公开(公告)号：US20240333734A1

公开(公告)日：2024-10-03

申请号：US18128978

申请日：2023-03-30

Applicant: Cisco Technology, Inc.

Inventor： Robert Edgar Barton ,  Bhavik Pradeep Shah ,  Thomas Szigeti ,  Nancy Patricia Cam-Winget ,  Edward Albert Warnicke

IPC: H04L9/40 ,  H04L41/0631

CPC classification number: H04L63/1425 ,  H04L41/065

Abstract: This disclosure describes techniques for escalating a security policy based on anomalous behavior. An example method includes identifying first behaviors associated with a first user and identifying a cluster comprising the first behaviors and second behaviors associated with at least one second user. The first user and the at least one second user are within a predetermined group within an organization. The example method further includes determining that a third behavior of a device associated with the first user is greater than a threshold distance from the cluster and outputting an alert.

公开(公告)号：US12063282B2

公开(公告)日：2024-08-13

申请号：US17719867

申请日：2022-04-13

Applicant: Cisco Technology, Inc.

Inventor： Vincent E. Parla ,  Kyle Andrew Donald Mestery ,  Rajvardhan Somraj Deshmukh ,  Nancy Patricia Cam-Winget

IPC: H04L67/561 ,  H04L9/40 ,  H04L12/46 ,  H04L45/00 ,  H04L45/42 ,  H04L61/103 ,  H04L61/4511 ,  H04L67/02 ,  H04L67/101 ,  H04L67/1012 ,  H04L67/141 ,  H04L67/562

CPC classification number: H04L67/561 ,  H04L12/4633 ,  H04L12/4641 ,  H04L45/42 ,  H04L45/66 ,  H04L61/103 ,  H04L61/4511 ,  H04L63/0236 ,  H04L63/0281 ,  H04L63/029 ,  H04L63/0435 ,  H04L67/02 ,  H04L67/101 ,  H04L67/1012 ,  H04L67/141 ,  H04L67/562

Abstract: Techniques for encoding metadata representing a policy into a QUIC connection ID are described herein. A metadata-aware network including one or more enforcement nodes, a policy engine, and/or a connection datastore may be utilized to enforce a policy and route communications on a QUIC connection. The policy engine may be configured to encode metadata representing one or more network policies into a QUIC source connection ID (SCID) and/or may store a mapping between the SCID and a corresponding destination connection ID (DCID) in the connection datastore. The policy engine may communicate with a QUIC application server and/or one or more QUIC proxy nodes to encode the SCID into a QUIC packet. The enforcement nodes may access the metadata and enforce the policies via a connection ID included in a QUIC header of a QUIC packet or by performing a lookup in the connection datastore using the connection ID.

公开(公告)号：US20240137428A1

公开(公告)日：2024-04-25

申请号：US17973115

申请日：2022-10-24

Applicant: Cisco Technology, Inc.

Inventor： Rajvardhan Somraj Deshmukh ,  Nancy Patricia Cam-Winget ,  James W. Kasper

IPC: H04L69/16 ,  H04L9/40 ,  H04L45/02

CPC classification number: H04L69/16 ,  H04L45/02 ,  H04L63/0236

Abstract: Techniques are described for managing QUIC connections. The techniques include identifying a first QUIC connection between a first and second device. Determining, from the connection, a first IP address and port number of the first device, a second IP address and port number of the second device, and a first CID. Storing an association between the first and second IP addresses, port numbers and first CID. Identifying a second QUIC connection between the first device and another device. Identifying, from the second connection, the first IP address and port number, a second CID, and a third IP address and port number. Determining if two of the following are met: the second IP address corresponds to the third IP address, the second port number corresponds to the third port number, the second CID corresponds to the first CID, if two are met, the first and second QUIC connections are the same.