Abstract: Application identification and control in a network device. In one embodiment, a method may include establishing, at a network device, a Virtual Private Network (VPN) tunnel through which all Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) traffic sent from or received at the network device is routed. The method may also include monitoring, at the network device, all TCP and UDP traffic sent from or received at the network device through the VPN tunnel. The method may further include extracting, at the network device, payload data from the monitored TCP and UDP traffic. The method may also include analyzing the extracted payload data to identify applications executing on the network device that sent or received the monitored TCP and UDP traffic. The method may further include taking, at the network device, a security action on the network device based on the identified applications.

Abstract: A network where FC and Ethernet storage traffic share the underlying network. The network extends FC SAN storage specific attributes to Ethernet storage devices. The network is preferably formed of FC switches, so each edge switch acts as an FCoE FCF, with internal communications done using FC. IP packets are encapsulated in FC packets for transport. Preferably, either each outward facing switch port can be configured as an Ethernet or FC port, so devices can be connected as desired. FCoE devices connected to the network are in particular virtual LANs (VLANs). The name server database is extended to include VLAN information for the device and the zoning database has automatic FCOE_VLAN zones added to provide a mechanism for enhanced soft and hard zoning. Zoning is performed with the conventional zoning restrictions enhanced by including the factor that any FCoE devices must be in the same VLAN.

Abstract: In one embodiment, a method includes determining a home node that corresponds to gateway (GW) nodes in a clustered file system, each GW node being eligible to process one or more read tasks, determining a peer GW eligibility value for more than one of the GW nodes in the clustered file system eligible to process one or more read tasks, and determining a single GW node from amongst the GW nodes having a highest peer GW eligibility value for each home node. Additionally, the method includes assigning and defining a size for one or more read task items for the GW nodes having the highest peer GW eligibility value for multiple home nodes based on a current dynamic profile of the GW nodes, and distributing workload to the GW nodes according to the size for each of the one or more read task items assigned to the GW nodes.

Abstract: Virtual machine environments are provided in the switches that form a network, with the virtual machines executing network services previously performed by dedicated appliances. The virtual machines can be executed on a single multi-core processor in combination with normal switch functions or on dedicated services processor boards. Packet processors analyze incoming packets and add a services tag containing services entries to any packets. Each switch reviews the services tag and performs any network services resident on that switch. This allows services to be deployed at the optimal locations in the network. The network services may be deployed by use of drag and drop operations. A topology view is presented, along with network services that may be deployed. Services may be selected and dragged to a single switch or multiple switches. The management tool deploys the network services software, with virtual machines being instantiated on the switches as needed.

Abstract: A frame transmission controlling apparatus includes: a list configuration unit managing a parameter related to a gate control; a cycle timer unit managing a start timing of a cycle; a list executing unit performing the gate control based on the parameter, wherein the list executing unit includes: a cycle executing state machine setting an expiration time of at least one section included in the cycle, checking gate operation information corresponding to a list pointer indicating the at least one section, and performing a control corresponding to the gate operation information; a delaying state machine deducting and updating the expiration time by a predetermined unit; a cycle holding state machine generating a control signal indicating stopping transmission in MAC; and a cycle releasing state machine generating a control signal indicating resuming the transmission in MAC.

Abstract: A PCB includes a programmable logic device (PLD), a memory, a live power ON sequence algorithm, and other electronics. The PLD is connectable to a primary DC power supply. The PLD is configurable by a configuration memory device having stored PLD configuration information. Upon completion of the configuring the PLD generates a PLD control signal or the algorithm triggers generation of a PLD control signal substitute to indicate a configuration of PLD is complete and the PLD is in active mode. Power coupling includes the primary DC power supply coupled to a power input of an electronic switch or the primary DC power supply wiring coupled to a power input of a second DC power supply. The PLD control signal or substitute provides an enable signal that controls power arriving through the electronic switch or from the second DC power supply to the other electronics.

Abstract: The invention is related to a method for transmitting sporadic data stream (SStream) over a packet switched network carrying out further a transmission of priority data transmission within scheduled successive priority time windows. More particularly, the transmission of the sporadic data stream is preceded by a transmission of a reservation frame (RSVFrame) including information related at least to a timing for transmitting the sporadic data stream outside from said scheduled priority time windows.

Abstract: An information processing apparatus connected to a plurality of networks, includes: a plurality of device drivers each of which is receives a packet from each of the networks; and circuitry determines a network to which a transmission source device of the packet belongs based on information indicating which of the device drivers has received the packet.

Abstract: A system for allocating wireless frequency spectrum is provided. The system may include one or more location tags attached on one or more foreign network devices and domestic network devices, one or more real-time location tracking system configured to detect the one or more location tags, and at least one control unit in communication with at least one domestic network device. The control unit may be configured to query one or more proximity policies associated with the foreign network devices and the domestic network devices, apply a modified network configuration to one or more of the domestic network devices when at least one associated proximity policy is discovered, and restore a default network configuration, or setting the modified network configuration as a new default network configuration, to the one or more of the domestic network devices when the discovered proximity policy is no longer effective.

Abstract: Particular embodiments described herein provide for an electronic device that includes at least one processor operating at eight hundred (800) megahertz and can be configured to receive a data stream, parse packets in the data stream, and process at least two (2) full packets from the data stream in a single clock cycle. In an example, the data stream is at least a two hundred (200) gigabit Ethernet data stream and a bus width is at least thirty-two (32) bytes.

Abstract: A communication apparatus comprises: a sending unit that sends data to a designated destination; a receiving unit that receives a response to the send by the sending unit; a recording unit that records information relating to a send when the send is performed by the sending unit, and associates and records, when a response to the send is further received by the receiving unit, information of a send-source of the response; and a control unit that causes the sending unit to resend data based on information recorded in the recording unit, wherein the control unit causes the sending unit to resend data to a destination indicated by information, among the recorded information, for which a predetermined time has elapsed since the recording and for which a response has not been received by the receiving unit.

Abstract: Disclosed herein are embodiments of systems, methods, and products comprise a computing device, which provides a secure data transport service (SecureX) for data packets traversing from an end user device (EUD) to a mission network over untrusted networks. The disclosed SecureX module may be software product running on the EUD and on a SecureX appliance fronting the mission network. The SecureX module on the EUD compresses the data packets by removing header fields that are constant over the same packet flow and double encrypts the data packets with different cryptographic keys. The SecureX on the EUD transmits the double compressed encrypted data packets over the untrusted network. The SecureX appliance receives the double compressed encrypted data packets, decrypts the data packets and decompresses the data packets to recreate the original data packets. The SecureX appliance transmits the original data packets to the mission network.

Abstract: In deploying a system in a computing environment, before deployment, a deployment engine performs a pre-deployment validation of the system using pre-determined system requirements. When the pre-deployment validation of the system fails, the deployment of the system is terminated. When the pre-deployment validation of the system succeeds, the deployment engine performs the following for each artifact of the system. Before deployment of a given artifact of the system, a pre-deployment validation of the given artifact is performed using pre-determined artifact properties. When the pre-deployment validation of the given artifact fails, the deployment of the system is terminated. When the pre-deployment validation of the given artifact succeeds, the given artifact is deployed. After the deployment of the given artifact, a post-deployment validation of the given artifact is performed using deployment data for the given artifact.

Abstract: A computer-automated method for securing unidirectional communication within a network. The method includes orchestrating an automated arrangement and/or coordination of at least one portion of a message using a top-level orchestration server, transmitting a first data packet from the top-level orchestration server to a first top-level backbone server, wherein the first data packet is a first portion of the message, and authenticating the first data packet using the first top-level backbone server. The method can include transmitting a second data packet from the first top-level backbone server to a second top-level backbone server, wherein the second data packet is a second portion of the message and/or the second data packet includes a modified first data packet and authenticating the second data packet using the second top-level backbone server.

Abstract: A method is disclosed. The method may comprise identifying a plurality of network devices in a cluster of network devices. In some examples, the method may comprise identifying any virtual local area networks (VLANs) that are enabled on each of the plurality of network devices in the cluster of network devices. In some examples, the method may comprise, for each identified VLAN, determine a set of network devices accessible on a respective VLAN. In some examples, the method may comprise probing the respective VLAN in response to the respective VLAN being accessible by each network device in the cluster of network devices. A network device and a machine-readable medium are also disclosed.

Abstract: In general, the disclosure describes techniques for distributing processing of routes among multiple execution threads of a network device. In some examples, a method includes identifying, with a thread of a plurality of execution threads, a first route processing thread of the execution threads to process a first route of a routing protocol, the first route received by the network device; identifying, with the thread, a second route processing thread of the execution threads to process a second route of a routing protocol, the second route received by the network device; processing, by the first route processing thread executing on a first core of the plurality of processing cores, the first route; and processing, by the second route processing thread executing on a second core at least partially concurrently with the first route processing thread executing on the first core of the plurality of processing cores, the second route.

Abstract: Embodiment provide recovering multicast data traffic during spine reload in software defined networks by identifying interfaces available between spine switches and a public network in a site; identifying Group Internet Protocol-outer (GIPo) addresses that handle multicast communications between endpoints associated together in a bridge domain, wherein the endpoints are connected via leaf switches in communication with the spine switches in a Clos topology; assigning each GIPo address to one virtual interface group (ViG) of a plurality of ViGs to generate GIPo-to-ViG mappings; distributing the GIPo-to-ViG mappings to the spine and leaf switches; assigning each ViG to one Interface as first ViG-to-Interface mappings; distributing the first ViG-to-Interface mappings to the spine and leaf switches and; when a number of available Interfaces changes, re-assigning each ViG to one currently-available Interface as second ViG-to-Interface mappings; and distributing the second ViG-to-Interface mappings to the spine swi

Abstract: Allocation of an entry in a variable size entry container is initiated in an in-memory database system. The variable size entry container includes a plurality of pages forming a chain. Thereafter, it is determined whether free space is found within the pre-existing pages. If free space is found, the entry is allocated in the free space. Otherwise, a new page is created and appended to the chain so that the entry can be allocated on such new page.

Abstract: Embodiments are provided for managing routes of data traffic within a network. The management may be performed via a graphical user interface that interacts with a Web server to update a configuration file. The configuration file can be converted to router management commands by a network management device (e.g., a BGP speaker). The commands can then be sent to border routers for controlling network traffic. Embodiments are also provided for capturing and logging routing updates made in a network.

Abstract: A method and apparatus for self-adjusting networks including internet-of-things (IoT) devices is provided. An exemplary system includes a source discovery system configured to identify if a source sending a message is in a database, and, if not, add the source to the database and rank the source by link metrics of messages received from the source. A sink discovery system is configured to identify if a sink receiving a message is in a database, and, if not, add the sink to the database. The sink discovery system is configured to rank the sink by link metrics of messages responded to by the sink. A dynamic mapping system is configured to create a dynamic map of communications between a source and a sink, and implement a self-healing subsystem to restore a loss of communications between a source and a sink.

Abstract: A method, device and system for message forwarding are provided. The method may include the following acts. A second device in a second domain receives a first message from a first domain. The second device allocates, for the first message, a second Service Function Path Identifier (SFPID) corresponding to a Service Function Chain (SFC) in the second domain, and obtains a second message. The second device sends the second message to one or more other devices, except the second device, in the second domain.

Abstract: Methods, systems, and computer program products for managing Internet of Things (IoT) network-connected devices.

Abstract: A network topology system having a plurality of nodes for data exchange is provided, with the number of said nodes being N. The nodes are sequentially connected to form a ring communication configuration. N is an even integer. The i-th node of said nodes connects to the [(i+m) mod N]-th and [(i+p) mod N]-th nodes according to a connection rule. The j-th node of said nodes connects to the [(j?m) mod N]-th and [(j+p) mod N]-th nodes according to the connection rule. i and j are non-negative integers and are less than N. m and p are integers and not larger than N. Here, i and m are odd numbers, and j and p are even numbers.

Abstract: Methods, systems, and apparatuses are provided for VoIP communication with VoIP-enabled devices via a network address translator (NAT). A set of proxy servers is configured to relay communications through mapped paths of the NAT during operations including VoIP sessions through or with the plurality of VoIP-enabled devices and during other operations not involving VoIP sessions through or with the plurality of VoIP-enabled devices. The mapped paths are susceptible to being unmapped by the NAT if the mapped path is unused for a threshold duration of time. The proxy servers maintain the mapped paths through the NAT by prompting the VoIP-enabled devices to communicate data to the set of proxy servers. More specifically, a VoIP-enabled device is prompted to communicate data to the set of proxy servers, in response to the VoIP-enabled device not communicating with the set of proxy servers for a duration of time exceeding the threshold duration of time.

Abstract: Some embodiments provide a method, that receives a packet having a first logical network address as a source address and a second logical network address as a destination network address. The method replaces the first and second logical network addresses with corresponding first and second physical network addresses. The method transmits the packet having the first and second physical network addresses as source and destination network addresses without encapsulation to a physical network for delivery to the second logical network address.

Abstract: The present disclosure envisages establishing a virtual overlay network between the source computer and the destination computer (in addition to a typical, unsecured, public computer network already connecting the source computer and the destination computer), and designating the source computer and destination computer to be identified on the virtual overlay network only by the corresponding source private IP address and destination private IP address. The present disclosure envisages an intermediary server for creating and subsequently managing the virtual overlay network. The intermediary server renders the virtual overlay network accessible only to the source computer and the destination computer to communicate with one another and to exchange data packets using the source private IP address and destination private address and the corresponding private ports, while ensuring that the virtual overlay network remains inaccessible to any other computer on the underlying public computer network.

Abstract: The present disclosure provides systems and methods for an address exchange system including a controller configured to provide an API configured to receive an identifier from a user and further configured not to receive a physical address from the user, wherein the user provides an item for shipment to the physical address. In response to receiving the identifier, the controller is further adapted to calculate a maximum cost of the item, including one or more of a maximum sales tax and maximum shipping cost. The systems and method receive payment for the maximum cost and then refund the difference between the maximum cost and actual cost after the item has shipped.

Abstract: Communication reception that enables reception of a packet which may not contain an error without invalidating the same is disclosed. In one example, an information analyzing unit analyzes a data string and frame/slot information, and supplies TMCC information, slot header information, and data length information to a packet length indicating unit and a packet dividing unit. The packet length indicating unit defines the packet length in advance, and indicates the defined packet length to the packet dividing unit. The packet dividing unit performs packet division on the basis of the packet length obtained from the TMCC information, the slot header information, the data length information and the like from the information analyzing unit, and the packet length defined by the packet length indicating unit.

Abstract: The present disclosure provides systems and methods for an address exchange system including a controller configured to provide an API configured to receive an identifier from a user and further configured not to receive a physical address from the user, wherein the user provides an item for shipment to the physical address. In response to receiving the identifier, the controller is further adapted to request the physical address from a data storage system wherein the data storage system stores an association between the identifier and the physical address and further stores one or more permission settings defining situations in which the physical address is to be provided in response to receipt of the identifier. In response to receipt of the identifier, the data storage system tests the permission settings to determine whether or not to provide the associated physical address.

Abstract: There is provided a method and an apparatus for converting a packet of a first transmission protocol into a packet of a second transmission control protocol, wherein one of the first transmission control protocol and the second transmission control protocol is multipath transmission control protocol (MPTCP) and the other is transmission control protocol (TCP), wherein the converting comprises: obtaining a sequence number indicated in a first header element of the first packet, and copying the obtained sequence number into a second header element of the second packet.

Abstract: This specification describes methods, systems, and computer-readable media for sidecar-backed services for a cloud computing platform. An application is bound to a service. A transformer component of the cloud computing platform transforms credential information for accessing the service by replacing an access address to the service with a localhost address to a sidecar program associated with the application. When the application uses the service, the application communicates with the sidecar program rather than with the service directly. The sidecar program then forwards the communication to the service.

Abstract: A multi-layer resource control stack based system may generate an availability indication for multiple domains supported by the resource control stack and send the indication to a client node. The client node may respond with a selection of a domain. The client node may also indicate a compute resource to be managed by the resource control stack. In response to the selection from the client node, the resource control stack may initiate a virtual representation of the domain. The client node may interact with the virtual representation to receive recommendations, utilization data, and control information relevant to the compute resource and within a subject area associated with the domain.

Abstract: Apparatuses and methods for pipelined hashing are described herein. An example apparatus to perform a pipelined hash function may include a first memory to store a first plurality of bucket records, a second memory to store a second plurality of bucket records, and a hash circuit to receive a key and to perform a pipelined hash function using the key to provide a hash value. The hash circuit further to select a first bucket record of the first plurality of bucket records from the first memory based on a first subset of bits of the hash value. The hash circuit further to provide a location of a particular entry of an entry record of the plurality of entry records based on contents of the first bucket record and a second subset of bits of the hash value.

Abstract: The disclosed embodiments relate to a system that compresses and transmits packets. During operation, the system obtains packets-to-be-compressed at a compressor located at a transmitter that transmits packets through a channel over a network link to a decompressor located at a receiver. The system also obtains cross-layer information regarding the network link from lower-layer network entities in the transmitter. Next, the system uses the cross-layer information to generate estimations for a state of the channel and a state of the decompressor. The system then determines a compression level for the packets-to-be-compressed based on a compression policy and the estimations for the state of the channel and the state of the decompressor. The system subsequently generates packets-to-be-transmitted by compressing headers of the packets-to-be-compressed, wherein the headers are compressed at different levels based on the determined compression level.

Abstract: A data processing apparatus includes first and second information processing apparatuses. The first information processing apparatus has a first power mode and a second power mode in which electric power consumption is smaller than in the first power mode. The second information processing apparatus is capable of communicating with the first information processing apparatus and an external apparatus via a network. Definition information including identification information identifying a packet received via the network and process information indicating a process to be performed on the packet is received at least from one of the first information processing apparatus and the external apparatus. If a packet is received from the external apparatus in the second power mode, the packet is analyzed to identify definition information corresponding to the packet based on the identification information. A process is performed according to the process information included in the definition information.

Abstract: Systems, methods, and devices can include link layer logic that is to identify, by a link layer device, first data received from the memory in a first protocol format, identify, by the link layer device, second data received from the cache in a second protocol format, multiplex, by the link layer device, a portion of the first data and a portion of the second data to produce multiplexed data; and generate, by the link layer device, a flow control unit (flit) that includes the multiplexed data.

Abstract: Forwarding Ethernet packets is disclosed, including: receiving an incoming packet; determining a value based at least in part on performing a hash operation on at least a portion of a destination Internet Protocol (IP) address included in the incoming packet; comparing the value against a pre-established look-up table to determine whether a corresponding index value is found, wherein the pre-established look-up table stores index values and corresponding data sets to respective ones of the index values; determining a destination media access control (MAC) address associated with the incoming packet based at least in part on whether the corresponding index value is found in the pre-established look-up table; and forwarding the incoming packet to a virtual machine associated with the determined destination MAC address.

Abstract: A lock management solution in a cluster, where the cluster includes a client and a lock server, the lock server includes an interface card and a memory, the memory stores a read lock request queue recording an identifier of a client waiting for a read lock or obtaining the read lock, the memory further stores a write lock request queue recording an identifier of a client waiting for a write lock or obtains the write lock, and the memory further includes a read lock allocation count and a write lock allocation identifier, where the read lock allocation count records an allocated read lock, and the write lock allocation identifier indicates whether the write lock has been allocated.

Abstract: The present invention provides a method of integrating existing strong encryption methods into the processing of a .ZIP file to provide a highly secure data container which provides flexibility in the use of symmetric and asymmetric encryption technology. The present invention adapts the well-established .ZIP file format to support higher levels of security and multiple methods of data encryption and key management, thereby producing a highly secure and flexible digital container for electronically storing and transferring confidential data.

Abstract: Methods and systems for facilitating communication between two or more autonomous system instances include the instantiation of a bridge between the autonomous system (AS) instances. The bridge includes multiple virtual routers each of which is connected using a Layer 2 and a Layer 3 connection to a respective one of the AS instances. For example, each router may be connected to a respective AS instance by each of a virtual local area network (VLAN) connection and a Border Gateway Protocol (BGP) session. To facilitate the BGP session, the bridge may be assigned an AS number (ASN) different than that of each of the AS instances and that is exchanged between the routers and the AS instances. Routing within the bridge may be facilitated by the exchange of interior gateway protocol (IGP) information between the virtual routers.

Abstract: A network system comprising a first network element and a second network element. The first network element is programmed to provide the step of first, communicating to the second network element a plurality of configuration parameter sets. Each configuration parameter set corresponds to a respective frame fragment and comprises a parameter value that differs in value from the parameter value in another configuration parameter set in the plurality of configuration parameter sets. The first network element also is programmed to provide the step of second, communicating a frame, to the second network element, in a plurality of frame fragments, wherein each frame fragment in the plurality of frame fragments is communicated according to a respective parameter value in the plurality of configuration parameter sets.

Abstract: Methods and systems are disclosed. The method comprises: designating a first plurality of links from a first stack segment to a second stack segment as a first etherchannel link; designating a second plurality of links from the first stack segment to a third stack segment as a second etherchannel link, where the second stack segment and the third stack segment are in communication with a fourth stack segment; designating the first etherchannel link and the second etherchannel link as members of a hierarchical etherchannel link; and sending a packet from the first stack segment to the fourth stack segment using the hierarchical etherchannel link.

Abstract: A streaming engine employed in a digital data processor specifies fixed first and second read only data streams. Corresponding stream address generator produces address of data elements of the two streams. Corresponding steam head registers stores data elements next to be supplied to functional units for use as operands. The two streams share two memory ports. A toggling preference of stream to port ensures fair allocation. The arbiters permit one stream to borrow the other's interface when the other interface is idle. Thus one stream may issue two memory requests, one from each memory port, if the other stream is idle. This spreads the bandwidth demand for each stream across both interfaces, ensuring neither interface becomes a bottleneck.

Abstract: Methods and apparatus for inserting local content of interest in an all digital content delivery network. In one embodiment, the content delivery network comprises a cable television or satellite network, and an RF channel thereof is separated or isolated from an incoming multiplex of all-digital content transmission. The separated RF channel is demodulated to provide a multiplexed transport stream, and packets corresponding to one or more programs from the transport stream are replaced with packets obtained from local compression and encoding of analog programming such as e.g., personal, educational and government (PEG) programming. The inserted programming may also contain closed captioning and emergency data alerts. The resulting encoded transport stream is then re-inserted into the multiplex, modulated, and put back onto the RF channel. In an alternate embodiment, space is reserved within the downstream multiplex so as to avoid having to remove an existing program stream.

Abstract: A method for performing aggregation at one or more layers starts with an AP placing at a first layer one or more received frames in a queue at the AP. When a transmit scheduler is ready to transmit an aggregated frame corresponding to the queue, the AP may iteratively select a plurality of frames selected from the one or more received frames, and aggregate at the first layer the plurality of frames into the aggregated frame. The number of frames included in an aggregated frame may be based on at least one of: a dynamically updated rate of transmission associated with a size of the frames, a class of the frames, a transmission opportunity value associated with the class of the frames and a total projected airtime for transmitting the aggregated frame. Other embodiments are also described.

Abstract: A satellite system may have a constellation of communications satellites. Satellite terminal equipment may be used to communicate with the satellite constellation. The satellite terminal equipment may have indoor and outdoor equipment that can communicate wirelessly. Power may be conveyed wirelessly between the indoor equipment and the outdoor equipment. The indoor equipment may include communications circuitry for supporting communications with electronic devices. The outdoor equipment may include satellite communications circuitry. The satellite communications circuitry may include antennas, satellite transceiver circuitry, and modems. Wireless communications between the indoor and outdoor equipment may be supported using radio-frequency wireless communications circuits or optical communications circuits.

Abstract: Systems and methods are described for a connection service that identifies routing paths for providing a data flow between a client computing device and a target computing device. A client computing device can send an API-based connection request to various servers hosting the connection service. The connection service processes the requests to determine a routing path for the connection. Advantageously, the connection service selects a routing path from a plurality of available routing paths if a client computing device is associated with a network address translator. The connection service may provide an externally addressable network address if it determines that no such address is available for routing of a data flow.

Abstract: Proxying Session Initiation Protocol (SIP) communications in a load balancing device. An outgoing SIP message is received from a session border controller device. The received outgoing SIP message comprises a routing control parameter in the form of a Uniform Resource Identifier (URI). The received outgoing message comprises one or more additional outgoing routing control parameters different to the URI. The one or more additional outgoing routing control parameters have been originated at the session border controller device to control one or more outgoing routing characteristics at the load balancing device. The one or more additional outgoing routing control parameters are extracted from the received outgoing SIP message. The outgoing SIP message is forwarded to a peer device using the one or more outgoing routing characteristics on the basis of the one or more extracted outgoing routing control parameters.

Abstract: Communication network architectures, systems and methods for supporting a network of mobile nodes. As a non-limiting example, various aspects of this disclosure provide communication network architectures, systems, and methods for supporting a dynamically configurable communication network comprising a complex array of both static and moving communication nodes (e.g., the Internet of moving things). More specifically, systems and methods for managing the routing and replication of data in the download direction in a network of moving things.

Abstract: Techniques for dynamic per subscriber policy enablement for security platforms within service provider network environments are disclosed. In some embodiments, a system/process/computer program product for dynamic per subscriber policy enablement for security platforms within service provider network environments includes monitoring network traffic on a service provider network at a security platform to identify a subscriber with a new IP flow; associating the subscriber with the new IP flow at the security platform; and determining a security policy to apply at the security platform to the new IP flow based on the subscriber.