Abstract: Disclosed herein is a method of limiting concurrent updates in a database, comprising adapting each of plurality of computing devices executing one or more applications capable of updating data in one or more databases accessible by a plurality of applications to execute a DB update limiter. The DP update limiter is configured for each update access of the one or more applications to the database(s), identify a DB segment identifier of a destination segment of the database targeted by the respective update access, check an access counter associated with the identified DB segment identifier which is indicative of a number of update accesses currently in progress to the destination segment, enable the respective update access responsive to determining that the access counter is smaller than a certain threshold, and prevent the respective update access responsive to determining that the access counter equals the certain threshold.

Abstract: An iscsi multi-path management system includes a connection module and a routing module deployed at a client. The routing module is adapted to update and maintain a routing table according to real-time updates, the routing table records legitimate paths conforming to a black/white list rule. The connection module includes a connector and a storage volume manager, the connector is adapted to search for an iscsi target that conforms to the black/white list rule at a storage end, establish an iscsi session through a legitimate path, and notify the storage volume manager to execute a mount volume operation; and the connector is further adapted to regularly recheck the established iscsi session according to an updated black/white list rule, and regularly update and acquire the iscsi target at the storage end, so as to establish the iscsi session with the newly acquired iscsi target that conforms to the updated black/white list rule.

Abstract: Prefix entries are efficiently stored at a networking device for performance of a longest prefix match against the stored entries. A prefix entry generally refers to a data entry which maps a particular prefix to one or more actions to be performed by a networking device with respect to network packets or other data structures associated with a network packet that matches the particular prefix. In the context of a router networking device handling a data packet, the one or more actions may include, for example, forwarding a received network packet to a particular “next hop” networking device in order to progress the network packet towards its final destination, applying firewall rule(s), manipulating the packet, and so forth. To reduce a total amount of space occupied by a prefix tree in storage, each of the nodes of a prefix tree may be configured to store only an incremental portion of a prefix relative to its parent node.

Abstract: Techniques and devices for expressing multicast groups using Weave traits are described for generating a multicast address in which a wireless network device receives an application group identifier and hashes the application group identifier to generate a group identifier. The wireless network device concatenates a global identifier and a Weave fabric identifier, inserts the concatenated global identifier and the Weave fabric identifier into a network prefix field of a destination address and inserts the group identifier into a group identifier field of the destination address. The wireless network device sets the value of a plen field of the destination address to a value that indicates a length of the Weave fabric identifier and inserts the destination address into an Internet Protocol version 6 data packet.

Abstract: Various example embodiments for supporting firewalling of traffic are presented. The support for firewalling of traffic may include support for firewalling of layer-2 traffic (e.g., applying firewall rules to layer-3 traffic embedded within layer-2 frames) using a layer-2 firewall. The firewalling of layer-2 traffic by a layer-2 firewall may include support for firewalling of layer-2 traffic associated with various types of layer-2 services. The firewalling of layer-2 traffic by a layer-2 firewall may include support for firewalling of layer-2 traffic for which the layer-2 destination address of the traffic is known and layer-2 traffic for which the layer-2 destination address of the traffic is unknown. The firewalling of layer-2 traffic by a layer-2 firewall may include receiving, by a router, a packet of a flow of a layer-2 service and supporting, by the router, layer-2 firewalling of the packet at the router while honoring layer-2 forwarding of the packet at the router.

Abstract: The present invention relates to a biometric-based identity authentication method and system.

Abstract: An example control system includes a set of light fixtures connected to a hub, where each light fixture includes a hub-communication device configured to communicate with the hub and a direct communication device configured to communicate directly with other light fixtures. Together, the light fixtures form a mesh network facilitated by the use of their direct communication devices. An external device communicates an instruction to a light fixture, and the instruction is propagated throughout the mesh network through communications among the light fixtures using their respective direct communication devices. As a result, each light fixture to which the instruction applies receives and complies with the instructions. The light fixtures are also configured to receive instructions from the hub, such that a light fixture is configured to receive instructions over dual networks.

Abstract: A method and system for operating a multitenancy telephony system including receiving a plurality of call requests associated with an application server; selecting a subset of the received call requests using a load balancer; assigning each selected call request to one of a plurality of resources creating, on the assigned resource, a call session for each selected call request; and coordinating the created call sessions resulting from the selected subset of the received call requests associated with the application server.

Abstract: Described herein are systems, methods, and apparatuses for determining an optimal path in a mesh network. A pre-emptive message, such as a request to send (RTS) message, carrying, for example, an address of a target mobile device, may be sent from an access point to a computing device in a mesh network. The computing device may relay the RTS to the target mobile device. A clear to send (CTS) message and transmission parameters indicating channel conditions may be transmitted from the target mobile device to the access point via the computing device. The access point may determine an optimal path based on the transmission parameters and send data via the optimal path.

Abstract: Techniques for operating a network device for increasing the logical multi-path size of a hardware forwarding table are provided. In some embodiments, the network device may determine that a number of data points in a first node is greater than a maximum node capacity; generate second nodes; update the first node to refer to the second nodes; distribute the data points among the second nodes; and program a hardware table with the updated first node and the second nodes.

Abstract: Ping or traceroute functionality is supported in a path spanning multiple autonomous systems (ASes) having segment routing (SR) enabled, the path including an ingress node in a first autonomous system (AS) and an egress node in an AS other than the first AS, using a reverse path label pair including (1) a node segment identifier (SID) corresponding to an AS Border Router (ASBR) of the second AS (second ASBR), and (2) an egress peer engineering (EPE) SID corresponding to a segment between the second ASBR to an ASBR of the first AS (first ASBR). Responsive to receiving a ping or traceroute request by a router in the second AS, the router generates a ping or traceroute reply including the reverse path label pair. The ping or traceroute reply is forwarded to the second ASBR using the node SID of the reverse path label pair. The ping or traceroute reply is then forwarded from the second ASBR to the first ASBR using the EPE SID of the reverse path label pair.

Abstract: A method includes sending a request for services from a Virtual Machine (VM) in an external cloud network to a provider multi-protocol label switching (MPLS) network, establishing a multi-protocol border gateway protocol (MP-BGP) session between the provider MPLS network and the external cloud network, exchanging control plane updates between the provider MPLS network and the cloud network and processing paths between the provider MPLS network and the remote VM.

Abstract: Approaches for a virtualized Cable Modem Termination System (CMTS) for providing high speed data services to a remote physical device (RPD). The virtualized Cable Modem Termination System (CMTS) comprises a core routing engine (CRE) for performing packet switching and routing and one or more physical or virtual compute servers (CS) that each perform CMTS functions for the one or more remote physical devices (RPDs). Each physical or virtual compute server (CS) connects to the core routing engine (CRE) with a Link Aggregation Group (LAG) of two or more Ethernet links.

Abstract: The present disclosure relates to multi-MAC controllers and single PHY systems and methods. An example method may include receiving, at a remote PHY device and from a first MAC device located at a headend of a network, a first data packet, including a first identifier. The example method may also include determining, by the remote PHY device and using the first identifier included in the first data packet, a first output of the PHY device onto which to transmit the first data packet, the first output including a first group of customer devices. The example method may also include receiving, at the remote PHY device and from a second MAC device located at the headend, a second data packet, including a second identifier. The example method may also include determining, by the remote PHY device and using the second identifier included in the second data packet, a second output of the PHY device onto which to transmit the second data packet, the second output including a second group of customer devices.

Abstract: A table organized into a set of batch units is accessed. A set of N-grams are generated for a data value in the source table. The set of N-grams include a first N-gram of a first length and a second N-gram of a second length where the first N-gram corresponds to a prefix of the second N-gram. A set of fingerprints are generated for the data value based on the set of N-grams. The set of fingerprints include a first fingerprint generated based on the first N-gram and a second fingerprint generated based on the second N-gram and the first fingerprint. A pruning index that indexes distinct values in each column of the source table is generated based on the set of fingerprints and stored in a database with an association with the source table.

Abstract: Various example embodiments for supporting candidate path selection in a communication system are presented. The support for candidate path selection may be based on candidate path preference information of the candidate paths where the candidate path preference information of the candidate paths may be configured for use by network devices in selecting between the candidate paths. The support for candidate path selection based on candidate path preference information of the candidate paths may be provided within the context of candidate path selection which may include failover switching. The support for candidate path selection based on candidate path preference information may be based on support for distribution of the candidate path preference information of the candidate paths to network devices and use of the candidate path preference information of the candidate paths by the network devices to support selection of the candidate paths.

Abstract: A networking router process, by a hardware data plane, a first incoming packet by matching the packet with a routing table of the hardware data plane. A software data plane processes a second incoming packet by matching the packet with a routing table of the software data plane. In response to the processing of the first incoming packet by the hardware data plane failing, subsequently processing, by the software data plane, the first incoming packet by matching the packet with the routing table of the software data plane. The method comprises delivering, from the software and hardware data plane, network traffic flow information to a flow analyzer. The flow analyzer analyzes the network traffic flow information and updates at least one of the routing tables based at least on the analyzed network traffic flow information.

Abstract: An electronic apparatus and a hot-swappable storage device thereof are provided. The hot-swappable storage device includes a carrier, a connector, a controller, and a wireless communication interface. The carrier is configured to carry a plurality of storage components. The connector is configured to be electronically connected to a host end for performing a data transfer operation. The controller detects a connection status between the connector and the host end. The wireless communication interface decides whether to perform the data transfer operation according to the connection status.

Abstract: In one embodiment, associated differential processing of decapsulated packets is performed using Service Function Instances (SFIs) identified by Service Function Values (SFVs) derived from their encapsulating transport packets. By using different SFVs associated with different processing policies within a same processing context, one embodiment performs differential processing of streams of packets (arriving in transport packets) as identified by the particular SFV obtained from each particular transport packet. In other words, the processing policy identifies processing performed on the corresponding decapsulated original packet, not processing of the transport packet. Thus, if the original packet is an Internet Protocol (IP) packet, the SFI identifies Layer 3 processing that is performed on the original IP packet. Additionally, one embodiment uses a route advertising protocol (e.g., Border Gateway Protocol) to distribute associations between different SFVs and different addresses in a processing context (e.

Abstract: A system administrator can specify NAT mappings to perform NAT translations in a switch. The administrator can specify an ACL to filter packets to be translated. Filter rules generated from the ACL are stored in a first memory store in a switch and NAT rules generated from the NAT mappings are stored in a second memory store separate from the first memory store. When a packet matches one of the filter rules a tag that identifies the ACL is associated with the packet. When the tagged packet matches one of the NAT rules, the packet is translated according to the matched NAT rule.

Abstract: An apparatus includes a first communication interface configured to be communicatively coupled, via an optical line, to a network device that is disposed in an optical network using wavelength division multiplexing (WDM). The apparatus also includes a second communication interface configured to be communicatively coupled to a router via an Ethernet connection. The apparatus also includes a signal generator operatively coupled to the first communication interface and the second communication interface. The signal generator is configured to generate an Ethernet signal representing at least one attribute of the optical line between the first communication interface and the network device. The second communication interface is configured to transmit the Ethernet signal to the router.

Abstract: A packet forwarding method includes obtaining, by a network device, a first tunnel identifier of a first packet. When the first tunnel identifier is a first value, and forwarding, by the network device, the first packet based on a first routing group in a virtual routing and forwarding (VRF) table. The first routing group consists of one or more local routes, and each next-hop outbound interface of the one or more local routes is a local outbound interface. The network device forwards the packet based on a local routing group including only a local route in the VRF table such that the packet is forwarded to a local virtual machine for processing, and is not forwarded to another tunnel endpoint device during packet forwarding.

Abstract: Disclosed are systems and methods for a self-contained multi-modal communication system. The multi-modal communication system comprises a first mobile telecommunication node, which provides a private telecommunication network, a layer 2 (L2) backhaul wireless transceiver, an ethernet switch and an embedded edge cloud compute device. The edge cloud compute device includes an automatic failover detection system, wherein the automatic failover detection system receives as input a plurality of network parameters and automatically performs failover and communication modality switching for one or more communication devices associated with the self-contained multi-modal communication system.

Abstract: A method performed by a computing system includes receiving a first request from a first pod being executed on the computing system, responding to the first request with an Internet Protocol (IP) address and a first port range, receiving a second request from a second pod being executed on the computing system, and responding to the second request with the Internet Protocol (IP) address and a second port range that is different than the first port range. The method further includes, with a networking service implemented within the kernel, processing network traffic between external entities and the first and second pods by updating source and destination IP addresses and ports of packets of the network traffic.

Abstract: Described are programmable input output (IO) devices comprising: an match processing unit (MPU) and a memory unit. The MPU comprising at least one arithmetic logic unit (ALU). The memory unit having instructions stored thereon which, when executed by the respective programmable IO device, cause the programmable IO device to perform operations. These operations comprise: receiving, from an inbound interface, a packet comprising packet data for at least one range-based element; determining, via the MPU, a lookup result by performing a modified binary search on an interval binary search tree with the packet data to determine a longest prefix match (LPM), wherein the interval binary search tree maps the at least one range-based element to an associated data element; and classifying the packet based on the lookup result.

Abstract: The disclosure describes techniques for enhancements to the Multicast Source Discovery Protocol (MSDP) to reduce Source Active (SA) message loops in one or more multicast domains having overlapping MSDP mesh groups. In some examples, a method includes receiving, by a first MSDP speaker, from a second MSDP speaker, a SA message. The method also includes, when the second MSDP speaker is in a mesh group with the first MSDP speaker, determining whether the first MSDP speaker includes an active SA state corresponding to the SA message. Additionally, the method includes, when the first MSDP speaker does not include the active SA state corresponding to the SA message, accepting the SA message and forwarding the SA message to a third MSDP speaker that is not in the mesh group with the first MSDP speaker and the second MSDP speaker.

Abstract: An electronic device, a method for domain name query, and related products are provided, which are for an electronic device. The method includes the following. Whether the electronic device enables a link aggregation (SLA) is detected in response to detecting an Internet protocol (IP) address query request for a target domain name. Multiple communication links enabled by the SLA are determined in response to detecting that the SLA is enabled. An IP address corresponding to the target domain name is obtained by querying multiple domain name system (DNS) servers through at least one target communication link of the multiple communication links.

Abstract: The disclosure is directed to a method and system including a first node that stores a first multipoint mesh VPN database including a plurality of underlay addresses in an underlay network for a plurality of nodes, respectively, and a plurality of VPN addresses in a multipoint mesh VPN for the plurality of nodes, respectively. The first node also receives a second multipoint mesh VPN database from a second node, the second multipoint mesh VPN database including underlay and VPN addresses for the third node. The first node further receives a third multipoint mesh VPN database from the third node, the third multipoint mesh VPN database including underlay and VPN addresses for the second node. The first node additionally compares the databases to determine if underlay addresses and VPN addresses are missing from the first multipoint mesh VPN database.

Abstract: Systems and techniques for end-to-end quality of service in edge computing environments are described herein. A set of telemetry measurements may be obtained for an ongoing dataflow between a device and a node of an edge computing system. A current key performance indicator (KPI) may be calculated for the ongoing dataflow. The current KPI may be compared to a target KPI to determine an urgency value. A set of resource quality metrics may be collected for resources of the network. The set of resource quality metrics may be evaluated with a resource adjustment model to determine available resource adjustments. A resource adjustment may be selected from the available resource adjustments based on an expected minimization of the urgency value. Delivery of the ongoing dataflow may be modified using the selected resource adjustment.

Abstract: Various example embodiments for supporting communications for a network (e.g., a local area network (LAN), a virtual LAN (VLAN), or the like) based on use of an identifier of the network are presented. Various example embodiments for supporting communications for a VLAN based on use of a VLAN identifier (VID) of the VLAN are presented. Various example embodiments for supporting communications of a VLAN based on use of a VID of the VLAN may be configured to support use of a variable sized encoding of the VID (denoted herein as an xVID). Various example embodiments for supporting communications of a VLAN based on use of an xVID for the VLAN may be configured to support use of an xVID that is encoded using a set of fixed-sized identifier units where a number of fixed-sized identifier units used to encode the VID in the xVID is based on the VID.

Abstract: Aspects of disclosure provide methods, systems, and computer-readable media for direct data displacement. The methods include in view of a write request pertaining to a first object, determining, based on a first signature of the first object, whether an index of a storage system comprises an existing object record pertaining to the first object; and in response to determining that the index of the storage system does not include an existing object record pertaining to the first signature, creating a first object record in the index comprising the first signature and a reference count. The methods further include in response to determining that the index of the storage system includes an existing object record pertaining to the first signature, updating a reference count associated with the first object stored in the existing object.

Abstract: A serverless application center is provided for multi-cloud deployment of serverless applications. One method comprises providing source code, obtained from a first user acting in a developer role, for a multi-cloud serverless application in a serverless application repository; deploying, in response to a request from a second user acting in an end user role, source code for the multi-cloud serverless application from the serverless application repository to one or more clouds in plurality of distinct cloud environments based on the request; and implementing role-based access for users acting in said developer role and said end user role. A user interface can allow the second user to (i) review a published list of serverless applications available in the serverless application repository; and/or (ii) search a plurality of serverless applications available in the serverless application repository.

Abstract: In some embodiments, a method sets a threshold for utilization of a first table, wherein the utilization is based on layer 3 addresses and layer 2 addresses being stored in the first table. When a utilization of the first table does not meet the threshold, the method stores a layer 3 address in the first table. The first table uses a first type of lookup to determine a next hop address for the layer 3 addresses or the layer 2 addresses, and the first table also stores one or more layer 2 addresses. When the utilization of the first table meets the threshold, the method stores the layer 3 address in a second table where the second table uses a second type of lookup to determine the next hop address for layer 3 addresses.

Abstract: Disclosed are systems and methods for a self-contained multi-modal communication system. The multi-modal communication system comprises a first mobile telecommunication node, which provides a private telecommunication network, a layer 2 (L2) backhaul wireless transceiver, an ethernet switch and an embedded edge cloud compute device. The edge cloud compute device includes an automatic failover detection system, wherein the automatic failover detection system receives as input a plurality of network parameters and automatically performs failover and communication modality switching for one or more communication devices associated with the self-contained multi-modal communication system.

Abstract: Systems and methods for optimizing the internal metadata management of key-value solid state drives (KVSSDs) are provided. A key-to-physical-address (K2P) mapping scheme (resizable hash-based indexing) that focuses on index resizing and space optimization can be used. The resizable metadata management scheme can efficiently handle a highly variable workload in an incredibly large keyspace. It can provide predictable metadata access cost, as well as fast membership checking. The metadata management structure can be designed to ensure near-constant performance in terms of metadata access cost and fast membership checking.

Abstract: A system, apparatus and method are provided for dynamically updating a configuration of a network device when relevant sources and destinations of network traffic are added, removed or migrated in a network. A configuration of a network device is associated with a set of network addresses representing a set of relevant sources and destinations of network traffic. The set is dynamic in that the membership of the set can change over time to include different network addresses as the set of relevant sources and destinations of network traffic changes over time. One or more data sources are monitored to obtain the network addresses for the set of relevant sources and destinations and to determine if the membership of the set has changed. When a change is detected, the configuration of the network device is updated on the network device to reflect the network addresses that are currently in the set.

Abstract: At least one processing device is configured to register a logical storage device of a storage system for a first set of paths associated with a first access protocol using a host identifier, to send a first reservation command in the first access protocol over each of the paths in the first set of paths, to register the logical storage device of the storage system for a second set of paths associated with a second access protocol using the same host identifier used in registering the logical storage device for the first set of paths, to receive an additional reservation command in the first access protocol, and responsive to receipt of the additional reservation command in the first access protocol, to translate the additional reservation command to the second access protocol, and to send the additional reservation command in the second access protocol to the storage system.

Abstract: A universal serial bus (USB) device includes a first storage device, a controller, and a second storage device. The first storage device is configured to store input packets to be transmitted to a USB host. The controller is configured to receive the input packets of the first storage device, respectively compute hash values of the input packets, and respectively label first identifiers in the input packets according to the hash values to correspond to one of cores of a central processing unit at the USB host end. Among the input packets, the input packets with the same hash value are labeled with the same first identifier. The second storage device is configured to store the input packets that are labeled with the first identifier. The controller is further configured to allow the input packets stored in the second storage device to be transmitted to the USB host.

Abstract: Metadata indicating that a virtual traffic hub enabling connectivity between a plurality of isolated networks has been established is stored. A determination is made that a first entry of a first isolated network attached to the hub is to be represented in a second routing table of a second isolated network attached to the hub, e.g., to enable network packets originating at resources of the second isolated network to be transmitted via the hub to the first isolated network. A new entry corresponding to the first entry is included in the second routing table.

Abstract: Described herein are systems, methods, and software to manage virtual routing and forwarding (VRF) in a computing environments. In one example, a management service identifies a registration or import of a route target (RT) to communicate in a VRF and identifies a first unique identifier associated with the RT. The management service further identifies a second unique identifier associated with the VRF and compares the first unique identifier to the second unique identifier. When the unique identifiers match, the management service determines that intra-VRF encryption is required for the communication. In contrast, when the unique identifiers do not match, then the management service determine that inter-VRF encryption is required for the communication.

Abstract: The present disclosure relates to searching for and committing low-frequency data to a database. An example method generally includes receiving, from a requesting application, a query for data from the data repository. A database system retrieves a set of indices associated with the data specified in the query from an index table in the data repository. Upon determining that the set of indices comprises a non-null set, the database system retrieves records associated with each index in the set of indices from a data table associated with the index table and returns the retrieved records to the requesting application.

Abstract: In accordance with embodiments, there are provided mechanisms and methods for facilitating metadata-based statistics-oriented query processing for large datasets in an on-demand services environment. In one embodiment and by way of example, a method comprises evaluating metadata associated with a query placed on behalf of a tenant in a multi-tenant environment, and computing process statistics for the query based on the metadata, where the process statistics reveal an estimation of resources needed for execution of the query within a predictable amount of time and using fewer than or equal to an allocated number of scans of a database. The method may further include associating, based on the process statistics, a set of rules and the estimated resources to process the query, and executing the query based on the set of rules and using the estimated resources such that the query is processed within the predictable amount of time and using fewer than or equal to the allocated number of scans of the database.

Abstract: A communications connection detection method includes sending, by a first network node, a detection request packet to a second network node, where the detection request packet is used to detect whether the first network node and the second network node are in a connected mode, deleting, by the first network node, a next hop resolution protocol (NHRP) table between the first network node and the second network node when the first network node determines that the first network node does not receive a detection response packet sent by the second network node.

Abstract: Various systems and methods for performing bit indexed explicit replication (BIER). For example, one method involves receiving a membership message that was generated by an egress router, where the membership message comprises information identifying a multicast group, and information identifying a plurality of egress routers. The method identifies at least one bit position in the membership message that is associated with the first egress router, where at least one bit position of the plurality of bit positions is associated with the first egress router. The method also records membership of the first egress router in the multicast group, where the membership is recorded in a bit of a group membership table, and the bit corresponds to the bit position identified in the membership message.

Abstract: The present technology pertains to a system and method for extending enterprise networks' trusted policy frameworks to cloud-native applications. The present technology comprises sending, by an enterprise network controller, a first communication to a service mesh orchestrator for a service mesh, wherein the first communication informs the service mesh orchestrator of traffic segmentation policies to be applied to traffic originating at an enterprise network and of layer 7 extension headers which correspond to the enterprise network traffic segmentation policies.

Abstract: Methods are provided for mitigating hash correlation. In this regard, a hash correlation may be found between a first switch and a second switch in a network. In this network, a first egress port is to be selected among a first group of egress ports at the first switch for forwarding packets, and a second egress port is to be selected among a second group of egress ports at the second switch for forwarding packets, where the first group has a first group size and the second group has a second group size. Upon finding the hash correlation, a new second group size coprime to the first group size may be selected, and the second group of egress ports may be mapped to a mapped group having the new second group size. The second switch may be configured to route packets according to the mapped group.

Abstract: Techniques for facilitating load balancing in distributed computing systems are disclosed herein. In one embodiment, a method includes receiving, at a destination server, a request packet from a load balancer via the computer network requesting a remote direct memory access (“RDMA”) connection between an originating server and one or more other servers selectable by the load balancer. The method can also include configuring, at the destination server, a rule for processing additional packets transmittable to the originating server via the RDMA connection based on the received reply packet. The rule is configured to encapsulate an outgoing packet transmittable to the originating server with an outer header having a destination field containing a network address of the originating server and a source field containing another network address of the destination server.

Abstract: The disclosure provides an approach for routing traffic in a network. Embodiments include receiving, by a service router of an edge services gateway (ESG), a packet comprising a virtual network identifier (VNI) and a virtual local area network (VLAN) identifier. Embodiments include sending, by the service router, the packet to a virtual switch of the ESG based on the VNI of the packet. Embodiments include determining, by the virtual switch, a virtual routing and forwarding (VRF) router of the ESG for the packet based on the VLAN identifier. Embodiments include forwarding, by the virtual switch, the packet to the VRF router.

Abstract: Embodiments of the invention are directed to a method. The method may comprise receiving a second biometric template of a user, and providing an authentication request message comprising an electronic identity and a derivative of the second biometric template of the user to a resource provider computer to conduct an interaction. The authentication request may be forwarded to a processing server computer by the resource provider computer, and the user device may receive an authentication response message comprising an authentication result from the processing server computer. The authentication result may be determined by the processing server computer based on a comparison of the derivative of the second biometric template to a derivative of a first biometric template accessible to the processing server computer. The authentication result may also be based on the validity of the electronic identity.

Abstract: A routing protocol, the routing protocol includes the steps of: receiving a packet at an ingress node of a distributed router, the ingress node having an ingress node address, and the packet having a packet header containing a global destination address; converting the global destination address into a local destination address, the local destination address identifying a location on the distributed router; and routing the packet to the local destination address.