John M Cruz

20040266420, Dec 30, 2004

Jun 24, 2003

10/603916

Jari Malinen - Sunnyvale CA, US
John Cruz - Sunnyvale CA, US
Dhaval Shah - Mountain View CA, US

NOKIA INC. - Irving TX

H04M011/00
H04Q007/24
H04L012/66

455/421000, 370/338000, 370/352000

The present invention discloses a methods and systems for securely connecting mobile nodes to an internal private network using IPsec based Virtual Private Network (VPN) technology. The system employs a proxy home agent (PHA) coupled to a home network associated with a mobile node that is located within a secure network, a home agent (HA) that is located outside of the secure network, and a VPN gateway to provide VPN services to a mobile device that changes its current address during the VPN session. The HA and PHA are configured to provide Mobile IP Home Agent functionality through a distributed system.

20220377013, Nov 24, 2022

Jun 30, 2021

17/364750

- Milpitas CA, US
Sarat Kamisetty - Fremont CA, US
Balakrishnan Raman - Fremont CA, US
Chandrasekaran Swaminathan - Bangalore, IN
Maruthi Ram Namburu - Bangalore, IN
Vijay Sampath - Milpitas CA, US
Akshay Nadahalli - Bangalore, IN
Pirabhu Raman - Fremont CA, US
John Cruz - San Jose CA, US

H04L 12/741
H04L 12/751
H04L 12/721
H04L 12/709
H04L 29/12

Network traffic flows can be processed by routers, switches, or service nodes. Service nodes may be ASICs that can provide the functionality of a switch or a router. Service nodes can be configured in a circular replication chain, thereby providing benefits such as high reliability. The service nodes can implement methods that include receiving a first packet that includes a source address in a source address field and that includes a destination address in a destination address field, routing the first packet to a selected service node that is in a circular replication chain that includes a plurality of service nodes that have local flow tables and are configured for chain replication of the local flow tables, producing a second packet by using a matching flow table entry of the first packet to process the first packet, and sending the second packet toward a destination indicated by the destination address.

20220321400, Oct 6, 2022

Apr 18, 2022

17/723243

- Santa Clara CA, US
John CRUZ - Cupertino CA, US
Steven LICKING - San Jose CA, US
Michael E. ATTIG - Sunnyvale CA, US

H04L 41/0654
H04L 69/22
H04L 45/745
H04L 41/0677
H04L 49/00
H04L 45/42
H04L 49/55
H04L 45/28
H04L 45/64

A method of identifying a failed egress path of a hardware forwarding element. The method detects an egress link failure in a data plane of the forwarding element. The method generates a link failure signal in the data plane identifying the failed egress link. The method generates a packet that includes the identification of the egress link based on the link failure signal. The method sets the status of the egress link to failed in the data plane based on the identification of the egress link in the generated packet.

20230069844, Mar 9, 2023

Aug 25, 2021

17/411988

- Milpitas CA, US
Akshaya Nadahalli - Bangalore, IN
Balakrishnan Raman - Fremont CA, US
Chandrasekaran Swaminathan - Bangalore, IN
John Cruz - San Jose CA, US
Maruthi Ram Namburu - Bangalore, IN
Pirabhu Raman - Fremont CA, US
Vijay Sampath - Milpitas CA, US
Vipin Jain - San Jose CA, US

H04L 7/033
H04L 29/08
G06F 16/22
G06F 16/27

Synchronizing the databases maintained by network appliances can support high availability or high throughput topologies, but also consumes the devices' processing resources. To address that resource consumption, the network appliance's packet processing pipeline circuits can process synchronization packets to thereby synchronize the databases. A local data structure can be in a first local state. Processing a network packet can result in changing the local data structure to a second local state. A state sync packet can include state transition data that indicates a state difference between the first local state and the second local state. The state sync packet can be sent to a peer device that is configured to process the state transition data using the peer device's packet processing pipeline circuit. The peer device's packet processing pipeline can use the state transition data to update a peer device data structure that is in the peer device.

20230064845, Mar 2, 2023

Aug 31, 2021

17/463256

- Milpitas CA, US
Sarat Kamisetty - Fremont CA, US
Krishna Doddapaneni - Cupertino CA, US
John Cruz - San Jose CA, US
Loganathan Nallusamy - Bengaluru, IN

H04L 12/26
H04L 12/24
H04L 12/935

An orchestrator can send trace directives to network appliances that indicate a network flow to trace. The network appliances can include packet processing pipelines that each include numerous processing stages. The network appliances implement network rules for processing network flows by configuring the pipeline's processing stages to execute specific policies for specific network packets in accordance with the network rules. The processing stages can also be configured to produce metadata indicating the policies implemented at each stage to process certain network packets in network flows indicated by trace directives. The metadata can be used to produce a trace report that indicates a network packet of the network flow, a first network rule that was applied to the network packet by a one of the first appliance processing stages, and the one of the first appliance processing stages that applied the first network rule to the network packet.

20230068914, Mar 2, 2023

Aug 31, 2021

17/463202

- Milpitas CA, US
Sarat Kamisetty - Fremont CA, US
Krishna Doddapaneni - Cupertino CA, US
John Cruz - San Jose CA, US
Loganathan Nallusamy - Bengaluru, IN

H04L 12/26
H04L 12/24
H04L 29/06
H04L 12/935

Network appliances can use packet processing pipeline circuits to implement network rules for processing network packet flows by configuring the pipeline's processing stages to execute specific policies for specific network packets in accordance with the network rules. Trace reports that indicate network rules implemented at specific processing stages can be more informative than those indicating policies implemented by the processing stages. A method implemented by a network appliance can store network rules for processing network flows by the processing stages of a packet processing pipeline circuit. The method can produce a trace report in response to to receiving a trace directive for one of the network flows wherein one of the processing stages has applied a network rule to a network packet in one of the network flows. The trace report can indicate the network rule in association with the processing stage and the network flow.

20200313955, Oct 1, 2020

Jun 16, 2020

16/903305

- Santa Clara CA, US
John Cruz - Cupertino CA, US
Steven Licking - San Jose CA, US
Michael E. ATTIG - Sunnyvale CA, US

H04L 12/24
H04L 29/06
H04L 12/741

A method of identifying a failed egress path of a hardware forwarding element. The method detects an egress link failure in a data plane of the forwarding element. The method generates a link failure signal in the data plane identifying the failed egress link. The method generates a packet that includes the identification of the egress link based on the link failure signal. The method sets the status of the egress link to failed in the data plane based on the identification of the egress link in the generated packet.