Abstract: An apparatus includes a packet encryption circuit that uses an encryption keys to encrypt each of two or more portions of a data packet. Each portion is encrypted with a different encryption key and includes one or more layers of the data packet. A first portion includes a layer of the data packet with MAC information. The apparatus includes a packet transmitter that transmits, from a source router, an encrypted data packet to an intermediate router between the source router and a destination router. The encrypted data packet includes an encrypted version of the data packet encrypted using the encryption keys. The intermediate router has encryption keys sufficient for a service level agreement of the intermediate router and lacks a portion of the encryption keys. The source and destination routers use a MAC security standard for encryption and decryption of the data packet using the encryption keys.

Abstract: Methods, apparatuses, and computer program products for telemetry-based network switch configuration validation are disclosed. An analytics engine captures a first network snapshot including telemetry data received from one or more network switches in a first state. Upon receiving a notice indicating that a network configuration change has been applied, the analytics engine initiates a timer in response to receiving the notice. The analytics engine captures, in response to expiration of the timer, a second network snapshot including telemetry data received from the one or more network switches in a second state and compares the first network snapshot and the second network snapshot. In dependence upon the comparison of the first network snapshot to the second network snapshot, the analytics engine validates the network configuration change.

Abstract: Transferring files in accordance with a data communications protocol includes: receiving, by a server from a client, a read request for a file, where the read request specifies a filename of the file, a message digest algorithm, and a key, where the key includes a result of applying the message digest algorithm to the file as stored on the client; generating, by the server, a local key including applying the message digest algorithm to a file currently stored on the server and having the filename; and if the local key matches the key specified in the read request, closing, by the server, a connection to the client with success without sending the requested file.

Abstract: Covert monitoring of an attacker host in a software defined perimeter network, includes: authenticating, by an SDP controller, a first and second host in the SDP network, where the first and second host, after authentication, establish an end-to-end encryption communication session; detecting, by the SDP controller, that the first host is an attacker host and the second host is a victim host; establishing, by the SDP controller as a copy of the victim host, a mimic host; and redirecting, by the SDP controller, communication from the attacker host to the mimic host including migrating, without disruption detectable by the attacker host, the communication session from the victim host to the mimic host, where the mimic host monitors communications with the attacker host.

Abstract: Methods, apparatuses, and computer programs products for connection parameter awareness in an authenticated link-layer network session are disclosed. A client sends, to a network access server (NAS), an initiation packet announcing the initiation of an authentication session. The client establishes an authenticated link-layer session with the NAS. The client receives, from the NAS, a network policy packet including a network policy defined by one or more connection parameters for the link-layer session. The client then enforces the network policy.

Abstract: Devices and methods for determining and indicating a source of power based on a characteristic of received power are disclosed. According to an aspect, a device includes a power line interface configured to receive power from multiple power lines. The device also includes a comparator module configured to compare one or more characteristics of the received power from the plurality of power lines. The comparator module is also configured to determine whether the received power on the power lines are from the same source based on the comparison. Further, the device includes a user interface configured to indicate whether the received power on the power lines are from the same source based on the determination.

Abstract: A method for reducing transmission of telemetry packets includes receiving, at a network controller, telemetry packets from network nodes in a communication pathway of data packets being transmitted from a sending host to a receiving host and determining from the telemetry packets a number of network nodes in the communication pathway. The method includes setting a network node threshold value equal to the determined number of network nodes in the communication pathway, and transmitting, from the network controller, the network node threshold value to each network node in the communication pathway.

Abstract: A processor may perform hypervisor operations including managing a virtual machine (VM), wherein the VM supports operation of a guest operating system and an application, managing a virtual trusted platform module (TPM), attaching the virtual TPM to the VM, and causing the virtual TPM to provide a session key to the application and a cloud storage application that controls data storage on one or more physical data storage device. A separate processor may perform cloud storage operations including receiving a session key from a virtual TPM and receiving first encrypted data from an application running in a VM. The operations may further include decrypting the first encrypted data using the session key, performing data reduction operations on the decrypted data to obtain compressed data, encrypting the compressed data using a storage encryption key to obtain second encrypted data, and causing the second encrypted data to be stored in data storage.

Abstract: A method for authorization of internet of things (“IoT”) identity bootstrapping includes receiving from a device, at a network access server (“NAS”) of a user and in response to an attestation request sent to the device, a vendor network address of a vendor server of a vendor and a device identifier for the device. The method includes authenticating the vendor using the vendor network address and, in response to authenticating the vendor, sending the device identifier to the vendor server. The method includes communicating device attestation packets between the vendor server and the device. The device attestation packets validate the device to the vendor server. The method includes receiving device attestation from the vendor server. The device attestation indicating validity status of the device to the NAS. The method includes, in response to the device attestation indicating validity of the device, transmitting a new device identity to the device.

Abstract: An apparatus includes a controller adds telemetry data to a telemetry packet transmitted along a communication pathway for data packets being transmitted from a sending host to a receiving host. The controller determines, from the telemetry packet, a number of network nodes in the communication pathway that have added telemetry data to the telemetry packet. The controller transmits the telemetry packet to a next destination along the communication pathway and to a network controller in response to determining that the number of network nodes in the communication pathway that have added telemetry data to the telemetry packet is equal to or greater than a network node threshold. The controller just transmits the telemetry packet to the next destination in response to determining that the number of network nodes in the communication pathway that have added telemetry data to the telemetry packet is less than the network node threshold.

Abstract: An apparatus for optical link fault management includes a processor in a network device with an optical adapter of an optical link, and a memory that stores program code. The program code is executable by the processor to store state parameters from the optical adapter in a data log, input the state parameters from the data log into a failure prediction model, and generate, using the failure prediction model, a probability of failure of the optical adapter based on current state parameters from the data log. In response to the probability of failure reaching a failure threshold, the program code is executable by the processor to decrease data traffic in the optical link and to send an alert comprising the probability of failure. The failure threshold includes a probability of failure indicative of impending failure of the optical adapter.

Abstract: An apparatus includes a processor and a memory that stores code executable by the processor to transmit a passenger status message in response to a trigger event indicative of a passenger failing to be picked up at a pickup location by a ride service vehicle. The passenger status message is transmitted to a passenger mobile communication device and a driver. The code is executable to transmit a help message to members of a passenger trusted list in response to receiving a reply to the passenger status message from the passenger indicative of a request for help by the passenger. The code is executable to transmit to a police agency a police request to assist the passenger in response to a trusted list timeout, which is indicative of not receiving a message from a member of the passenger trusted list that indicates the passenger is okay before the trusted list timeout.

Abstract: A method includes identifying, for each port of a storage controller, an optimal path between a port of the storage controller to a computer and identifying a port of the computer connected to the optimal path. Two or more interconnected switches connect the computer and the storage controller. The method includes assigning a static IP address to each port of the storage controller, and transmitting to the computer, for each port of the storage controller, a static MAC address of a port of the storage controller and the corresponding port of the computer that is part of the optimal path between the port of the storage controller and the computer. The computer uses the static MAC addresses and the corresponding ports to create a static map and uses the static map to determine which port of the computer to use to service a storage request.

Abstract: An apparatus for machine learning for workloads for ISA optimization is disclosed. The apparatus includes a processor and a memory that stores code executable by the processor. The executable code is executable to run program code to service a workload with a default instruction set of the processor, identify an instruction sequence from execution results for the workload, the instruction sequence called repeatedly during execution for the workload, and generate a custom instruction that includes the instruction sequence. The executable code is executable to write the custom instruction to a writable area of processor memory storing the default instruction set, recompile program code used to service the workload, where the recompiled program code includes the custom instruction, and run the recompiled program code to service the workload.

Abstract: An apparatus includes a message receiver circuit that receives, at a port of a network node, a message from a neighboring network node. The message includes a maximum transmission unit (“MTU”) of the neighboring network node. The network nodes communicate using a layer-2 protocol. The apparatus includes a comparison circuit that determines if the received MTU is larger than an MTU for the port, and an approval circuit that, after determining that the received MTU is larger than the port's MTU, determines if the received MTU is supported by the network node. The method includes an increase circuit that, after determining that the received MTU is supported, changes the MTU of the network node's ports to match the received MTU, and a message circuit that, after determining that the received MTU is supported, sends a message with the MTU to network nodes connected to ports of the network node.

Abstract: An apparatus includes a packet encryption circuit that uses an encryption keys to encrypt each of two or more portions of a data packet. Each portion is encrypted with a different encryption key and includes one or more layers of the data packet. A first portion includes a layer of the data packet with MAC information. The apparatus includes a packet transmitter that transmits, from a source router, an encrypted data packet to an intermediate router between the source router and a destination router. The encrypted data packet includes an encrypted version of the data packet encrypted using the encryption keys. The intermediate router has encryption keys sufficient for a service level agreement of the intermediate router and lacks a portion of the encryption keys. The source and destination routers use a MAC security standard for encryption and decryption of the data packet using the encryption keys.

Abstract: An apparatus for machine learning for workloads for ISA optimization is disclosed. The apparatus includes a processor and a memory that stores code executable by the processor. The executable code is executable to run program code to service a workload with a default instruction set of the processor, identify an instruction sequence from execution results for the workload, the instruction sequence called repeatedly during execution for the workload, and generate a custom instruction that includes the instruction sequence. The executable code is executable to write the custom instruction to a writable area of processor memory storing the default instruction set, recompile program code used to service the workload, where the recompiled program code includes the custom instruction, and run the recompiled program code to service the workload.

Abstract: An apparatus for optimization for Spanning Tree Protocol (“STP”) data network includes an egress filter setting circuit in a first network node that sets an egress filter to discard data packets at an egress port of the first network node connected to a second network node in response to receiving an egress filter bridge protocol data unit (“BPDU”) message from the second network node indicating that a link between the first network node and the second network node is a redundant link. The network nodes are layer-2 STP bridges. The apparatus includes, in the first network node, an egress filter timeout circuit that resets a timer in response to receiving the egress filter BPDU message, and a filter clear circuit that clears the egress filter to allow data packets to be sent from the egress port to the second network node in response to the timer reaching a timeout.

Abstract: A method for optimizing telemetry packet for in-band telemetry includes receiving a telemetry packet at a network node in a communication pathway between a sending host sending data packets to a receiving host and determining telemetry data for the network node. The telemetry data includes latency information for data packet processing of the network node. The method includes adding metadata to the telemetry packet, where the metadata is added after a header and a telemetry packet header and after any metadata added by any upstream network nodes. The metadata includes the telemetry data and the metadata overwrites a portion of a payload of the telemetry packet. The method includes, in response to adding the metadata to the telemetry packet, transmitting the telemetry packet to a next destination.

Abstract: An apparatus for optimization for Spanning Tree Protocol (“STP”) data network includes an egress filter setting circuit in a first network node that sets an egress filter to discard data packets at an egress port of the first network node connected to a second network node in response to receiving an egress filter bridge protocol data unit (“BPDU”) message from the second network node indicating that a link between the first network node and the second network node is a redundant link. The network nodes are layer-2 STP bridges. The apparatus includes, in the first network node, an egress filter timeout circuit that resets a timer in response to receiving the egress filter BPDU message, and a filter clear circuit that clears the egress filter to allow data packets to be sent from the egress port to the second network node in response to the timer reaching a timeout.