Abstract: In one example, an Access Point (AP) configures a first mapping of a first cellular network connection to a first local access network group, and further configures a second mapping of a second cellular network connection to a second local access network group. The AP determines whether a user device is authorized to use the first cellular network connection or the second cellular network connection. If the user device is authorized to use the first cellular network connection, the AP associates, for the user device, a first user device identifier with the first local access network group. If the user device is authorized to use the second cellular network connection, the AP associates, for the user device, a second user device identifier with the second local access network group.

Abstract: In one example, an Access Point (AP) configures a first mapping of a first cellular network connection to a first local access network group, and further configures a second mapping of a second cellular network connection to a second local access network group. The AP determines whether a user device is authorized to use the first cellular network connection or the second cellular network connection. If the user device is authorized to use the first cellular network connection, the AP associates, for the user device, a first user device identifier with the first local access network group. If the user device is authorized to use the second cellular network connection, the AP associates, for the user device, a second user device identifier with the second local access network group.

Abstract: A networked electronic device produces a data object comprising content and assigns a location-independent application-level name to the data object. The location-independent application-level name is independent of any network location at which the content is available. The networked electronic device maps the location-independent application-level name to an IP address, generates a DNS resource record specifying the mapping of the location-independent application-level name to the IP address, and provides the DNS resource record to a DNS network node.

Abstract: A source virtual private network (VPN) gateway supports a local source subnet and communicates over a wide area network (WAN) with a destination VPN gateway that supports a local destination subnet. The source VPN gateway receives from the local source subnet an Internet Protocol (IP) packet destined for the local destination subnet, determines a security association (SA) based on a source IP address and a destination IP address of the IP packet, and encapsulates the IP packet with tunnel encapsulation including a tunnel protocol header and a tunnel outer IP header, to produce a clear-text tunnel packet. The source VPN gateway encrypts the IP packet and the tunnel protocol header but not the tunnel outer IP header using an encryption key and a security parameter index for the SA, to produce an encrypted tunnel packet, and tunnels it to the destination VPN gateway over the WAN.

Abstract: The container deployment system of the present disclosure provides systems and processes to perform authorization of each unique container instance by the enterprise organization that published the container image and requested the container instance. A controller may be programmed or configured to apply one or more authorization policies to determine if a container instance should be executed or not. The authorization policies may include rules that restrict the number of containers running, cost consideration for executing a container, violations of time constraints for the execution of a container image, and violations of location constraints for execution of a container image, among other variations.

Abstract: The container deployment system of the present disclosure provides systems and processes to perform authorization of each unique container instance by the enterprise organization that published the container image and requested the container instance. A controller may be programmed or configured to apply one or more authorization policies to determine if a container instance should be executed or not. The authorization policies may include rules that restrict the number of containers running, cost consideration for executing a container, violations of time constraints for the execution of a container image, and violations of location constraints for execution of a container image, among other variations.

Abstract: A source virtual private network (VPN) gateway supports a local source subnet and communicates over a wide area network (WAN) with a destination VPN gateway that supports a local destination subnet. The source VPN gateway receives from the local source subnet an Internet Protocol (IP) packet destined for the local destination subnet, determines a security association (SA) based on a source IP address and a destination IP address of the IP packet, and encapsulates the IP packet with tunnel encapsulation including a tunnel protocol header and a tunnel outer IP header, to produce a clear-text tunnel packet. The source VPN gateway encrypts the IP packet and the tunnel protocol header but not the tunnel outer IP header using an encryption key and a security parameter index for the SA, to produce an encrypted tunnel packet, and tunnels it to the destination VPN gateway over the WAN.

Abstract: Various techniques that allow group members to detect the use of stale encryption policy by other group members are disclosed. One method involves receiving a message from a first group member via a network. The message is received by a second group member. The method then detects that the first group member is not using a most recent policy update supplied by a key server, in response to information in the message. In response, a notification message can be sent from the second group member. The notification message indicates that at least one group member is not using the most recently policy update. The notification message can be sent to the key server or towards the first group member.

Abstract: A system and methods for providing dynamic transcoder rate adaption for an adaptive bit streaming function is described. In a first embodiment, a client may select from all available bit rates during the encoding session, wherein the bit rates are provided to the client via a manifest file from a media gateway. In a second embodiment, a subset of the bit rates are provided to the client, from which a client chooses a selected bit rate. The encoding session continues until a request for a new bit rate is received from the client, at which time a new subset of bit rates are generated. This new subset of bit rates is presented to the client, and this loop continues until the termination of the encoding session.

Abstract: A method is provided in one example embodiment and includes receiving at a node of a transitive IP network a data packet including a Network Services Header (“NSH”); accessing by the transitive IP network node context contained in the NSH, wherein the context may be used by the transitive IP network node to perform an enhanced network service in connection with the received data packet; performing by the transitive IP network node the enhanced network service in connection with the received data packet using the accessed context; and, subsequent to the performing, forwarding the received packet to a next node.

Abstract: A first virtual machine is established in a virtual private service chain to provide a first network service to virtual private service chain traffic. A second virtual machine is also established the virtual private service chain to provide a second network service to the virtual private service chain traffic. The virtual private service chain traffic is encrypted for transmission within the virtual private service chain from the first virtual machine to the second virtual machine, wherein the encryption uses a key shared by the first and second virtual machines.

Abstract: Techniques are presented for optimizing secure communications in a network. As disclosed herein, a key server is configured to provision a plurality of routers that are part of a virtual private network. The key server selects a counter value that is part of a security association and calculates a key value. The key server sends the key value, together with the security association, to the plurality of routers that are part of the virtual private network to enable them to exchange encrypted packets with each other in the virtual private network using the key value and the security association. The key server then increments the counter value to a value within a range of counter values capable of being predicted by the plurality of routers that received the key value.

Abstract: A method is provided in one example embodiment and includes receiving at a node of a transitive IP network a data packet including a Network Services Header (“NSH”); accessing by the transitive IP network node context contained in the NSH, wherein the context may be used by the transitive IP network node to perform an enhanced network service in connection with the received data packet; performing by the transitive IP network node the enhanced network service in connection with the received data packet using the accessed context; and, subsequent to the performing, forwarding the received packet to a next node.

Abstract: A system and methods for providing dynamic transcoder rate adaption for an adaptive bit streaming function is described. In a first embodiment, a client may select from all available bit rates during the encoding session, wherein the bit rates are provided to the client via a manifest file from a media gateway. In a second embodiment, a subset of the bit rates are provided to the client, from which a client chooses a selected bit rate. The encoding session continues until a request for a new bit rate is received from the client, at which time a new subset of bit rates are generated. This new subset of bit rates is presented to the client, and this loop continues until the termination of the encoding session.

Abstract: A slave resource router may receive a client request. The slave resource router may be the nearest representation of an Anycast IP address in a network to a client sending the client request in the network. The slave resource router may then determine that the slave resource router has been authorized to cache content for a delivery service corresponding to the client request. Next, the slave resource router may determine that content corresponding to the client request is cached locally in a blind cache. Then the slave resource router may provide the client with the content from the blind cache.

Abstract: A system and methods for providing dynamic transcoder rate adaption for an adaptive bit streaming function is described. In a first embodiment, a client may select from all available bit rates during the encoding session, wherein the bit rates are provided to the client via a manifest file from a media gateway. In a second embodiment, a subset of the bit rates are provided to the client, from which a client chooses a selected bit rate. The encoding session continues until a request for a new bit rate is received from the client, at which time a new subset of bit rates are generated. This new subset of bit rates is presented to the client, and this loop continues until the termination of the encoding session.

Abstract: A first customer edge network device receives an encapsulated packet that includes inner headers comprising source address information for a first service running on a first computing apparatus in a first home cloud and destination address information for a second service running on a second computing apparatus in a second home cloud. The customer edge network device inserts a predetermined portion of bits of a virtual domain identifier of the encapsulated packet into a label to form a virtual domain label for label-based routing. The virtual domain label is appended to the encapsulated packet. The encapsulated packet is sent to a first provider edge network device of a provider network. The first provider edge network device appends an virtual private network label to the encapsulated packet, and sends the encapsulated packet to a provider network device for label-based routing in the provider network.

Abstract: A first customer edge network device receives an encapsulated packet that includes inner headers comprising source address information for a first service running on a first computing apparatus in a first home cloud and destination address information for a second service running on a second computing apparatus in a second home cloud. The customer edge network device inserts a predetermined portion of bits of a virtual domain identifier of the encapsulated packet into a label to form a virtual domain label for label-based routing. The virtual domain label is appended to the encapsulated packet. The encapsulated packet is sent to a first provider edge network device of a provider network. The first provider edge network device appends an virtual private network label to the encapsulated packet, and sends the encapsulated packet to a provider network device for label-based routing in the provider network.

Abstract: Techniques are presented herein for optimizing secure communications in a network. A router in a virtual private network determines whether or not it has successfully registered with a key server that provides cryptographic keys for routers in the virtual private network. The router stores state information that is indicative of whether or not the router has successfully registered with the key server.

Abstract: Consistent with embodiments of the present invention, a system may be provided to provide per-subscriber stream management comprising: a client capable of receiving a playlist containing a subset of segments associated with a video asset; a video application server to request subscriber state information and to build state representations in a subscriber database on a per-subscriber basis; a media segmenter capable of providing the video asset in multiple bit rates; a subscriber state manager capable of managing the current state of one or more subscribers in a subscriber database; and a stream manager capable of requesting the assignment of bandwidth from a wireless infrastructure on a per-subscriber basis.