Abstract: Techniques for using proxies with overprovisioned IP addresses to demultiplex data flows, which may otherwise look the same at L7, into multiple subflows for L3 policy enforcement without having to modify an underlying L3 network. The techniques may include establishing a subflow through a network between a first proxy and a second proxy, the subflow associated with a specific policy. In some examples, the first proxy node may receive an encrypted packet that is to be sent through the network and determine, based at least in part on accessing an encrypted application layer of the packet, a specific application to which the packet is to be sent. The first proxy node may then alter an IP address included in the packet to cause the packet to be sent through the network via the subflow such that the packet is handled according to the specific policy.

Abstract: In one embodiment, a method includes receiving one or more 5G software-defined wide area network (SD-WAN) policies, identifying one or more identity-based policies from the one or more 5G SD-WAN policies, communicating the identified one or more identity-based policies to one or more WAN routers, communicating one or more 5G bindings to the one or more WAN routers, and applying the identified one or more identity-based policies to one or more flows between the one or more WAN routers.

Abstract: Systems and methods are disclosed herein that enable Time Sensitive Networking (TSN) network or Deterministic Networking (DetNet) network replication function fallback. In some embodiments, a method comprises, at a primary replication function, obtaining a packet in a particular stream, obtaining a sequence number for the packet, generating M copies of the packet each comprising the sequence number, transmitting the M copies, and providing, to a redundancy controller, the sequence number or a next sequence number of a next packet to be transmitted for the particular stream. The method further comprises, at the redundancy controller, receiving the sequence number or the next sequence number and providing the sequence number or the next sequence number to a secondary replication function. The method further comprises, at the secondary replication function, receiving the sequence number or the next sequence number and configuring a sequence generation function with the next sequence number.

Abstract: A method for delayed cyclic forwarding of messages by a system includes: receiving, by an input side of the system, the messages to be forwarded; and sending, by an output side of the system, the messages to be forwarded to a receiving device. A check is performed to determine whether the difference between a current system time and a receive time of a message under consideration is greater than or equal to the delay time. In the event that the difference is greater than or equal to the delay time, the message that has been in the buffer memory for the next longest time being checked in the same manner, and the checking of the messages is continued until a difference smaller than the specified delay time is found for a message.

Abstract: A node within a network including a plurality of interconnected nodes, and a method for operating a network that includes a plurality of interconnected nodes is provided. The network includes a primary path and an alternate path. Each path is respectively configured to connect a source node to a receiving node. The alternate path may include at least one more intermediate node than the primary path. Both the primary path and the alternate path are stored in a routing table. The data packets may be transmitted, substantially simultaneously, from the source node via the primary path and via the alternate path toward the receiving node. The data packets are accepted and forward by the receiving node. The determination of where to forward the data packets may be done locally by inspecting the incoming data packets.

Abstract: A hardware system for simulating a network physical layer for communication channels. The hardware system includes a plurality of hardware processors configurable to model a network physical layer and communication channels. The hardware system is further implemented where the hardware processors are configured such that a single set of hardware, including a single set of gates and registers, is used in a single simulation to model a plurality of virtual routers for different nodes.

Abstract: Apparatuses and methods for command and response descriptors handling are provided. In an example, a method for descriptor handling can include instantiating a command descriptor of a command regarding a packet at a first layer of a protocol stack by a microcontroller of a node. The method can also include passing a command pointer to the command descriptor to integrated circuits of the node from the microcontroller of the node. The method can further include looking up, by the integrated circuits, the command descriptor. The method can additionally include processing the command by the integrated circuits.

Abstract: A device for service-oriented communication with a signal-based hardware architecture. The device comprises a number of service-oriented communication interfaces for communicative connection to a number of external service-oriented communication partners, a number of signal-based communication interfaces for communication with a number of external signal-based devices, and an embedded system.

Abstract: For preempting an uplink resource allocation, one apparatus may include a processor coupled with a memory and configured to cause the apparatus to receive a first uplink grant associated with a first set of uplink resources and receive a second uplink grant associated with a second set of uplink resources, where one or more uplink resources of the second set of uplink resources at least partially overlap with one or more uplink resources of the first set of uplink resources. The processor may be configured to cause the apparatus to prioritize the second uplink grant and deprioritize the first uplink grant in response to the second priority being higher than the first priority. The processor may be configured to cause the apparatus to generate a first transport block (TB) based on the second uplink grant and to transmit the first TB using the second set of uplink resources.

Abstract: An apparatus comprises a first processing device, the first processing device comprising a physical hardware controller configured for coupling with a second processing device. The first processing device is configured to identify remote security service instances attached to the second processing device and to initiate, at the first processing device, one or more network emulation modules for the remote security service instances attached to the second processing device that emulate physical network interface devices configured for attachment to the second processing device.

Abstract: A reconfigurable dataflow unit (RDU) includes an intra-RDU network, an array of configurable units connected by an array level network and function interfaces. The RDU also includes interface circuits coupled between the intra-RDU network and external interconnects. An interface circuit receives a packet from the external interconnect and extracts a target RDU identifier and compares the target RDU identifier to the value of the identity register. It also communicates over the intra-RDU network to a function interface based on information in the first packet in response to the target RDU identifier being equal to the identity register. The interface circuit retrieves another interface circuit identifier for the target RDU identifier from the pass-through table and, in response to the target RDU identifier not being equal to the identity register, sends the target RDU identifier and other information to the other interface circuit over the intra-RDU network.

Abstract: Techniques for enabling offline, intelligent load balancing of Stream Control Transmission Protocol (SCTP) traffic are provided. According to one embodiment, a load balancer can receive one or more SCTP packets that have been replicated from a network being monitored. The load balancer can further recover an SCTP message from the one or more SCTP packets and can map the SCTP message to an egress port based on one or more parameters decoded from the SCTP message and one or more rules. The load balancer can then transmit the SCTP message out of the egress port towards an analytic probe or tool for analysis.

Abstract: A computing device may receive a plurality of scanning requests with at least one scanning request in the plurality identifying a target address of a target network. The computing device may for at least a subset of the plurality of scanning requests: generate a scanner instance and a virtual network interface card (VNIC) in response to the scanning request. The scanner instance and the VNIC communicating with a routing namespace that can communicate with two or more scanner instances simultaneously. Until the target address has been scanned: one or more packets can be sent from the scanner instance to the target address via the routing namespace and VNIC. The one or more packets can be wrapped in one or more packet wrappers identifying the target address and the target network. In response to the target address being scanned, the scanner instance and VNIC can be decommissioned.

Abstract: The present application relates to devices and components including apparatus, systems, and methods for latency reduction for beam failure recovery (BFR), with respect to transmit-receive point (TRP)-specific BFR.

Abstract: A resilient incident management system is provided that continues operation when certain outages occur. An RSS feed is utilized to indicate incident-related information despite the certain outages. In an embodiment, the incident management system includes a redundant architecture that comprises a traffic manager and a backup traffic manager. The incident management system receives a client request for incident-related information and determines a priority level or a performance level of end points associated with the request. Based on a status of the traffic manager and the backup traffic manager, as well as based on the priority level or the performance level, the incident management system causes a computer operation to be executed via the redundant architecture to retrieve a response from a producer and generate the RSS feed.

Abstract: Embodiments of systems and methods for modulating a downlink signals representative of a communication signal are provided herein. An example method comprises receiving an input signal; in a first one or more processing blocks in a one or more processors, performing a first modulation operation on first data packets of the input signal based on a modulation scheme for a receiver of the downlink signal; in a second one or more processing blocks in the one or more processors in parallel with the first one or more processing blocks, performing a second modulation operation on second data packets of the input signal based on the modulation scheme; and generating a waveform as the downlink signal based on performing the first and second modulation operations.

Abstract: In order to maintain performance during wireless communication, a transmitting electronic device may concurrently and independently communicate redundant information to a receiving electronic device. In particular, information associated with a data stream may be communicated to the receiving electronic device using one or more channels by two radios using one or more wireless local area network communication protocols. The packets transmitted by the radios may preferentially include the same information. Moreover, the transmitting electronic device may attempt to maintain the redundant communication if a performance metric associated with the one or more channels degrades. For example, the transmitting electronic device may transfer communication to a different channel or may compress the information in the packets in the one or more channels if the throughput drops below a threshold value.

Abstract: Data routing with a forwarding process of service data can avoid problems of offline nodes. The forwarding process for data routing can also improve the fault tolerance and service data can be quickly transmitted to a corresponding data pool. Using consensus nodes and a target data pool with routing and forwarding tables along with subtrees from a trie tree can improve the routing. Subtrees may be obtained by splitting the trie tree from a root node by using a first leaf node as a benchmark, which correspondingly represents a data pool of the consensus node. The routing and forwarding table is configured to record addresses of data pools correspondingly represented by a preset quantity of leaf nodes in a corresponding subtree.

Abstract: A vehicle signal relay system enables a relay agent in a first zone of a vehicle to send sensor signals having a first link-layer communication protocol to a software application deployed on a compute unit in another zone of the vehicle that is connected using another link-layer communication protocol. The vehicle signal relay system allows the software application to identify target relay agents with access to needed sensor signals. The vehicle signal relay system may further enable one way or mutual attestation. The vehicle signal relay system may also allow filters to be applied to the subscribed vehicle sensor signals, and may allow the software application to determine a communication protocol to be used between the software application and the relay agent.

Abstract: A data transmission circuit and method, a core, a chip with a multi-core structure, an electronic device and a storage medium are provided. The data transmission circuit includes a receiver, a controller, a lookup table circuit and a selector. The receiver is configured to receive an original data packet from Fabric; the controller is configured to determine whether the original data packet needs to be relayed according to an original control bit, and control a first input terminal of the selector to be enabled in response to that the original data packet needs to be relayed; the selector is configured to send a new data packet to the Fabric via the first input terminal, wherein the new data packet includes the original data and a new header acquired by the lookup table circuit according to an original index. In this way, power consumption of the data transmission circuit is reduced.

Abstract: In networks, some communication links may be provided as part of a network overlay. Technologies are disclosed for monitoring/analyzing targeted networks (e.g., network overlays) using probe packets sent from outside of the targeted networks/overlays. The probe packets are configured to include a stack of headers, including indications of UDP source ports, which are respectively examined in order at network devices in the targeted network to determine a routing scheme to utilize to route the packet.

Abstract: A method of establishing communication with a second device via wireless communication channel that is not natively secure. The method includes performing mutual authentication between the first and second devices by receiving via the communication interface from the second device a FIDO public certificate of the second device and using a FIDO public key of the second device. The FIDO public key of the second device having been registered by the second device with a FIDO relying party in connection with a user identity associated with both the first device and the second device. The FIDO public key of the second device having been fetched by the first device from the FIDO relying party in connection with FIDO registration of the first device with the FIDO relying party in connection with the user identity. The method may include negotiating a shared secret used to engage in ongoing communication.

Abstract: Some embodiments provide a method for configuring a gateway router of a virtual datacenter. The method is performed at a network management component of a virtual datacenter that is defined in a public cloud and comprises a set of network management components and a set of network endpoints connected by a logical network managed by the network management components of the virtual datacenter. The method receives a set of network addresses of the network endpoints. The method aggregates at least a subset of the network addresses into a single subnet address that encompasses all of the aggregated network addresses. The method provides an aggregated route for the subset of network addresses to a gateway router that connects the virtual datacenter to a public cloud underlay network in order for the router to route data messages directed to the network endpoints to the logical network of the virtual datacenter.

Abstract: A method and system for detecting domain name system (DNS) recursive cyber-attacks are presented. The system includes learning a plurality of baselines of at least rates and rate invariants of DNS features; monitoring DNS traffic directed to and from a DNS resolver, wherein the DNS resolver is communicatively connected between at least one client and at least one name server; analyzing the monitored DNS traffic using at least one detection function to detect an anomaly based in part on at least one baseline of the plurality of learnt baselines; and upon detection of at least one anomaly, performing at least one mitigation action to filter out incoming DNS queries to a domain name under attack.

Abstract: One example method includes obtaining hop information of a metadata path for backup metadata, obtaining content sensitivity information indicating a relative sensitivity of backup data to an attack, based on the hop information and the content sensitivity information, selecting an encryption to be applied to the backup metadata, and applying the encryption to the backup metadata. The backup data may be encrypted with the same encryption algorithm that was used to encrypt the backup metadata.

Abstract: A control device may be configured to delay an attachment procedure while attachment messages are being transmitted over the network. The control device may be configured to initiate an attachment procedure with a router device on a network at the end a back-off period of time. The attachment procedure may include transmitting attachment messages (e.g., parent request messages) that enable the control device to transmit and receive messages over the network through the router device. During the back-off period of time, the control device may determine an attachment message is received from another control device on the network. And, if an attachment message (e.g., a parent request messages and/or a link request message) is received from another control device, the control device may increase the back-off period of time (e.g., delaying when the control device initiates its attachment procedure).

Abstract: Techniques for user identity-based security policy enforcement. The techniques may include sending, to an edge device associated with a network, a networking policy associated with a user. The techniques may also include receiving, from an identity provider, an IP address associated with the user. Additionally, the techniques may include sending, to the edge device, an indication to associate the IP address with the user such that the edge device applies the networking policy to packets that include the IP address.

Abstract: Techniques are described for managing communications between multiple computing nodes, such as computing nodes that are separated by one or more physical networks. In some situations, the techniques may be used to provide a virtual network between multiple computing nodes that are separated by one or more intermediate physical networks, such as from the edge of the one or more intermediate physical networks by modifying communications that enter and/or leave the intermediate physical networks. In some situations, the computing nodes may include virtual machine nodes hosted on one or more physical computing machines or systems, such as by or on behalf of one or more users (e.g., users of a program execution service). The managing of the communications may include determining whether communications sent to managed computing nodes are authorized, and providing the communications to the computing nodes only if they are determined to be authorized.

Abstract: Systems and methods for avoiding duplicate delivery in the reset mechanism of seamless redundancy, e.g., of a Time Sensitive Networking (TSN) network or Deterministic Networking (DetNet) network, are disclosed herein. In one embodiment, a method performed by a receiving node comprises receiving packets from multiple streams from a transmitting node via a network, each being a replication of a particular packet stream and each packet comprising a sequence indication. The method further comprises performing an elimination procedure, wherein performing the elimination procedure comprises resetting one or more parameters utilized by the elimination procedure responsive to an occurrence of an event while receiving the packets and, responsive thereto, discarding all of the received packets processed by the elimination procedure from a time at which the elimination procedure was reset until an end of a defined period of time.

Abstract: The present disclosure is directed to a comprehensive Route Selection Policy (URSP) based on Wi-Fi multi-link operation. In one aspect, a method includes identifying a user device connected to an enterprise network that provides network connectivity to user devices over multiple radio access technologies; receiving network capability information indicating that the user device is capable of a multi-link operation over a Wi-Fi network, the Wi-Fi network being one of the multiple radio access technologies; determining a URSP for the user device, wherein the URSP is a singular route selection policy for the user device to send and receive data over the multiple radio access technologies and defines, in part, a per-application traffic routing rule for routing a portion of traffic for an application used on the user device, over one of multiple links available on the Wi-Fi network; and transmitting the URSP to the user device.

Abstract: A method includes obtaining, by a first network node, a first segment identifier advertisement message, where the first segment identifier advertisement message includes a first segment identifier and a first flag bit, and the first segment identifier is corresponding to a second network node; determining, by the first network node, that the first flag bit indicates that a packet needs to be forwarded through the second network node; and generating, by the first network node, a first packet forwarding path, where the first packet forwarding path includes the second network node.

Abstract: A bridge device for a building network includes a radio, a wired communications interface configured to communicate with a first master slave/token passing (MS/TP) network, and a processing circuit configured to wirelessly transmit and receive messages to and from MS/TP devices coupled to the MS/TP network. The processing circuit is configured to transparently communicate the messages such that the MS/TP devices on the first MS/TP network are operationally unaware of a wireless network associated with the bridge device by passing tokens for MS/TP devices outside of the MS/TP network.

Abstract: Provided are a method and apparatus for processing a deterministic networking (DetNet) data packet. The method includes: performing, by a DetNet node, format encapsulation on a data packet of a DetNet application flow when the DetNet application flow passes through a multiprotocol label switching (MPLS) network, wherein an encapsulated data packet comprises a label indication and a flow identifier header; and forwarding the encapsulated data packet in the MPLS network.

Abstract: Embodiments of this disclosure provide a network information processing method and a terminal device. The method includes: obtaining M PLMN identifiers, where the M PLMN identifiers are identifiers of M equivalent public land mobile networks EPLMNs, the M EPLMNs are equivalent networks of a registered public land mobile network RPLMN, the RPLMN is a network currently accessed by a terminal device, and M is a positive integer; and in a case that a target list of the terminal device includes at least one of the M PLMN identifiers obtained by an obtaining module, forbidding adding an identifier of the RPLMN to the target list, where the PLMN identifier in the target list is an identifier of a PLMN in which the terminal device is forbidden from accessing a 4G network.

Abstract: A communications system for providing data communication to a vehicle (10), the communications system comprising: a mobile transport layer proxy (150) located on the vehicle; a parent transport layer proxy (170) located remote from the vehicle; the mobile transport layer proxy being configured to: accept a transport layer connection with a host device (32, 33), the transport layer connection being addressed to a remote server (160); and communicate with the parent transport layer proxy via multiple paths using a multipath transport layer protocol to communicate on behalf of the host device whilst identifying as the mobile transport layer proxy; and the parent transport layer proxy being configured to: communicate with the mobile transport layer proxy using the multipath transport layer protocol; and communicate with the remote server whilst identifying as the parent transport layer proxy to communicate on behalf of the mobile transport layer proxy to permit the host device to communicate with the remote serve

Abstract: A network node apparatus may be configured to receive, from a first user equipment (UE), a first transmission including an indication of a first protocol identifier. The apparatus may further be configured to communicate with the first UE using a first protocol associated with the first protocol identifier. The apparatus may also be configured to receive, from a second UE, a second transmission including an indication of a second protocol identifier. The apparatus may further be configured to communicate with the second UE using a second protocol associated with the second protocol identifier. The apparatus may include a shared kernel space driver for a first PCIe interface and a second PCIe interface, a first modem connected to the shared kernel space driver via the first PCIe interface, and a second modem connected to the shared kernel space driver via the second PCIe interface.

Abstract: This application relates to the field of computer network technologies and discloses an autonomous system (AS) pair verification method, apparatus, and device. The method can avoid incorrect determining of an AS pair in path information of an AS path during verification of the AS path, and improve accuracy of verifying the AS path. The method is applied to a network device. The method includes: obtaining path information including an AS pair; determining region information of a region to which the AS pair in the path information belongs; and verifying the AS pair based on the determined region information of the region to which the AS pair belongs, where the AS pair in the path information includes two adjacent AS numbers in the path information.

Abstract: The present technology relates to a communication apparatus and a communication method that permit realization of more reliable communication. Provided is a communication apparatus that includes a control section that performs control such that plural aggregated subframes are sent in a predetermined sequence for each frame included in each of spatially multiplexed streams when a frame is sent to another communication apparatus as plural spatially multiplexed streams. The present technology is applicable, for example, to a communication apparatus included in a wireless LAN system.

Abstract: Techniques are described for providing a proactive indication of a disruption of a network session. In one example, a network session is established between a first endpoint and a second endpoint based on a connection-oriented protocol. One or more network attributes associated with the network session are stored in a persistent storage. The one or more network attributes may be obtained from the persistent storage when the network session is disrupted. A proactive indication that the network session has been disrupted may be provided to the second endpoint based on the one or more network attributes.

Abstract: Transmission of content items through a network may employ a variety of devices that comprise buffers for the content. The content may include buffer priority information to assist in management of the buffers of intermediate devices for the routing. For example, the buffer priority information may assist the devices in managing buffer queue priorities.

Abstract: A client device establishes a first VPN connection with a VPN server. Traffic is sent from the client device through the first VPN connection that is destined to a different client device that has a second VPN connection with the VPN server. The client device receives a public network address of the different client device and routing metrics from the VPN server. Based at least in part on the routing metrics, the client device determines an optimal route to the different client device, where the optimal route is a connection between the client device and the different client device that does not traverse the VPN server. The client device establishes a VPN connection with the different client device and transmits traffic to that different client device using the VPN connection using the public network address of the different client device.

Abstract: Methods and apparatuses are described for routing of network traffic based on future utilization of a plurality of network devices. For example, future utilization for each of a plurality of network devices may be predicted. Then, based on the predicted future utilization, a route may be determined that comprises at least some of the plurality of network devices. An instruction to route data packets based on the route can then be sent to one (e.g. the first) of the network devices in the determined route.

Abstract: A multi-port memory is provided that supports collision between a read port and a write port to the same multi-port bitcell. A sense amplifier reads a data bit from a multi-port bitcell when a write port to the multi-port bitcell is addressed during a system clock signal. Should a read port to the multi-port bitcell be addressed during the same system clock signal, a multiplexer selects for an output bit from the sense amplifier.

Abstract: In some implementations, a device may receive a SIP invite associated with a call to a first user device from a second user device. The first user device may be associated with a first network and the second user device may be associated with a second network that is separate from the first network. The SIP invite may include an identity header that indicates a carrier identifier associated with the second network. The device may authenticate the call based on a caller identification associated with the second user device and the carrier identifier. The device may send, based on authenticating the call, the SIP invite to the first user device to indicate, in association with receiving the call and via a user interface, an authorized entity associated with the carrier identifier according to the SIP update.

Abstract: Methods, systems, and media for aggregating and presenting content relevant to a particular video game. In some embodiments, the method comprises: identifying videos related to a video game; selecting videos relevant to each of a plurality of categories; selecting videos based on popularity; receiving a request to present a user interface related to the video game; determining user subscription information for a user associated with the request; selecting videos based on user subscription information; causing the user interface to be presented including representations of: videos relevant to a first category in a first portion, videos selected based on popularity in a second portion, and videos selected based on the user subscription information in a third portion; receiving a request to present a video selected via the user interface; and causing the user device to present the requested video.

Abstract: A network device may include a packet processing pipeline. The packet processing pipeline may include a parser configured to parse packet information in a transit packet received at an input interface of the network device. The packet processing pipeline may include packet sampling information storage circuitry configured to store sampled packet information obtained based on the parsed packet information. The packet processing pipeline may include a processing engine configured to modify a payload of a sampling information accumulation packet to include the sampled packet information for the transit packet. The payload of the sampling information accumulation packet may include the sampled packet information for multiple transit packets.

Abstract: Systems, methods, and related technologies for determining fields of an unknown protocol are described. Network traffic capture is grouped into one or more clusters of packets based on similarity. Each of the one or more clusters are parsed to identify one or more fields of an unknown protocol. The network traffic capture is modified, including annotating the identified one or more fields of the unknown protocol. A protocol parser is generated without user input, including parsing each of the annotated one or more fields of the unknown protocol to generate a description of the unknown protocol comprising identified one or more fields of the unknown protocol and an order of the identified one or more fields of the unknown protocol, and compiling the description into the protocol parser.

Abstract: According to certain embodiments, an electronic device comprises: a communication module; at least one processor; and a memory electrically connected to the at least one processor, wherein the memory stores instructions, that when executed, cause the at least one processor to perform a plurality of operations, the plurality of operations comprising: determining whether a packet received through the communication module satisfies at least one packet filtering rule, transmitting the packet directly to a user address space allocated to the memory, bypassing a network stack included in a kernel address space allocated to the memory, when the packet satisfies the at least one packet filtering rule, and transmitting the packet to the user address space through the network stack included in the kernel address space allocated to the memory when the packet does not satisfy the at least one packet filtering rule.

Abstract: Live-custom recording functionality is described. Live-custom recording can help a teleconferencing participant overcome situations where the participant may, for example, not have been attentive and therefore may have missed what was communicated. Another example of a situation that can be overcome with techniques described in this paper is one in which the participant cannot hear the speaker due to inadequate or low bandwidth and network connectivity issues. An enhanced conference recording functionality such as the live-custom recording functionality proposed and described herein is designed to capture applicable segments or clips of the teleconference meeting.

Abstract: In general, this disclosure describes techniques for provisioning virtual private network (VPN) services for cloud native routers using a multi-stage process. In an example, a method comprises deploying, in a first computing device, using a layer 2 bridge domain that includes the first computing device, a containerized routing protocol process; deploying, in the first computing device, using the layer 2 bridge domain, a containerized application; configuring, in the containerized routing protocol process executing on the first computing device, a virtual private network (VPN); and exchanging, by the containerized routing protocol process executing on the first computing device, routing protocol messages with another router to provide virtual connectivity between the containerized application and another application that is external to the first computing device.