Abstract: In cloud computing, for various reasons such as load-balancing, hotspot elimination, server consolidation, energy and cost savings, and system maintenance, there is a need to migrate a virtual sub-network of virtual entities from a source network of servers to a destination set of servers. Existing migration methods are limited to the migration of VM memory and controller states, where network entities are migrated individually. Embodiments of this disclosure include systems and methods for the stateful live migration of a multi-layer network, while maintaining live state convergence and consistency, and preventing network connection losses, packet disordering and packet drops.

Abstract: The present disclosure relates to securing workloads of a network by identifying compromised elements in communication with the network and preventing their access to network resources. In one aspect, a method includes monitoring network traffic at network elements of a network; detecting a compromised element in communication with one or more of the network elements, the compromised element being associated with at least one network threat; and based on a defined network policy, applying one of a number of different access prevention schemes to the compromised element to prevent access to the network by the compromised element.

Abstract: In an aspect of the disclosure, a method, a computer-readable medium, and an apparatus are provided that improve data packet exchange between a UE in an inactive mode and a network. In certain configurations, the apparatus may receive, from a user equipment (UE) in an active mode, a first packet including a first identifier associated with an anchor base station, a second identifier associated with a UE context, and a payload. The apparatus may identify the anchor base station based at least in part on one or more of the first identifier associated with the anchor base station or the second identifier associated with the UE context. The apparatus may transmit a second packet to the anchor base station. The second packet may include at least a portion of the first packet.

Abstract: In embodiments of systems and methods for managing acknowledgement packets in an uplink data packet stream including secure or encrypted data packets, a computing device may identify uplink acknowledgement (UL ACK) packets within the uplink data packet stream, and may accelerate processing of the identified UL ACK packets. In some embodiments, UL ACK packets may be identified based on whether packet lengths of packets meet a packet length threshold or meet a packet length range. In some embodiments, UL ACK packets may be identified based on information for identifying such packets receiving via a cross-layer application program interface (API). In some embodiments, UL ACK packets based whether packets include a specified differentiated services field codepoint (DSCP) in a packet header portion that is not encrypted.

Abstract: A method of propagating data packets in a network of nodes is disclosed. The method, implemented at one of the nodes, includes: collecting a set of first data packets during a first time period, the set including at least one data packet received from one or more first nodes in the network; obtaining a plurality of encoded data packets, each one of the plurality of encoded data packets being generated by combining two or more first data packets of the set using network coding; determining a mapping of the plurality of encoded data packets and the first data packets of the set to one or more neighbouring nodes connected to the node; and transmitting the plurality of encoded data packets and the first data packets of the set to the one or more neighbouring nodes according to the determined mapping.

Abstract: An ROP attack protection apparatus constituted of: a first region of memory having stored therein a protection function, the first region of memory set as executable; and a second region of memory having stored thereon a plurality of operation functions, the second region of memory set as non-executable, wherein the protection function is arranged to: responsive to a call to one of the plurality of operation functions and further responsive to at least one predetermined rule, allow execution of the called operation function; and after receiving a return from the executed operation function, set the executed operation function as non-executable.

Abstract: A method may include orienting a set of solar power units in a first position in which rows of solar power units are shaded by adjacent rows of solar power units; and monitoring energy generated by the set of solar power units over a window of time, that includes from when the set of solar power units are oriented in the first position until a sun angle corresponds to none of the rows being shaded by the adjacent rows. The method may include identifying a knee in energy generation during the first window of time, where the knee indicates a transition from higher to lower rates of change of energy generation at a given solar angle. The method may include plotting a trajectory of future orientation positions over time of the set of solar power units that include an orientation and time corresponding to the given solar angle.

Abstract: Residual data is obtained based on first and second representations of an image at a first level of quality. The second representation is based on a representation of the image at a second, lower level of quality. The residual data is useable by a decoder to reconstruct the first representation using the second representation. A configuration message comprising a header part and a payload part is generated and output for processing by the decoder. The payload part comprises obtained configuration data relating to processing of the residual data. The header part comprises: (i) a message type parameter specifying a configuration message type and indicating a given payload format of the payload part, a format size of a payload part having said payload format is predetermined or can be determined from the content of the payload part, and (ii) a payload size parameter specifying the actual size of the payload part.

Abstract: Systems and methods are provided for congestion notification in network communications, including multi-protocol label switching (MPLS) network communications. In one or more implementations, an MPLS node that receives a data packet and detects congestion may generate a cloned copy of the data packet, add congestion information, such as a congestion notification label and a congestion notification header, into the data packet, and forward the cloned copy with the congestion notification label and the congestion notification header to a next MPLS node. The next MLPS node may, responsive to receiving the cloned copy with the congestion information, provide one packet with the congestion information to a subsequent node, and another packet with the congestion information to the node from which the cloned copy was received.

Abstract: Techniques for using application network requirements and/or telemetry information from a first networking technology to enhance operation of a second networking technology and optimize wide area network traffic are described herein. The techniques may include establishing a communication network for use by applications of a scalable application service platform, the communication network including a first networking technology and a second networking technology. In this way, a request to establish a connection for use by an application may be received by the first networking technology. The request may include an indication of a threshold service level of the connection. In response to the request, the first networking technology may determine whether the second networking technology is capable of hosting the connection.

Abstract: Various embodiments of the present application set forth a computer-implemented method that includes receiving, by a trusted tunnel bridge and from a first application executing in a first network, a first encrypted data packet, where the first encrypted data packet includes an encrypted portion of data, and a destination device identifier (DDI). The method further includes determining, by the trusted tunnel bridge, a particular device in a second network and associated with the DDI included in the first encrypted data packet. The method further includes sending, by the trusted tunnel bridge directly to the particular device, the first encrypted data packet.

Abstract: A method for packet transmission in a network includes receiving, by a first node, a second segment identifier sent by the third node, receiving, by the first node, a packet sent by the second node through the first path, determining, by the first node, that a next-hop node of the first node on the first path is faulty, and in response to the determining, by the first node, that a next-hop node of the first node on the first path is faulty, adding, by the first node, the second segment identifier to the packet, and sending the packet to the third node through a second path, where the second path is established by the first node based on the second segment identifier.

Abstract: This disclosure describes techniques for diagnosing a presence or malfunction of a network node. In an example method, a first network node receives an indication of a diagnostic transmission originating from a second network node. The second network node further receives a forwarded transmission corresponding to the diagnostic transmission. The first network node diagnoses at least one of a presence or a malfunction of an intermediary node between the first network node and the second network node based on at least one of the indications of the diagnostic transmission or the forwarded transmission.

Abstract: A distributed resource may be mapped into a virtual network, where the resource is distributed across a large number of nodes that are uniquely addressable within the distributed resource service's address space. The resource can be represented using a relatively small number of private VIP addresses within the virtual network, while still enabling access to all of the nodes that are uniquely addressable within the address space of the distributed resource service. A resource map may be created that relates the distributed resource service's address space to the virtual network's address space. The resource map may be used by a gateway that facilitates access to a distributed resource by clients. The resource map may also be used to translate packets that are sent from clients within a virtual network into the distributed resource service's address space.

Abstract: In one embodiment, a Segment Routing network node provides efficiencies in processing and communicating Internet Protocol packets in a network. This Segment Routing node typically advertises (e.g., using Border Gateway Protocol) its Segment Routing processing capabilities, such as Penultimate Segment Pop (PSP) and/or Ultimate Segment Pop (USP) of a Segment Routing Header (including in the context of a packet that has multiple Segment Routing Headers). Subsequently, an Internet Protocol Segment Routing packet having multiple Segment Routing Headers is received. The packet is processed according to a Segment Routing function, with is processing including removing a first one of the Segment Routing Headers and forwarding the resultant Segment Routing packet. The value of the Segments Left field in the first Segment Routing Header identifies to perform PSP when the value is one, to perform USP when the value is zero, or to perform other processing.

Abstract: A method for transporting a Multi-Transport Network Context Identifier (MTNC-ID) over a Segment Routing Version 6 (SRV6) enabled data plane for fifth generation (5G) transport. The method includes setting an indicator in a flags field of a SRV6 header of a data packet that an MTNC-ID type-length-value (TLV) is included in a TLV field of the SRV6 header. The MTNC-ID TLV for the MTNC-ID is inserted in the TLV field of the SRV6 header of the data packet. The data packet with the SRV6 header containing the MTNC-ID is transmitted over the SRV6 enabled data plane to a next node along a forwarding path corresponding to the MTNC-ID.

Abstract: Example methods and systems to perform flow cache information update(s) for packet processing are described. In one example, a network element may configure flow cache information specifying a set of actions based on a sequence of stages that is executable during slow-path packet processing. The network element may configure dependency information specifying execution dependence or independence among the set of actions during fast-path packet processing. In response to detecting a configuration change associated with stage(s) from the sequence of stages, the network element may identify first action(s) affected by the configuration change and second action(s) not affected by the configuration change. This way, a granular update may be performed to the flow cache information by updating the at least one first action, but not the at least one second action.

Abstract: Metadata indicating that a virtual traffic hub enabling connectivity between a plurality of isolated networks has been established is stored. A determination is made that a first entry of a first isolated network attached to the hub is to be represented in a second routing table of a second isolated network attached to the hub, e.g., to enable network packets originating at resources of the second isolated network to be transmitted via the hub to the first isolated network. A new entry corresponding to the first entry is included in the second routing table.

Abstract: This application provides a traffic classification method and apparatus. The method includes: determining, based on distribution characteristics of concerned bits of a plurality of rules in a first rule set, an effective bit corresponding to the first rule set; determining a hash key value of each rule based on a value of the effective bit of each rule in the first rule set, and storing each rule in the first rule set in at least one of S storage units based on the hash key value, where the first rule set is any one of N rule sets, the N rule sets are stored in the S storage units; and when traffic classification is performed, searching for a corresponding rule in each of the S storage units based on a hash key value of a search key.

Abstract: A network interface controller (NIC) capable of performing message passing interface (MPI) list matching is provided. The NIC can include a host interface, a network interface, and a hardware list-processing engine (LPE). The host interface can couple the NIC to a host device. The network interface can couple the NIC to a network. During operation, the LPE can receive a match request and perform MPI list matching based on the received match request.

Abstract: The present disclosure provides a network packet transmission device and a network packet transmission method thereof. The network packet transmission method includes: receiving a network packet, wherein the network packet has at least one packet attribute; determining at least one destination VID for the network packet according to the at least one packet attribute; determining a transmission speed corresponding to the at least one destination VID based on at least one LAN speed table; and transmitting the network packet to a VLAN corresponding to the at least one destination VID according to the transmission speed.

Abstract: In some examples, high-speed hardware-based traffic analyzer integration with speed test control application may include receiving, from a speed test control application, speed test control instructions and data connection instructions to perform an upload and download high-speed test associated with network traffic for a network. The speed test control instructions and the data connection instructions may be forwarded to a speed test control server. A hardware-based traffic analyzer may perform, based on the speed test control instructions and the data connection instructions, the high-speed test associated with the network traffic for the network.

Abstract: In association with a virtual area, a first network connection is established with a first network node present in the virtual area and a second network connection is established with a second network node present in the virtual area. Based on stream routing instructions, a stream router is created between the first network node and the second network node. The stream router includes a directed graph of processing elements operable to receive network data, process the received network data, and output the processed network data. On the first network connection, an input data stream derived from output data generated by the first network node is received in association with the virtual area. The input data stream is processed through the stream router to produce an output data stream. On the second network connection, the output data stream is sent to the second network node.

Abstract: A network device includes a memory and a processor. The processor implements at least one classifier to provide classification for tunneled IPinIP traffic based on classification parameters provided by Internet Protocol Version 6 (IPv6) classification encoding, Internet Protocol Version 4 (IPv4) classification encoding, and Transport Control Protocol/User Datagram Protocol (TCP/UDP) classification encodings, wherein one of the IPv6 classification encoding and the IPv4 classification encoding is provided by extension information to provide extended classification capabilities. The processor uses the at least one classifier to compare the classification parameters provided by the IPv6 classification encoding, the IPv4 classification encoding, and the TCP/UDP classification encodings to fields in an IPv6 header, an IPv4 header, and a TCP/UDP header of the IPinIP packet. Based on the comparison, the processor maps the IPinIP packet to a service flow identified by the classification parameters.

Abstract: One embodiment of the invention is directed to a computer-implemented method comprising, receiving a first request that includes a token associated with a first computing device to utilize a shared resource implemented by a federated network of computing devices. The method further comprises identifying that the first computing device is an unknown entity based in part on the token and one or more signature used to sign the token. The method further comprises transmitting, to a trust management system, a second request to authenticate the first computing device using the token. The method further comprises, receiving an authentication message that verifies the first computing device within an open trust network. The authentication message may be generated in response to the trust management system communicating with a plurality of registrar computers in the open trust network about the signatures associated with the token.

Abstract: Methods and systems for improving the robustness of wireless communications. The methods and systems provided transmit data packets over a first isochronous stream and transmit one or more supplemental data packets over the same time intervals. The one or more supplemental data packets are used to re-create and/or enhance at least a portion of one or more data packets of the plurality of data packets that have already been sent. Alternatively, the one or more supplemental data packets are used to create and/or enhance at least a portion of one or more data packets of the plurality of data packets that will be received during the next isochronous intervals. The methods and system described herein allow for increased robustness by allowing for better retransmission with correctly received packets and the methods set forth herein work with any Bluetooth broadcaster sink without modification.

Abstract: A peripheral device may implement storage virtualization for non-volatile storage devices connected to the peripheral device. A host system connected to the peripheral device may host one or multiple virtual machines. The peripheral device may implement different virtual interfaces for the virtual machines or the host system that present a storage partition at a non-volatile storage device to the virtual machine or host system for storage. Access requests from the virtual machines or host system are directed to the respective virtual interface at the peripheral device. The peripheral device may perform data encryption or decryption, or may perform throttling of access requests. The peripheral device may generate and send physical access requests to perform the access requests received via the virtual interfaces to the non-volatile storage devices. Completion of the access requests may be indicated to the virtual machines via the virtual interfaces.

Abstract: A data transmission method for to a data center including a first site and a second site is disclosed. According to the data transmission method, after obtaining a first data packet sent by a virtual machine at the first site, a switch at the first site identifies a service type of the first data packet, and determines routing information of the first data packet based on the service type of the first data packet; and after determining the routing information, the switch sends the first data packet based on the routing information, where the routing information is used to indicate a bearer link for transmitting the first data packet, and a link through which the first data packet is transmitted to the second site is the bearer link. In this way, the first data packet may be transmitted through a link that corresponds to the service type of the first data packet.

Abstract: In one embodiment, a method by an apparatus of a Border Gateway Protocol (BGP) network includes accessing an attestation token for the apparatus. The method further includes encoding the attestation token in a BGP signaling message. The method further includes sending the BGP signaling message with the encoded attestation token to a second apparatus of the BGP network.

Abstract: Nodes within a network are configured to adapt to changing path states, due to congestion, node failures, and/or other factors. A node may selectively convey path information and/or other state information to another node by annotating the information into packets it receives from the other node. A node may selectively reflect these annotated packets back to the other node, or other nodes that subsequently receive these annotated packets may reflect them. A weighted cost multipathing selection technique is improved by dynamically adjusting weights of paths in response to feedback indicating the current state of the network topology, such as collected through these reflected packets. In an embodiment, certain packets that would have been dropped may instead be transformed into “special visibility” packets that may be stored and/or sent for analysis. In an embodiment, insight into the performance of a network device is enhanced through the use of programmable visibility engines.

Abstract: A data flow redirection method to overcome a disadvantage that a quantity of adjustable data flows is relatively small due to limited space of a flow specification forwarding table. The method includes receiving, by a network device, a control message sent by a control device, where the control message carries redirection routing information of a data flow and a redirection routing indication, the redirection routing indication instructing to convert the redirection routing information of the data flow into a forwarding entry in a target forwarding table, and tablespace of the target forwarding table is greater than tablespace of a flow specification forwarding table of the network device, and converting, by the network device, the redirection routing information of the data flow into the forwarding entry in the target forwarding table according to the redirection routing indication.

Abstract: A vehicle includes at least one output device; an input device configured to receive at least one in-vehicle input from a user; a communication device configured to receive an operation authentication message including an operation request message, an encryption key, and priority setting information from an external server; and a controller configured to generate a new operation request signal corresponding to the operation request message when the encryption key is identical to an encryption key of the vehicle stored in advance, determine priority between the new operation request signal and at least one existing operation request signal corresponding to the at least one in-vehicle input based on the priority setting information, and control an output device corresponding to a target operation to perform the target operation based on the priority.

Abstract: An optical communication network includes a primary laser source, a first comb generator, and a first transceiver. The first comb generate a first plurality of comb tones having constant frequency spacing. The first transceiver includes a first transmitter having a secondary laser with a resonator frequency injection locked to a frequency of a single longitudinal mode corresponding to a particular comb tone of the first plurality of comb tones. The first transmitter adheres input data onto the injection locked frequency, and outputs a modulated data stream over an optical transport to a second transceiver downstream of the first transceiver. The improvement includes a second comb generator disposed downstream of, receives a seed tone from, and is phase-synchronized with, the first comb generator. The second comb generator outputs a second plurality of comb tones substantially conforming to the frequencies and frequency spacing of the first plurality of comb tones.

Abstract: In some examples, a system arranges data in a plurality of nodes in a tree structure, where a given node of the plurality of nodes is associated with a probabilistic data structure that provides a probabilistic indication of whether data is present in the given node. The system determines, for reads of the given node, a false positive measure of false positives indicated by the probabilistic data structure, and prioritizes a compaction of the given node based on the determined false positive measure.

Abstract: Systems and techniques are provided for obscured routing. A computing device may send stacks of identifiers to neighbor computing devices in a network. Each stack of identifiers may include a unique identifier for the neighbor computing device to which it is sent. The computing device may send a notification identifying a destination computing device to the neighbor computing devices. The computing device may receive stacks of identifiers from the neighbor computing devices. The received stacks of identifiers may include completed routes to the destination computing device. Each completed route may be specified by unique identifiers added to the stack of identifiers by computing devices in the network. A unique identifier in each stack of identifiers may not be resolvable to an address by the computing device. The computing device may send a message a neighbor computing device based on a unique identifier in a chosen stack of identifiers.

Abstract: Various example embodiments for supporting scalability of label switched paths (LSPs) in a label switching network are presented herein. Various example embodiments for supporting scalability of LSPs in a label switching network may be configured to support scalability of LSPs in a Multiprotocol Label Switching (MPLS) network. Various example embodiments for supporting scalability of LSPs in an MPLS network may be configured to support scalability of LSPs of various FEC types. Various example embodiments for supporting scalability of LSPs in an MPLS network may be configured to support scalability of Prefix FEC based LSPs spanning across multiple routing domains. Various example embodiments for supporting scalability of LSPs in an MPLS network may be configured to support scalability of LSPs for various FEC types that enable aggregation of ranges of FECs by aggregate FECs.

Abstract: For end-to-end encryption of a virtual cloud network, a VPN tunnel from a customer device is terminated at a host network headend device using encryption keys secured in hardware and managed by the customer. The network headend device can be a card in a bare-metal server with one or more network virtualization devices. The network headend device is configured to receive a first key provisioned by a customer; receive a first data packet sent from a device of the customer; and decrypt the first data packet using the first key to obtain information. A network virtualization device is configured to receive the information from the network headend device; ascertain that the information is to be sent to a virtual machine in a virtual cloud network; ascertain that data in the virtual cloud network is configured to be encrypted; and encrypt the information with a second key to generate a second data packet before routing the second data packet to the virtual machine.

Abstract: Provided herein are systems and methods for providing insights or metrics in connection with provisioning applications and/or desktop sessions to end-users. Network devices (e.g., appliances, intermediary devices, gateways, proxy devices or middle-boxes) can gather insights such as network-level statistics. Additional insights (e.g., metadata and metrics) associated with virtual applications and virtual desktops can be gathered to provide administrators with comprehensive end-to-end real-time and/or historical reports of performance and end-user experience (UX) insights. Insights relating to an application or desktop session can be used to determine and/or improve the overall health of the infrastructure of the session, Citrix Virtual Apps and Desktops, the applications (e.g., remote desktop application) being delivered using the infrastructure, and/or the corresponding user experience.

Abstract: Techniques and systems for notifying a client device regarding a server device that is at least partially out of service are disclosed. An example process may include determining that a server device, such as a PGW or a SMF, is at least partially out of service, setting a flag to a value indicative of the server device being at least partially out of service, determining that a client device, such as a PCRF or a PCF, sent a message to the server device, and sending, to the client device, in response to the determining that the client device sent the message to the server device, and based at least in part on the value of the flag, a notification indicating that the server device is at least partially out of service. In this way, the client device can take appropriate action based on the out-of-service condition of the server device.

Abstract: Systems, methods, and computer-readable media for elastic policy scaling in multi-cloud fabrics. A method can involve deploying a cluster of policy agents on a hub virtual private cloud (VPC) that interconnects spoke VPCs in a cloud associated with a multi-cloud fabric, and mapping endpoints in the spoke VPCs to the policy agents. The method can involve distributing groups of policies for the endpoints across the policy agents based on the mapping of endpoints to policy agents, and advertising, by each policy agent to a respective first set of virtual gateways in the spoke VPCs, routes associated with endpoints mapped to the policy agent and preventing the policy agent from advertising routes associated with a second set of virtual gateways in the spoke VPCs. The method can involve applying, via the policy agent, a group of policies on the policy agent to traffic received by the policy agent.

Abstract: A display module includes: a module substrate; a plurality of pixels provided on the module substrate; and a plurality of micro-pixel controllers provided in spaces between the plurality of pixels and configured to supply a drive current to at least two pixels among the plurality of pixels, where each micro-pixel controller of the plurality of micro-pixel controllers includes a pixel circuit configured to, based on a first voltage and a second voltage being applied to the micro-pixel controller, control an amplitude of the drive current based on the first voltage and control a pulse width of the drive current based on the second voltage, and, based on the display module being in a power saving mode, the first voltage is adjusted to decrease a brightness of a pixel in a specified region, among the plurality of pixels.

Abstract: A BIERv6 packet forwarding method, device, and system. The method includes: receiving, by a first network device, a BIERv6 packet, where the first network device is a BFR or a BFER; determining, by the first network device, whether a value of a hop limit field in the BIERv6 packet is less than or equal to a preset threshold of the first network device, where the preset threshold is a value greater than or equal to 2, and is determined based on a quantity of one or more consecutive second network devices connected to the first network device, and the second network device is a device that does not support BIER forwarding; and when the value of the hop limit field in the BIERv6 packet is less than or equal to the preset threshold, avoiding, by the first network device, forwarding the BIERv6 packet.

Abstract: Methods are provided for decentralized key negotiation. One method includes initiating, by a first Internet Key Exchange (IKE) node from among a plurality of IKE nodes, a rekeying process for an Internet Protocol Security (IPSec) communication session established with a client device and serviced by a second IKE node from among the plurality of IKE nodes, and in which a first encryption key is used to encrypt traffic. The method further includes obtaining, by the first IKE node from a key value store, information about the IPSec communication session and performing, by the first IKE node, at least a part of the rekeying process in which the first encryption key is replaced with a second encryption key for the IPSec communication session.

Abstract: A method for handover between base stations of an access system for access to a core network including interconnections in a tree structure having wireless links and a single wired link. The wired link connects only one of the base stations, known as a donor node, to the core network. The interconnections between the base stations are solely wireless links. The method includes: transmitting, by a source base station of the access system, to which a terminal is attached, a handover request to a target base station of the access system, the source and target base stations being interconnected via at least one base station known as a decision-making node, which is different from the donor node; intercepting the handover request by the decision-making node; transmitting, by the decision-making node, an agreement message to the source base station; and transmitting a handover trigger message to the target base station.

Abstract: The technology disclosed herein enables a dynamic chain of service functions for processing network traffic. In a particular embodiment, a method includes, in a logical router for a logical network connecting service functions, receiving a network packet from a service function over the logical network after the network packet has been processed by the service function. The method further includes determining a new classification of the network packet and determining a next service function based on application of a service chain policy to the new classification. The method also includes directing the network packet to the next service function over the logical network.

Abstract: A data processing system may include a plurality of host servers, each server including a device processor and a non-transitory computer readable medium including instructions stored thereon and executable by the processor, wherein the computer readable medium of each server includes instructions for running one or more virtual machines. In addition, the system may include a system controller including a device processor and a non-transitory computer readable medium including instructions stored thereon and executable by the processor, the computer readable medium of the system controller including instructions for receiving commands to host two or more virtual machines on the plurality of host servers; making a determination as to which of the virtual machines share commonalities with one another; and based on the determination, providing instructions to the plurality of host servers to host virtual machines determined to share one or more commonalities with one another on the same host server.

Abstract: A method for communicating between a first network and a second network is described. The method includes receiving, by a network device via a persistent control channel established between the network device and a server device connected to a first network, a first message that includes: (1) information indicating a tunneling protocol, and (2) information associated with a first tunneling payload. The persistent control channel is for communicating: (1) messages including control information, and (2) messages including tunneling payloads. The method also includes transmitting, by the network device to an endpoint device connected to a second network, a second message including the information associated with the first tunneling payload.

Abstract: A region-based electrical intelligence system is used to configure and control electrical usage within regions, for example, within certain areas of a floor of a building or within certain floors of a building. A number of network-enabled electric plugs are deployed in a region. Each of the network-enabled electric plugs is configured to deliver electricity from an electricity source to one or more powered devices located in the region. A server runs a web application used to monitor electrical usage information for the region based on electrical usage by each of the one or more powered devices. The web application generates rules for selectively controlling the delivery of electricity from the network-enabled electric plugs to the powered devices based on the monitored electrical usage information.

Abstract: In some embodiments, a method sets a threshold for utilization of a first table, wherein the utilization is based on layer 3 addresses and layer 2 addresses being stored in the first table. When a utilization of the first table does not meet the threshold, the method stores a layer 3 address in the first table. The first table uses a first type of lookup to determine a next hop address for the layer 3 addresses or the layer 2 addresses, and the first table also stores one or more layer 2 addresses. When the utilization of the first table meets the threshold, the method stores the layer 3 address in a second table where the second table uses a second type of lookup to determine the next hop address for layer 3 addresses.

Abstract: A security context obtaining method includes: a first access and mobility management function (AMF) receiving a first registration request message sent by a user equipment (UE) and validating integrity protection for the first registration request message; if the first AMF successfully validates integrity protection for the first registration request message, sending, by the first AMF, a second request message to a second AMF; the second AMF receiving the second request message; and if the second request message carries indication information and the indication information is used to indicate that the UE is validated, sending, by the second AMF, a security context of the UE to the first AMF.