Abstract: Some embodiments use CRDs (custom resource definitions) to define resources in an O-RAN system. These resources include applications (xApps, rApps, etc.), components of these applications, deployment constructs, cloud constructs, AI/ML models and RTE constructs. Using these CRD descriptors, app developers can develop and distribute their applications in a platform independent manner. The CRDs of some embodiments are used to on board applications into an O-RAN system. In some embodiments, the SMO (Service, Management and Orchestration) framework of the O-RAN system has a service for processing CRDs. In some of these embodiments, this SMO service has one controller to process the new application CRD. In some embodiments, the SMO identifies clouds for placements of the deployed applications and directs Kubernetes managers of the identified clouds to deploy the applications.

Abstract: An orchestrator process can efficiently distribute images of virtual network functions (“VNFs”) in a telco network. The images can be accompanied by metadata that describes VNF requirements, such as computing requirements and functional characteristics. Based on the image metadata and location of a virtual infrastructure manager (“VIM”), the orchestrator can select a storage location and deploy the image to the storage location. The VIM can instantiate a corresponding VNF by retrieving the image. The orchestrator can track the storage location and cause the VIM to delete the image if the image is not used for a threshold period of time.

Abstract: An orchestrator process can efficiently distribute images of virtual network functions (“VNFs”) in a telco network. The images can be accompanied by metadata that describes VNF requirements, such as computing requirements and functional characteristics. Based on the image metadata and location of a virtual infrastructure manager (“VIM”), the orchestrator can select a storage location and deploy the image to the storage location. The VIM can instantiate a corresponding VNF by retrieving the image. The orchestrator can track the storage location and cause the VIM to delete the image if the image is not used for a threshold period of time.

Abstract: A method and network element include receiving, at a receiver node, at least one of sender timestamps and sequence numbers in continuity check (CC) frames sent by a sender node; determining receiver timestamps at the receiver node; detecting instability based on one or more of the at least one of sender timestamps and sequence numbers and the receiver timestamps; and performing a remedial action based on the detecting instability. The CC frames can include Bidirectional Forwarding Detection (BFD) or Continuity Check Message (CCM) frames which are regularly transmitted in a session, but do not currently include timestamps or sequence numbers.

Abstract: A method, a network element, and a network include determining an authentication mechanism between two nodes in a network path; operating the network path; performing connectivity check between the two nodes in the network path; and authenticating specific frames in the connectivity check between the two nodes with the authentication mechanism responsive to the specific frames affecting a state of the network path. The frames can be Bidirectional Forwarding Detection (BFD), Continuity Check Messages (CCMs), etc. Advantageously, the method, network element, and network reduce the computational load of providing authentication while maintaining secure authentication for important frames, i.e., ones that affect the state of the network path.

Abstract: Methods and apparatus for optimizing fault synchronization in a bidirectional data network are provided. In an example, a downstream endpoint of the data network receives a first Alarm Indication Signal (AIS). The first AIS indicates a first FLI of an upstream interface having an interface fault. The downstream endpoint transmits, to an upstream endpoint of the data network, a second AIS including a Remote Defect Indication (RDI) and a second FLI identifying the downstream endpoint. An upstream endpoint of the data network receives the second AIS and determines that the AIS is an AIS-RDI (AIS-RDI) from the presence of the second FLI. The presence of the AIS-RDI triggers the upstream endpoint to initiate tunnel failure synchronization with the downstream endpoint.

Abstract: In an embodiment, a method comprises establishing a first data communications session with a first router. In response to receiving a first request to establish a second data communications session, a probe message that is configured to test whether the first data communications session or the first router is responsive is sent to the first router. In response to determining that the first router has not acknowledged the probe message before a probe timer has expired, and receiving a second request to establish the second data communications session, the second data communications session with the first router is established and a state for the first data communications session is deleted.

Abstract: A method and network element include receiving, at a receiver node, at least one of sender timestamps and sequence numbers in continuity check (CC) frames sent by a sender node; determining receiver timestamps at the receiver node; detecting instability based on one or more of the at least one of sender timestamps and sequence numbers and the receiver timestamps; and performing a remedial action based on the detecting instability. The CC frames can include Bidirectional Forwarding Detection (BFD) or Continuity Check Message (CCM) frames which are regularly transmitted in a session, but do not currently include timestamps or sequence numbers.

Abstract: A method, a network element, and a network include determining an authentication mechanism between two nodes in a network path; operating the network path; performing connectivity check between the two nodes in the network path; and authenticating specific frames in the connectivity check between the two nodes with the authentication mechanism responsive to the specific frames affecting a state of the network path. The frames can be Bidirectional Forwarding Detection (BFD), Continuity Check Messages (CCMs), etc. Advantageously, the method, network element, and network reduce the computational load of providing authentication while maintaining secure authentication for important frames, i.e., ones that affect the state of the network path.

Abstract: Methods and apparatus for optimizing fault synchronization in a bidirectional data network are provided. In an example, a downstream endpoint of the data network receives a first Alarm Indication Signal (AIS). The first AIS indicates a first FLI of an upstream interface having an interface fault. The downstream endpoint transmits, to an upstream endpoint of the data network, a second AIS including a Remote Defect Indication (RDI) and a second FLI identifying the downstream endpoint. An upstream endpoint of the data network receives the second AIS and determines that the AIS is an AIS-RDI (AIS-RDI) from the presence of the second FLI. The presence of the AIS-RDI triggers the upstream endpoint to initiate tunnel failure synchronization with the downstream endpoint.

Abstract: Systems and procedures are presented for communicating multiple data streams through an SSLVPN gateway. One implementation of a method includes receiving a plurality of incoming data streams and load balancing the incoming data streams. The load balancing includes assigning a first set of one or more incoming data streams to a first subprocessor, and responding to the first set of incoming data streams with outgoing data streams that include a first identifier that indicates the first subprocessor. One implementation of a network element includes a plurality of subprocessors and a dispatcher module. The dispatcher module is coupled to the plurality of subprocessors, and is configured to recognize an identifier in a received data stream. The dispatcher module dispatches the received data stream to a corresponding subprocessor of the plurality of processors in response to the identifier in the received data stream.

Abstract: In an embodiment, a method comprises establishing a first data communications session with a first router. In response to receiving a first request to establish a second data communications session, a probe message that is configured to test whether the first data communications session or the first router is responsive is sent to the first router. In response to determining that the first router has not acknowledged the probe message before a probe timer has expired, and receiving a second request to establish the second data communications session, the second data communications session with the first router is established and a state for the first data communications session is deleted.

Abstract: Methods and apparatus for secure network communication in a Secure Sockets Layer (SSL) by avoiding small Transmission Control Protocol (TCP) packets are provided. For some embodiments, these small packets may be avoided by adjusting a maximum segment size (MSS) used in transmissions between an encryption engine and a server to compensate for the amount of overhead added by the encryption process.