the network. The method also involves using the network name information to communicate with a second network device via the network.

A method for regulating network traffic may be provided. The method may comprise: measuring usage of a CPU; determining if the CPU usage is greater than an overload threshold value; halting the increase of a data traffic shaping rate associated with traffic regulated by the CPU if the CPU usage is greater than the overload threshold value; determining if the CPU usage is greater than an overflow threshold value; and decreasing the data traffic shaping rate associated with traffic regulated by the CPU if the CPU usage is greater than the overflow threshold value for improving session setup speed.

Feedback-based internet traffic regulation for multi-service gateways

For an Internet Access Gateway operative between an area network and a public network, managing dynamic network sessions therebetween whereby a primary server on the public network in a primary session with a client of the area network initiates an additional session with an additional server on the public network, for which an unexpected data packet received at the gateway from the additional server is associated with the primary session, and accordingly allowed access to the area network through the gateway, provided the gateway received the data packet at an input port exceeding 1023, the additional session comprises a pre-defined Session Triggering Event, and at least one internal network component of the area network indicates willingness to receive the data packet. Wherefore, a preferred Application Level Gateway is thereby provided for firewall and NAT implementations to enhance network security.

System and method for managing dynamic network sessions

A content aggregation server (CAS) establishes an IPSec tunnel with a gateway of a home network and discovers content on the home network. The CAS generates a web page that a user of the home network can access remotely to view an index of content hyperlinks, organize the content on the home network, and if desired select a hyperlink to access the content directly through the gateway, not the CAS, which thus is used for listing and managing content but not for hosting the content.

Content aggregation server on virtual universal plug-n-play network

System and method for allocating and managing a shared Internet access channel on an Internet access device. The system and method prioritize data flow in a multi-user, limited bandwidth networking environment by differentiating data types for disparate processing thereof by which a plurality of aggregation classes are hierarchically ordered to include at least one favored class (bandwidth guaranteed) and at least one disfavored class (best effort). Network sessions are aggregated into these classes according to an aggregation policy and bandwidth is asymmetrically allocated to the sessions according to a plurality of algorithms operating in conjunction with the hierarchy.

Growing community of inventors

Austin, TX, United States of America

Xuechen Yang