公开(公告)号：US12063169B2

公开(公告)日：2024-08-13

申请号：US18464783

申请日：2023-09-11

Applicant: Cisco Technology, Inc.

Inventor： Sridhar Vallepalli ,  Javed Asghar ,  Umamaheswararao Karyampudi ,  Saad Malik ,  Amitkumar V. Patel

IPC: H04L49/15 ,  H04L45/00 ,  H04L45/02 ,  H04L45/745 ,  H04L47/20 ,  H04L67/563 ,  H04L12/66

CPC classification number: H04L49/1507 ,  H04L45/04 ,  H04L45/22 ,  H04L45/72 ,  H04L45/745 ,  H04L47/20 ,  H04L67/563 ,  H04L12/66

Abstract: Embodiments herein describe using translation mappings and security contracts to establish interconnects and policies between switching fabrics at different sites to create a unified fabric. In one embodiment, a multi-site controller can stretch endpoint groups (EPGs) between the sites so that a host or application in a first site can communicate with a host or application in a second site which is assigned to the same stretched EPG, despite the two sites have different namespaces. Further, the shadow EPGs can be formed to facilitate security contracts between EPGs in different sites. Each site can store namespace translation mapping that enable the site to convert namespace information in packets received from a different site into its own namespace values. As a result, independent bridging and routing segments in the various sites can be interconnected as well as providing application accessibility across different fabrics with independent and private namespaces.

公开(公告)号：US20200127987A1

公开(公告)日：2020-04-23

申请号：US16166973

申请日：2018-10-22

Applicant: Cisco Technology, Inc.

Inventor： Govind Prasad Sharma ,  Javed Asghar ,  Prabhu Balakannan ,  Sridhar Vallepalli

IPC: H04L29/06 ,  H04L9/08 ,  H04L12/46

Abstract: A Software-Defined Networking (SDN)-based “upstream” approach is a controller-based solution that provides secure key distribution and management for multi-site data centers. The approach uses an SDN Multi-Site Controller (MSC) that acts as an intermediary between SDN controllers at sites in a multi-site data center and manages the distribution of keys to sites. The approach is not dependent upon any particular routing protocol, such as the Border Gateway Protocol (BGP), and is well suited for multicast stream encryption by allowing the same key to be used for all replicated packets sent to downstream sites from an upstream source site. The approach distributes keys in a secure manner, ensures that data transferred between sites is done in a secure manner, and supports re-keying with error handling.

公开(公告)号：US12199963B2

公开(公告)日：2025-01-14

申请号：US18508743

申请日：2023-11-14

Applicant: Cisco Technology, Inc.

Inventor： Govind Prasad Sharma ,  Javed Asghar ,  Prabhu Balakannan ,  Sridhar Vallepalli

IPC: H04L9/40 ,  H04L9/08 ,  H04L12/46 ,  H04L69/14 ,  H04L69/22

Abstract: A Software-Defined Networking (SDN)-based “upstream” approach is a controller-based solution that provides secure key distribution and management for multi-site data centers. The approach uses an SDN Multi-Site Controller (MSC) that acts as an intermediary between SDN controllers at sites in a multi-site data center and manages the distribution of keys to sites. The approach is not dependent upon any particular routing protocol, such as the Border Gateway Protocol (BGP), and is well suited for multicast stream encryption by allowing the same key to be used for all replicated packets sent to downstream sites from an upstream source site. The approach distributes keys in a secure manner, ensures that data transferred between sites is done in a secure manner, and supports re-keying with error handling.

公开(公告)号：US11895100B2

公开(公告)日：2024-02-06

申请号：US16940114

申请日：2020-07-27

Applicant: Cisco Technology, Inc.

Inventor： Govind Prasad Sharma ,  Javed Asghar ,  Prabhu Balakannan ,  Sridhar Vallepalli

IPC: H04L9/40 ,  H04L9/08 ,  H04L12/46 ,  H04L69/14 ,  H04L69/22

CPC classification number: H04L63/062 ,  H04L9/0891 ,  H04L12/4641 ,  H04L63/0428 ,  H04L63/166 ,  H04L69/14 ,  H04L69/22

Abstract: A Software-Defined Networking (SDN)-based “upstream” approach is a controller-based solution that provides secure key distribution and management for multi-site data centers. The approach uses an SDN Multi-Site Controller (MSC) that acts as an intermediary between SDN controllers at sites in a multi-site data center and manages the distribution of keys to sites. The approach is not dependent upon any particular routing protocol, such as the Border Gateway Protocol (BGP), and is well suited for multicast stream encryption by allowing the same key to be used for all replicated packets sent to downstream sites from an upstream source site. The approach distributes keys in a secure manner, ensures that data transferred between sites is done in a secure manner, and supports re-keying with error handling.

公开(公告)号：US11159451B2

公开(公告)日：2021-10-26

申请号：US16162199

申请日：2018-10-16

Applicant: Cisco Technology, Inc.

Inventor： Javed Asghar ,  Sridhar Vallepalli ,  Umamaheswararao Karyampudi ,  Srinivas Kotamraju

IPC: H04L12/00 ,  H04L12/933 ,  H04L12/46 ,  H04L12/24 ,  H04L12/715 ,  H04L12/761 ,  H04L12/707 ,  H04L12/741 ,  H04L12/931 ,  H04L29/12 ,  H04L29/06

Abstract: An endpoint group (EPG) can be stretched between the sites so that endpoints at different sites can be assigned to the same stretched EPG. Because the sites can use different bridge domains when establishing the stretched EPGs, the first time a site transmits a packet to an endpoint in a different site, the site learns or discovers a path to the destination endpoint. The site can use BGP to identify the site with the host and use a multicast tunnel to reach the site. A unicast tunnel can be used to transmit future packets to the destination endpoint. Additionally, a stretched EPG can be segmented to form a micro-stretched EPG. Filtering criteria can be used to identify a subset of the endpoints in the stretched EPG that are then assigned to the micro-stretched EPG, which can have different policies than the stretched EPG.

公开(公告)号：US10389618B2

公开(公告)日：2019-08-20

申请号：US15413131

申请日：2017-01-23

Applicant: CISCO TECHNOLOGY, INC.

Inventor： Heidi Ou ,  Sridhar Vallepalli

IPC: H04L12/751 ,  H04L12/761 ,  H04L12/18

Abstract: Methods for distributing multicast network path information to various network nodes in a network environment are disclosed. An exemplary method includes a downstream node transmitting a first message including a network path indicating a specific desired route that is to be used when delivering multicast traffic from a given multicast source to a given host, as well as an identifier assigned to the network path in order to uniquely identify that network path in the network. The method also includes the downstream node transmitting a second message for announcing that the multicast source is to be reached via the network path announced in the first message. The second message identifies the network path to be used by including the identifier of the path announced in the first message, but not the network path itself.

公开(公告)号：US20190124093A1

公开(公告)日：2019-04-25

申请号：US15788861

申请日：2017-10-20

Applicant: Cisco Technology, Inc.

Inventor： Govind P. Sharma ,  Gilles Rhéal Roy ,  Eric Levy-Abegnoli ,  Ajay Kumar Modi ,  Sridhar Vallepalli

IPC: H04L29/06

Abstract: Theft detection in data center networks may be provided. First, a first leaf switch may create an entry in a first distributed secure cache in response to an endpoint appearing on the first leaf switch. The entry may correspond to the endpoint and may be marked as having a tentative state. Then a request message may be sent to a plurality of leaf switches. The request message may comprise data identifying the endpoint. Next, a reply message may be received in response to the request message from a second leaf switch within the plurality of leaf switches. The tentative state may then be removed from the entry in response to the reply message indicating that the endpoint is valid.