John L Cruz

US Patent:

20040266420, Dec 30, 2004

Filed:

Jun 24, 2003

Appl. No.:

10/603916

Inventors:

Jari Malinen - Sunnyvale CA, US
John Cruz - Sunnyvale CA, US
Dhaval Shah - Mountain View CA, US

Assignee:

NOKIA INC. - Irving TX

International Classification:

H04M011/00
H04Q007/24
H04L012/66

US Classification:

455/421000, 370/338000, 370/352000

Abstract:

The present invention discloses a methods and systems for securely connecting mobile nodes to an internal private network using IPsec based Virtual Private Network (VPN) technology. The system employs a proxy home agent (PHA) coupled to a home network associated with a mobile node that is located within a secure network, a home agent (HA) that is located outside of the secure network, and a VPN gateway to provide VPN services to a mobile device that changes its current address during the VPN session. The HA and PHA are configured to provide Mobile IP Home Agent functionality through a distributed system.

US Patent:

20220377013, Nov 24, 2022

Filed:

Jun 30, 2021

Appl. No.:

17/364750

Inventors:

- Milpitas CA, US
Sarat Kamisetty - Fremont CA, US
Balakrishnan Raman - Fremont CA, US
Chandrasekaran Swaminathan - Bangalore, IN
Maruthi Ram Namburu - Bangalore, IN
Vijay Sampath - Milpitas CA, US
Akshay Nadahalli - Bangalore, IN
Pirabhu Raman - Fremont CA, US
John Cruz - San Jose CA, US

International Classification:

H04L 12/741
H04L 12/751
H04L 12/721
H04L 12/709
H04L 29/12

Abstract:

Network traffic flows can be processed by routers, switches, or service nodes. Service nodes may be ASICs that can provide the functionality of a switch or a router. Service nodes can be configured in a circular replication chain, thereby providing benefits such as high reliability. The service nodes can implement methods that include receiving a first packet that includes a source address in a source address field and that includes a destination address in a destination address field, routing the first packet to a selected service node that is in a circular replication chain that includes a plurality of service nodes that have local flow tables and are configured for chain replication of the local flow tables, producing a second packet by using a matching flow table entry of the first packet to process the first packet, and sending the second packet toward a destination indicated by the destination address.

US Patent:

20220321400, Oct 6, 2022

Filed:

Apr 18, 2022

Appl. No.:

17/723243

Inventors:

- Santa Clara CA, US
John CRUZ - Cupertino CA, US
Steven LICKING - San Jose CA, US
Michael E. ATTIG - Sunnyvale CA, US

International Classification:

H04L 41/0654
H04L 69/22
H04L 45/745
H04L 41/0677
H04L 49/00
H04L 45/42
H04L 49/55
H04L 45/28
H04L 45/64

Abstract:

A method of identifying a failed egress path of a hardware forwarding element. The method detects an egress link failure in a data plane of the forwarding element. The method generates a link failure signal in the data plane identifying the failed egress link. The method generates a packet that includes the identification of the egress link based on the link failure signal. The method sets the status of the egress link to failed in the data plane based on the identification of the egress link in the generated packet.

US Patent:

20230069844, Mar 9, 2023

Filed:

Aug 25, 2021

Appl. No.:

17/411988

Inventors:

- Milpitas CA, US
Akshaya Nadahalli - Bangalore, IN
Balakrishnan Raman - Fremont CA, US
Chandrasekaran Swaminathan - Bangalore, IN
John Cruz - San Jose CA, US
Maruthi Ram Namburu - Bangalore, IN
Pirabhu Raman - Fremont CA, US
Vijay Sampath - Milpitas CA, US
Vipin Jain - San Jose CA, US

International Classification:

H04L 7/033
H04L 29/08
G06F 16/22
G06F 16/27

Abstract:

Synchronizing the databases maintained by network appliances can support high availability or high throughput topologies, but also consumes the devices' processing resources. To address that resource consumption, the network appliance's packet processing pipeline circuits can process synchronization packets to thereby synchronize the databases. A local data structure can be in a first local state. Processing a network packet can result in changing the local data structure to a second local state. A state sync packet can include state transition data that indicates a state difference between the first local state and the second local state. The state sync packet can be sent to a peer device that is configured to process the state transition data using the peer device's packet processing pipeline circuit. The peer device's packet processing pipeline can use the state transition data to update a peer device data structure that is in the peer device.

US Patent:

20230064845, Mar 2, 2023

Filed:

Aug 31, 2021

Appl. No.:

17/463256

Inventors:

- Milpitas CA, US
Sarat Kamisetty - Fremont CA, US
Krishna Doddapaneni - Cupertino CA, US
John Cruz - San Jose CA, US
Loganathan Nallusamy - Bengaluru, IN

International Classification:

H04L 12/26
H04L 12/24
H04L 12/935

Abstract:

An orchestrator can send trace directives to network appliances that indicate a network flow to trace. The network appliances can include packet processing pipelines that each include numerous processing stages. The network appliances implement network rules for processing network flows by configuring the pipeline's processing stages to execute specific policies for specific network packets in accordance with the network rules. The processing stages can also be configured to produce metadata indicating the policies implemented at each stage to process certain network packets in network flows indicated by trace directives. The metadata can be used to produce a trace report that indicates a network packet of the network flow, a first network rule that was applied to the network packet by a one of the first appliance processing stages, and the one of the first appliance processing stages that applied the first network rule to the network packet.

US Patent:

20230068914, Mar 2, 2023

Filed:

Aug 31, 2021

Appl. No.:

17/463202

Inventors:

- Milpitas CA, US
Sarat Kamisetty - Fremont CA, US
Krishna Doddapaneni - Cupertino CA, US
John Cruz - San Jose CA, US
Loganathan Nallusamy - Bengaluru, IN

International Classification:

H04L 12/26
H04L 12/24
H04L 29/06
H04L 12/935

Abstract:

Network appliances can use packet processing pipeline circuits to implement network rules for processing network packet flows by configuring the pipeline's processing stages to execute specific policies for specific network packets in accordance with the network rules. Trace reports that indicate network rules implemented at specific processing stages can be more informative than those indicating policies implemented by the processing stages. A method implemented by a network appliance can store network rules for processing network flows by the processing stages of a packet processing pipeline circuit. The method can produce a trace report in response to to receiving a trace directive for one of the network flows wherein one of the processing stages has applied a network rule to a network packet in one of the network flows. The trace report can indicate the network rule in association with the processing stage and the network flow.

US Patent:

20200313955, Oct 1, 2020

Filed:

Jun 16, 2020

Appl. No.:

16/903305

Inventors:

- Santa Clara CA, US
John Cruz - Cupertino CA, US
Steven Licking - San Jose CA, US
Michael E. ATTIG - Sunnyvale CA, US

International Classification:

H04L 12/24
H04L 29/06
H04L 12/741

Abstract:

A method of identifying a failed egress path of a hardware forwarding element. The method detects an egress link failure in a data plane of the forwarding element. The method generates a link failure signal in the data plane identifying the failed egress link. The method generates a packet that includes the identification of the egress link based on the link failure signal. The method sets the status of the egress link to failed in the data plane based on the identification of the egress link in the generated packet.