Abstract: Techniques are disclosed for reducing the time required to instantiate network services in a service provider network to service requests by subscriber devices. In one example, an orchestration engine pre-creates pools of different virtual network functions (VNFs). Upon receiving a request to service network traffic from a subscriber device, the orchestration engine dynamically creates a service chain using the appropriate VNFs from the pools of different VNFs. In another example, the orchestration engine pre-creates pools of common service chains. Upon receiving a request to service network traffic from a subscriber device, the orchestration engine selects the appropriate service chain from the pools of service chains. After configuring the service chain, the orchestration engine issues instructions to a Software-Defined Networking (SDN) controller causing the SDN controller to update forwarding information in the service provider network to enable the service chain to service the subscriber traffic.

Abstract: The disclosed apparatus may include (1) providing a framework that enables a customer entity of a service provider to configure, via a customer portal, a network device of the service provider that directs network traffic of the customer entity, (2) creating, for the customer entity by way of the framework, a virtual network that includes at least a portion of the network device of the service provider, (3) detecting an attempt by the customer entity to configure at least a portion of the virtual network via the customer portal, and then in response to detecting the attempt by the customer entity, (4) performing a configuration operation that configures the portion of the virtual network as directed by the customer entity via the customer portal. Various other apparatuses, systems, and methods are also disclosed.

Abstract: The disclosed apparatus may include an encryption device that signs information exchanged between network devices to ensure the integrity of the information. The disclosed apparatus may also include a network device communicatively coupled to the encryption device, wherein the network device (1) obtains geo-location information that identifies the location of the network device, (2) directs the encryption device to sign the geo-location information to ensure the integrity of the geo-location information, (3) provides the signed geo-location information to a remote management system that manages the configuration of the network device based at least in part on the geo-location information, and (4) receives a configuration profile that modifies the configuration of the network device to account for the current location of the network device from the remote management system. Various other apparatuses, systems, and methods are also disclosed.

Abstract: A device may include one or more processors to detect an issue in a universal customer premises equipment (uCPE) platform; select a traffic flow to migrate from the uCPE platform to a virtual customer premises equipment (vCPE) platform, the traffic flow may be selected based on a characteristic of the traffic flow; determine a traffic path of the traffic flow through the vCPE platform; select a point of presence (PoP) of the vCPE platform to host a virtual network function (VNF) associated with the traffic flow based on the PoP being situated along the traffic path; and perform an action associated with the PoP or the traffic flow to resolve the issue.

Abstract: The disclosed apparatus may include (1) a storage device that stores a set of cookies that facilitate authenticating packets received from a node within a network and (2) a processing unit communicatively coupled to the storage device, wherein the processing unit (A) receives at least one packet from the node, (B) identifies a cookie included in the packet received from the node, (C) searches the set of cookies stored in the storage device for the cookie included in the packet received from the node, (D) identifies, during the search of the set of cookies, the cookie included in the packet and (E) protects against a DoS attack by authenticating the legitimacy of the packet based at least in part on the cookie included in the packet being identified in the set of cookies stored in the storage device. Various other apparatuses, systems, and methods are also disclosed.

Abstract: The disclosed apparatus may include (1) providing a framework that enables a customer entity of a service provider to configure, via a customer portal, a network device of the service provider that directs network traffic of the customer entity, (2) creating, for the customer entity by way of the framework, a virtual network that includes at least a portion of the network device of the service provider, (3) detecting an attempt by the customer entity to configure at least a portion of the virtual network via the customer portal, and then in response to detecting the attempt by the customer entity, (4) performing a configuration operation that configures the portion of the virtual network as directed by the customer entity via the customer portal. Various other apparatuses, systems, and methods are also disclosed.

Abstract: A device may include one or more processors to detect an issue in a universal customer premises equipment (uCPE) platform; select a traffic flow to migrate from the uCPE platform to a virtual customer premises equipment (vCPE) platform, the traffic flow may be selected based on a characteristic of the traffic flow; determine a traffic path of the traffic flow through the vCPE platform; select a point of presence (PoP) of the vCPE platform to host a virtual network function (VNF) associated with the traffic flow based on the PoP being situated along the traffic path; and perform an action associated with the PoP or the traffic flow to resolve the issue.

Abstract: Techniques are disclosed for intercepting, by a customer-premises equipment (CPE), a request for a content file. The request may originate from a computing device in a local area network for the CPE and may be destined for a destination device external to the local area network for the CPE. In response to determining that an encrypted content file for the content file is stored by a storage device for the CPE, the CPE may decrypt, using at least one cryptographic key obtained from a Trusted Platform Module (TPM) for the CPE, the encrypted content file to obtain the content file. The CPE may send the content file to the computing device.

Abstract: Techniques are disclosed for reducing the time required to instantiate network services in a service provider network to service requests by subscriber devices. In one example, an orchestration engine pre-creates pools of different virtual network functions (VNFs). Upon receiving a request to service network traffic from a subscriber device, the orchestration engine dynamically creates a service chain using the appropriate VNFs from the pools of different VNFs. In another example, the orchestration engine pre-creates pools of common service chains. Upon receiving a request to service network traffic from a subscriber device, the orchestration engine selects the appropriate service chain from the pools of service chains. After configuring the service chain, the orchestration engine issues instructions to a Software-Defined Networking (SDN) controller causing the SDN controller to update forwarding information in the service provider network to enable the service chain to service the subscriber traffic.

Abstract: The disclosed apparatus may include a set of communication ports that facilitate communication with a network device via a set of communication links that collectively operate as a LAG bundle. The disclosed apparatus may also include a link-management unit communicatively coupled to the set of communication ports that facilitate communication with the network device. The link-management unit may detect an amount of communication activity on one or more active communication links included in the set of communication links that are collectively operating as the LAG bundle. The link-management unit may then determine that the amount of communication activity detected on the active communication links has reached a certain threshold. In response to this determination, the link-management unit may modify the active communication links included in the set of communication links to account for the amount of communication activity. Various other apparatuses, systems, and methods are also disclosed.

Abstract: The disclosed apparatus may include an encryption device that signs information exchanged between network devices to ensure the integrity of the information. The disclosed apparatus may also include a network device communicatively coupled to the encryption device, wherein the network device (1) obtains geo-location information that identifies the location of the network device, (2) directs the encryption device to sign the geo-location information to ensure the integrity of the geo-location information, (3) provides the signed geo-location information to a remote management system that manages the configuration of the network device based at least in part on the geo-location information, and (4) receives a configuration profile that modifies the configuration of the network device to account for the current location of the network device from the remote management system. Various other apparatuses, systems, and methods are also disclosed.

Abstract: In general, techniques are described for placing, for execution, virtualized network functions (VNFs) for network services to virtual hardware components of a network function virtualization infrastructure (NFVI) having a multi-layer switch hierarchy to locate VNFs that are adjacent, in an ordering within a network service or between network services, logically near to one another in the multi-layer switch hierarchy.

Abstract: The disclosed apparatus may include a secure storage device that securely stores an initial geographic location of a network device that facilitates network traffic within a network. This apparatus may also include a processing unit communicatively coupled to the secure storage device. The processing unit may determine a current geographic location of the network device. The policy-enforcement unit may then detect evidence of theft of the network device by (1) comparing the current geographic location of the network device with the initial geographic location of the network device and (2) determining, based at least in part on the comparison, that the current geographic location of the network device does not match the initial geographic location of the network device. Finally, the processing unit may perform at least one security action in response to detecting the evidence of theft of the network device.

Abstract: The disclosed apparatus may include an encryption device that signs information exchanged between network devices to ensure the integrity of the information. The disclosed apparatus may also include a network device communicatively coupled to the encryption device, wherein the network device (1) obtains geo-location information that identifies the location of the network device, (2) directs the encryption device to sign the geo-location information to ensure the integrity of the geo-location information, (3) provides the signed geo-location information to a remote management system that manages the configuration of the network device based at least in part on the geo-location information, and (4) receives a configuration profile that modifies the configuration of the network device to account for the current location of the network device from the remote management system. Various other apparatuses, systems, and methods are also disclosed.

Abstract: The disclosed apparatus may include (1) a storage device that stores a set of cookies that facilitate authenticating packets received from a node within a network and (2) a processing unit communicatively coupled to the storage device, wherein the processing unit (A) receives at least one packet from the node, (B) identifies a cookie included in the packet received from the node, (C) searches the set of cookies stored in the storage device for the cookie included in the packet received from the node, (D) identifies, during the search of the set of cookies, the cookie included in the packet and (E) protects against a DoS attack by authenticating the legitimacy of the packet based at least in part on the cookie included in the packet being identified in the set of cookies stored in the storage device. Various other apparatuses, systems, and methods are also disclosed.

Abstract: The disclosed apparatus may include (1) a reply-reception module, stored in memory, that receives, from a satellite device, an authentication reply that includes an original authentication message digitally signed by the aggregation device using a private key of the aggregation device and that is digitally signed by the satellite device using a private key of the satellite device, (2) a forwarding module, stored in memory, that forwards the authentication reply to a network management server, (3) a validation-reception module, stored in memory, that receives, from the network management server in response to forwarding the authentication reply, a validation message, and (4) an authentication module, stored in memory, that authenticates the satellite device based at least in part on receiving the validation message. Various other apparatuses, systems, and methods are also disclosed.

Abstract: The disclosed apparatus may include a secure storage device that securely stores an initial geographic location of a network device that facilitates network traffic within a network. This apparatus may also include a processing unit communicatively coupled to the secure storage device. The processing unit may determine a current geographic location of the network device. The policy-enforcement unit may then detect evidence of theft of the network device by (1) comparing the current geographic location of the network device with the initial geographic location of the network device and (2) determining, based at least in part on the comparison, that the current geographic location of the network device does not match the initial geographic location of the network device. Finally, the processing unit may perform at least one security action in response to detecting the evidence of theft of the network device.

Abstract: The disclosed apparatus may include a secure storage device that securely stores an initial geographic location of a network device that facilitates network traffic within a network. This apparatus may also include a processing unit communicatively coupled to the secure storage device. The processing unit may determine a current geographic location of the network device. The policy-enforcement unit may then detect evidence of theft of the network device by (1) comparing the current geographic location of the network device with the initial geographic location of the network device and (2) determining, based at least in part on the comparison, that the current geographic location of the network device does not match the initial geographic location of the network device. Finally, the processing unit may perform at least one security action in response to detecting the evidence of theft of the network device.

Abstract: The disclosed system may include (1) a detection module, stored in memory, that detects that a user is attempting to operate a network peripheral device configured for connecting into a base network device, at least one of the network peripheral device and the base network device including a trusted platform module that further includes an endorsement key that identifies the trusted platform module, (2) an obtaining module, stored in memory, that obtains a digitally signed indication that the user is authorized by a vendor to operate the network peripheral device, (3) an enablement module, stored in memory, that enables the user to operate the network peripheral device based on obtaining the digitally signed indication that the user is authorized by the vendor to operate the network peripheral device, and (4) at least one physical processor configured to execute these modules. Various other systems and methods are also disclosed.

Abstract: The disclosed apparatus may include a secure storage device that securely stores an initial geographic location of a network device that facilitates network traffic within a network. This apparatus may also include a processing unit communicatively coupled to the secure storage device. The processing unit may determine a current geographic location of the network device. The policy-enforcement unit may then detect evidence of theft of the network device by (1) comparing the current geographic location of the network device with the initial geographic location of the network device and (2) determining, based at least in part on the comparison, that the current geographic location of the network device does not match the initial geographic location of the network device. Finally, the processing unit may perform at least one security action in response to detecting the evidence of theft of the network device.