公开(公告)号：US20220182322A1

公开(公告)日：2022-06-09

申请号：US17115451

申请日：2020-12-08

Applicant: Cisco Technology, Inc.

Inventor： Nagendra Kumar Nainar ,  Carlos M. Pignataro ,  Zafar Ali ,  Syed Kamran Raza

IPC: H04L12/741 ,  H04L12/26

Abstract: The present disclosure includes methods, systems, and non-transitory computer-readable media for validating data in a data structure used for forwarding packets by a network device comprising sending a data packet probe identifying a destination and including a segment ID, wherein the segment ID maps to a first interpretation by a receiving router to perform an action on the data packet probe to rewrite a portion of a destination address in a header of the data packet probe, and to redirect the data packet probe to the network device that initiated the data packet probe.

公开(公告)号：US11343152B2

公开(公告)日：2022-05-24

申请号：US16842457

申请日：2020-04-07

Applicant: Cisco Technology, Inc.

Inventor： Nagendra Kumar Nainar ,  Carlos M. Pignataro

IPC: H04W36/30 ,  H04L41/12 ,  H04L41/0893 ,  H04L45/02 ,  H04L45/42 ,  H04L45/64 ,  H04L47/125

Abstract: Systems, methods, and computer-readable for load distribution amongst smart network interface cards (sNICs) connected to a host device include a controller. The controller can instantiate an agent in the host device to obtain telemetry information pertaining to the sNICs, where the sNICs can be used for communication between the host device and upstream devices in a software-defined network. The telemetry information indicates service offloading capabilities of the sNICs. The controller can also obtain network topology information pertaining to at least the host device, the sNICs and the upstream devices, and determine load distribution policies for the sNICs based on the network topology information and the telemetry information. The controller can provide the load distribution policies to the one or more upstream devices, where the load distribution policies take into account the service offload capabilities of the sNICs.

公开(公告)号：US20220103570A1

公开(公告)日：2022-03-31

申请号：US17035065

申请日：2020-09-28

Applicant: Cisco Technology, Inc.

Inventor： Nagendra Kumar Nainar ,  Carlos M. Pignataro ,  Akram Ismail Sheriff

IPC: H04L29/06 ,  H04L9/32 ,  H04L12/707 ,  H04L12/715 ,  H04L12/741

Abstract: Techniques and mechanisms for providing integrity verified paths using only integrity validated pods of nodes. A network service mesh (NSM) associated with a first pod may locally generate a nonce and provide the nonce to the first pod, where the request includes a request for an attestation token. Using the nonce, the first pod may generate the attestation token and reply back to the NSM. The NSM may generate a second request for an attestation token and forward it to a NSE pod, where the request includes a second locally generated nonce generated by the NSM. The NSE pod may generate the second attestation token using the second nonce and reply back to the NSM. The NSM may then have the attestation tokens verified or validated by a certificate authority (CA) server. The NSM may thus instantiate an integrity verified path between the first pod and the NSE pod.

公开(公告)号：US11150963B2

公开(公告)日：2021-10-19

申请号：US16289412

申请日：2019-02-28

Applicant: Cisco Technology, Inc.

Inventor： Nagendra Kumar Nainar ,  Carlos M. Pignataro

IPC: G06F9/54 ,  G06F9/50 ,  G06F9/455 ,  H04L12/721 ,  H04L12/717 ,  H04L12/723

Abstract: Systems and methods provide for accelerating and offloading network processing to a remote smart network interface card (NIC). A first network element, including a first smart NIC, can transmit capability information of the first smart NIC for receipt by a neighboring second network element. The second network element can determine that a network processing task of a virtualized network function (e.g., virtual network function (VNF), cloud-native network function (CNF), etc.) instantiated on the second network element can be offloaded to the first smart NIC. The second network element can receive processing information from the virtualized network function for performing the network processing task. Based on the processing information, the second network element can transmit control information that causes the first smart NIC to perform the network processing task on at least a portion of network data received by the first network element for transmission to the second network element.

公开(公告)号：US20210314232A1

公开(公告)日：2021-10-07

申请号：US16842457

申请日：2020-04-07

Applicant: Cisco Technology, Inc.

Inventor： Nagendra Kumar Nainar ,  Carlos M. Pignataro

IPC: H04L12/24 ,  H04L12/751 ,  H04L12/715 ,  H04L12/717 ,  H04L12/803

Abstract: Systems, methods, and computer-readable for load distribution amongst smart network interface cards (sNICs) connected to a host device include a controller. The controller can instantiate an agent in the host device to obtain telemetry information pertaining to the sNICs, where the sNICs can be used for communication between the host device and upstream devices in a software-defined network. The telemetry information indicates service offloading capabilities of the sNICs. The controller can also obtain network topology information pertaining to at least the host device, the sNICs and the upstream devices, and determine load distribution policies for the sNICs based on the network topology information and the telemetry information. The controller can provide the load distribution policies to the one or more upstream devices, where the load distribution policies take into account the service offload capabilities of the sNICs.

公开(公告)号：US11140177B2

公开(公告)日：2021-10-05

申请号：US16118699

申请日：2018-08-31

Applicant: Cisco Technology, Inc.

Inventor： Nagendra Kumar Nainar ,  Carlos M. Pignataro ,  Luca Muscariello ,  Alberto Compagno ,  Giovanna Carofiglio

IPC: H04L29/06 ,  H04L9/30 ,  H04L9/32 ,  H04L29/12

Abstract: An electronic device of a content producer generates a chunk of data, associates a location-independent name with the chunk of data, generates a signature for the chunk of data, attaches the signature to the chunk of data, and transmits the chunk of data, with the signature attached, to one or more user devices in response to respective requests. The signature is generated based on the data in the chunk, using a private key of the electronic device. The electronic device also stores information, including a specification of a public key associated with the private key, in a first ledger entry of a blockchain, to provide the one or more user devices with access to the public key. A user device may obtain the public key and use it to verify the chunk of data.

公开(公告)号：US11088928B2

公开(公告)日：2021-08-10

申请号：US16601969

申请日：2019-10-15

Applicant: Cisco Technology, Inc.

Inventor： Carlos M. Pignataro ,  Benoit Claise ,  Nagendra Kumar Nainar

IPC: H04L12/26 ,  H04L12/721 ,  H04L12/707

Abstract: In one embodiment, a method is provided service aware conditional path monitoring. The method includes determining, for a network that includes a plurality of nodes, which particular nodes of the plurality of nodes forward traffic associated with a service. The method involves identifying relevant forwarding instructions within the particular nodes that are used to forward traffic for the service. The method further includes configuring the particular nodes to perform monitoring of traffic with a higher priority given to the relevant forwarding instructions than other forwarding instructions on the particular nodes. Monitoring results are obtained from the monitoring of traffic on the particular nodes on the relevant forwarding instructions. The monitoring results are analyzed to determine assurance of the service in the network.

公开(公告)号：US11018981B2

公开(公告)日：2021-05-25

申请号：US15783010

申请日：2017-10-13

Applicant: Cisco Technology, Inc.

Inventor： Carlos M. Pignataro ,  Nagendra Kumar Nainar ,  Rajiv Asati

IPC: H04L12/813 ,  H04L29/08 ,  H04L12/823 ,  H04L12/24 ,  H04L12/26 ,  H04L12/851 ,  H04L12/911

Abstract: Systems, methods, and computer-readable media are disclosed for using real time network traffic for validating policy configuration(s) of containers, virtual machines, bare-metals, etc. In one aspect of the present disclosure a method includes receiving, at a controller, an incoming data packet destined for one or more containers; replicating, at the controller, the incoming data packet for validating at least one non-production container to yield a replicated data packet; sending the replicated data packet to the at least one non-production container; and dropping any data packet received from the at least one non-production container at a corresponding incoming port of the controller.

公开(公告)号：US11012353B2

公开(公告)日：2021-05-18

申请号：US16231319

申请日：2018-12-21

Applicant: Cisco Technology, Inc.

Inventor： Shwetha Subray Bhandari ,  Nagendra Kumar Nainar ,  Carlos M. Pignataro ,  Frank Brockners

IPC: H04L12/741 ,  H04L29/06 ,  H04L9/08 ,  H04L12/707 ,  H04L9/32 ,  H04L12/935

Abstract: In one embodiment, nodes use in-band operations data (e.g., carried in iOAM data field(s)) to signal departures in the processing of a packet in a network. A “departure” refers to a divergence or deviation, as from an established rule, plan, or procedure. Departures include, but are not limited to, sending a packet over a backup path (thus, a departure/deviation from sending over a primary path); offload processing of a packet (thus, a departure/deviation from processing of a packet by an application processing apparatus); and exception or punting/slow/software path processing of a packet (thus, a departure/deviation from normal or fast/hardware path processing of a packet). In one embodiment, a proof of transit validation apparatus uses departure information to select among multiple possible verification secrets, with the selected verification secret used in validation processing with a cumulative secret value obtained from the packet.

公开(公告)号：US20210111989A1

公开(公告)日：2021-04-15

申请号：US16601747

申请日：2019-10-15

Applicant: Cisco Technology, Inc.

Inventor： Nagendra Kumar Nainar ,  Carlos M. Pignataro ,  Jaganbabu Rajamanickam ,  Madhan Sankaranarayanan

IPC: H04L12/721 ,  H04L12/707 ,  H04L12/743

Abstract: Techniques are presented for evaluating Equal Cost Multi-Path (ECMP) performance in a network that includes a plurality of nodes. According to an example embodiment, a method is provided that includes obtaining information indicating equal cost multi-path (ECMP) paths in the network and a branch node in the network. For the branch node in the network, the method includes instantiating a virtual network function that simulates an ECMP hashing algorithm employed by the branch node to select one of multiple egress interface of the branch node; providing to the virtual network function for the branch node, a query containing entropy information as input to the ECMP hashing algorithm that returns interface selection results; and obtaining from the virtual network function a reply that includes the interface selection results. The method further includes evaluating ECMP performance in the network based on the interface selection results obtained for the branch node.