Abstract: Presented herein are methodologies for implementing application security. A method includes generating an extraction vector based on a plurality of application security rules to be enforced, transmitting the extraction vector to a first agent operating on a first network device and to a second agent operating on a second network device; receiving, separately, from the first agent and from the second agent, first metadata generated by the first agent and second metadata generated by the second agent by the agents applying the extraction vector to network traffic passing, respectively, through the first network device and the second network device. The first metadata includes a transaction ID assigned by the first agent, and the second metadata includes the same transaction ID. The method further includes correlating the first metadata with the second metadata based on the transaction ID to construct a transactional service graph for the network traffic.

Abstract: Presented herein are methodologies for implementing application security. A method includes generating an extraction vector based on a plurality of application security rules to be enforced, transmitting the extraction vector to a first agent operating on a first network device and to a second agent operating on a second network device; receiving, separately, from the first agent and from the second agent, first metadata generated by the first agent and second metadata generated by the second agent by the agents applying the extraction vector to network traffic passing, respectively, through the first network device and the second network device. The first metadata includes a transaction ID assigned by the first agent, and the second metadata includes the same transaction ID. The method further includes correlating the first metadata with the second metadata based on the transaction ID to construct a transactional service graph for the network traffic.

Abstract: A method is provided in one example embodiment and includes receiving a data packet transported on a backhaul link at a first network element; de-capsulating the data packet; identifying whether the data packet is an upstream data packet; identifying whether the data packet matches an internet protocol (IP) access control list (ACL) or a tunnel endpoint identifier; and offloading the data packet from the backhaul link. In more specific embodiment, the method can include identifying that the data packet does not match the IP ACL or the tunnel endpoint identifier; and communicating the data packet to a second network element. In other examples, the method can include identifying that the data packet is a downstream data packet; identifying a service to be performed for the data packet that cannot be performed at the first network element; and communicating the data packet to a second network element.

Abstract: A method is provided in one example embodiment and includes communicating a message from a network element to a remote data plane element in order to request a data plane resource for hosting a session for a particular subscriber. The remote data plane element is designated to host a data plane function for a particular mobile network subscriber and the data plane resource comprises at least one of memory space and processor allocation. The method further includes discovering nodes capable of supporting the control plane functions; discovering nodes capable of supporting the data plane functions for the session; and performing a system-specific internal configuration to support separation of the data plane functions and the control plane functions.

Abstract: A method is provided in one example embodiment and includes receiving a data packet transported on a backhaul link at a first network element; de-capsulating the data packet; identifying whether the data packet is an upstream data packet; identifying whether the data packet matches an internet protocol (IP) access control list (ACL) or a tunnel endpoint identifier; and offloading the data packet from the backhaul link. In more specific embodiment, the method can include identifying that the data packet does not match the IP ACL or the tunnel endpoint identifier; and communicating the data packet to a second network element. In other examples, the method can include identifying that the data packet is a downstream data packet; identifying a service to be performed for the data packet that cannot be performed at the first network element; and communicating the data packet to a second network element.

Abstract: A method is provided in one example embodiment and includes receiving a data packet transported on a backhaul link at a first network element; de-capsulating the data packet; identifying whether the data packet is an upstream data packet; identifying whether the data packet matches an internet protocol (IP) access control list (ACL) or a tunnel endpoint identifier; and offloading the data packet from the backhaul link. In more specific embodiment, the method can include identifying that the data packet does not match the IP ACL or the tunnel endpoint identifier; and communicating the data packet to a second network element. In other examples, the method can include identifying that the data packet is a downstream data packet; identifying a service to be performed for the data packet that cannot be performed at the first network element; and communicating the data packet to a second network element.

Abstract: A context-driven publication option is received over a network at an adaptive publish subscribe broker from a publishing network device. The context driven publication options are presented over the network to a subscribing network device. A selection of a context-driven subscription is received over the network at the adaptive publish/subscribe broker from the subscribing network device. A publication configured for network management and operations is received at the adaptive publish/subscribe broker. Publications are filtered at the adaptive publish/subscribe broker for the subscribing network device according to the selection of the context-driven subscription.

Abstract: A method is provided in one example embodiment and includes receiving a data packet transported on a backhaul link at a first network element; de-capsulating the data packet; identifying whether the data packet is an upstream data packet; identifying whether the data packet matches an internet protocol (IP) access control list (ACL) or a tunnel endpoint identifier; and offloading the data packet from the backhaul link. In more specific embodiment, the method can include identifying that the data packet does not match the IP ACL or the tunnel endpoint identifier; and communicating the data packet to a second network element. In other examples, the method can include identifying that the data packet is a downstream data packet; identifying a service to be performed for the data packet that cannot be performed at the first network element; and communicating the data packet to a second network element.

Abstract: A session border controller for delivering content includes a first port to communicate with a user using a first signaling protocol, a second port to communicate with a content provider using a second signaling protocol, and a processor coupled to the first and second ports. The session border controller sends a message to the content provider to begin delivery of a content destined for the user. The session border controller receives a first media stream including the content and content provider information from the content provider. The session border controller creates a second media stream that includes the content without the content provider information, and delivers the second media stream to the user.

Abstract: A method is provided in one example embodiment and includes communicating a message from a network element to a remote data plane element in order to request a data plane resource for hosting a session for a particular subscriber. The remote data plane element is designated to host a data plane function for a particular mobile network subscriber and the data plane resource comprises at least one of memory space and processor allocation. The method further includes discovering nodes capable of supporting the control plane functions; discovering nodes capable of supporting the data plane functions for the session; and performing a system-specific internal configuration to support separation of the data plane functions and the control plane functions.

Abstract: A method is provided in one example embodiment and includes communicating an in-band message packet from a first network element; receiving a response to the in-band message from a second network element, the response contains tunnel identification binding data that identifies a tunnel on a backhaul link on which traffic from a user equipment can flow; and receiving instructions from the second network element to offload a received data packet from the backhaul link. In particular instances, the in-band message is set to loopback when the in-band message is sent from the first network element. In other embodiments, the tunnel identification binding data is provided in the payload of the in-band message when the in-band message is sent from the first network element. In other examples, the method can include receiving an assigned Internet protocol (IP) address of the user equipment in the response to the in-band message.

Abstract: A method is provided in one example embodiment and includes receiving a downstream data packet transported on a backhaul link at a first network element, the downstream data packet is associated with a user equipment; identifying whether a downstream tunnel used to communicate the data packet to the user equipment has become dormant; and communicating an in-band message to a second network element that the downstream tunnel is dormant. In other examples, the method can include dropping the data packet when a network address port translation binding has expired or does not exist. In certain implementations, the method can include identifying the downstream tunnel as dormant when an activity timer has expired, or identifying the downstream tunnel as dormant based on a stale state setting.

Abstract: A method is provided in one example embodiment and includes receiving a data packet over a first link at a first network element; establishing an out-of-band channel over a second link between the first network element and a second network element; and receiving instructions at the first network element to offload the data packet from the first link. In more particular embodiments, the first network element is a mobile enabled router, and the second network element is a gateway general packet radio service support node or a packet data network gateway. The method can also include receiving a discovery message from the second network element, the discovery message triggering the establishment of the out-of-band channel. In certain cases, the data packet is offloaded based on a type of data in the data packet.

Abstract: A session border controller includes a first port to communicate with a user using a first signaling protocol, a second port to communicate with a content provider using a second signaling protocol, and a processor coupled to the first and second ports. The session border controller may send a PLAY message to the content provider to begin delivery of a content destined for the user. The session border controller may further receive a first media stream including the content and content provider information from the content provider. The session border controller may further create a second media stream that includes the content without the content provider information, and deliver the second media stream to the user.

Abstract: A method is provided in one example embodiment and includes receiving a data packet transported on a backhaul link at a first network element; de-capsulating the data packet; identifying whether the data packet is an upstream data packet; identifying whether the data packet matches an internet protocol (IP) access control list (ACL) or a tunnel endpoint identifier; and offloading the data packet from the backhaul link. In more specific embodiment, the method can include identifying that the data packet does not match the IP ACL or the tunnel endpoint identifier; and communicating the data packet to a second network element. In other examples, the method can include identifying that the data packet is a downstream data packet; identifying a service to be performed for the data packet that cannot be performed at the first network element; and communicating the data packet to a second network element.

Abstract: A method is provided in one example embodiment and includes communicating a message to a remote data plane element in order to request a data plane resource for hosting a session. The method also includes receiving a response at a network element acknowledging the message. Data plane traffic is managed at the remote data plane element based on enforcement rules. The enforcement rules are provisioned in a table element at the remote data plane element, and the table element reflects a portion of a master table element included in the network element.

Abstract: Techniques are provided herein for establishing at a network management server a presence on a network. A presence associated with one or more managed devices on the network is detected. An instant messaging (IM) session is established with the one or more managed devices. The IM session forms a virtual chat room for performing a management function on the one or more managed devices, and IM messages are sent that are configured to perform the management function on the one or more managed devices. Techniques are also provided herein for establishing on a network an enriched presence by a network management server that is configured to perform a management function via a presence function of a messaging and presence protocol.

Abstract: A method is provided in one example embodiment and includes receiving a data packet transported on a backhaul link at a first network element; identifying whether the data packet is an upstream data packet; identifying whether the data packet matches an internet protocol (IP) access control list (ACL) or a tunnel endpoint identifier; performing a network address translation on the data packet; and offloading the data packet from the backhaul link. In certain implementations, the method can include identifying that the data packet does not match the IP ACL or the tunnel endpoint identifier; and communicating the data packet to a second network element. In other instances, the method can include identifying that the data packet is a downstream data packet; and restoring a tunnel header and tunnel identification based on an IP address of the data packet.

Abstract: A context-driven publication option is received over a network at an adaptive publish subscribe broker from a publishing network device. The context driven publication options are presented over the network to a subscribing network device. A selection of a context-driven subscription is received over the network at the adaptive publish/subscribe broker from the subscribing network device. A publication configured for network management and operations is received at the adaptive publish/subscribe broker. Publications are filtered at the adaptive publish/subscribe broker for the subscribing network device according to the selection of the context-driven subscription.

Abstract: This disclosure relates to a system and method for offloading selected data traffic in logical tunnels to the Internet. The offloading provides another data path for selected data traffic that can relieve the burden on a mobile operator's network, such as the backhaul and core networks. As the proliferation of data rich content and increasingly more capable mobile devices has continued, the amount of data communicated over mobile operator's networks has increased. Upgrading the existing network that was designed for voice calls is not desirable or practical for many mobile operators. This disclosure provides systems and methods for offloading data to the Internet at a router to relieve congestion on the mobile operator's network.