Abstract: A system for provisioning a device is provided. The system includes a computer device. The computer device is programmed to receive, from a user equipment, a connection request via a layer two connection. The computer device is also programmed to accept the connection request. The computer device is further programmed to receive, from the user equipment, a certificate request via the layer two connection. Additionally, the computer device is programmed to determine a destination for the certificate request, and to route the certificate request to the destination.

Abstract: Aspects of the invention pertain to methods and devices that allow user equipment (UE), such as for example wireless devices, to reconfigure their respective antennas in a dynamic manner to allow connection to additional or fewer logical networks, also being referred to as network slices. Changing the configuration of the array of antennas may include changing an existing configuration, or allocation, of the antennas that are currently communicating with a first number of logical networks into a different configuration of antennas for communicating with a second, different second number of logical networks. In some cases this may mean that antennas that were allocated for communicating with a primary logical network are re-allocated for communicating with a second logical network, with other antennas remaining in communication with the primary logical network.

Abstract: A controller and method for fault detection is provided in network cloud environments is provided. The controller may transmit a request to activate at least two scout functions at deployment locations in the network cloud environment, each scout function operable to execute one or more evaluation operations to collect and report evaluation information relating to its corresponding deployment location. The controller may receive at least one evaluation report comprising an evaluation of computational or communication resource availability at the deployment locations.

Abstract: There is disclosed a network communication system that includes data sources and of switches. Each of the data sources and switches is interconnected by a packet-switched network, and is synchronized to a common clock. The system also includes a network controller that maintains records of network characteristics including a transmission delay for each of the data sources and switches, and a transmission delay for links in the packet-switched network. The network controller processes the network characteristics to generate, for each of a plurality of packets of a given type of traffic: a path from a particular data source, and through at least one particular switch, and a schedule of departure times at each of the particular data source and the at least one particular switch. The path and the schedule are optimized to meet jitter requirements for the given type of traffic.

Abstract: A method, in a node of a network, of establishing a transport layer connection with another node of the network. The method comprises: sending, by the node, a first permanent identifier of the transport layer connection to the other node, the first permanent identifier being independent of at least an IP-address of the node; receiving, by the node, a second permanent identifier of the transport layer connection from the other node, the second permanent identifier being independent of at least an IP-address of the other node; and associating, by the node, the first and second permanent identifiers with a transport layer identifier of the transport layer connection.

Abstract: A source routing method and apparatus are provided. The method includes receiving a data packet that comprises a destination address, a source address, and a payload, determining a plurality of next-hops along a service chain path between the source address and the destination address, generating a source routed data packet that comprises the destination address, the source address, the plurality of next-hops, and the payload, setting the destination address of the source routed data packet to a first next-hop from the plurality of next-hops along the service chain path, and forwarding the source routed data packet in accordance with the destination address.

Abstract: The present disclosure is drawn to systems, methods, and computer-readable media for mitigating cookie-injection and cookie-replaying attacks using a VPN client. The VPN client receives a session request regarding access to a private intranet. In response to the request, the VPN client retrieves cookie deleting criteria, and deletes all cookies which satisfy the cookie deleting criteria. Once all cookies satisfying the cookie deleting criteria are deleted, the VPN client proceeds with the session request.

Abstract: A method for operating a source node includes receiving a data path validation request command requesting validation of a path associated with a traffic flow identified in the data path validation request command, and determining a first hop sequence in accordance with the path being validated, wherein the first hop sequence is identical to a second hop sequence associated with a non-validation request packet associated with the path being validated. The method also includes generating, by the source node, a validation request packet in accordance with the data path validation request command, the validation request packet comprises route information associated with the first hop sequence, an alert flag set to a specified value, and a path validation header specifying processing performed by nodes receiving the validation request packet, and transmitting, by the source node, the validation request packet in accordance with the route information.

Abstract: A service description may be used in network virtualization in order to specify requirements of an application. In order to provide network virtualization for generic networking components, including legacy networking components, the service description is mapped to a logical network implementation and then subsequently mapped to a physical implementation.

Abstract: A data traffic scheduling method that includes selecting, using a network controller, plurality of flows that traverses a network node, generating an augmented graph based on a flow rate of the plurality of flows and link capacities of the network node, computing a flow schedule for the flow using the augmented graph to minimize delay or delay variance of the flows, and outputting the flow schedule. A data traffic scheduling method that includes obtaining, using a network controller, a network topology for a network, generating an augmented graph based on the network topology, converting the augmented graph to a mixed-integer linear program, scheduling a flow in the network using the mixed-integer linear program to minimize delay or delay variance of the flow, and outputting a flow schedule.

Abstract: A method, in a node of a network, of establishing a transport layer connection with another node of the network. The method comprises: sending, by the node, a first permanent identifier of the transport layer connection to the other node, the first permanent identifier being independent of at least an IP-address of the node; receiving, by the node, a second permanent identifier of the transport layer connection from the other node, the second permanent identifier being independent of at least an IP-address of the other node; and associating, by the node, the first and second permanent identifiers with a transport layer identifier of the transport layer connection.

Abstract: The present disclosure is drawn to systems and methods for activating a mobile device in an enterprise mobile management context. The mobile device is configured to generate a first device security certificate which comprises a device key and an identifier of the mobile device. The device key corresponds to a shared secret known to the mobile device and to an authentication server. The mobile device sends the first device security certificate to the authentication server. The authentication server validates the mobile device by comparing the device key to a server key and by locating the identifier in a list of known identifiers. When the mobile device is validated, the authentication server sends a first server security certificate to the mobile device. The first device and server security certificates may then be used to establish a secure connection, over which a second set of device and server certificates may be enrolled.

Abstract: A controller and method for fault detection is provided in network cloud environments is provided. The controller may transmit a request to activate at least two scout functions at deployment locations in the network cloud environment, each scout function operable to execute one or more evaluation operations to collect and report evaluation information relating to its corresponding deployment location. The controller may receive at least one evaluation report comprising an evaluation of computational or communication resource availability at the deployment locations.

Abstract: A method implemented by a network firewall, comprising obtaining a first authentication token for a network test, receiving a test request message for performing the network test on a network element (NE) connected to the network firewall, authenticating the test request message by determining whether the test request message includes a second authentication token that matches the first authentication token, and granting the network test on the NE when the second authentication token matches the first authentication token.

Abstract: An address resolution method, comprising obtaining an Internet Protocol (IP) address for a destination network node, computing a Media Access Control (MAC) address for the destination network node using a mapping function and the IP address for the destination network node, and sending data traffic using the MAC address computed for the destination network node.

Abstract: A packet obfuscation method comprising receiving a data packet having a routing header portion and a payload portion, performing a first obfuscation on the routing header portion to generate an obfuscated routing header portion, performing a second obfuscation on at least the payload portion to generate an obfuscated payload portion, and combining the obfuscated routing header portion and the obfuscated payload portion to form an obfuscated packet. A packet forwarding method comprising obfuscating routing information using a packet obfuscation function, generating a plurality of forwarding rule entries in accordance with the obfuscated routing information, transmitting the plurality of forwarding rule entries to at least one network node in a network, transmitting the packet obfuscation function to at least one network node in the network, and transmitting a de-obfuscation function to at least one network node in the network.

Abstract: A source routing method and apparatus are provided. The method includes receiving a data packet that comprises a destination address, a source address, and a payload, determining a plurality of next-hops along a service chain path between the source address and the destination address, generating a source routed data packet that comprises the destination address, the source address, the plurality of next-hops, and the payload, setting the destination address of the source routed data packet to a first next-hop from the plurality of next-hops along the service chain path, and forwarding the source routed data packet in accordance with the destination address.

Abstract: A method and apparatus for connecting/attaching a mobile device to a network. Service information, such as pricing and plan information, associated with one or more networks is provided to a mobile device. The mobile device requests and receives configuration details for a selected one of the networks. The configuration details can include identity information such as is stored in a reprogrammable SIM, usable for connecting/attaching the mobile device to the selected network. The mobile device then registers and connects with the selected network based on the configuration details.

Abstract: The present disclosure is drawn to systems and methods for activating a mobile device in an enterprise mobile management context. The mobile device is configured to generate a first device security certificate which comprises a device key and an identifier of the mobile device. The device key corresponds to a shared secret known to the mobile device and to an authentication server. The mobile device sends the first device security certificate to the authentication server. The authentication server validates the mobile device by comparing the device key to a server key and by locating the identifier in a list of known identifiers. When the mobile device is validated, the authentication server sends a first server security certificate to the mobile device. The first device and server security certificates may then be used to establish a secure connection, over which a second set of device and server certificates may be enrolled.

Abstract: A measurement initiation method for inter-frequency/inter-system cell reselection and UE thereof are described. A signal quality value of a current serving cell is obtained for many times, and a signal quality value smaller than or equal to a threshold of measurement initiation of a neighboring inter-frequency/inter-system cell is stored storing until L signal quality values are obtained; a mean signal quality value is obtained by calculation according to the obtained L signal quality values, and when the mean signal quality value is greater than a signal quality reference threshold, UE initiates the measurement of the neighboring inter-frequency/inter-system cell. By using the method and UE, the problem that UE frequently initiates measurement of a neighboring inter-frequency/inter-system cell even when UE does not move or moves a little can be solved, the power of the UE can be saved, and the radiation produced by the UE on a mobile user can be reduced.