Abstract: In one implementation, a method includes transmitting, to a server, a first interest message. The first interest message includes a request for a representational state transfer (REST) operation and a name of a first state for the REST operation. The method also includes receiving, from the server, a second interest message. The second interest message includes the name of the first state for the REST operation. The method further includes transmitting, to the server, the first state based on the second interest message and receiving, from the server, a response to the REST operation.

Abstract: In one implementation, a method includes receiving, via a first information centric networking (ICN) interface, a first interest message comprising a first name of a first data object. The method also includes determining whether the first data object is stored within a cache of a router based on the first interest message. The method further includes updating, when the first data object is stored within the cache of the router, the first interest message with a first indicator indicating that the first data object is stored within the cache of the router. The method further includes transmitting, via a second ICN interface, the updated first interest message when the first data object is stored within the cache of the router.

Abstract: A network device configured for information centric networking (ICN) receives an Interest having traversed a path in an ICN network from a consumer. The Interest requests data by name. The network device determines whether data satisfying the Interest is available in the network device, and if it is determined that data satisfying the Interest is available in the network device, the network device generates an Interest acknowledgement (InterestAck) that includes the data name. The network device forwards the InterestAck to the consumer along the path in reverse based on the data name. The network device retrieves the data satisfying the Interest, and forwards the data along the reverse path based on the data name.

Abstract: In one implementation, a method includes receiving, via a first information centric networking (ICN) interface, a first interest message comprising a first name of a first data object. The method also includes determining whether the first data object is stored within a cache of a router based on the first interest message. The method further includes updating, when the first data object is stored within the cache of the router, the first interest message with a first indicator indicating that the first data object is stored within the cache of the router. The method further includes transmitting, via a second ICN interface, the updated first interest message when the first data object is stored within the cache of the router.

Abstract: In one implementation, a method includes transmitting, to a server, a first interest message. The first interest message includes a request for a representational state transfer (REST) operation and a name of a first state for the REST operation. The method also includes receiving, from the server, a second interest message. The second interest message includes the name of the first state for the REST operation. The method further includes transmitting, to the server, the first state based on the second interest message and receiving, from the server, a response to the REST operation.

Abstract: In an embodiment, a data processing apparatus comprising one or more electronic digital processors; Dynamic Host Configuration Protocol (DHCP) server logic coupled to the one or more processors; an active leasequery channel response logic coupled to the DHCP server logic which when executed causes the one or more processors to perform receiving, from a particular DHCP client among a plurality of DHCP clients, an active leasequery initiation message requesting the DHCP server logic to actively send update messages about changes in network address leases that the DHCP server logic manages; wherein the active leasequery initiation message comprises a channel identifier value; determining whether the channel identifier value matches a client class that the DHCP server logic manages; in response to determining that the channel identifier value does match a client class identifier that the DHCP server logic manages, sending, to the particular DHCP client, one or more DHCP response messages describing any changes in

Abstract: Generating a binding between a source address and one or more roles of a user accessing the network and distributing the binding to a filter node. The source address is currently assigned to the device. The binding may be generated by one or more nodes on an ingress path used during authentication of the user. The binding may be distributed to the filter node on demand or without any request from the filter node. Responsive to a determination that the user is associated with a new source address, a new binding is generated to associate a new source address with the one or more roles for the user. The new binding is distributed to the filter node. Another aspect is a method of enforcing a role based security policy at a filter node, using bindings of source addresses to roles.

Abstract: Generating a binding between a source address and one or more roles of a user accessing the network and distributing the binding to a filter node. The source address is currently assigned to the device. The binding may be generated by one or more nodes on an ingress path used during authentication of the user. The binding may be distributed to the filter node on demand or without any request from the filter node. Responsive to a determination that the user is associated with a new source address, a new binding is generated to associate a new source address with the one or more roles for the user. The new binding is distributed to the filter node. Another aspect is a method of enforcing a role based security policy at a filter node, using bindings of source addresses to roles.

Abstract: In an embodiment, a data processing apparatus comprising one or more electronic digital processors; Dynamic Host Configuration Protocol (DHCP) server logic coupled to the one or more processors; an active leasequery channel response logic coupled to the DHCP server logic which when executed causes the one or more processors to perform receiving, from a particular DHCP client among a plurality of DHCP clients, an active leasequery initiation message requesting the DHCP server logic to actively send update messages about changes in network address leases that the DHCP server logic manages; wherein the active leasequery initiation message comprises a channel identifier value; determining whether the channel identifier value matches a client class that the DHCP server logic manages; in response to determining that the channel identifier value does match a client class identifier that the DHCP server logic manages, sending, to the particular DHCP client, one or more DHCP response messages describing any changes in

Abstract: Generating a binding between a source address and one or more roles of a user accessing the network and distributing the binding to a filter node. The source address is currently assigned to the device. The binding may be generated by one or more nodes on an ingress path used during authentication of the user. The binding may be distributed to the filter node on demand or without any request from the filter node. Responsive to a determination that the user is associated with a new source address, a new binding is generated to associate a new source address with the one or more roles for the user. The new binding is distributed to the filter node. Another aspect is a method of enforcing a role based security policy at a filter node, using bindings of source addresses to roles.

Abstract: Techniques for managing leased network addresses for multiple networks using overlapping address spaces include storing banks of addresses corresponding to the multiple networks. A request for a network address for a host on a first network is received from a relay agent on an intermediate device. The request includes a qualifier associated with the first network by the relay agent. A first bank of addresses is selected based on the qualifier. A first network address from the first bank is identified based at least in part on the request. A response for the host is sent to the relay agent. The response indicates the first network address and the qualifier. Thus a dynamic host configuration protocol (DHCP) server can provide the same network address for several hosts spread over different networks, such as different virtual private networks (VPNs).

Abstract: Techniques for providing sets of network addresses for dynamically configuring hosts on a network include sending to a first server a first request for a first count of network addresses in a first set of network addresses. A first message indicating the first set of network addresses is received. A second message is received from a second server that requests a second count of network addresses for a second set of network addresses. The second set of network addresses is determined based at least in part on the first set of network addresses and the second count. In response to the second message, a first response indicating the second set is sent to the second server. The techniques allow an administrator to enter available subnets at any DHCP server. The DHCP servers using these techniques then automatically apportion subnets among each other based on the relative usage of the subnets.

Abstract: A method and apparatus for providing network addresses for hosts on a network includes generating and storing network configuration information in a subnet management process, where a subnet is a set of contiguous network addresses. The network configuration information indicates network addresses to be distributed among a plurality of network devices. Policy information is also generated and stored. The policy information indicates a policy set of one or more policy processes. Each policy process selects an available subnet from available network addresses. A request for a subnet is received from a subnet requesting process. A particular subnet is determined based on the network configuration information, the request, and the policy set. A response indicating the particular subnet is sent to the subnet requesting process. These techniques allow an administrator to choose a policy for selecting subnets that better utilizes network resources for a wide range of network architectures.

Abstract: Generating a binding between a source address and one or more roles of a user accessing the network and distributing the binding to a filter node. The source address is currently assigned to the device. The binding may be generated by one or more nodes on an ingress path used during authentication of the user. The binding may be distributed to the filter node on demand or without any request from the filter node. Responsive to a determination that the user is associated with a new source address, a new binding is generated to associate a new source address with the one or more roles for the user. The new binding is distributed to the filter node. Another aspect is a method of enforcing a role based security policy at a filter node, using bindings of source addresses to roles.

Abstract: Techniques for managing leased network addresses for multiple networks using overlapping address spaces include storing banks of addresses corresponding to the multiple networks. A request for a network address for a host on a first network is received from a relay agent on an intermediate device. The request includes a qualifier associated with the first network by the relay agent. A first bank of addresses is selected based on the qualifier. A first network address from the first bank is identified based at least in part on the request. A response for the host is sent to the relay agent. The response indicates the first network address and the qualifier. Thus a dynamic host configuration protocol (DHCP) server can provide the same network address for several hosts spread over different networks, such as different virtual private networks (VPNs).

Abstract: A method for providing leased network addresses for a host from a server executing on a server device is disclosed. A first request for a leased network address from the host, relayed by an intermediate device, is received. The intermediate device filters communications between the host and the server device. A response is generated for the host, by the server, which offers a leased network address for a particular period of time and includes a network address of the intermediate device. The network address of the intermediate device is provided in a portion of the response normally designated for indicating a network address of the server. By providing the address of the intermediate device in the portion of the response designated for the server address, the server causes the client to send renewal requests to the intermediate device so that a relay process on the intermediate device can properly operate on the request, without modifying the client process.

Abstract: Techniques for providing sets of network addresses for dynamically configuring hosts on a network include sending to a first server a first request for a first count of network addresses in a first set of network addresses. A first message indicating the first set of network addresses is received. A second message is received from a second server that requests a second count of network addresses for a second set of network addresses. The second set of network addresses is determined based at least in part on the first set of network addresses and the second count. In response to the second message, a first response indicating the second set is sent to the second server. The techniques allow an administrator to enter available subnets at any DHCP server. The DHCP servers using these techniques then automatically apportion subnets among each other based on the relative usage of the subnets.

Abstract: Techniques for providing sets of network addresses for dynamically configuring hosts on a network include sending to a first server a first request for a first count of network addresses in a first set of network addresses. A first message indicating the first set of network addresses is received. A second message is received from a second server that requests a second count of network addresses for a second set of network addresses. The second set of network addresses is determined based at least in part on the first set of network addresses and the second count. In response to the second message, a first response indicating the second set is sent to the second server. The techniques allow an administrator to enter available subnets at any DHCP server. The DHCP servers using these techniques then automatically apportion subnets among each other based on the relative usage of the subnets.