Abstract: Some embodiments provide a method for a first network controller that manages a set of logical forwarding elements implemented in several managed forwarding elements. The method receives a request to trace a specified packet having a particular source on a logical forwarding element. The method generates the packet according to the packet specification. The generated packet includes an indicator that the packet is for a trace operation. The method sends the packet to a second network controller that manages a managed forwarding element associated with the particular source. The method receives a first set of messages regarding operations performed on the packet from a set of network controllers that receives a second set of messages regarding operations performed on the packet from a set of managed forwarding elements that process the packet.

Abstract: A method is presented of probing a network using probing with a probe packet pair, the pair comprising a first probe packet (L1) and a second probe packet (L2), and wherein L1>L2. The L1 probe packet is transmitted before L2 and the probe packets are arranged to be back-to-back on the last link. Use of the method provides the capacity of the last link in the probed path. The method may be run from a gateway in a network to probe aspects of the network and is suitable for probing a domestic network behind a home gateway. A use for the method is also described.

Abstract: According to one embodiment, a monitoring control system includes a controller and a monitoring control device. The monitoring control device includes: a first common memory to store therein common data cyclically transmitted/received by cyclic transmission; a first internal memory to store therein data other than the common data; and a search processor that searches control data to control the controller by transmitting tag information associated with the control data to the controller. The controller includes: a second common memory to store therein the common data; a second internal memory to store therein data other than the common data; and a storage processor that stores the control data read from the second internal memory in the second common memory as the common data when the control data corresponding to the tag information received from the monitoring control device is not stored in the second common memory.

Abstract: Methods, computer readable media, and wireless apparatuses are disclosed for trigger frame recovery. An apparatus of a wireless device is disclosed. The apparatus comprising processing circuitry configured to: encode a trigger frame comprising a resource allocation for one or more stations, where the trigger frame comprises a network allocation vector (NAV) duration. The processing circuitry may be further configured to configure the wireless device to transmit the trigger frame to the one or more stations. The processing circuitry may be further configured to configure the wireless device to contend for the wireless medium a first time, encode a retransmission of the trigger frame, and configure the wireless device to transmit the retransmission of the trigger frame to the one or more stations, if a frame is not received from the one or more stations in response to the trigger frame before a trigger frame timeout duration.

Abstract: A system for providing test receive port resiliency includes a network equipment test device including a port module for transmitting test packets to and receiving packets from a device under test (DUT). The system further includes a port central processing unit (CPU) associated with the port module for processing packets that the CPU receives from the DUT. The system further includes a configurable pre-filter associated with the port module for pre-filtering the packets to prevent at least some of the packets from being forwarded to the port CPU. The system further includes a pre-filter rules generator for analyzing the packets forwarded to the port CPU and for automatically generating a pre-filtering rule to be used by the pre-filter for filtering subsequent packets received from the DUT.

Abstract: Embodiments including methods, systems, and apparatuses for distributing, processing, and reacting to path information distributed via a service-agnostic packet fabric for the purpose of enabling path selection are disclosed. By configuring two ingress line cards to send path quality words to each other via the switch fabric, compare the path quality words, and determine whether to transmit traffic to an egress line card via the switch fabric based on the comparison of the path quality words, the embodiments enable a central switch fabric to be unaware of the paths that it carries, and enable both ingress and egress bandwidth of the switch fabric to be sized according to the facilities for which it is terminating. The switch fabric does not need to support working and protection paths simultaneously in some embodiments, allowing it to be scaled appropriately to termination facilities.

Abstract: A first device may receive information that identifies a second device. The second device may be connected to the first device or a third device. The second device may be a source of traffic to be received by the first device. The first device may determine whether the second device is local or remote to the first device based on receiving the information. The first device may store first information or second information based on determining whether the second device is local or remote. The first information may identify a route associated with the second device. The second information may identify a single route associated with multiple second devices. The first device may provide the traffic using the first information or the second information after storing the first information or the second information.

Abstract: A method is described and in one embodiment includes receiving a packet of a traffic flow at an ingress node of a communications network; routing the packet to an egress node of the communications network via a first path comprising a tunnel if the packet was received from a node external to the communications network; and routing the packet to the egress node of the communications network via a second path that does not traverse the tunnel if the packet was received from a node internal to the communications network. The first path is identified by a first Forwarding Information Base (“FIB”) entry corresponding to the flow and the second path is identified by a second FIB entry corresponding to the flow.

Abstract: In order to be able to maintain cross-traffic between slaves in a ring topology of an Ethernet-based data network even in the event of an error in the ring topology, which leads to the interruption of the ring topology, it is provided that in the event of the occurrence (rectification) of an error (F) in the annular data network (1), the ringmaster is configured to forward data packets or to block at least multicast data packets, and that the master prompts the slaves (S1, S2), communicating with one another via cross-traffic, to transmit configuration data packets (DPMC1, DPMC2) as multicast data packets to each of the other slaves (S1, . . . , Sn) of the annular data network in order to adjust address tables (AT1, AT2) in the slaves (S1, S2), communicating with one another via cross-traffic.

Abstract: A device may cause an optical signal to be transmitted via a network path. The device may receive, from a network device, a link layer discover protocol (LLDP) message. The LLDP message may include signal characteristic information regarding the optical signal. The device may adjust transmission of the optical signal based on receiving the LLDP message. The device may cause an adjusted optical signal to be transmitted via the network path based on adjusting transmission of the optical signal.

Abstract: In one example, techniques of this disclosure may enable a point of local repair (PLR) network device to signal availability of link protection or node protection to a merge point (MP) network device and enable a network device to actively determine whether or not it is a merge point router. Based on whether or not the network device determines it is a MP, the network device may selectively clean up LSP states when there is an upstream link or node failure. The RSVP-TE protocol may be extended to enable a network device to send a tear down message to a downstream router, which may enable the downstream router to conditionally delete locale LSP state information. In some instances, a PLR network device may directly send a tear down message to a MP network device even though the PLR network device may not have a working bypass LSP.

Abstract: A telecommunications mobility management system is arranged to allocate a mobile unit to different switching routes for different classes of service, for example to allow services capable of operation over packet-switched and circuit-switched to be managed separately. Separate location updates are transmitted to a register, and flagged for selective retrieval by a routing function when an incoming connection request is made, the appropriate switch ID being selected according to the class of service to which the connection request relates.

Abstract: In one embodiment, a system includes a switch controller in communication with a plurality of switches in a switch cluster via a communication protocol. The switch controller includes a processor and logic integrated with and/or executable by the processor. The logic is configured to cause the processor to receive an address resolution protocol (ARP) request packet as a unicast packet from an entry switch in the switch cluster, the entry switch being connected to a first host. The logic is also configured to cause the processor to send an ARP response packet as a unicast packet to the entry switch. The ARP response packet indicates a media access control (MAC) address of the switch controller as a source MAC (SMAC) for the ARP response packet, and an internet protocol (IP) address of a virtual router of the switch controller as being a source of the ARP response packet.

Abstract: Examples disclosed herein provide methods and systems for selecting Internet Protocol addresses for Session Initiation Protocol (SIP) communications. In at least one implementation, a method of operating a first communication device includes applying a source address selection algorithm to determine at least one source Internet Protocol (IP) address for the first communication device, and transferring a communication invite that indicates the at least one source IP address. The method further provides, receiving, from a second communication device, a response to the invite that indicates at least one IP address for the second communication device, applying SASA to the at least one IP address to determine a third source IP address for the first communication device, and initiating a communication with the second communication device using the third source IP address.

Abstract: The disclosed computer-implemented method may include (1) receiving, at an upstream router of a multicast distribution tree, a packet that is destined for a receiver within an MPLS network, (2) identifying within the packet (A) a context label that specifies a controller and (B) a tree label that is assigned by the controller, (3) identifying a forwarding table that corresponds to the context label identified within the packet, (4) searching the forwarding table that corresponds to the context label for the tree label that specifies the multicast distribution tree, (5) identifying, based at least in part on the search, a downstream router of the multicast distribution tree that is to receive the packet on the way to the receiver, and then (6) forwarding the packet to the downstream router of the multicast distribution tree on the way to the receiver. Various other methods, systems, and apparatuses are also disclosed.

Abstract: Method and system for transferring a message, comprising routing information relating to the intended recipient of the message and content information, from a first node via a second node to a third node in a communications network. According to the invention, a repository is associated with the second node. The method comprises the steps of: transmitting the message from the first node to the second node; storing data representative of the content information in the repository of the second node; replacing, by the second node, in the message, the content information by a token; transmitting the message, comprising the routing information and the token, from the second node to the third node; retrieving, by the third node, the content information from the second node; and replacing by the third node, in the message, the token by the content information.

Abstract: A device receives a configuration file that includes an object concerning a Hypertext Transfer Protocol (HTTP) route. The object includes a parameter, related to the HTTP route, that includes one or more elements related to the HTTP route, and includes an attribute related to an HTTP action. The device parses the configuration file to recognize the object, and parses the object to recognize the parameter. The device creates the HTTP route based on the parameter. The HTTP route includes information concerning the one or more elements related to the HTTP route and the attribute related to the HTTP action, and sends the HTTP route to a server, causing the server to perform an operation based on the HTTP route.

Abstract: Disclosed are various embodiments for avoiding flow collisions in networks employing flow-based hashing to assign flows to routes. A flow of packets is sent from a source endpoint to a destination endpoint by way of a network. The flow is associated with flow identification information including, for example, a source port, a source network address, a destination port, and a destination address. It is determined whether to perturb the flow identification information for the flow to avoid flow collisions caused by flow-based hashing performed in the network. A state associated with the flow is updated to effect a perturbation to the flow identification information for the flow if the flow identification information for the flow is to be perturbed.

Abstract: Intelligent packet analysis may be provided to determine congestion problems and lead to fast solutions in low latency networks. Specifically, a congestion analyzer system may allow a user to monitor congestion on a network while using lightweight storage. A sniffer tool may be employed to capture all packets and store associated packet information into a database.

Abstract: A route control device controls a transfer destination in a plurality of transfer devices that are included in a network and that transfer packets flowing between a first information processing device and a second information processing device. The route control device comprises a processor. The processor detects that a session is to be newly established, on the basis of a packet of a protocol that controls establishment of a session between the first information processing device and the second information processing device, selects a route with a light load from among a plurality of routes connecting the first information processing device and the second information processing device, and makes a transfer device on a selected route establish a selected route.

Abstract: A method, non-transitory computer readable medium and an application management computing device that assists with progressive image delivery includes obtaining one or more webpages requested by a client computing device. One or more images are identified in the obtained one or more webpages. The identified one or more images are prioritized based on a position of each of the identified one or more images in the obtained one or more webpages. The prioritized one or more images are progressively delivered to the requesting client computing device. By progressively delivering images over multiple passes, the technology is able to quickly convert the low quality images initially provided to high quality images. Additionally, by converting the low quality images to high quality images over multiple passes, the technology utilizes very less bandwidth thereby providing the requested content to the requesting one of the plurality of client computing devices quickly.

Abstract: A device for facilitating data communication in a peer-to-peer network may include at least one processor circuit. The processor circuit may be configured to initiate, in or outside a discovery time window, a data connection setup with a second device. The processor circuit may be configured to, when the data connection setup is not completed within the discovery time window, select a negotiation time window based on at least one of an advertised availability of the device or an advertised availability of the second device and resume, in the negotiation time window, the data connection setup. The processor circuit may be configured to receive information associated with one or more data transfer time windows from the second device upon completion of the data connection setup, where the one or more data transfer time windows are selected based at least on the data connection setup.

Abstract: A method for redundant transmission of data telegrams between automation devices of an installation by a communication network requires a ring topology. A sending device sends out two data telegrams in different transmission directions of the communication network and a receiving device processes the data telegram arriving at the receiving device first and discards the other data telegram as a duplicate. To ensure fast transmission of data telegrams having important content, the sending automation device assigns a priority level and data telegrams having a high priority level are sent according to a first communication protocol and data telegrams having a low priority level are sent according to a different second communication protocol. A network component arranged between the sending device and the receiving device receives the data telegram, recognizes the priority level based on the communication protocol used, and forwards the data telegram taking into consideration the priority level.

Abstract: Congestion management for data traffic in a virtual domain identifies a congestion source and sends a message to the source to adjust data traffic rates. The source may be a virtual machine hosted by a physical server with one or more virtual servers incorporated. A congestion manager may identify the source and send the message to the source without affecting other data sources hosted by the physical server or the virtual servers. In some embodiments, information about the congestion source may be encapsulated in a packet payload readable only by the congestion source so only the congestion source receives the instruction to adjust the transmission rate.

Abstract: A network switch includes circuitry, multiple ports and multiple hardware-implemented distinct-flow counters. The multiple ports are configured to receive packets from a communication network. Each of the multiple hardware-implemented distinct-flow counters is configured to receive (i) a respective count definition specifying one or more packet-header fields and (ii) a respective subset of the received packets, and to estimate a respective number of distinct flows that are present in the subset, by evaluating, over the packets in the subset, a number of distinct values in the packet-header fields belonging to the count definition. The circuitry is configured to provide each of the distinct-flow counters with the respective subset of the received packets, including providing a given packet to a plurality of the distinct-flow counters, and to identify an event-of-interest based on numbers of distinct flows estimated by the distinct-flow counters.

Abstract: Resources used by a foreground process associated with an application as well as one or more background tasks associated with the application that are running as separate processes on the computing device are tracked. Historical data relating to resource usage by the application is utilized to predict a resource usage amount for the application which is then stored. A subsequent launch of the application can be conditioned upon whether the predicted resource usage amount is available. If the predicted resource usage amount is available, it can be allocated to the application and the application can be launched. If the application then exceeds the predicted resource usage amount, other processes executing concurrently therewith may be terminated to free up the resource. Regardless of how the application performs, new resource usage data is obtained for the application, which is then used to adjust the predicted resource usage amount.

Abstract: A physical network node controls allocation and/or deallocation of resources of an interconnected hardware infrastructure. The physical network node determines a number of requests currently queued at a first service node of a plurality of serially-connected service nodes at a current time. The plurality of serially-connected service nodes supports a packet flow using resources of the interconnected hardware infrastructure. The physical network node also determines a packet flow rate of the packet flow into the first service node. The physical network node also determines a future time to control allocation or deallocation of a resource of the interconnected hardware infrastructure to a second service node of the plurality of serially-connected service nodes based on the determined number of requests and the determined packet flow rate. The physical network node controls allocation or deallocation of the resource to the second service node at the future time.

Abstract: A client and content provider are connected by a plurality of simultaneous transport connections. The number of the transport connections that are used to transfer data is selected based on the size of the data to be transferred and may change after transfer of data has commenced based on the amount of data left and the attributes of the transport connections. In another aspect, data to be transmitted over the transport connections is organized into frames such that each frame includes data from only one data stream. The frames are sized to be less than or equal to a control window of the transport connection over which they are transmitted. Each frame may be assigned to a transport connection in a round robin fashion or based on the size of the frame and the sizes of the control windows of the transport connections.

Abstract: A crossbar switch has N input ports, M output ports, and a switching matrix with N×M crosspoints. Each crosspoint contains an internal queue (XQ), which can store one or more packets to be routed. Traffic rates between Input/Output (IO) pairs of the switch are specified in an N×M traffic rate matrix, where each element equals a number of requested cell transmission opportunities between each IO pair within a scheduling frame of F time-slots. An algorithm for scheduling N traffic flows with traffic rates is based upon recursive and fair decomposition of a traffic rate vector with N elements. To reduce memory requirements a shared row queue (SRQ) may be embedded in each row of the switching matrix, allowing the size of XQs to be reduced. A shared column queue may be used in place of the XQs.

Abstract: In a particular implementation, a method includes dynamically adjusting a size of a buffer of a receiving terminal based on a comparison of a signal quality metric associated with a wireless communication channel between the receiving terminal and a transmitting terminal to a signal quality threshold. The method also includes storing a first set of data packets of a plurality of data packets in the buffer. The first set of data packets are received at the receiving terminal from the transmitting terminal. The method further includes outputting reconstructed speech based on the first set of data packets and replacement packets that are generated based at least in part on the first set of data packets. The replacement packets are associated with a set of unreceived data packets of the plurality of data packets.

Abstract: A method implemented by a client application when executed on a user device during an instant messaging communication between said user device and at least one further device, the method comprising: transmitting a first message comprising media data over a communication network from said user device to said at least one further device; receiving a second message comprising further media data transmitted over said communication network from said at least one further device; determining that the media data and the further media data are of the same data type; and generating a composite media object based on the media data and the further media data in response to said determination and displaying the composite media object on a display of said user device.

Abstract: Systems, methods, and computer-readable media are provided for dividing and merging online content sharing environments such as, for example, online chat rooms. An online content sharing environment may have a group of user profiles associated therewith, some subgroup of which may be exchanging message content within the online content sharing environment at any given time. If an amount of message data traffic being exchanged and/or a number of user profiles exchanging messages exceeds a corresponding threshold value, the online content sharing environment may be divided into two or more sub-environments. Respective sub-groups of user profiles may then be identified based on association criteria and associated with the various sub-environments.

Abstract: A search-based email client may incorporate a number of useful features. A search function can default to a search of all email contexts, thereby eliminating user cogitation over which context an email message may be stored in. Furthermore, the search function can automatically search for related personal content and/or related information on the internet or other computer network, and present this useful information to the user in addition to the returned emails. The search function can be integrated into a user interface to allow for one-click searches on any likely search field. The search function can search the body of email messages by default, thereby widening the scope of default searches and eliminating potentially missed information and user need to proactively widen their search. A search function can search attachments, which also provides a wider search scope.

Abstract: A server transmits a message from a sender to a recipient. The server receives from the recipient an attachment relating to the message route between the server and the recipient. The server transmits to the sender the message and the attachment and their encrypted digital fingerprints and expunges the transmitted information. To subsequently authenticate the message and the attachment, the sender transmits to the server what the server has previously transmitted to the sender. The server then prepares a digital fingerprint of the message and decrypts the encrypted digital fingerprint of the message and compares these digital fingerprints. to authenticate the message. The server performs the same routine with the attachment and the encrypted digital fingerprint of the attachment to authenticate the attachment the recipient replies to the sender's message through the server. The server records proof of the delivery and content of the reply to the sender and the recipient.

Abstract: A method and apparatus of a device that focuses messages is described. In an exemplary method, the device receives a first and second group of message. The device further selects a related message from the second group of messages that is related to each message in the first group. This selecting is based on an affinity group, where the affinity group includes a message address that occurs in at least one of the messages in the second group and the affinity group is determined using the message addresses contained in the first and second groups.

Abstract: In one embodiment, a method for maintaining real-time communications of a user includes receiving a user's real-time communications of different types over a network, presenting the real-time communications in an email inbox of the user in a uniform manner, and allowing the user to search contents of the real-time communications presented in the email inbox.

Abstract: A method for estimation of information diffusion route on computer mediated communication network. The method includes: generating, by a computing device, a user collection that includes an original user posting original information and one or more users forwarding the original information through the communication network; obtaining a network of users registered by a first user of the one or more users forwarding the original information; selecting one or more candidates potentially referred by the first user from the network of the users registered by the first user based on the user collection; and rating the one or more candidates based on historical information of the one or more candidates and the first user. The present invention also provides a computer system and computer program product.

Abstract: Disclosed are systems and methods for improving interactions with and between computers in content generating, searching, hosting and/or providing systems supported by or configured with personal computing devices, servers and/or platforms. The systems interact to identify and retrieve data within or across platforms, which can be used to improve the quality of data used in processing interactions between or among processors in such systems. The disclosed systems and methods automatically identify and communicate media content to users as the media content is uploaded to the internet. The disclosed systems and methods leverage an internet hosted data firehose in order to build and communicate streams of content that are relevant to users' determined interests. Real-time analysis of the continuous stream of content results in curated media streams being created and communicated to users thereby stimulating social interactivity between users and automating the discovery of other users on a network.

Abstract: An electronic messaging system includes a messaging server that identifies a recipient for an electronic message. The messaging system sends the recipient an electronic message that includes instrumented content. A web server monitors activity and determines whether interaction occurred with the instrumented content. The web server determines whether a sandbox intercepted the message based on whether interaction occurred, or did not occur, with the instrumented content within a threshold time period or with one or more activity characteristics.

Abstract: A system, method, and computer-readable medium enable a domain name or host name registry to effectively manage status codes associated with the domain or host. Status codes are organized into status sets that can be added, removed, activated, or deactivated in accordance with a suitable change request. The status codes corresponding to a removed status set that are also enabled according to other active status sets are not removed when the removal of the status set is processed.

Abstract: Systems and methods are described to enable integrating operation of a service record system with operation of an automatically scaled service hosting system. The service hosting system can maintain a set of servers to provide a network-accessible service, and the service record system can maintain records identifying the set of servers as endpoints for the service. The service hosting system can further modify the number of servers within the set based, for example, on demand. When the service hosting system intends to remove a server from the set, it may notify the service record system. The service record system, in turn, can determine whether any valid records are predicted to exist that identify the to-be-removed server as an endpoint for the service. If such records are predicted to exist, removal of the server can be delayed until those records expire, to prevent errors resulting from client reliance on those records.

Abstract: A contact center maintains a pool of calling party telephone numbers (“CPTN”) that can be selected for call origination. A new CPTN can be selected based on various criteria in order to avoid, or respond to, a determination that the current CPTN is “tagged” as being a robocall. The triggering of a new CPTN can be initiated based on various factors, including a number of calls made, a time period, a change in call outcomes, direct input, or by querying a database maintaining status information. Upon triggering the selection of a new number, the old calling party number may be placed in a “dead” pool if tagged, or placed in an “aging” pool for where it is not used for a given time. Once aged, the number is placed in an “available for use” pool. Thus, impacts of service provider robocall processing can be mitigated.

Abstract: Some embodiments provide a method for applying a security policy defined for a logical network to an MHFE that integrates physical workloads (e.g., physical machines connected to the MHFE) with the logical network. The method applies the security policy to the MHFE by generating a set of ACL rules based on the security policy's definition and configuring the MHFE to apply the ACL rules on the network traffic that is forwarded to and/or from the physical machines. In order to configure an MHFE to implement the different LFEs of a logical network, some embodiments propagate an open source database stored on the MHFE, using an open source protocol. Some embodiments propagate a particular table of the database such that each record of the table creates an association between a port of an LFE stored in a logical forwarding table and one or more ACL rules stored in an ACL table.

Abstract: Embodiments of the present invention refer to a method for establishing a connection through a virtual private network “VPN” (9) between a first (1) and a second (3) entities of a transport network, the entities including a VPN interface (5, 7), wherein, between the interfaces, a bearer of a selected type, among a plurality of types corresponding to a plurality of quality of service “QoS”, is determined according to the QoS requested for the connection and wherein the parameters used by the VPN interfaces (5, 7) for the establishment of the bearer are global routing parameters corresponding to global routing parameters of the transport network and wherein the parameters include at least one parameter which is different from one bearer type to another so that the selected bearer type associated with the QoS requested for the connection is identified by the first and the second entities.

Abstract: A method for the transmission of a message by a server of a multimedia IP core network is disclosed. In one aspect, following the reception, by the server, of a request from a terminal to register with the core network, the registration request proposing an authentication method for the establishment of a secure tunnel between the terminal and an entity for the connection of the terminal to the core network. The transmission method may comprise identifying an access network used by the terminal for registering with the multimedia IP core network, drawing-up, according to the identified access network, a recommendation concerning the establishment or otherwise of the secure tunnel between the terminal and the connection entity for the authentication method, and inserting said recommendation into the message transmitted by the server.

Abstract: Techniques and mechanisms described herein facilitate the efficient common storage of partially encrypted content. According to various embodiments, a client device to transmit a designated representation of a media content item via a communications interface may be received. The media content item may be associated with a plurality of representations including the designated representation. The media content item may be associated with first media content data and second media content data. The first media content data may be shared among the plurality of representations. The second media content data may be specific to the designated representation. The first media content data may be combined with the second media content data to create a designated partially encrypted media content portion associated with the designated representation via a processor. The designated partially encrypted media content portion may be transmitted to the client device via the communications interface.

Abstract: At a source network device, data is compiled into a plurality of data blocks for transmission in a data frame over a network to a destination network device. The plurality of data blocks are arranged into a plurality of data block groups such that each data block group comprises a predetermined number of data blocks. Encryption information is generated for each of the plurality of data blocks groups. The encryption information identifies an encryption key for each of the plurality of data block groups. Overhead data configured to allow the destination network device to align and decode the data frame is generated. The data frame is transmitted from the source network device to the destination network device such that the encryption information for each of the plurality of data block groups is transmitted consecutively with a respective data block group, and a portion of the overhead data is transmitted prior to each consecutive transmission of encryption information with a data block group.

Abstract: Described are systems, methods, and computer readable medium for authenticating user device interactions with external entities. A secure communication session is established between an external device or application and a trusted execution environment. An authentication request is received from the external application or device at the trusted execution environment. A secure communication channel is established between the trusted execution environment and an input/output interface of the user authentication device. Input is received from a user assurance action related to the authentication request over the secure communication channel. Data is encrypted at a secure element of the user authentication device, and a response is transmitted including the encrypted data and an indicator of the user assurance action to the external application or device from the trusted execution environment in response to the authentication request via the secure communication session.

Abstract: An apparatus, system, and method are disclosed for secure data transmissions. A method includes receiving a request for data that is encrypted according to a first encryption scheme, and determining a first public IP address associated with the request. The first public IP address identifies a remote client that created the request and is located in a field of a data packet that includes the request. The method includes determining a second public IP address associated with the request that identifies a sender of the request and is determined dynamically when the request is received. The method includes verifying an authenticity of the request in response to the first public IP address of the remote client matching the second public IP address of the sender. The method includes encrypting the requested data according to a second encryption scheme, and transferring the data to the remote client.

Abstract: Bridging encrypted datasets is provided. A system transmits, to a server, a first identifier vector encrypted with a first encryption that is commutative. The system receives an encrypted first identifier vector encrypted based on the first encryption and encrypted by a second encryption associated with the server. The system receives a second identifier vector encrypted based on the second encryption. The system encrypts the second identifier vector with the first encryption to generate an encrypted second identifier vector that is encrypted based on the second encryption and further encrypted based on the first encryption. The system determines a correlation count between the encrypted first identifier vector and the encrypted second identifier vector. The system generates one identifier key for both the first identifier and the second identifier. The system can provide the one identifier key for input into an application to process interactions.