Abstract: In one embodiment, a method includes receiving energy efficiency data from a plurality of nodes within a network. The method also includes determining an energy efficiency node quotient for each of the plurality of nodes within the network to generate a plurality of energy efficiency node quotients and determining an energy efficiency path quotient for each of a plurality of paths within the network to generate a plurality of energy efficiency path quotients. The method further includes determining one or more policies associated with the plurality of paths and selecting a path from the plurality of paths based at least on the plurality of energy efficient path quotients and the one or more policies.

Abstract: A method to operate a multi-link wireless device. The method includes establishing at least a first multi-link device interface and a second multi-link device interface, exposing, via a virtual data port, the first multi-link device interface and the second multi-link device interface at a data processing layer of the wireless device, selecting one of the first multi-link device interface and the second multi-link device interface, as a selected multi-link device interface, based on performance information associated with a first radio and a second radio associated, respectively, with the first multi-link device interface and the second multi-link device interface, and wirelessly transmitting a packet from the wireless device by routing the packet through the selected multi-link device interface.

Abstract: Techniques for leveraging efficient metadata communications to improve domain name system (DNS) security are described. The DNS service uses a hash value to uniquely identify a client, and detect any change in metadata in order to keep policies up-to-date for the client. In an example method a first DNS query for a client device is intercepted. A cryptographic hash function is applied to metadata associated with the client device to generate a hash value. The hash value is added to an additional records section of the first DNS query to generate a second DNS query. The second DNS query is transmitted to a DNS service. The metadata associated with the client device is transmitted to the DNS service on an out-of-band encrypted channel. A DNS response, including the hash value, is received from the DNS service and transmitted to the client device.

Abstract: The present disclosure is related to dynamic methods of managing roaming of client devices at boundaries of area serviced by access points. In one aspect, a method includes estimating by a controller, first signal information of a signal transmitted by an access point and received at a client device, the first signal information being from the perspective of the access point, the client device operating at a boundary of an area serviced by the access point; determining, by the controller, second signal information for the signal, the second signal information being from the perspective of the client device; and performing, by the controller, roaming management of the client device based on the first signal information and the second signal information.

Abstract: Presented herein are techniques for scheduling Ultra-Wideband (UWB) anchors and mobile devices for client ranging. A control device can determine respective ranging priorities for a plurality of mobile devices, which are each assigned to at least one UWB anchor. The control device can obtain at least one collision mapping identifying, for a respective pair of the mobile devices, a collision probability that a UWB signal associated with a ranging procedure involving a first mobile device of the respective pair will collide with a UWB signal associated with a ranging procedure involving a second mobile device of the respective pair. The control device can establish a ranging schedule for the mobile devices and UWB anchors based on the respective UWB ranging priorities and the collision mapping(s). The control device can send at least one command to cause UWB ranging procedures to be performed according to the ranging schedule.

Abstract: Presented herein are infrastructure triggering techniques for secure Ultra-Wideband (UWB) ranging. In one example, a method may include providing UWB ranging parameters to a mobile device via a first radio communication, wherein the first radio communication is a non-UWB radio communication; and triggering the mobile device to perform UWB ranging with a UWB anchor, wherein the triggering is performed using a second radio communication. In another example, a method may include, obtaining, by a mobile device, UWB ranging parameters for a geographic area; obtaining a UWB ranging instruction for the geographic area; and performing UWB ranging with a target UWB anchor based on the UWB ranging parameters and the UWB ranging instruction.

Abstract: Presented herein are techniques for assigning Ultra-Wideband (UWB) anchors for client ranging. A location server can estimate a coarse location of a mobile device using a localization technique other than a UWB localization technique. The localization technique can involve multiple wireless access points or other radio devices. The location server can define an area around the coarse location to identify a set of candidate anchors for UWB ranging. The set of candidate anchors can be disposed within the area and include at least a subset of the radio devices. The location server can modify the set of candidate anchors to create a modified set of candidate anchors that includes only UWB-enabled devices. The location server can select a primary anchor from the modified set of candidate anchors and send a command to cause a UWB ranging procedure to be initiated between the primary anchor and the mobile device.

Abstract: Systems, methods, and computer-readable media for the secure creation of application containers for 5G slices. A MEC application in a MEC layer of a 5G network can be associated with a specific network slice of the 5G network. A backhaul routing policy for the MEC application can be defined based on the association of the MEC application with the specific network slice of the 5G network. Further, a SID for the MEC application that associates the MEC application with a segment routing tunnel through a backhaul of the 5G network can be generated. A MEC layer access policy for the MEC application can be defined based on the SID for the MEC application. As follows, access to the MEC application through the 5G network can be controlled based on both the backhaul routing policy for the MEC application and the MEC layer access policy for the application.

Abstract: Disclosed are methods, systems, and non-transitory computer-readable media for using a sponsor as a proxy for multi-factor authentication of a first user account for a first user when a primary multi-factor authentication mechanism is unavailable to the first user account, comprising registering the sponsor in a multi-factor authentication chain of trust associated with the first user account; requesting verification of an identity of the first user from the sponsor; receiving, from the sponsor, a verification of the identity of the first user; and granting access to a service to the first user account.

Abstract: Presented herein are techniques for assigning Ultra-Wideband (UWB) anchors for client ranging. A control device can monitor UWB ranging between a mobile device and a primary anchor. In response to determining that a signal strength between the mobile device and the primary anchor is below a threshold, the control device can identify anchors for which the mobile device has had a signal strength above the threshold during a period of time, and select one of the anchors as a new primary anchor for the mobile device. For example, the control device can select the new primary anchor based on a relative collision tolerance mapping for the new primary anchor and at least one other anchor within a UWB range of the new primary anchor. The control device can send a command causing UWB ranging to be performed between the mobile device and the new primary anchor.

Abstract: A method comprising: at a multi-link device (MLD) configured for multi-link operation: establishing a first Internet Protocol (IP) stack of a first IP type and configured with a first IP address of the first IP type, wherein the first IP stack is associated to a first MLD media access control (MAC) address of a first station of the MLD; establishing a second IP stack of a second IP type and configured with a second IP address of the second IP type, wherein the second IP stack exists concurrently with the first IP stack and is associated to a second MLD MAC address of a second station of the MLD; and exchanging, with a peer MLD, IP traffic using one or more of (i) the first IP stack and the first MLD MAC address, and (ii) the second IP stack and the second MLD MAC address.

Abstract: A method is provided that is performed for a wireless network that includes one or more wireless client devices that may rotate their media access control (MAC) address used for wireless communication with one or more wireless access point devices in the wireless network. The method includes determining an impact of MAC address rotation by the one or more wireless client devices on operational resources of one or more networking devices or networking processes in a network infrastructure associated with the wireless network. The method further includes scheduling MAC address rotation by the one or more wireless client devices according to the impact on operational resources of the one or more networking devices or networking processes in the network infrastructure.

Abstract: Systems, methods, and computer-readable media for enforcing data sovereignty policies in a cloud environment are provided. An example method can include sending, by a cloud provider, to a government entity associated with a geographic area, a request for device certificates for nodes located within the geographic area; receiving device certificates for the nodes; creating a data sovereignty policy specifying that data associated with the government entity must be stored on nodes located within the geographic area; based on the device certificates, verifying those of the nodes that comply with the data sovereignty policy; and storing the data associated with the government entity on those of the nodes verified to comply with the data sovereignty policy.

Abstract: Cloud services are provided by a distributed network including a number of geographically distributed datacenters, to client devices in accordance with data sovereignty requirements. A server within the distributed network may receive a service request and determine whether it complies with the data sovereignty requirements of the client. When the geographic location of the server does not comply with the client's data sovereignty requirements, the server may determine and transmit back to the client device a set of alternative datacenters within the distributed network that comply with the client's data sovereignty requirements. The client device may use network probes to select an alternative datacenter, and the cloud service request of the client device may be migrated from the server to the selected datacenter.

Abstract: Techniques herein facilitate policy-based wireless infrastructure-initiated device address rotations for wireless devices of a wireless local area network (WLAN). In one example, a method may include obtaining device information for a plurality of wireless devices connected to the wireless network infrastructure; associating a first wireless device of the plurality of wireless devices with a Media Access Control (MAC) address rotation policy based on device information obtained for the first wireless device; determining that a MAC address rotation is to be performed for the first wireless device based on the MAC address rotation policy; and triggering the MAC address rotation for the wireless device via the wireless network infrastructure.

Abstract: A server that includes a graphics processing unit (GPU) may receive, from a first application that is remote from the server, a first request to reserve a first number of cores of the GPU for a first amount of time. The server may also receive, from a second application that is also remote from the server, a second request to reserve a second number of cores of the GPU for a second amount of time that at least partly overlaps the first amount of time. The server may determine that the first request is associated with a higher priority than the second request and, in response, may reserve the first number of cores for the first amount of time for the first application. The server may send, to the first application, an indication that the first number of cores have been reserved as requested by the first application.

Abstract: Techniques for utilizing a cloud service to compute an end-to-end SLA-aware path using dynamic software-defined cloud interconnect (SDCI) tunnels between a user device and an access point-of-presence (POP) node and inter-POP tunnels of the SDCI. The cloud service may include a performance aware path instantiation (PAPI) component including a POP database for storing performance metrics associated with the POPs of the SDCI, an enterprise policy database for storing user specific policies, and/or a path computation component. The path computation component may compute the path, based on the user specific policies, performance metrics associated with the POP nodes, and/or real-time contextual data associated with the user device and/or destination device. The path may include a first tunnel between the user device and the most optimal access POP node of the SDCI and a second tunnel between the access POP node, through the internal POP nodes, and to the destination device.

Abstract: The disclosed technology provides solutions that enable scalable and secure data retrieval between microservices by using microservice attributes to encrypt container based data stores. A process of the technology can include steps for: instantiating a first microservice and a second microservice in a cloud environment, wherein the first microservice is associated with a first attribute label and the second microservice is associated with a second attribute label, generating a first key based on the first attribute label and a second key based on the second attribute label, associating a first data store with the first microservice, wherein the first data store is encrypted using the first key, and associating a second data store with the second microservice, wherein the second data store is encrypted using the second key. Systems and machine readable media are also provided.

Abstract: The disclosed technology relates to a process for metered training of fog nodes within the fog layer. The metered training allows the fog nodes to be continually trained within the fog layer without the need for the cloud. Furthermore, the metered training allows the fog node to operate normally as the training is performed only when spare resources are available at the fog node. The disclosed technology also relates to a process of sharing better trained machine learning models of a fog node with other similar fog nodes thereby speeding up the training process for other fog nodes within the fog layer.

Abstract: In one embodiment, a method comprises: determining, by a constrained network device in a low power and lossy network (LLN), a self-estimated density value of neighboring LLN devices based on wirelessly receiving an identified number of beacon message transmissions within an identified time interval from neighboring transmitting LLN devices in the LLN; setting, by the constrained network device, a first wireless transmit power value based on the self-estimated density value; and transmitting a beacon message at the first wireless transmit power value, the beacon message specifying the self-estimated density value, a corresponding trust metric for the self-estimated density value, and the first wireless transmit power value used by the constrained network device for transmitting the beacon message.