Mark J Stapp, 5975 Beatrice Cir, Belmont, MA 02478

7139818, Nov 21, 2006

Oct 4, 2001

09/972139

Kenneth Kinnear, Jr. - Boxborough MA, US
Mark Stapp - Belmont MA, US
Richard Johnson - Santa Barbara CA, US

Cisco Technology, Inc. - San Jose CA

G06F 15/177

709222, 709226, 709244

A method for providing leased network addresses for a host from a server executing on a server device is disclosed. A first request for a leased network address from the host, relayed by an intermediate device, is received. The intermediate device filters communications between the host and the server device. A response is generated for the host, by the server, which offers a leased network address for a particular period of time and includes a network address of the intermediate device. The network address of the intermediate device is provided in a portion of the response normally designated for indicating a network address of the server. By providing the address of the intermediate device in the portion of the response designated for the server address, the server causes the client to send renewal requests to the intermediate device so that a relay process on the intermediate device can properly operate on the request, without modifying the client process.

7152117, Dec 19, 2006

Jan 18, 2002

10/053759

Mark Stapp - Belmont MA, US
Kenneth Kinnear, Jr. - Boxborough MA, US
Richard A. Johnson - Santa Barbara CA, US
Jayadev Kumarasamy - Morgan Hill CA, US

Cisco Technology, Inc. - San Jose CA

G06F 15/16

709245, 709224

Techniques for managing leased network addresses for multiple networks using overlapping address spaces include storing banks of addresses corresponding to the multiple networks. A request for a network address for a host on a first network is received from a relay agent on an intermediate device. The request includes a qualifier associated with the first network by the relay agent. A first bank of addresses is selected based on the qualifier. A first network address from the first bank is identified based at least in part on the request. A response for the host is sent to the relay agent. The response indicates the first network address and the qualifier. Thus a dynamic host configuration protocol (DHCP) server can provide the same network address for several hosts spread over different networks, such as different virtual private networks (VPNs).

7302484, Nov 27, 2007

Aug 13, 2002

10/218555

Mark Stapp - Belmont MA, US
Kenneth Kinnear, Jr. - Boxborough MA, US

Cisco Technology, Inc. - San Jose CA

G06F 15/173
G06F 12/02

709226, 345543

A method and apparatus for providing network addresses for hosts on a network includes generating and storing network configuration information in a subnet management process, where a subnet is a set of contiguous network addresses. The network configuration information indicates network addresses to be distributed among a plurality of network devices. Policy information is also generated and stored. The policy information indicates a policy set of one or more policy processes. Each policy process selects an available subnet from available network addresses. A request for a subnet is received from a subnet requesting process. A particular subnet is determined based on the network configuration information, the request, and the policy set. A response indicating the particular subnet is sent to the subnet requesting process. These techniques allow an administrator to choose a policy for selecting subnets that better utilizes network resources for a wide range of network architectures.

7373397, May 13, 2008

Mar 14, 2006

11/375806

Richard A. Johnson - Santa Barbara CA, US
Kenneth Kinnear, Jr. - Boxborough MA, US
Mark Stapp - Belmont MA, US
Jayadev Kumarasamy - Morgan Hill CA, US

Cisco Technology, Inc. - San Jose CA

G06F 15/177

709220, 709223

Techniques for providing sets of network addresses for dynamically configuring hosts on a network include sending to a first server a first request for a first count of network addresses in a first set of network addresses. A first message indicating the first set of network addresses is received. A second message is received from a second server that requests a second count of network addresses for a second set of network addresses. The second set of network addresses is determined based at least in part on the first set of network addresses and the second count. In response to the second message, a first response indicating the second set is sent to the second server. The techniques allow an administrator to enter available subnets at any DHCP server. The DHCP servers using these techniques then automatically apportion subnets among each other based on the relative usage of the subnets.

7640340, Dec 29, 2009

Aug 7, 2006

11/501150

Mark Stapp - Belmont MA, US
Kenneth Kinnear, Jr. - Boxborough MA, US
Richard A. Johnson - Santa Barbara CA, US
Jayadev Kumarasamy - Morgan Hill CA, US

Cisco Technology, Inc. - San Jose CA

G06F 15/173
G06F 15/16
G06F 15/177

709224, 709245, 709222

Techniques for managing leased network addresses for multiple networks using overlapping address spaces include storing banks of addresses corresponding to the multiple networks. A request for a network address for a host on a first network is received from a relay agent on an intermediate device. The request includes a qualifier associated with the first network by the relay agent. A first bank of addresses is selected based on the qualifier. A first network address from the first bank is identified based at least in part on the request. A response for the host is sent to the relay agent. The response indicates the first network address and the qualifier. Thus a dynamic host configuration protocol (DHCP) server can provide the same network address for several hosts spread over different networks, such as different virtual private networks (VPNs).

7814311, Oct 12, 2010

Mar 10, 2006

11/373727

Sean Convery - Mountain View CA, US
David R. Oran - Acton MA, US
James Rivers - Saratoga CA, US
John Schnizlein - Fort Washington MD, US
Ralph Droms - Westford MA, US
Mark Stapp - Belmont MA, US

Cisco Technology, Inc. - San Jose CA

H04L 29/06

713153, 713152, 726 12, 726 13

Generating a binding between a source address and one or more roles of a user accessing the network and distributing the binding to a filter node. The source address is currently assigned to the device. The binding may be generated by one or more nodes on an ingress path used during authentication of the user. The binding may be distributed to the filter node on demand or without any request from the filter node. Responsive to a determination that the user is associated with a new source address, a new binding is generated to associate a new source address with the one or more roles for the user. The new binding is distributed to the filter node. Another aspect is a method of enforcing a role based security policy at a filter node, using bindings of source addresses to roles.

8156325, Apr 10, 2012

Aug 25, 2010

12/868696

Sean Convery - Mountain View CA, US
David R. Oran - Acton MA, US
James Rivers - Saratoga CA, US
John Schnizlein - Fort Washington MD, US
Ralph Droms - Westford MA, US
Mark Stapp - Belmont MA, US

Cisco Technology, Inc. - San Jose CA

H04L 29/06

713153, 713154, 370389

Generating a binding between a source address and one or more roles of a user accessing the network and distributing the binding to a filter node. The source address is currently assigned to the device. The binding may be generated by one or more nodes on an ingress path used during authentication of the user. The binding may be distributed to the filter node on demand or without any request from the filter node. Responsive to a determination that the user is associated with a new source address, a new binding is generated to associate a new source address with the one or more roles for the user. The new binding is distributed to the filter node. Another aspect is a method of enforcing a role based security policy at a filter node, using bindings of source addresses to roles.

2010029, Nov 18, 2010

May 13, 2009

12/465113

Kenneth Kinnear, JR. - Boxborough MA, US
Neil Russell - Wakefield MA, US
Mark Stapp - Boxborough MA, US
Bernard Volz - Center Harbor NH, US

G06F 15/177

709221, 709206

In an embodiment, a data processing apparatus comprising one or more electronic digital processors; Dynamic Host Configuration Protocol (DHCP) server logic coupled to the one or more processors; an active leasequery channel response logic coupled to the DHCP server logic which when executed causes the one or more processors to perform receiving, from a particular DHCP client among a plurality of DHCP clients, an active leasequery initiation message requesting the DHCP server logic to actively send update messages about changes in network address leases that the DHCP server logic manages; wherein the active leasequery initiation message comprises a channel identifier value; determining whether the channel identifier value matches a client class that the DHCP server logic manages; in response to determining that the channel identifier value does match a client class identifier that the DHCP server logic manages, sending, to the particular DHCP client, one or more DHCP response messages describing any changes in network address leases that the DHCP server logic performs only for a subset of the DHCP clients that are in the matched client class.