Abstract: A method of utilizing a list of predictive paths by a map-server. The method includes receiving the list of predictive paths, storing the list of predictive paths in a memory, receiving, from a first network element, a request for a location of a user device, the request related to transmitting a packet to the user device, and transmitting, to the first network element, a plurality of user locations based on the list of predictive paths, the plurality of user locations identifying where a second user device will transmit the packet when the packet is received by the second user device.

Abstract: A method implemented by a receiving host entity comprises transmitting, by a transmitter of the receiving host entity, an anonymized identifier of the receiving host entity, wherein the anonymized identifier is a temporary and recyclable identifier identifying the receiving host entity, and receiving, by a receiver of the receiving host entity, a data packet from a sending host entity, wherein the data packet includes the anonymized identifier.

Abstract: A method of utilizing a list of predictive paths by a map-server. The method includes receiving the list of predictive paths, storing the list of predictive paths in a memory, receiving, from a first network element, a request for a location of a user device, the request related to transmitting a packet to the user device, and transmitting, to the first network element, a plurality of user locations based on the list of predictive paths, the plurality of user locations identifying where a second user device will transmit the packet when the packet is received by the second user device.

Abstract: A method implemented by a firewall device in a network, comprising storing, by a memory, a firewall policy comprising information indicating whether to forward a data packet from a sending host entity to a receiving host entity, receiving, by a receiver, a data packet from a sending host entity, wherein the data packet includes an identifier of the receiving host entity, and determining, by a processor coupled to the memory and the receiver, whether to forward the data packet to the receiving host entity based on the firewall policy and the identifier of the receiving host entity.

Abstract: A method of utilizing a list of predictive paths by a map-server. The method includes receiving the list of predictive paths, storing the list of predictive paths in a memory, receiving, from a first network element, a request for a location of a user device, the request related to transmitting a packet to the user device, and transmitting, to the first network element, a plurality of user locations based on the list of predictive paths, the plurality of user locations identifying where a second user device will transmit the packet when the packet is received by the second user device.

Abstract: A method implemented by a sending host entity comprises sending, by the sending host entity, a data packet to a receiving host entity, a source identifier field of the data packet comprising an anonymized identifier of the sending host entity, the anonymized identifier being a temporary identifier of the sending host entity, and sending, by the sending host entity to a distributed mapping system, a request for the distributed mapping system to send information identifying the sending host entity to the receiving host entity.

Abstract: A method implemented by a receiving host entity comprises transmitting, by a transmitter of the receiving host entity, an anonymized identifier of the receiving host entity, wherein the anonymized identifier is a temporary and recyclable identifier identifying the receiving host entity, and receiving, by a receiver of the receiving host entity, a data packet from a sending host entity, wherein the data packet includes the anonymized identifier.

Abstract: A computer-implemented method of transmitting encrypted data comprises accessing, by one or more processors of an origination endpoint, first data to be transmitted to a destination having a corresponding identifier; generating, by the one or more processors, an identifier security header; generating, by the one or more processors, second data from the first data and the identifier security header; encrypting, by the one or more processors, the second data; generating, by the one or more processors, authentication data based on the encrypted second data; generating, by the one or more processors, third data from the encrypted second data and the authentication data; generating, by the one or more processors, fourth data from the identifier corresponding to the destination and the third data; and sending, by the one or more processors, the fourth data to the destination.

Abstract: A computer-implemented method of transmitting encrypted data comprises accessing, by one or more processors of an origination endpoint, first data to be transmitted to a destination having a corresponding identifier; generating, by the one or more processors, an identifier security header; generating, by the one or more processors, second data from the first data and the identifier security header; encrypting, by the one or more processors, the second data; generating, by the one or more processors, authentication data based on the encrypted second data; generating, by the one or more processors, third data from the encrypted second data and the authentication data; generating, by the one or more processors, fourth data from the identifier corresponding to the destination and the third data; and sending, by the one or more processors, the fourth data to the destination.

Abstract: A method implemented by a receiving host entity comprises transmitting, by a transmitter of the receiving host entity, a message comprising an anonymization policy of the receiving host entity, the message comprising an anonymized identifier of the receiving host entity, the anonymized identifier being an ephemeral identifier of the receiving host entity, and receiving, by a receiver of the receiving host entity, a data packet from a sending host entity, a destination identifier field of the data packet including the anonymized identifier.

Abstract: A computer-implemented method of extending generic resilient identity services (GRIDS) is provided that comprises: receiving, by a mapping server, a resolve request from an originator endpoint for a locator of a destination endpoint; sending, by the mapping server, a request for authorization to provide the requested locator, the request for authorization indicating an identifier of the originator endpoint; receiving, by a policy server, the request for authorization; accessing, by the policy server, from a database, a set of policies for the destination endpoint; based on the identifier of the originator endpoint and the set of policies for the destination endpoint, sending, by the policy server, an authorization response to the mapping server; and based on the authorization response, sending, by the mapping server, a response to the resolve request to the originator endpoint.

Abstract: An apparatus in an IP network, the apparatus comprises: a receiver configured to: obtain an identity of a first entity, the identity is a unique identification of the first entity at a given time, obtain a first identifier of the identity, and obtain a second identifier of the identity, the first identifier and the second identifier are identifications of the identity; and a processor coupled to the receiver and configured to: create an association of the first identifier and the second identifier with the identity, and instruct storage of the association in a database.

Abstract: A method of utilizing a list of predictive paths by a map-server. The method includes receiving the list of predictive paths, storing the list of predictive paths in a memory, receiving, from a first network element, a request for a location of a user device, the request related to transmitting a packet to the user device, and transmitting, to the first network element, a plurality of user locations based on the list of predictive paths, the plurality of user locations identifying where a second user device will transmit the packet when the packet is received by the second user device.

Abstract: A method implemented by a service rendezvous point (SRP) comprises receiving, by a receiver of the SRP, a plurality of register messages from a plurality of service switch points (SSPs), each of the register messages comprising at least one of resource information or service information, each of the SSPs being associated with a different network domain, sending, by a transmitter of the SRP, a plurality of report messages to the plurality of SSPs, each of the report messages comprising resource allocation information for each of the network domains for a service, the resource allocation information including an amount of resources to be allocated at the each of the network domains for the service, and maintaining, at a memory of the SRP, a SSP database storing at least one of the resource allocation information of each of the network domains, the resource information of each of the network domains, and the service information of each of the network domains.

Abstract: A computer-implemented method of monitoring communication flows between identities is provided that comprises: accessing a first data packet that indicates a source identifier, a destination identifier, a first source locator, and a first destination locator; accessing a second data packet that indicates the source identifier, the destination identifier, a second source locator, and a second destination locator, the second destination locator being different from the first destination locator; storing data regarding the first data packet and the second data packet in a single ID flow record based on a determination that the source identifier of the first data packet matches the source identifier of the second data packet and a determination that the destination identifier of the first data packet matches the destination identifier of the second data packet; and based on the single ID flow record, adjusting a resource allocation.

Abstract: A method of using ephemeral identifiers (IDs) in a network implemented a network element (NE) comprises obtaining ephemeral ID for at least one user equipment (UE) accessible by the NE, wherein the ephemeral ID is a temporary and recyclable ID associated with the UE, transmitting a request to map the ephemeral ID of the UE to a locator of the NE to a mapping server, and establishing a communication session between the UE and a network site using the ephemeral ID.

Abstract: Disclosed herein are various embodiments designed to implement a handover operation of a user entity (UE) from a source base station to a target base station using a predictive routing feature in LISP or other ID protocols for packet replication to reduce latency in packet delivery to the user entity.

Abstract: A method of utilizing a list of predictive paths by a map-server. The method includes receiving the list of predictive paths, storing the list of predictive paths in a memory, receiving, from a first network element, a request for a location of a user device, the request related to transmitting a packet to the user device, and transmitting, to the first network element, a plurality of user locations based on the list of predictive paths, the plurality of user locations identifying where a second user device will transmit the packet when the packet is received by the second user device.

Abstract: A computer-implemented method of preventing communications based on endpoint category is provided that comprises: accessing, by one or more processors of a router, a data packet that indicates a source identifier that identifies a source endpoint and a destination identifier that identifies a destination endpoint; determining, by the one or more processors of the router, a source category based on the source identifier; determining, by the one or more processors of the router, a destination category based on the destination identifier; and based on the source category and the destination category, refraining from sending the data packet to the destination endpoint.

Abstract: A method implemented by a service rendezvous point (SRP) comprises receiving, by a receiver of the SRP, a plurality of register messages from a plurality of service switch points (SSPs), each of the register messages comprising at least one of resource information or service information, each of the SSPs being associated with a different network domain, sending, by a transmitter of the SRP, a plurality of report messages to the plurality of SSPs, each of the report messages comprising resource allocation information for each of the network domains for a service, the resource allocation information including an amount of resources to be allocated at the each of the network domains for the service, and maintaining, at a memory of the SRP, a SSP database storing at least one of the resource allocation information of each of the network domains, the resource information of each of the network domains, and the service information of each of the network domains.