Abstract: A method and apparatus for managing requests in a computer network. A request for a resource from a first node is received by a second node. The request for a resource comprises a header with a timeout indication corresponding to an amount of time the first node will wait for a response to its request for the resource. The second node sends to the first node a response to the request for the resource prior to the end of the amount of time indicated in the timeout indication. The response to the request comprises either the resource or an error message.

Abstract: An improved autonegotiation approach includes determining that a negotiated rate between a first network device and a second network device exceeds data transfer capacity over a network path downstream of the second network device. In response, a configuration message is generated and transmitted to the first network device. When received by the first network device, the configuration message causes the first network device to limit data transfer between the first network device and the second network device to no more than the downstream data transfer capacity.

Abstract: Novel tools and techniques are provided for implementing self-service border gateway protocol ("BGP") instantiation. In examples, a computing system may receive, via a user interface ("UI"), a user input to order a network service, the user input including a physical address of a building in which network service is to be provided. The computing system may exchange BGP information with a gateway device located at a customer premises associated with the physical address, and may autonomously identify a set of network routes between the gateway device and a network node that connects to service provider networks. The computing system may autonomously generate a BGP session based on the set of network routes and on the BGP information, may autonomously establish a network connection between the gateway device and the network node based on the BGP session, and may provision the network service over the network connection.

Abstract: In a network, Domain Name Service (DNS) queries may be handled by one or more resolvers and one or more authoritative name servers. If a DNS distributed denial of service attack is launched against the network, it may degrade the performance of the authoritative name servers. As such, systems and methods for protection of authoritative name servers are provided.

Abstract: Novel tools and techniques are provided for implementing name-based routing through networks. In various embodiments, a broker manager in each of a plurality of networks may receive a subscription request for a network device from a client device, each device being locally accessible or disposed in an upstream or downstream network. The broker manager uses its client broker to communicate with a locally accessible client device, and uses its mediator broker (and, sometimes, an intermediate device(s)) to communicate with a locally accessible network device. The broker manager otherwise uses its messaging brokers to communicate with control channels of one or more networks. Once subscription with the network device has been established, any commands and responses between the client device and the network device may be routed over pub/sub channels via the broker managers and their brokers using name-based routing, without routing based on IP address of the network device.

Abstract: Novel tools and techniques are provided for implementing monitoring and detection of fraudulent or unauthorized use in telephone conferencing systems or voice networks. In various embodiments, a computing system might monitor call activity through telephone conferencing system or voice network. In response to detecting use of the telephone conferencing system or voice network by at least one party based on the monitored call activity, the computing system might identify incoming and/or outgoing associated with a call initiated by the at least one party. The computing system might analyze the identified incoming and/or outgoing call data to determine whether the call initiated by the at least one party constitutes at least one of fraudulent use or unauthorized use of the telephone conferencing system or voice network. If so, the computing system might initiate one or more first actions.

Abstract: Novel tools and techniques are provided for implementing object-based changes to filter-intent over multicast or publication/subscription ("Pub/Sub") distribution. In various embodiments, a computing system (e.g., a managed device among a plurality of managed devices and/or its corresponding agent) may receive, from a network filter orchestration conductor, a global filter-intent list including a first filter intent that references a corresponding filter-intent object. The computing system may determine whether the at least one first filter intent applies to the managed device. If so, the computing system may translate the at least one first filter intent into a first filter that is specific to a first configuration of the managed device, in some cases, by building the first filter based at least in part on the at least one first filter intent. The computing system may subsequently apply the first filter to one or more network communications handled by the managed device.

Abstract: The present application describes systems and methods for secured network information transmission. A network tunnel may be established from a customer premises equipment (CPE) to a routing device at a provider site. The network tunnel may traverse over one or more networks while maintaining a secure path for data. A customer may indicate a chosen configuration for a CPE, and a device at a provider site, a customer device, and/or the CPE itself may automatically, or manually, configure the CPE based on the chosen configuration to allow and/or disallow certain customer network information from being received and/or transmitted through the network tunnel.

Abstract: Disclosed are systems and methods that provide a decision-intelligence (DI)-based, computerized framework for automatically and dynamically managing fiber assets within a distributed ledger. The framework operates via predicted insights into how a fiber optic network, inclusive of the fiber assets as a whole and/or individualized, can be optimized to provide accurate, efficient and/or reliable network facilities for associated entities. OTDR data can be utilized by the framework to perform maintenance, troubleshooting and/or to ensure the network operates efficiently. Accordingly the framework can operate to manage, analyze and utilize such forms and/or types of data to curate computerized fiber optic solutions for the fiber optic networks and/or the entities that are operating therefrom, which can be effectuated via the implementation of the disclosed systems and methods within a fiber optics network infrastructure.

Abstract: Systems and methods for ingesting, managing, and distributing configuration data in one or more computing networks are provided. In examples, a flexible configuration definition framework is provided to allow for simplified ingestion, management, and distribution of configuration data to various computing devices in complex networks. Rather than table data, the framework permits expression of configuration settings in a non-relational, text-based data format to allow easy searching and filtering of configuration data and targeted distribution of data to machines and applications within the network(s).

Abstract: Novel tools and techniques are provided for implementing generation of real-time metrics of an edge-to-edge network. In examples, a CPE, located at a customer premises, sends a test packet(s) to a responder server in a core network over a path therebetween through a metro network. The CPE receives a response to the test packet(s) from the responder server, and measures network characteristics, based on the response. The CPE stores the network characteristics as part of first data in a local memory of the CPE, and pushes the first data to a cloud storage database in which is stored a digital twin of the first data. An orchestration system aggregates network characteristics data from digital twins of data associated with a plurality of CPE, identifies patterns by analyzing collected network characteristics data, and generates and sends a report containing the identified patterns and suggested actions for the identified patterns.

Abstract: Novel tools and techniques are provided for implementing an enhanced optical line terminal ("OLT") with Layer 3 functionality. In examples, a computing system, which is located within a network of a service provider, receives a request for an Internet protocol ("IP") address from an OLT. The computing system assigns a first IP address to the OLT, from a list of IP addresses reserved for assignment to customer premises equipment ("CPE") to be connected to the network. The computing system sends at least one test packet to the OLT over a path through the network, based on the first IP address, the path including network nodes that transport data traffic over Layer 3 of the network. The computing system receives a response to the at least one test packet from the OLT, measures network characteristics based on the response, and sends the network characteristics to a device.

Abstract: In a network system in which a server receives packets each including a source address, and in which the server ordinarily responds to each packet, Distributed Denial of Service attacks may be launched by malicious actors controlling a plurality of network devices. In such an attack, the attacking devices may spoof the IP address of a legitimate device, e.g., they may include, in each packet, the source address of the legitimate device. As such, systems and methods for increased security using client address manipulation are provided.

Abstract: Novel tools and techniques are provided for implementing programmable protocol-independent session processor (“PPSP”)-based communications. When a computing system determines that a first administrative domain and a second administrative domain require different signaling protocols to establish communication sessions for user devices in the two administrative domains, the computing system may convert one or more signaling protocols used by the two administrative domains into a common signaling protocol, and may establish an end-to-end (“E2E”) real-time communication session between the user devices in the two administrative domains, using the common signaling protocol.

Abstract: Novel tools and techniques are provided for implementing real-time fault management or real-time fault management system (“RFM”). In various embodiments, RFM may receive alerts from or associated with network devices (e.g., layer 2, 3, and/or 4 devices, or the like) that are disposed in a plurality of disparate networks that may utilize different alert management protocols and/or different fault management protocols. RFM may collect, enrich, normalize, aggregate, and display the alerts in a user interface to facilitate addressing of the alerts by a user. To enable continuous and real-time functionality, RFM may be implemented in a plurality of siloed platforms in a primary data center, with processing of alerts being load balanced across the siloed platforms, with mirrored group of siloed platforms in a secondary data center located geographically distant from the primary data center and configured to be on “hot standby” and to completely take over RFM processing operations.

Abstract: A method is disclosed for testing network devices for networks with a large traffic load utilizing one or more traffic load amplifiers to amplify the traffic load. The load amplifiers connected to the device may receive packets of an initial traffic load, multiply or copy the received packet, alter the destination address information in the header of the copied packets to generate packets with different destination addresses, and transmit the altered packets back to the device for further routing. The altered or copied packets may then be routed via the device back to the load amplifier for further amplification. Through this amplification process, a small initial load of packets may be amplified over and over by the load amplifiers until a target traffic load is achieved at the device to test the device performance at a large traffic load.

Abstract: Apparatus, systems, methods, and the like, for autonomous scaling of security and other network services through initialization of a service from a network service device and/or migration of such services from one service device to another is provided. Such network scaling may allow for migration of services from existing service edges to other service edges. A security management system may coordinate the migration of services provided to a secondary network from one or more service edges to another, separate service edge while providing session synchronization during the migration. To migrate the services from the first service edge to a second service edge, a session table may be shared between the service edges and the first and second service edges may advertise service routes or endpoints with one or more priority values to control or otherwise determine which service edge is selected by a service-receiving device to receive the services.

Abstract: Novel tools and techniques are provided for implementing intelligent alert automation ("IAA"). In various embodiments, IAA receives alert/event feeds from several different alerting and ticketing systems via input Redis queues, and uses a triage system to determine whether to process the alert/event or disregard it. If so, IAA may create a flow instance, assign a unique instance ID, and place the flow instance in one of a plurality of jobs queues based on alert/event type and/or or source. An abattoir system retrieves a flow instance from one of the jobs queues (in order of the queue's priority), and processes the next node or step in the flow instance. The flow instance is placed back into the jobs queue for subsequent processing by the same or different abattoir system until no additional nodes or steps remain in the flow, at which point the flow instance is considered complete.

Abstract: Systems and methods for enforcing compliance-program conformity during authorization-token generation are presented. Applications may be registered with an identity and access management (IAM) system. The registration of the application may include whether the application is subject to one or more compliance program(s). When an authorization token is requested from the IAM system, the IAM system may (a) determine the set of authorization information needed in the token, and (b) determine whether the application is subject to a compliance program. The IAM system may then check an approval source of record to determine whether the user was legitimately approved for the required authorization prior to granting an authorization token. If there is a mismatch between the approval source of record and the authorization information associated with the user identity, then the mismatch may cause certain mitigation actions to be performed.

Abstract: Implementations include providing security services to workloads deployed across various types of network environments, such as public networks, private networks, hybrid networks, customer premise network environments, and the like, by redirecting traffic intended for the service device through a security environment of the first network. After application of the security features to the incoming traffic, the “clean” traffic may be transmitted to the service device instantiated on the separate network via a tunnel. Redirection of incoming traffic to the security-providing first network may include correlating a network address of the service device to a reserved network address of a block of reserved addresses and updating a Domain Name Server (DNS) or other address resolving system with the reserved address. The return transmission tunnel may be established between the security environment and the network address of the service device.