Abstract: Provided are a router estimation system and a router estimation method which enable accurate estimation of a router in network slices that is a cause of a silent failure. A policy manager (90) identifies, when a plurality of function elements are determined to have deteriorated in performance in slice communication, for each of the plurality of function elements determined to have deteriorated in performance, a group of routers located on a route of the slice communication, based on router group data. The policy manager (90) estimates at least one router included in every router group identified for the each of the plurality of function elements determined to have deteriorated in performance to be a router that is a cause of the deterioration of performance of the function element.

Abstract: Examples described herein relate to a network interface device that includes packet processing circuitry to detect usage of an egress port and report the usage of the egress port to a network interface device driver to cause reallocation of hash-based packet buckets to at least one egress port to provide an allocation of hash-based packet buckets to multiple active egress ports of the network interface device with retention of bucket-to-egress port mappings except for re-allocations of one or more buckets to one or more active egress ports. In some examples, usage of the egress port is based on a count of hash buckets assigned to packets to be transmitted from the egress port or a number of bytes of packets enqueued to be transmitted from the egress port.

Abstract: A train positioning method includes acquiring first device identification information at an antenna; acquiring train positioning information; after determining the first device identification information is trustworthy, storing the first device identification information and the positioning information in a non-volatile memory; after awakening the train from dormancy mode, receiving second device identification information using the antenna; according to the received second device identification information and the first device identification information from the memory, determining whether, after being awakened, the train is at the same position as before entering dormancy mode; upon determining that, after awakening, the train is at the same position as before entering dormancy mode, determining the current position and direction of the train match positioning information in the memory, and completing positioning of the train. This ensures the usage experience of users of a train.

Abstract: Gateway devices can use dual cellular interfaces, each assignable to at least one of a plurality of network services, to provide reliable communications for client machines. A gateway device can use one of the dual cellular interfaces assigned to a first network service as a primary interface and the other assigned to a second network service as a hot backup interface. The backup interface remains connected to a cellular network while communications are routed on the primary interface. Accordingly, the gateway device can rapidly switch communications between from the primary interface to the backup interface. Applications, for example, for ATM payment processing, vending machine telemetry, point of sale payment processing, kiosk internet connectivity, remote monitoring and control, mobile or electronic health, and remote information displays, may run on the gateway devices, on servers, on user devices, or a combination of these devices.

Abstract: The present invention facilitates the confirmation of the state of a slave device. This terminal monitoring device (10) comprises: a terminal information acquisition unit (14) for acquiring, from terminals of a network, terminal information including the addresses of the respective terminals, information for each type, and information pertaining to communication states; and a terminal list screen generation unit (151) that generates a terminal list screen on which selection boxes for displaying the terminals and the terminal information are disposed side by side on the basis of the terminal information and that displays the generated screen on a display unit (12).

Abstract: Technologies for bi-directional encryption and decryption for underlay and overlay operations are described. One network device a path-selection circuit that operates in a first mode or a second mode. In the first mode, the path-selection circuit receives a first incoming packet on a first port, sends it to a security circuitry to decrypt the first incoming packet to obtain a first decrypted packet, sends the first decrypted packet to a processing circuitry to process the first decrypted packet to obtain a first outgoing packet, and sends the first outgoing packet to a second port of the network device. In the second mode, the path-selection circuit receives a second incoming packet on a third port, sends it to the processing circuitry to de-encapsulate the second incoming packet to obtain a second outgoing packet, and sends the second outgoing packet to a fourth port of the network device.

Abstract: A system for optimizing traffic signal timing using telemetry includes: wirelessly connected devices (WCDs), traffic operations centers (TOCs) controlling one or more traffic signals, and control modules storing and continuously executing control logic in a closed loop. The control logic continuously receives real-time WCD telemetry data and performs real-time processing of the telemetry data to match the telemetry data to physical locations. Processed telemetry data is aggregated to determine WCD trajectories. The system selectively performs time-of-day (TOD), offset, and green split optimizations, and receives the WCD trajectories and outputs of the TOD, offset, and green split optimization within an API. The system generates an optimized signal plan from data from the API, and verifies the optimized signal plan. The optimized signal plan is received by the TOCs and selectively uploaded to the traffic signals.

Abstract: A network interface controller may include a transceiver coupled to a transmit buffer to send messages via a communications medium and coupled to a receive buffer to store messages received via the communications medium, each of said messages including a source field containing a media access control (MAC) address. A network node may include a network interface controller coupled to the transceiver to implement a network communications protocol for conveying the messages via the communications medium, the network interface controller being configured to dynamically determine a locally unique MAC address for the network interface.

Abstract: Systems, methods, and apparatus to monitor mobile Internet activity are disclosed. An example apparatus includes at least one memory, machine-readable instructions, programmable circuitry to execute the machine-readable instructions to at least assign a first port of a proxy server to a mobile device associated with a panelist, cause transmission of configuration data to the mobile device to instruct the mobile device to transmit future requests the first port of the proxy server, obtain a first request for media on the first port originating from the mobile device, and after a determination that the first request originated from an Internet Protocol (IP) address associated with an IP address range representative of devices on a cellular network, service the first request, generate a data association, request the media from an Internet media provider identified in the first request, and cause transmission of the media to the mobile device.

Abstract: The present disclosure relates to a method of transmitting a Beam Failure Recovery (BFR) Medium Access Control (MAC) Control Element (CE) by a user equipment (UE) in a wireless communication system. Especially, the method includes the steps of configuring a plurality of cells with cell indexes and priorities of the cells; detecting a beam failure on two or more cells among the plurality of cells; generating the BFR MAC CE including beam failure recovery information for the two or more beam failure detected cells; and transmitting the BFR MAC CE to the network, wherein the beam failure recovery information for the two or more beam failure detected cells are included in a descending order of priorities of two or more beam failure detected cells.

Abstract: One embodiment of the present invention facilitates address resolution protocol (ARP) resolution in an extended subnet. A gateway of a first segment of the extended subnet can determine that a layer-2 address corresponding to a layer-3 destination address of a packet is locally unavailable. The gateway can then determine whether a respective egress interface of an ARP request for the layer-3 destination address is associated with a layer-2 subnet extension from the first segment to a second segment of the extended subnet. The extension can provide a common layer-2 broadcast domain comprising the first and second segments with a same default gateway layer-3 address. If the egress interface is associated with the extension, the gateway can insert a layer-3 address of a first endpoint associated with the extension as a source protocol address in the ARP request. The gateway can send the modified ARP request via the egress interface.

Abstract: A network device is configured with multiple forwarding domains where each forwarding domain has its own view of a front panel, referred to as a virtual front panel. The virtual front panel of a forwarding domain represents the serdes (transceivers) of that forwarding domain as virtual ports. Forwarding domains can be interconnected by an orchestrator in terms of “connecting” their respective virtual ports. The orchestrator can connect two virtual ports by configuring hardware (e.g., crosspoint switch) in the network device to create an electrical path between the physical serdes that correspond to the virtual ports.

Abstract: A network device may obtain its Internet Protocol (IP) address information. The network device may receive a device network address assignment message that indicates an IP address of the network device. The network device may receive a router advertisement message that indicates an IP address prefix that includes the IP address and that indicates a prefix length of the IP address prefix. The network device may form an IP interface that specifies the IP address and the prefix length.

Abstract: Aspects of the subject disclosure may include, for example, a method of receiving, by a processing system including a processor, a plurality of routes in a network through a routing device having a fabric, a first set of distributed chassis packet forwarders (DCPs) that support external service interfaces and a second set of DCPs; storing, by the processing system, the plurality of routes in a forwarding information base (FIB); determining, by the processing system, a third set of routes in the FIB having a high volume of usage; determining, by the processing system, a fourth set of routes in the FIB having a low volume of usage; copying, by the processing system, the third set of routes to the first set of DCPs; and copying, by the processing system, the fourth set of routes to the second set of DCPs. Other embodiments are disclosed.

Abstract: A system for satellite communication including a plurality of nodes, each node including a ground terminal for communication with a satellite constellation, each ground terminal including a phased array antenna, each node being arranged to monitor a signal quality of a signal received by the ground terminal from the satellite constellation, the system being arranged to assign at most one node in the system to serve as a master node, the master node being arranged to obtain, for each node, the signal quality of the signal received by the ground terminal from the satellite constellation, assign, based on the signal quality, a node within the system to maintain communication with the satellite constellation, and hand over communication with the satellite constellation from a first node to a second node based on changes in the signal quality over time.

Abstract: Methods, systems, and devices are described for wireless communications. A wireless device may advertise communication parameters for a particular frequency band over another frequency band. In one example, a wireless device generates multi-band wrapper information element or a neighbor report information element, which may include one or more subelements, each conveying communication information for a particular frequency band. The wireless device may include the multi-band wrapper information element or the neighbor report information element in a management frame and may transmit the management frame over a first frequency band. Another wireless device may receive the management frame over the first frequency band and may obtain the communication information for other frequency bands from the included multi-band wrapper information element.

Abstract: Examples described herein include systems and methods which include a multiple input, multiple output transceiver including a plurality of receive antenna configured to receive a plurality of receive signals, and a wireless receiver coupled to the plurality of antenna and configured to receive and decode the plurality of receive signals. The transceiver includes a memory array and a memory controller. The memory controller includes a data address generator configured to, during the decode of the plurality of receive signals, generate at least one memory address according to an access mode of a memory command associated with a memory access operation. The at least one memory address corresponds to a specific sequence of memory access instructions to access a memory cell of the memory array.

Abstract: A character input device converts an input character string into a corresponding conversion character string, and includes a first input unit accepting input of a first character string by a first input method; a second input unit accepting input of a second character string by a second input method; and a character string combination unit that, when the input of the first character string is accepted after the input of the second character string, generates an input character string candidate by connecting the first and the second character string accepted for input this time. The character string combination unit extracts an identical character string as a duplicate character string at a tail of the first character string and a head of the second character string; and generates a character string formed by connecting the first and the second character string without the duplicate character string by the duplicate character string.

Abstract: A method for rerouting communication in a unified communications network is disclosed. The method includes receiving an inbound call at a first session border controller and determining a redirect number mapped to the inbound call number. The inbound call can be routed to a first call destination based on the redirect number. During the inbound call, a transfer request may be received from a server associated with the first call destination, and a new destination number may be determined for transferring the inbound call. An out-of-band transfer request may be transmitted to one or more servers maintaining the inbound call, and one or more connections associated with the inbound call to the first call destination may be dropped based on the out-of-band transfer request. The inbound call may then be rerouted to a second call destination based on the new destination number identified in the out-of-band transfer request.

Abstract: Processing logic may determine that a service is absent among a plurality of nodes within a zone of a mesh network. Processing logic may nominate one of the plurality of nodes to run the service. Processing logic may request a consensus among the plurality of nodes within the zone of the mesh network to confirm the nomination. Processing logic may, in response to receiving confirmation of the nomination by the plurality of nodes in the zone of the mesh network, push the service to the one of the plurality of nodes to run the service.

Abstract: An example method of handling traffic for an existing connection of a virtual machine (VM) migrated from a source site to a destination site includes: receiving, at an edge server of the destination site, the traffic, the traffic being associated with a network flow; determining, by the edge server of the destination site, that a stateful service of the edge server does not have state for the network flow; sending, by the edge server of the destination site, a threshold number of packets of the traffic to a plurality of sites; receiving, at the edge server of the destination site, an acknowledgement from the source site that the source site has the state for the network flow; and creating, by the edge server of the destination site, a flow mapping to send the traffic associated with the network flow to the source site.

Abstract: Various aspects of the present disclosure generally relate to wireless communication. In some aspects, a user equipment (UE) may establish, via a first subscriber service, at least one protocol data unit (PDU) session. The UE may receive a first internet protocol (IP) address associated with the first subscriber service. The UE may register the first subscriber service with an IP multimedia subsystem (IMS) network using the first IP address. The UE may register a second subscriber service with the IMS network using a second IP address, wherein the second subscriber service uses the at least one PDU session of the first subscriber service. Numerous other aspects are described.

Abstract: In some examples, a method includes determining that a listing of other users is to be displayed on a user interface for a first user, accessing augmentation trigger criteria, applying the augmentation trigger criteria to user profile data, determining, based on the application of the augmentation trigger criteria to the user profile data, that a second user meet a trigger criterion of the one or more augmentation trigger criteria. The method then includes identifying at least one recommended content augmentation associated with the trigger criterion and causing display of a first selectable user interface element associated with the at least one recommended content augmentation with the listing of other users on the user interface.

Abstract: Techniques for using proxies with overprovisioned IP addresses to demultiplex data flows, which may otherwise look the same at L7, into multiple subflows for L3 policy enforcement without having to modify an underlying L3 network. The techniques may include establishing a subflow through a network between a first proxy and a second proxy, the subflow associated with a specific policy. In some examples, the first proxy node may receive an encrypted packet that is to be sent through the network and determine, based at least in part on accessing an encrypted application layer of the packet, a specific application to which the packet is to be sent. The first proxy node may then alter an IP address included in the packet to cause the packet to be sent through the network via the subflow such that the packet is handled according to the specific policy.

Abstract: Systems and methods are disclosed herein that enable Time Sensitive Networking (TSN) network or Deterministic Networking (DetNet) network replication function fallback. In some embodiments, a method comprises, at a primary replication function, obtaining a packet in a particular stream, obtaining a sequence number for the packet, generating M copies of the packet each comprising the sequence number, transmitting the M copies, and providing, to a redundancy controller, the sequence number or a next sequence number of a next packet to be transmitted for the particular stream. The method further comprises, at the redundancy controller, receiving the sequence number or the next sequence number and providing the sequence number or the next sequence number to a secondary replication function. The method further comprises, at the secondary replication function, receiving the sequence number or the next sequence number and configuring a sequence generation function with the next sequence number.

Abstract: In one embodiment, a method includes receiving one or more 5G software-defined wide area network (SD-WAN) policies, identifying one or more identity-based policies from the one or more 5G SD-WAN policies, communicating the identified one or more identity-based policies to one or more WAN routers, communicating one or more 5G bindings to the one or more WAN routers, and applying the identified one or more identity-based policies to one or more flows between the one or more WAN routers.

Abstract: A method for delayed cyclic forwarding of messages by a system includes: receiving, by an input side of the system, the messages to be forwarded; and sending, by an output side of the system, the messages to be forwarded to a receiving device. A check is performed to determine whether the difference between a current system time and a receive time of a message under consideration is greater than or equal to the delay time. In the event that the difference is greater than or equal to the delay time, the message that has been in the buffer memory for the next longest time being checked in the same manner, and the checking of the messages is continued until a difference smaller than the specified delay time is found for a message.

Abstract: A hardware system for simulating a network physical layer for communication channels. The hardware system includes a plurality of hardware processors configurable to model a network physical layer and communication channels. The hardware system is further implemented where the hardware processors are configured such that a single set of hardware, including a single set of gates and registers, is used in a single simulation to model a plurality of virtual routers for different nodes.

Abstract: A node within a network including a plurality of interconnected nodes, and a method for operating a network that includes a plurality of interconnected nodes is provided. The network includes a primary path and an alternate path. Each path is respectively configured to connect a source node to a receiving node. The alternate path may include at least one more intermediate node than the primary path. Both the primary path and the alternate path are stored in a routing table. The data packets may be transmitted, substantially simultaneously, from the source node via the primary path and via the alternate path toward the receiving node. The data packets are accepted and forward by the receiving node. The determination of where to forward the data packets may be done locally by inspecting the incoming data packets.

Abstract: Apparatuses and methods for command and response descriptors handling are provided. In an example, a method for descriptor handling can include instantiating a command descriptor of a command regarding a packet at a first layer of a protocol stack by a microcontroller of a node. The method can also include passing a command pointer to the command descriptor to integrated circuits of the node from the microcontroller of the node. The method can further include looking up, by the integrated circuits, the command descriptor. The method can additionally include processing the command by the integrated circuits.

Abstract: For preempting an uplink resource allocation, one apparatus may include a processor coupled with a memory and configured to cause the apparatus to receive a first uplink grant associated with a first set of uplink resources and receive a second uplink grant associated with a second set of uplink resources, where one or more uplink resources of the second set of uplink resources at least partially overlap with one or more uplink resources of the first set of uplink resources. The processor may be configured to cause the apparatus to prioritize the second uplink grant and deprioritize the first uplink grant in response to the second priority being higher than the first priority. The processor may be configured to cause the apparatus to generate a first transport block (TB) based on the second uplink grant and to transmit the first TB using the second set of uplink resources.

Abstract: A device for service-oriented communication with a signal-based hardware architecture. The device comprises a number of service-oriented communication interfaces for communicative connection to a number of external service-oriented communication partners, a number of signal-based communication interfaces for communication with a number of external signal-based devices, and an embedded system.

Abstract: An apparatus comprises a first processing device, the first processing device comprising a physical hardware controller configured for coupling with a second processing device. The first processing device is configured to identify remote security service instances attached to the second processing device and to initiate, at the first processing device, one or more network emulation modules for the remote security service instances attached to the second processing device that emulate physical network interface devices configured for attachment to the second processing device.

Abstract: A reconfigurable dataflow unit (RDU) includes an intra-RDU network, an array of configurable units connected by an array level network and function interfaces. The RDU also includes interface circuits coupled between the intra-RDU network and external interconnects. An interface circuit receives a packet from the external interconnect and extracts a target RDU identifier and compares the target RDU identifier to the value of the identity register. It also communicates over the intra-RDU network to a function interface based on information in the first packet in response to the target RDU identifier being equal to the identity register. The interface circuit retrieves another interface circuit identifier for the target RDU identifier from the pass-through table and, in response to the target RDU identifier not being equal to the identity register, sends the target RDU identifier and other information to the other interface circuit over the intra-RDU network.

Abstract: A computing device may receive a plurality of scanning requests with at least one scanning request in the plurality identifying a target address of a target network. The computing device may for at least a subset of the plurality of scanning requests: generate a scanner instance and a virtual network interface card (VNIC) in response to the scanning request. The scanner instance and the VNIC communicating with a routing namespace that can communicate with two or more scanner instances simultaneously. Until the target address has been scanned: one or more packets can be sent from the scanner instance to the target address via the routing namespace and VNIC. The one or more packets can be wrapped in one or more packet wrappers identifying the target address and the target network. In response to the target address being scanned, the scanner instance and VNIC can be decommissioned.

Abstract: Techniques for enabling offline, intelligent load balancing of Stream Control Transmission Protocol (SCTP) traffic are provided. According to one embodiment, a load balancer can receive one or more SCTP packets that have been replicated from a network being monitored. The load balancer can further recover an SCTP message from the one or more SCTP packets and can map the SCTP message to an egress port based on one or more parameters decoded from the SCTP message and one or more rules. The load balancer can then transmit the SCTP message out of the egress port towards an analytic probe or tool for analysis.

Abstract: In order to maintain performance during wireless communication, a transmitting electronic device may concurrently and independently communicate redundant information to a receiving electronic device. In particular, information associated with a data stream may be communicated to the receiving electronic device using one or more channels by two radios using one or more wireless local area network communication protocols. The packets transmitted by the radios may preferentially include the same information. Moreover, the transmitting electronic device may attempt to maintain the redundant communication if a performance metric associated with the one or more channels degrades. For example, the transmitting electronic device may transfer communication to a different channel or may compress the information in the packets in the one or more channels if the throughput drops below a threshold value.

Abstract: Embodiments of systems and methods for modulating a downlink signals representative of a communication signal are provided herein. An example method comprises receiving an input signal; in a first one or more processing blocks in a one or more processors, performing a first modulation operation on first data packets of the input signal based on a modulation scheme for a receiver of the downlink signal; in a second one or more processing blocks in the one or more processors in parallel with the first one or more processing blocks, performing a second modulation operation on second data packets of the input signal based on the modulation scheme; and generating a waveform as the downlink signal based on performing the first and second modulation operations.

Abstract: The present application relates to devices and components including apparatus, systems, and methods for latency reduction for beam failure recovery (BFR), with respect to transmit-receive point (TRP)-specific BFR.

Abstract: A resilient incident management system is provided that continues operation when certain outages occur. An RSS feed is utilized to indicate incident-related information despite the certain outages. In an embodiment, the incident management system includes a redundant architecture that comprises a traffic manager and a backup traffic manager. The incident management system receives a client request for incident-related information and determines a priority level or a performance level of end points associated with the request. Based on a status of the traffic manager and the backup traffic manager, as well as based on the priority level or the performance level, the incident management system causes a computer operation to be executed via the redundant architecture to retrieve a response from a producer and generate the RSS feed.

Abstract: A vehicle signal relay system enables a relay agent in a first zone of a vehicle to send sensor signals having a first link-layer communication protocol to a software application deployed on a compute unit in another zone of the vehicle that is connected using another link-layer communication protocol. The vehicle signal relay system allows the software application to identify target relay agents with access to needed sensor signals. The vehicle signal relay system may further enable one way or mutual attestation. The vehicle signal relay system may also allow filters to be applied to the subscribed vehicle sensor signals, and may allow the software application to determine a communication protocol to be used between the software application and the relay agent.

Abstract: Data routing with a forwarding process of service data can avoid problems of offline nodes. The forwarding process for data routing can also improve the fault tolerance and service data can be quickly transmitted to a corresponding data pool. Using consensus nodes and a target data pool with routing and forwarding tables along with subtrees from a trie tree can improve the routing. Subtrees may be obtained by splitting the trie tree from a root node by using a first leaf node as a benchmark, which correspondingly represents a data pool of the consensus node. The routing and forwarding table is configured to record addresses of data pools correspondingly represented by a preset quantity of leaf nodes in a corresponding subtree.

Abstract: A data transmission circuit and method, a core, a chip with a multi-core structure, an electronic device and a storage medium are provided. The data transmission circuit includes a receiver, a controller, a lookup table circuit and a selector. The receiver is configured to receive an original data packet from Fabric; the controller is configured to determine whether the original data packet needs to be relayed according to an original control bit, and control a first input terminal of the selector to be enabled in response to that the original data packet needs to be relayed; the selector is configured to send a new data packet to the Fabric via the first input terminal, wherein the new data packet includes the original data and a new header acquired by the lookup table circuit according to an original index. In this way, power consumption of the data transmission circuit is reduced.

Abstract: In networks, some communication links may be provided as part of a network overlay. Technologies are disclosed for monitoring/analyzing targeted networks (e.g., network overlays) using probe packets sent from outside of the targeted networks/overlays. The probe packets are configured to include a stack of headers, including indications of UDP source ports, which are respectively examined in order at network devices in the targeted network to determine a routing scheme to utilize to route the packet.

Abstract: A method and system for detecting domain name system (DNS) recursive cyber-attacks are presented. The system includes learning a plurality of baselines of at least rates and rate invariants of DNS features; monitoring DNS traffic directed to and from a DNS resolver, wherein the DNS resolver is communicatively connected between at least one client and at least one name server; analyzing the monitored DNS traffic using at least one detection function to detect an anomaly based in part on at least one baseline of the plurality of learnt baselines; and upon detection of at least one anomaly, performing at least one mitigation action to filter out incoming DNS queries to a domain name under attack.

Abstract: A method of establishing communication with a second device via wireless communication channel that is not natively secure. The method includes performing mutual authentication between the first and second devices by receiving via the communication interface from the second device a FIDO public certificate of the second device and using a FIDO public key of the second device. The FIDO public key of the second device having been registered by the second device with a FIDO relying party in connection with a user identity associated with both the first device and the second device. The FIDO public key of the second device having been fetched by the first device from the FIDO relying party in connection with FIDO registration of the first device with the FIDO relying party in connection with the user identity. The method may include negotiating a shared secret used to engage in ongoing communication.

Abstract: Some embodiments provide a method for configuring a gateway router of a virtual datacenter. The method is performed at a network management component of a virtual datacenter that is defined in a public cloud and comprises a set of network management components and a set of network endpoints connected by a logical network managed by the network management components of the virtual datacenter. The method receives a set of network addresses of the network endpoints. The method aggregates at least a subset of the network addresses into a single subnet address that encompasses all of the aggregated network addresses. The method provides an aggregated route for the subset of network addresses to a gateway router that connects the virtual datacenter to a public cloud underlay network in order for the router to route data messages directed to the network endpoints to the logical network of the virtual datacenter.

Abstract: One example method includes obtaining hop information of a metadata path for backup metadata, obtaining content sensitivity information indicating a relative sensitivity of backup data to an attack, based on the hop information and the content sensitivity information, selecting an encryption to be applied to the backup metadata, and applying the encryption to the backup metadata. The backup data may be encrypted with the same encryption algorithm that was used to encrypt the backup metadata.

Abstract: A control device may be configured to delay an attachment procedure while attachment messages are being transmitted over the network. The control device may be configured to initiate an attachment procedure with a router device on a network at the end a back-off period of time. The attachment procedure may include transmitting attachment messages (e.g., parent request messages) that enable the control device to transmit and receive messages over the network through the router device. During the back-off period of time, the control device may determine an attachment message is received from another control device on the network. And, if an attachment message (e.g., a parent request messages and/or a link request message) is received from another control device, the control device may increase the back-off period of time (e.g., delaying when the control device initiates its attachment procedure).

Abstract: Techniques for user identity-based security policy enforcement. The techniques may include sending, to an edge device associated with a network, a networking policy associated with a user. The techniques may also include receiving, from an identity provider, an IP address associated with the user. Additionally, the techniques may include sending, to the edge device, an indication to associate the IP address with the user such that the edge device applies the networking policy to packets that include the IP address.