Abstract: Novel tools and techniques are provided for implementing programmable protocol-independent session processor (“PPSP”)-based communications. When a computing system determines that a first administrative domain and a second administrative domain require different signaling protocols to establish communication sessions for user devices in the two administrative domains, the computing system may convert one or more signaling protocols used by the two administrative domains into a common signaling protocol, and may establish an end-to-end (“E2E”) real-time communication session between the user devices in the two administrative domains, using the common signaling protocol.

Abstract: Novel tools and techniques are provided for implementing real-time fault management or real-time fault management system (“RFM”). In various embodiments, RFM may receive alerts from or associated with network devices (e.g., layer 2, 3, and/or 4 devices, or the like) that are disposed in a plurality of disparate networks that may utilize different alert management protocols and/or different fault management protocols. RFM may collect, enrich, normalize, aggregate, and display the alerts in a user interface to facilitate addressing of the alerts by a user. To enable continuous and real-time functionality, RFM may be implemented in a plurality of siloed platforms in a primary data center, with processing of alerts being load balanced across the siloed platforms, with mirrored group of siloed platforms in a secondary data center located geographically distant from the primary data center and configured to be on “hot standby” and to completely take over RFM processing operations.

Abstract: Apparatus, systems, methods, and the like, for autonomous scaling of security and other network services through initialization of a service from a network service device and/or migration of such services from one service device to another is provided. Such network scaling may allow for migration of services from existing service edges to other service edges. A security management system may coordinate the migration of services provided to a secondary network from one or more service edges to another, separate service edge while providing session synchronization during the migration. To migrate the services from the first service edge to a second service edge, a session table may be shared between the service edges and the first and second service edges may advertise service routes or endpoints with one or more priority values to control or otherwise determine which service edge is selected by a service-receiving device to receive the services.

Abstract: A method is disclosed for testing network devices for networks with a large traffic load utilizing one or more traffic load amplifiers to amplify the traffic load. The load amplifiers connected to the device may receive packets of an initial traffic load, multiply or copy the received packet, alter the destination address information in the header of the copied packets to generate packets with different destination addresses, and transmit the altered packets back to the device for further routing. The altered or copied packets may then be routed via the device back to the load amplifier for further amplification. Through this amplification process, a small initial load of packets may be amplified over and over by the load amplifiers until a target traffic load is achieved at the device to test the device performance at a large traffic load.

Abstract: Novel tools and techniques are provided for implementing intelligent alert automation ("IAA"). In various embodiments, IAA receives alert/event feeds from several different alerting and ticketing systems via input Redis queues, and uses a triage system to determine whether to process the alert/event or disregard it. If so, IAA may create a flow instance, assign a unique instance ID, and place the flow instance in one of a plurality of jobs queues based on alert/event type and/or or source. An abattoir system retrieves a flow instance from one of the jobs queues (in order of the queue's priority), and processes the next node or step in the flow instance. The flow instance is placed back into the jobs queue for subsequent processing by the same or different abattoir system until no additional nodes or steps remain in the flow, at which point the flow instance is considered complete.

Abstract: Systems and methods for enforcing compliance-program conformity during authorization-token generation are presented. Applications may be registered with an identity and access management (IAM) system. The registration of the application may include whether the application is subject to one or more compliance program(s). When an authorization token is requested from the IAM system, the IAM system may (a) determine the set of authorization information needed in the token, and (b) determine whether the application is subject to a compliance program. The IAM system may then check an approval source of record to determine whether the user was legitimately approved for the required authorization prior to granting an authorization token. If there is a mismatch between the approval source of record and the authorization information associated with the user identity, then the mismatch may cause certain mitigation actions to be performed.

Abstract: Implementations include providing security services to workloads deployed across various types of network environments, such as public networks, private networks, hybrid networks, customer premise network environments, and the like, by redirecting traffic intended for the service device through a security environment of the first network. After application of the security features to the incoming traffic, the “clean” traffic may be transmitted to the service device instantiated on the separate network via a tunnel. Redirection of incoming traffic to the security-providing first network may include correlating a network address of the service device to a reserved network address of a block of reserved addresses and updating a Domain Name Server (DNS) or other address resolving system with the reserved address. The return transmission tunnel may be established between the security environment and the network address of the service device.

Abstract: A device for performing event-driven diagnostics may identify a service identifier of a service provided by the communications network to a customer; identify, based on the service identifier, a persisted path for the service, the persisted path generated prior to any user request to perform a diagnostic on the service, and the persisted path including devices and interfaces used to provide the service; receive performance metrics of the devices and interfaces of the persisted path; detect, without receiving any user request to perform a diagnostic on the service, based on comparisons of the performance metrics to event criteria, an occurrence of an event in the persisted path; and present, based on the occurrence of the event, a notification of the event to the customer.

Abstract: Aspects of the present disclosure involve systems, methods, computer program products for consolidating toll-free and/or tolled features of two or more telecommunications networks. The networks may be consolidated via an Enhanced Feature Server (EFS) deployed in a telecommunications network. The EFS may be configured to receive a toll-free and/or tolled communication and route the communication based on the dialed toll-free number and a carrier identification code (CIC) associated with the communication, or based on the dialing number and a CIC. Routing the communication based at least on the CIC associated with the communication allows the telecommunications network to consolidate a redundant network from the telecommunications network. In circumstances where a CIC is not associated with a communication, the EFS may request a data schema from a toll-free database, or from an automatic number identification (ANI) database, and determine a CIC based on an analysis of the data schema.

Abstract: Novel tools and techniques are provided for implementing provisioning of network services via passive optical network (“PON”) ports that have been incorrectly assigned or connected. In response to receiving an indication that a first port, of a PON terminal, to which a first customer premises equipment (“CPE”) at a first customer premises has been assigned to be connected is already being used to connect a second CPE at a second customer premises, a computing system may identify a second port that is available to provide network services, may autonomously cause re-assignment of the first CPE from the first port to the second port, within a service provider database, may autonomously cause updating of network configurations of the first CPE to enable provisioning of network services over the second port, and may autonomously cause provisioning of network services to the first CPE via the second port, based on the re-assignment.

Abstract: Novel tools and techniques are provided for implementing name-based routing through networks. In various embodiments, a broker manager in each of a plurality of networks may receive a subscription request for a network device from a client device, each device being locally accessible or disposed in an upstream or downstream network. The broker manager uses its client broker to communicate with a locally accessible client device, and uses its mediator broker (and, sometimes, an intermediate device(s)) to communicate with a locally accessible network device. The broker manager otherwise uses its messaging brokers to communicate with control channels of one or more networks. Once subscription with the network device has been established, any commands and responses between the client device and the network device may be routed over pub/sub channels via the broker managers and their brokers using name-based routing, without routing based on IP address of the network device.

Abstract: This disclosure describes systems, methods, and devices related to using an application programming interface (API) gateway orchestration layer. A method may include identifying, by the API gateway orchestration layer, a first API request, received by an API gateway API, to access a first microservice of a first API gateway that uses a first API gateway model; identifying a second API request, received by the API gateway API, to access a second microservice of a second API gateway that uses a second API gateway model; determining, based on the first API request, a first route to the first API gateway; determining, based on the second API request, a second route to the second API gateway; routing the first API request to the first microservice based on the first route; and routing the second API request to the second microservice based on the second route.

Abstract: Novel tools and techniques are provided for implementing cloud-based voice calling service, video calling service, and/or over-the-top (“OTT”) services. In various embodiments, with a unified communications and collaboration interconnection (“UCCI”) interconnection established between separate hyperscalers or communication service providers that have separate administrative domains, Internet Protocol (“IP”) based communications services may be instantiated between a first user device or a first telephone number (or call identifier (“ID”)) via a first hyperscaler and a second user device or a second telephone number (or call ID) via a second hyperscaler, without touching or traversing the public switched telephone network (“PSTN”).

Abstract: Novel tools and techniques are provided for implementing name-based routing through networks. In various embodiments, a broker manager in each of a plurality of networks may receive a subscription request for a network device from a client device, each device being locally accessible or disposed in an upstream or downstream network. The broker manager uses its client broker to communicate with a locally accessible client device, and uses its mediator broker (and, sometimes, an intermediate device(s)) to communicate with a locally accessible network device. The broker manager otherwise uses its messaging brokers to communicate with control channels of one or more networks. Once subscription with the network device has been established, any commands and responses between the client device and the network device may be routed over pub/sub channels via the broker managers and their brokers using name-based routing, without routing based on IP address of the network device.

Abstract: The present application describes a system and method for passively collecting DNS traffic data as that data is passed between a recursive DNS resolver and an authoritative DNS server. The information contained in the collected DNS traffic data is used to generate a virtual authoritative DNS server, or a zone associated with the authoritative DNS server, when it is determined that the authoritative DNS server has been compromised.

Abstract: Novel tools and techniques are provided for implementing management of edge network protection service. In various embodiments, a computing system may receive a request from a customer to manage edge network protection services for at least one Internet circuit. Based on a determination that the customer has been provisioned one or more circuits that are capable of implementing edge network protection services, the computing system may present, or cause to be presented, options to select a circuit, from among the one or more circuits, for which edge network protection service should be provisioned or managed. When a selection of a first circuit is received from the customer, the computing system may automatically cause the selected first circuit to be configured to provision a new service instance of the edge network protection service or reconfigured to modify an existing service instance of the edge network protection service.

Abstract: Disclosed are systems and methods that provide a decision-intelligence (DI)-based, computerized framework for automatically and/or dynamically managing connectivity and/or operation of assets on/over an electronic network. The disclosed framework functions in relation to providing network management, inclusive of inventor and network reconciliation, via a network data quality management tool (NDQ). The NDQ framework is configured for advanced network data discovery, provisioning analysis, discrepancy resolution, monitoring processes, and the like. The disclosed NDQ framework serves as a comprehensive, automated solution for ensuring accurate network data and seamless network management by integrating advanced analytics, multi-platform compatibility, and automation capabilities.

Abstract: Disclosed herein are system, method, and computer program product embodiments for providing an API description of an external network service and using the API to integrate the external service into a network. An embodiment operates by receiving, from a service provider, a description of an application programming interface (API), transmitting a call to the service provider using the API for creating a new instance of a service and transmitting to the service provider a traffic flow upon which the service will be applied.

Abstract: In a network, Domain Name Service (DNS) queries may be handled by one or more resolvers and one or more authoritative name servers. If a DNS distributed denial of service attack is launched against the network, it may degrade the performance of the authoritative name servers. As such, systems and methods for protection of authoritative name servers are provided.

Abstract: Novel tools and techniques are provided for implementing network service ordering and provisioning of secure access service edge (“SASE”) software packages. In various embodiments, a computing system may provide a user experience (“UX”) platform for a customer portal, the UX platform being accessible by a user via a user device over a first network(s); may provide, via the UX platform, options to configure, via the customer portal, one or more SASE-based network services among a plurality of network services provided by a service provider; and may autonomously orchestrate deployment and configuration of the one or more SASE-based network services via one or more customer premises equipment (“CPE”) that are associated with the user or to an entity with which the user is associated, over a second network(s), based at least in part on user selection of at least one option to configure the one or more SASE-based network services.