Abstract: Disclosed are systems, methods, devices, and computer-readable media for offloading lattice-based cryptographic operations to hybrid cloud computing system. In one embodiment, a method is disclosed comprising receiving a first network request from a client device via a secure application programming interface (API), the request including unencrypted data; encrypting the unencrypted data using an algorithm that generates homomorphically encrypted data; issuing a second network request to a second API of a cloud platform, the second network request including the encrypted data; receiving a response from the cloud platform in response to the second network request; and transmitting, in response to the first network request, a result to the client device based on the response, the result obtained by decrypting an encrypted output returned by the cloud platform.

Abstract: Systems and methods described herein securely compute private data on a cloud platform. A network device in the cloud platform obtains a product or service description from a first user. The description includes a combination of public data and encrypted private data based on a first encryption key. The network device receives a query from an end device of a second user and retrieves, based on the query, the product or service description. The network device forwards the description to a trusted execution environment (TEE) instance for decryption of the encrypted private data, processing of the private data, and re-encryption of the private data with a second encryption key. The network device receives the re-encrypted private data from the TEE instance and assembles the re-encrypted private data and the public data into a query response for presentation on the end device. The network device sends, to the end device, the query response including the re-encrypted private data and the public data.

Abstract: Systems and methods described herein enable data analytics for secure cloud compute data that protects the integrity and confidentiality of the underlying data. A network device in a network creates an instance of a Trusted Execution Environment (TEE). The network device generates, in the TEE instance, transactional data that includes private information and removes the private information from the transactional data to generate extracted data. The network device encrypts, within the TEE instance, the extracted data and exports the encrypted extracted data to a memory outside of the TEE instance.

Abstract: Disclosed are systems, methods, devices, and computer-readable media for offloading lattice-based cryptographic operations to hybrid cloud computing system. In one embodiment, a method is disclosed comprising receiving a first network request from a client device via a secure application programming interface (API), the request including unencrypted data; encrypting the unencrypted data using an algorithm that generates homomorphically encrypted data; issuing a second network request to a second API of a cloud platform, the second network request including the encrypted data; receiving a response from the cloud platform in response to the second network request; and transmitting, in response to the first network request, a result to the client device based on the response, the result obtained by decrypting an encrypted output returned by the cloud platform.

Abstract: A device determines, based on location verification data that has been received, that the device is indoors at a first geographic location. The device determines a base measured barometric pressure, and an initial floor that the device is located on in a structure that includes the first geographic location. The device determines an adjusted measured barometric pressure for a second geographic location based on a second measured barometric pressure for the second geographic location and one or more reference barometric pressures that are associated with a reference location. The device determines an altitude for the second geographic location based on the base measured barometric pressure and the adjusted measured barometric pressures. The device causes a server to predict a floor that the device is located on at the second geographic location and to provide floor data that identifies the floor to an interface that is accessible to the device.

Abstract: A device determines, based on location verification data that has been received, that the device is indoors at a first geographic location. The device determines a base measured barometric pressure, and an initial floor that the device is located on in a structure that includes the first geographic location. The device determines an adjusted measured barometric pressure for a second geographic location based on a second measured barometric pressure for the second geographic location and one or more reference barometric pressures that are associated with a reference location. The device determines an altitude for the second geographic location based on the base measured barometric pressure and the adjusted measured barometric pressures. The device causes a server to predict a floor that the device is located on at the second geographic location and to provide floor data that identifies the floor to an interface that is accessible to the device.

Abstract: Systems and methods described herein securely compute private data on a cloud platform. A network device in the cloud platform obtains a product or service description from a first user. The description includes a combination of public data and encrypted private data based on a first encryption key. The network device receives a query from an end device of a second user and retrieves, based on the query, the product or service description. The network device forwards the description to a trusted execution environment (TEE) instance for decryption of the encrypted private data, processing of the private data, and re-encryption of the private data with a second encryption key. The network device receives the re-encrypted private data from the TEE instance and assembles the re-encrypted private data and the public data into a query response for presentation on the end device. The network device sends, to the end device, the query response including the re-encrypted private data and the public data.

Abstract: Systems and methods described herein enable data analytics for secure cloud compute data that protects the integrity and confidentiality of the underlying data. A network device in a network creates an instance of a Trusted Execution Environment (TEE). The network device generates, in the TEE instance, transactional data that includes private information and removes the private information from the transactional data to generate extracted data. The network device encrypts, within the TEE instance, the extracted data and exports the encrypted extracted data to a memory outside of the TEE instance.

Abstract: A device determines, based on location verification data that has been received, that the device is indoors at a first geographic location. The device determines a base measured barometric pressure, and an initial floor that the device is located on in a structure that includes the first geographic location. The device determines an adjusted measured barometric pressure for a second geographic location based on a second measured barometric pressure for the second geographic location and one or more reference barometric pressures that are associated with a reference location. The device determines an altitude for the second geographic location based on the base measured barometric pressure and the adjusted measured barometric pressures. The device causes a server to predict a floor that the device is located on at the second geographic location and to provide floor data that identifies the floor to an interface that is accessible to the device.

Abstract: A session controller coupled to a database and configured to receive an indication associated with an ingress call is disclosed. The disclosed session controller is further configured to compare at least one of a network capacity, a call-peer bandwidth, or a number of active call-legs associated with the ingress call session against a respective threshold, and to reject the ingress call when a respective threshold is exceeded.

Abstract: A method for routing media calls over a real time packet switch connection includes providing a session controller for connecting to a network. The method further includes providing a signaling switch for connecting to the session controller. The method further includes controlling call routing in the network with the session controller where the call routing control includes identifiers for elements in at least two layers of a seven layer model. The call routing control includes a preference for a codec for the call. The call routing is carried out taking into consideration a mean opinion score qualifier from previous calls having a same source and destination.

Abstract: A voice over Internet protocol communication system and method provides infrastructure components as intermediaries between networks, the components include multi-protocol session controllers and a multi-protocol signaling switch as well as a management system. The session controllers process calls and participate in the calls that flow through it. The session controllers process calls that are either at the edge of the network or at the core of the voice over Internet protocol network. The session controllers associate calls with one another in call peers for incoming calls as ingress call peers and for outgoing calls as egress call peers. A centralized database of call routing policies is provided to the session controllers. The session controllers provide cost management, topology hiding, and inter-working, or conversion, of calls from SIP networks to H.323 networks for both voice and video.

Abstract: In a method and system for managing at least one media stream from a media source to a media destination, where the media stream passes through at least one network, providing a media manager for managing the media stream and the at least one network for performing at least one of the management functions bandwidth management, media hairpin detection, media path control, equal access or preventing media backhauling. In the media manager at least one of the media stream information types media routing, receive transport address, routed receive transport address, source network, destination network, media stream identifier, or bandwidth of the media stream is stored for a time period during which the media stream exists in the at least one network. The media manager uses at least one of the stored information types for performing at least one of the management functions.

Abstract: In a method and system for managing at least one media stream from a media source to a media destination, where the media stream passes through at least one network, providing a media manager for managing the media stream and the at least one network for performing at least one of the management functions bandwidth management, media hairpin detection, media path control, equal access or preventing media backhauling. In the media manager at least one of the media stream information types media routing, receive transport address, routed receive transport address, source network, destination network, media stream identifier, or bandwidth of the media stream is stored for a time period during which the media stream exists in the at least one network. The media manager uses at least one of the stored information types for performing at least one of the management functions.

Abstract: A voice over Internet protocol communication system and method provides infrastructure components as intermediaries between networks, the components include multi-protocol session controllers and a multi-protocol signaling switch as well as a management system. The session controllers process calls and participate in the calls that flow through it. The session controllers process calls that are either at the edge of the network or at the core of the voice over Internet protocol network. The session controllers associate calls with one another in call peers for incoming calls as ingress call peers and for outgoing calls as egress call peers. A centralized database of call routing policies is provided to the session controllers. The session controllers provide cost management, topology hiding, and inter-working, or conversion, of calls from SIP networks to H.323 networks for both voice and video.

Abstract: In a method and system for managing at least one media stream from a media source to a media destination, where the media stream passes through at least one network, providing a media manager for managing the media stream and the at least one network for performing at least one of the management functions bandwidth management, media hairpin detection, media path control, equal access or preventing media backhauling. In the media manager at least one of the media stream information types media routing, receive transport address, routed receive transport address, source network, destination network, media stream identifier, or bandwidth of the media stream is stored for a time period during which the media stream exists in the at least one network. The media manager uses at least one of the stored information types for performing at least one of the management functions.

Abstract: A voice over Internet protocol communication system and method provides infrastructure components as intermediaries between networks, the components include multi-protocol session controllers and a multi-protocol signaling switch as well as a management system. The session controllers process calls and participate in the calls that flow through it. The session controllers process calls that are either at the edge of the network or at the core of the voice over Internet protocol network. The session controllers associate calls with one another in call peers for incoming calls as ingress call peers and for outgoing calls as egress call peers. A centralized database of call routing policies is provided to the session controllers. The session controllers provide cost management, topology hiding, and inter-working, or conversion, of calls from SIP networks to H.323 networks for both voice and video.

Abstract: A method for routing media calls over a real time packet switch connection includes providing a session controller for connecting to a network. The method further includes providing a signaling switch for connecting to the session controller. The method further includes controlling call routing in the network with the session controller where the call routing control includes identifiers for elements in at least two layers of a seven layer model. The call routing control includes a preference for a codec for the call. The call routing is carried out taking into consideration a mean opinion score qualifier from previous calls having a same source and destination.

Abstract: A voice over Internet protocol communication system and method provides infrastructure components as intermediaries between networks, the components include multi-protocol session controllers and a multi-protocol signaling switch as well as a management system. The session controllers process calls and participate in the calls that flow through it. The session controllers process calls that are either at the edge of the network or at the core of the voice over Internet protocol network. The session controllers associate calls with one another in call peers for incoming calls as ingress call peers and for outgoing calls as egress call peers. A centralized database of call routing policies is provided to the session controllers. The session controllers provide cost management, topology hiding, and inter-working, or conversion, of calls from SIP networks to H.323 networks for both voice and video.

Abstract: A method for multistage routing of packets using call templates is disclosed. An ingress call is filtered based on a plurality of ingress-call parameter values. A parameter value for the ingress call is modified based on a plurality of ingress-call-peer parameter values. A filtered ingress-call parameter value and at least one filtered ingress-call-peer parameter value from a plurality of ingress-call-peer parameter values are converted to an egress-call parameter value and an egress-call-peer parameter value, respectively. An egress call is filtered based on a plurality of egress-call parameter values. A parameter value for the egress call is modified based on a plurality of egress-call-peer parameter values.