Abstract: A network communication system comprising a client device, a pre-proxy server, a forward proxy server, a destination server, and a nameserver is provided. The nameserver is configured such that when the client device requests a network address of the destination server, the nameserver instead provides a network address of the pre-proxy server. The client device then relies on the provided network address to send traffic to the pre-proxy server that appears, to the client, to be directed to the destination server. The pre-proxy server optionally processes the received data and causes the data to be forwarded to the destination server via a multi-party relay (MPR) pathway. Secure and anonymized access for the client device to the destination server via an MPR pathway is thereby provided without requiring the client device to rely on specialized hardware or software.

Abstract: According to various embodiments, a cellular architecture for enhanced privacy regarding identity and location of a computing device is disclosed. The architecture includes a privacy gateway connected to the core packet forwarding gateway, where the privacy gateway is configured to authenticate the computing device while hiding the identity of the computing device by verifying authentication tokens that represent units of access. The architecture further includes an over-the-air (OTA) gateway configured to select an international mobile subscriber identity (IMSI) from a pool of valid IMSIs and deliver the selected IMSI to a subscriber identity module (SIM) card of the computing device, where the SIM card periodically shuffles the pool of valid IMSIs.

Abstract: Systems and methods for providing secure network routing as a service. In some aspects, the system generates or retrieves a database including information related to connections existing in one or more networks and devices included in the one or more networks. The system receives, from a data source device, a request for a data path including one or more data processing tasks to be performed by devices in the one or more networks on behalf of the data source device. The system, in response to receiving the request from the data source device, processes the request to generate a data path including connection and device information from the one or more networks in the database. The system transmits the data path to the data source device for routing network packets to a data destination device.

Abstract: Systems and methods for providing privacy-preserving mobile connectivity services to a mobile device. In some aspects, the system, based on receiving a request for an authentication token from a mobile device, generates the authentication token for transmission to the mobile device. The authentication token is decoupled from the mobile device requesting the authentication token such that the authentication token cannot be used to identify the mobile device. The system, based on receiving a request for connectivity to a mobile network operator and the authentication token from the mobile device, determines whether the authentication token is valid. The system, based on determining that the authentication token is valid, obtains, from the mobile network operator, an access code for initiating connectivity for the mobile device to the mobile network operator and transmits the access code to the mobile device.

Abstract: A network function virtualization platform for providing network functions for traffic flow of a network is disclosed. The platform may be added to a Function as a Service (FaaS) network infrastructure. A worker node includes a core executing network functions, a scheduler, and an agent. A first network function includes code for executing the network function and a runtime. An ingress module receives network traffic flow and separates packets for performance of the first network function. A controller is coupled to the ingress module and the agent. The controller controls the ingress module to route the separated packets to the worker node. The scheduler schedules execution of the first network function on the packets. The agent assigns execution of the first network function to the core of the worker node.

Abstract: A method for anticipatory bidirectional packet steering involves receiving, by a first packet steering module of a network, a first encapsulated packet traveling in a forward traffic direction. The first encapsulated packet includes a first encapsulating data structure. The network includes two or more packet steering modules and two or more network nodes. Each of the packet steering modules includes a packet classifier module, a return path learning module, a flow policy table, and a replicated data structure (RDS). The return path learning module of the first packet steering module generates return traffic path information associated with the first encapsulated packet and based on the first encapsulating data structure. The first packet steering module updates the RDS using the return traffic path information and transmits the return traffic path information to one or more other packet steering modules.

Abstract: A method for automating network function virtualization (NFV) using a modular NFV framework involves subscribing, by a control module of a network, to a key of a state store of the network. The state store includes stored data objects and unique keys. Each of the stored data objects is associated with one of the unique keys. The key is one of the unique keys. A notification is received at the control module from the state store. The notification is associated with the key. The control module reads a data object, associated with the key, from the stored data objects in the state store in response to the notification, and the control module modifies a network traffic flow of the network through two or more software network functions of the network based on the data object.

Abstract: A method for anticipatory bidirectional packet steering involves receiving, by a first packet steering module of a network, a first encapsulated packet traveling in a forward traffic direction. The first encapsulated packet includes a first encapsulating data structure. The network includes two or more packet steering modules and two or more network nodes. Each of the packet steering modules includes a packet classifier module, a return path learning module, a flow policy table, and a replicated data structure (RDS). The return path learning module of the first packet steering module generates return traffic path information associated with the first encapsulated packet and based on the first encapsulating data structure. The first packet steering module updates the RDS using the return traffic path information and transmits the return traffic path information to one or more other packet steering modules.

Abstract: A method for anticipatory bidirectional packet steering involves receiving, by a first packet steering module of a network, a first encapsulated packet traveling in a forward traffic direction. The first encapsulated packet includes a first encapsulating data structure. The network includes two or more packet steering modules and two or more network nodes. Each of the packet steering modules includes a packet classifier module, a return path learning module, a flow policy table, and a replicated data structure (RDS). The return path learning module of the first packet steering module generates return traffic path information associated with the first encapsulated packet and based on the first encapsulating data structure. The first packet steering module updates the RDS using the return traffic path information and transmits the return traffic path information to one or more other packet steering modules.

Abstract: A method for automating network function virtualization (NFV) using a modular NFV framework involves subscribing, by a control module of a network, to a key of a state store of the network. The state store includes stored data objects and unique keys. Each of the stored data objects is associated with one of the unique keys. The key is one of the unique keys. A notification is received at the control module from the state store. The notification is associated with the key. The control module reads a data object, associated with the key, from the stored data objects in the state store in response to the notification, and the control module modifies a network traffic flow of the network through two or more software network functions of the network based on the data object.

Abstract: A method for anticipatory bidirectional packet steering involves receiving, by a first packet steering module of a network, a first encapsulated packet traveling in a forward traffic direction. The first encapsulated packet includes a first encapsulating data structure. The network includes two or more packet steering modules and two or more network nodes. Each of the packet steering modules includes a packet classifier module, a return path learning module, a flow policy table, and a replicated data structure (RDS). The return path learning module of the first packet steering module generates return traffic path information associated with the first encapsulated packet and based on the first encapsulating data structure. The first packet steering module updates the RDS using the return traffic path information and transmits the return traffic path information to one or more other packet steering modules.

Abstract: A method for automating network function virtualization (NFV) using a modular NFV framework involves subscribing, by a control module of a network, to a key of a state store of the network. The state store includes stored data objects and unique keys. Each of the stored data objects is associated with one of the unique keys. The key is one of the unique keys. A notification is received at the control module from the state store. The notification is associated with the key. The control module reads a data object, associated with the key, from the stored data objects in the state store in response to the notification, and the control module modifies a network traffic flow of the network through two or more software network functions of the network based on the data object.

Abstract: A method for anticipatory bidirectional packet steering involves receiving, by a first packet steering module of a network, a first encapsulated packet traveling in a forward traffic direction. The first encapsulated packet includes a first encapsulating data structure. The network includes two or more packet steering modules and two or more network nodes. Each of the packet steering modules includes a packet classifier module, a return path learning module, a flow policy table, and a replicated data structure (RDS). The return path learning module of the first packet steering module generates return traffic path information associated with the first encapsulated packet and based on the first encapsulating data structure. The first packet steering module updates the RDS using the return traffic path information and transmits the return traffic path information to one or more other packet steering modules.

Abstract: Aspects and implementations of the present disclosure generally relate to use of a multi-chassis link aggregation for high performance and resilience in wide-area networking. In one aspect, the disclosure relates to a system that includes a switch fabric. The fabric includes at least a plurality of edge network devices, a set of internal switch devices, and a plurality of internal network links coupling each edge network device to at least a subset of the set of internal switch devices. The system includes a network controller coupled to the switch fabric, configured to maintain at least one link aggregation comprising a logical grouping of externally facing network interfaces of at least two of the plurality of edge devices. The network controller is configured to monitor internal link performance characteristics and determine throughput characteristics for each link aggregation over time based at least in part on current internal link performance characteristics.