公开(公告)号：US20230328038A1

公开(公告)日：2023-10-12

申请号：US17718634

申请日：2022-04-12

Applicant: Cisco Technology, Inc.

Inventor： Alberto Rodriguez-Natal ,  Lorand Jakab ,  Fabio R. Maino

IPC: H04L9/40 ,  H04L43/0823 ,  H04L43/0864

CPC classification number: H04L63/0407 ,  H04L63/20 ,  H04L63/0281 ,  H04L43/0847 ,  H04L43/0864

Abstract: Techniques for using proxies with overprovisioned IP addresses to demultiplex data flows, which may otherwise look the same at L7, into multiple subflows for L3 policy enforcement without having to modify an underlying L3 network. The techniques may include establishing a subflow through a network between a first proxy and a second proxy, the subflow associated with a specific policy. In some examples, the first proxy node may receive an encrypted packet that is to be sent through the network and determine, based at least in part on accessing an encrypted application layer of the packet, a specific application to which the packet is to be sent. The first proxy node may then alter an IP address included in the packet to cause the packet to be sent through the network via the subflow such that the packet is handled according to the specific policy.

公开(公告)号：US12294569B2

公开(公告)日：2025-05-06

申请号：US17718634

申请日：2022-04-12

Applicant: Cisco Technology, Inc.

Inventor： Alberto Rodriguez-Natal ,  Lorand Jakab ,  Fabio R. Maino

IPC: H04L9/40 ,  H04L43/0823 ,  H04L43/0864 ,  H04L47/10 ,  H04L47/20

Abstract: Techniques for using proxies with overprovisioned IP addresses to demultiplex data flows, which may otherwise look the same at L7, into multiple subflows for L3 policy enforcement without having to modify an underlying L3 network. The techniques may include establishing a subflow through a network between a first proxy and a second proxy, the subflow associated with a specific policy. In some examples, the first proxy node may receive an encrypted packet that is to be sent through the network and determine, based at least in part on accessing an encrypted application layer of the packet, a specific application to which the packet is to be sent. The first proxy node may then alter an IP address included in the packet to cause the packet to be sent through the network via the subflow such that the packet is handled according to the specific policy.

公开(公告)号：US20240205094A1

公开(公告)日：2024-06-20

申请号：US18591960

申请日：2024-02-29

Applicant: Cisco Technology, Inc.

Inventor： Alberto Rodriguez-Natal ,  Saswat Praharaj ,  Lorand Jakab ,  Fabio R. Maino ,  Pradeep Kumar Kathail ,  Vivek Agarwal ,  Ram Dular Singh

IPC: H04L41/12

CPC classification number: H04L41/12

Abstract: An application monitoring system for collecting, utilizing, and/or exchanging state information (e.g., application state and network state), configuration information, and/or other information to make network optimizations for applications orchestrated by an application orchestration system. The application monitoring system may include an application orchestrator discovery component that is configured to determine a presence of an application orchestration system for orchestrating applications. The application monitoring system may also include one or more application watch components for monitoring, among other things, application state, application configuration, and/or application replicas. The application monitoring system may further include a network state propagation component configured to provide network state information to the orchestration system.

公开(公告)号：US11647019B2

公开(公告)日：2023-05-09

申请号：US16654160

申请日：2019-10-16

Applicant: Cisco Technology, Inc.

Inventor： Alberto Rodriguez Natal ,  Mikhail Davidov ,  Lorand Jakab ,  Richard James Smith ,  Fabio Maino

IPC: H04L9/40 ,  H04L9/32 ,  G06F21/34 ,  G06F21/60

CPC classification number: H04L63/0853 ,  G06F21/34 ,  G06F21/602 ,  H04L9/32 ,  H04L63/0428 ,  H04L63/061 ,  H04L63/10

Abstract: A method includes generating, by an internal segmentation orchestrator, a key to cipher/decipher a cryptographic segmentation tag used by an untrusted device, transmitting the key to an external segmentation orchestrator, transmitting the cryptographic segmentation tag to the external segmentation orchestrator and provisioning a trusted network edge with the key and optionally the cryptographic segmentation tag. The method can also include onboarding, based on the key and the cryptographic segmentation tag, the untrusted device, wherein the untrusted device receives the cryptographic segmentation tag from the external segmentation orchestrator.

公开(公告)号：US20210119993A1

公开(公告)日：2021-04-22

申请号：US16654160

申请日：2019-10-16

Applicant: Cisco Technology, Inc.

Inventor： Alberto Rodriguez Natal ,  Mikhail Davidov ,  Lorand Jakab ,  Richard James Smith ,  Fabio Maino

IPC: H04L29/06 ,  H04L9/32 ,  G06F21/34 ,  G06F21/60

Abstract: A method includes generating, by an internal segmentation orchestrator, a key to cipher/decipher a cryptographic segmentation tag used by an untrusted device, transmitting the key to an external segmentation orchestrator, transmitting the cryptographic segmentation tag to the external segmentation orchestrator and provisioning a trusted network edge with the key and optionally the cryptographic segmentation tag. The method can also include onboarding, based on the key and the cryptographic segmentation tag, the untrusted device, wherein the untrusted device receives the cryptographic segmentation tag from the external segmentation orchestrator.

公开(公告)号：US20160119196A1

公开(公告)日：2016-04-28

申请号：US14612691

申请日：2015-02-03

Applicant: Cisco Technology, Inc.

Inventor： Marc Portoles Comeras ,  Preethi Natarajan ,  Alberto Rodriguez Natal ,  Fabio Rodolfo Maino ,  Alberto Cabellos Aparicio ,  Vasileios Lakafosis ,  Lorand Jakab

IPC: H04L12/24 ,  H04L12/707

CPC classification number: H04L41/5054 ,  H04L45/24 ,  H04L47/125 ,  H04L47/193 ,  H04L69/14 ,  H04L69/16 ,  H04L69/161

Abstract: Techniques are provided for a network mapping server device in a network to receive a connection upgrade message comprising information to establish a first data flow from a first endpoint that does not support multiple subflows for the first data flow according to a multipath protocol, where multiple subflows subdivide the first data flow across two or more network paths. The information in the connection upgrade message is analyzed in order to resolve network connectivity to determine potential network connections for at least two subflows of the first data flow to a second endpoint. A response message is sent comprising information configured to establish at least two subflows for the first data flow between the first endpoint and the second endpoint.

Abstract translation: 为网络中的网络映射服务器设备提供技术，以接收包括信息的连接升级消息，以便根据多路径协议从不支持第一数据流的多个子流的第一端点建立第一数据流，其中多个子流 第一个数据流跨越两个或多个网络路径细分。 分析连接升级消息中的信息以便解析网络连接以确定到第二端点的至少两个子流的第一数据流的潜在网络连接。 发送响应消息，包括被配置为为第一端点和第二端点之间的第一数据流建立至少两个子流的信息。