Abstract: Location-based, context-aware challenge-response authentication may be provided. First, a challenge may be provided to a user. The challenge may be based on a context corresponding to the user. The context corresponding to the user may comprise a location of a device associated with the user within an environment. Next, in response to providing the challenge, a response to the challenge may be received from the user. Then, in response to receiving the response to the challenge, it may be determined that the response is a correct answer to the challenge. In response to determining the response is the correct answer, a privilege may be provided to the user.

Abstract: A method is performed at a gateway device including one or more processors and a non-transitory memory. The method includes, receiving, from a first wireless network, a first get authentication token request, where the first get authentication token request includes network information of a second wireless network and information of a first user equipment (UE). The method further includes forwarding the first get authentication token request to the second wireless network in response to receiving the first get authentication token request. The method additionally includes receiving a first authentication token from the second wireless network. The method also includes forwarding the first authentication token to the first UE via the first wireless network in order to associate the first UE with the second wireless network.

Abstract: Systems, methods, and computer-readable media for dynamically assigning devices to specific channels in the CBRS band. One or more dedicated channels within the CBRS band can be selected and a boost channel device group can be formed by exclusively allocating the one or more dedicated channel to the boost channel device group. Further, a normal channel device group can be formed by allocating, to the normal channel device group, one or more channels in the CBRS band that are separate from the one or more dedicated channels allocated to the boost channel device group. One or more devices communicating in the CBRS band can be selectively assigned to either the boost channel device group or the normal channel device group to selectively control communications in the CBRS band over the one or more dedicated channels utilized by the boost channel device group.

Abstract: Systems, methods, and computer-readable media for radio resource management in a Citizens Broadband Radio Service (CBRS) network include one or more CBRS devices (CBSDs) which can obtain a group type associated with the CBSDs and their associated Radio Environment Map (REM) reports of one or more frequency channels of the CBRS network. The group type and the REM reports may be provided to a Self-Organizing Network (SON) manager of the CBRS network, where the SON manager may determine and provide to the CBSDs, one or more of a channel utilization information, transmission power, or mobility load management information for the CBSD, based on the group type and the REM reports.

Abstract: A method of controlling performance of a wireless device is performed by a node that is in electronic communication with a cellular network. The node includes a processor, a non-transitory memory, and a network interface. The method includes receiving a performance value characterizing a performance of a communication channel between a wireless device and a wireless access point. In some implementations, the wireless device and the cellular network are associated with different radio access technologies (RATs). The method includes determining whether the performance value breaches a performance criterion for the wireless device. The method includes adjusting a first amount of data transmitted to the wireless device from a base station of the cellular network and a second amount of data transmitted to the wireless device from the wireless access point. In some implementations, the combined first and second amounts of data satisfy the performance criterion for the wireless device.

Abstract: Systems, methods, and devices are disclosed for providing a quality of service between nodes. A service provider can receive, from a first node of a customer network to an ingress node of a service provider network, packets bound for a second node on the customer network that is remote from the first node. The packets are mapped to a network segment according to a traffic type based on an identifier associated with the packets that identifies the traffic type of the packets. The packets are sent via their mapped network segment to an egress node with connectivity to the second node of the customer network according to a quality of service associated with the traffic type identified by the identifier.

Abstract: Systems, methods, and computer-readable storage media are provided for parallel initiating of devices in a system. The method includes generating an affinity table that stores option ROM execution data including first data associated with a first device and second data associated with a second device and triggering, based on the affinity table, a first initialization of the first device and executing a first option ROM code during a pre-boot phase and triggering, based on the affinity table, a second initialization of the second device and executing a second option ROM code during the pre-boot phase. Triggering the first initialization of the first device and triggering the second initialization of the second device during the pre-boot phase is performed such that at least a part of the first initialization of the first device and at least part of the second initialization of the second device are executed in parallel.

Abstract: The disclosed technology relates a system is configured to generate a protected configuration for a network device based on network connectivity data for a plurality of devices in a managed network associated with a cloud management system. The system is further configured to receive a configuration change for the managed network, determine that the configuration change is incompatible with the protected configuration, and generate a notification that the configuration change is incompatible with the protected configuration.

Abstract: Techniques for improved wireless ranging are provided. A first communication from a first client device is received at a first network device. A predefined minimum distance is determined for the first access point, where the predefined minimum distance corresponds to a distance at which the vertical location of the first network device causes time of flight ranging techniques to result in inaccurate location estimations. A first distance of the first client device from the first network device is estimated. Upon determining that the first distance of the first client device is below the predefined minimum distance, ToF ranging requests from the first client device are declined.

Abstract: Systems, methods, and computer-readable media for radio resource management in a Citizens Broadband Radio Service (CBRS) network include one or more CBRS devices (CBSDs) which can obtain a group type associated with the CBSDs and their associated Radio Environment Map (REM) reports of one or more frequency channels of the CBRS network. The group type and the REM reports may be provided to a Self-Organizing Network (SON) manager of the CBRS network, where the SON manager may determine and provide to the CBSDs, one or more of a channel utilization information, transmission power, or mobility load management information for the CBSD, based on the group type and the REM reports.

Abstract: In one example, a wireless Access Point (AP) is configured to provide network connectivity between a User Equipment (UE) and a private wireless network. The wireless AP obtains, from the private wireless network, an indication that the UE is unregistered with the private wireless network. In response to the indication that the UE is unregistered with the private wireless network, the wireless AP provides, to the private wireless network, an indication to initiate an emergency attach procedure with respect to the UE. In response to the indication to initiate the emergency attach procedure, the wireless AP obtains, from the private wireless network, an indication that the UE is authorized to access the private wireless network. In response to the indication that the UE is authorized to access the private wireless network, the wireless AP provides guest access to the private wireless network on behalf of the UE.

Abstract: Techniques and mechanisms for secure management of network device configuration and audit are provided. A configuration blockchain is received by a first network device of a plurality of network devices. Additionally, the first network device analyzes the configuration blockchain to identify a plurality of configuration records associated with a second network device of the plurality of network devices. For at least one respective configuration record of the plurality of configuration records, the first network device determines a respective configuration change reflected in the at least one respective configuration record, and implements the respective configuration change on the first network device.

Abstract: Techniques for establishing network quality of service for an internet of things device are described. A manufacturer usage description identifier relating to the internet of things device is received. The internet of things device is coupled to a communication network. Quality of service parameters relating to the internet of things device and the communication network are determined based on the manufacturer usage description identifier. The quality of service parameters are provided to a network policy controller. The network policy controller is configured to establish a quality of service for the internet of things device on the communication network based on the one or more quality of service parameters.

Abstract: Systems, methods, and devices are disclosed for providing a quality of service between nodes. A service provider can receive, from a first node of a customer network to an ingress node of a service provider network, packets bound for a second node on the customer network that is remote from the first node. The packets are mapped to a network segment according to a traffic type based on an identifier associated with the packets that identifies the traffic type of the packets. The packets are sent via their mapped network segment to an egress node with connectivity to the second node of the customer network according to a quality of service associated with the traffic type identified by the identifier.

Abstract: Techniques for handling requests from a remote device are disclosed. A server receives a first unsolicited activation request from a first device of a plurality of devices. A probabilistic hash filter, associated with a data set, is queried using a first identifier associated with the first device. In response, a first result is received from the probabilistic hash filter indicating that the first device is not ready for activation. In response to receiving the first result, a back-off indication is transmitted to the first device.

Abstract: In one embodiment, an IoT server includes: processing circuitry, an I/O module operative to communicate with at least an IoT device and a vendor network server, and an onboarding application and operative to at least: receive an onboarding request from the IoT device via the I/O module, send a confirmation request to the vendor network server via the I/O module, where the confirmation request indicates a request to confirm an identity of the IoT device according to a connection to a network device authenticated by the vendor network server, receive a confirmation response from the vendor network server via the I/O module, where the confirmation response indicates whether the IoT device is connected to the network device, and if the confirmation response is a positive confirmation response that indicates that the IoT device is connected to the network device, onboard the IoT device for participation in an IoT-based system.

Abstract: Systems and methods provide for Selective Tracking of Acknowledgments (STACKing) to improve buffer utilization and traffic shaping for one or more network devices. A network device can identify a first flow that corresponds to a predetermined traffic class and a predetermined congestion state. The device can determine a current window size and congestion threshold of the first flow. In response to a determination to selectively track a portion of acknowledgments of the first flow, the device can track, in main memory, information of a first portion of acknowledgments of the first flow. The device can exclude, from one or more buffers, a second portion of acknowledgments of the first flow. The device can re-generate and transmit segments corresponding to the second portion of acknowledgments at a target transmission rate based on traffic shaping policies for the predetermined traffic class and congestion state.

Abstract: Techniques for identification and isolation of Internet-of-Things devices in an enterprise network are described. In one embodiment, a method includes detecting a plurality of devices having a first network interface to connect to a wireless wide area network and a second network interface to connect to an enterprise network. The method also includes identifying a first subset of the plurality of devices as Internet-of-Things (IoT) devices based on at least a detected repetition rate on a physical random access channel of a transmission made by a device of the plurality of devices. The method includes assigning the IoT devices to a separate network segment within the enterprise network.

Abstract: The disclosed technology relates to systems and methods for automatically scaling down network resources, such as servers or gateway instances, based on predetermined thresholds. A system is configured to detect a reduction in one or more network metrics related to a first server, and instruct the first server to issue a rekey request to a plurality of devices connected to the first server. The system is further configured to instruct a load balancer to route to at least one other server responses from the plurality of devices to the rekey request, and determine a number of connections remaining between the first server and the plurality of devices. The system may be further configured to instruct the load balancer to terminate the first server based on the detected number of connections remaining between the first server and the plurality of devices.

Abstract: Various implementations disclosed herein enable controlling access to networks. In various implementations, a method of controlling access to a network is performed by a computing device including one or more processors, and a non-transitory memory. In various implementations, the method includes obtaining an indication that a mobile device having access to a first network utilizing a first radio access technology (RAT) has requested access to a second network utilizing a second RAT. In some implementations, the method includes determining whether the access to the first network satisfies an authentication criterion associated with the second network. In some implementations, the method includes granting the mobile device access to the second network in response to determining that the access to the first network satisfies the authentication criterion associated with the second network.