Abstract: A method for aggregating and regulating messages in a network that has a plurality of pairs of nodes and two transmitting/receiving devices communicating via a bidirectional channel. The method is implemented by each of the transmitting/receiving devices. Each received message may be segmented into packets of a predefined size, and each packet may be allocated to a queue that depends on the origin, the destination, and the priority of the message. One or more frames may then be created, and packets of the queues may be inserted into the frames. Frames may then be sent via the bidirectional channel over a predefined time interval, the number of frames sent over the time interval being dependent on the maximum throughput of the channel and on the useful throughput in each of the transport directions of the channel.

Abstract: Techniques are described to provide for the ability to combine policies in a manner that utilized policy purposes to generate a combined policy. In one example, a method includes obtaining, at a network entity of a network, a plurality of policies, wherein each policy is associated with a policy purpose defined by a policy originator; combining the plurality of policies by the network entity to generate a combined policy, wherein the combining is performed based on a ranking of policy purposes; and enforcing the combined policy at one or more policy enforcement entities of the network for one or more packet flows communicated between a client and the network.

Abstract: Systems, apparatuses, methods, and one or more computer-readable media storing executable instructions for registering a multi-port device are described. A computing device may receive a registration request from a user device supporting multiple ports. In response, the computing device may send to the user device a message including a plurality of telephone numbers and information of associated ports.

Abstract: A method for obtaining segment routing over Internet Protocol version 6 data plane (SRv6) tunnel information of Internet Protocol version 6 segment routing, including sending, by a first network device, a request packet to a second network device, where the request packet is used to request to detect reachability of an SRv6 tunnel and obtain SRv6 tunnel information of the second network device, and the second network device is a network device on the SRv6 tunnel, receiving, by the first network device, a response packet from the second network device, where the response packet includes the SRv6 tunnel information of the second network device, and obtaining, by the first network device, the SRv6 tunnel information of the second network device based on the response packet.

Abstract: Techniques for designing and implementing networks-on-chip (NoCs) are provided. For example, a computer-implemented method for programming a network-on-chip (NoC) onto an integrated circuit includes determining a first portion of a plurality of registers to potentially be included in a NoC design, determining routing information regarding datapaths between registers of the first portion of the plurality of registers, and determining an expected performance associated with the first portion of the plurality of registers. The method also includes determining whether the expected performance is within a threshold range, including the first portion of the plurality of registers and the datapaths in the NoC design after determining that the expected performance is within the threshold range, and generating instructions configured to cause circuitry corresponding to the NoC design to be implemented on the integrated circuit.

Abstract: Methods and apparatus are disclosed for configuring one or more processors to implement service function chains comprising one or more virtualised service functions. A method according to one aspect, performed by a processing module (330) implemented on one or more processors (30), involves steps being performed in respect of at least one new virtualised service function (33) to be included in a service function chain of: determining a position in the service function chain at which the new virtualised service function (33) is to be included; allocating at least one internal address to the new virtualised service function, the at least one internal address being an address to be usable by a switching processor (34); and providing to the switching processor (34) an indication of the at least one internal address allocated to the new virtualised service function (33).

Abstract: Systems and techniques are provided for obscured routing. A computing device may send stacks of identifiers to neighbor computing devices in a network. Each stack of identifiers may include a unique identifier for the neighbor computing device to which it is sent. The computing device may send a notification identifying a destination computing device to the neighbor computing devices. The computing device may receive stacks of identifiers from the neighbor computing devices. The received stacks of identifiers may include completed routes to the destination computing device. Each completed route may be specified by unique identifiers added to the stack of identifiers by computing devices in the network. A unique identifier in each stack of identifiers may not be resolvable to an address by the computing device. The computing device may send a message a neighbor computing device based on a unique identifier in a chosen stack of identifiers.

Abstract: The disclosed systems and methods for encoding, by a polar encoder, K message bits into an encoded message bits sequence C(M) using polar codes, where K and M are integer values and M is greater than or equal to K; rearranging, by an interleaver, the encoded message bits sequence C(M) to rearranged encoded message bits sequence C?(M) such that a C(i)th bit and a C ? ( M 2 + i ) th bit of the encoded message bits sequence C(M) are arranged together, where i is an integer value that varies between 1 to M 2 ; mapping, by a bits-to-symbol mapper, the rearranged encoded message bits sequence C(M) to N non-binary symbols, where N is an integer value; and processing, by a transmitter symbol processor, the N non-binary symbols to transmit the processed non-binary symbols towards a receiver.

Abstract: A data processing device is described including one or more processors implementing a plurality of data processing entities, one or more software interrupt nodes and an access register for each software interrupt node. The access register specifies which one or more data processing entities of the plurality of data processing entities is/are each allowed to, as interrupt source data processing entity, trigger an interrupt service request on the software interrupt node for another one of the plurality of data processing entities as an interrupt target processing entity. Each software interrupt node is configured to forward an interrupt service request triggered by an interrupt source data processing entity which is allowed to trigger an interrupt service request on the software interrupt node to an interrupt target processing entity.

Abstract: Exemplary embodiments include methods and/or procedures for handling messages from one or more data-plane nodes (DPNs) to a plurality of controller nodes configured in a cluster, comprising: receiving a message from a DPN; tagging the message with an incarnation identifier (IID) associated with the DPN; and performing HD handling of the tagged message, which includes comparing a value of the IID of the tagged message with a value of a global IID associated with the DPN, discarding the tagged message if the value of the IID of the tagged message is less than the value of the global IID, and processing the tagged message if the value of the IID of the tagged message is not less than the value of the global IID. Exemplary embodiments also include controller nodes, controller clusters, and computer-readable media embodying operations of the exemplary methods and/or procedures.

Abstract: Mirrored volatile memory in a storage system is configured with a dual cast region of addresses. Buffers in the dual cast region are allocated for data associated with a received Write IO. A host IO device associates the dual cast addresses with the data. A switch or CPU complex recognizes the dual cast addresses associated with the data and, in response, creates and sends a first copy of the data to a first volatile memory mirror and creates and sends a second copy of the data to a second volatile memory mirror. The second copy may be sent via PCIe NTB between switches or CPU complexes.

Abstract: Semantic feature values of notification messages in different applications are obtained, and notification messages that are in different applications and whose semantic feature values match are associated. This associates notification messages that are of associated events of a mobile terminal and that are from different channels (for example, different applications). A user can view notification messages that are of associated events and that are from different channels.

Abstract: A computer-implemented method for deploying an application between an on-premise server and an off-premise server includes identifying a plurality of nodes in a flow of an application deployed on the on-premise server. The computer-implemented method further includes splitting the flow at the plurality of nodes to form a plurality of sub-flows of the application. The computer-implemented method further includes routing a flow execution workload of the application to the plurality of sub-flows of the application.

Abstract: A system for intelligent data transfer is provided. The system is configured to: collect sensor data from a plurality of user devices, the plurality of user devices being connected to a device gateway in an edge layer of the network; combine the collected sensor data with contextual data stored in a contextual device database, wherein the contextual data comprises device usage data and user data; generate a data transfer rule set for governing data transfer from the plurality of user devices over the network based on the combined data; calculate a data configuration flow for the plurality of user devices based on the data transfer rule set; and execute the data configuration flow to control a flow of the sensor data transferred from the device gateway to an application server in a platform layer.

Abstract: The disclosed embodiments relate to regulation of a rate of incoming orders by buffering or otherwise batching orders together as they are received and subsequently forwarding batches of orders to a match engine for processing thereby in a manner which may equalize orders from traders having varying abilities to rapid submit orders or otherwise capitalize on market events. The disclosed embodiments further relate to prioritizing the matching of resting orders against an incoming order. In particular, the disclosed embodiments alter the priority of a given resting order to match against an incoming order, relative to other suitably matching resting orders, as a function of how long the orders have been resting on the order book.

Abstract: A cache and memory coherent system includes multiple processing chips each hosting a different subset of a shared memory space and one or more routing tables defining access routes between logical addresses of the shared memory space and endpoints that each correspond to a select one of the multiple processing chips. The system further includes a coherent mesh fabric that physically couples together each pair of the multiple processing chips, the coherent mesh fabric being configured to execute routing logic for updating the one or more routing tables responsive to identification of a first processing chip of the multiple processing chips hosting a defective hardware component, the update to the routing tables being effective to remove all access routes having endpoints corresponding to the first processing chip.

Abstract: In one illustrative example, network fabric policy data associated with an application, subscriber, and/or device may be received. Mobile network policy data that corresponds to the received network fabric policy data may be selected, based on stored policy mappings between a set of network fabric policy profiles of a fabric network and a set of mobile network policy profiles of a mobile network. A bearer or Quality of Service (QoS) flow of the mobile network may be established in satisfaction of the selected mobile network policy data. In addition, a packet filter of a traffic flow template (TFT) or a packet detection rule (PDR) may be generated and applied in order to direct IP traffic flows associated with the application to the established bearer or QoS flow for communication in the mobile network.

Abstract: A Self-Describing Packet block (SDPB) is defined that allows concurrent processing of various fixed headers in a packet block defined to take advantage of multiple cores in a networking node forwarding path architecture. SPDB allows concurrent processing of various pieces of header data, metadata, and conditional commands carried in the same data packet by checking a serialization flag set upon creation of the data packet, without needing to serialize the processing or even parsing of the packet. When one or h more commands in one or more sub-blocks may be processed concurrently, the one or more commands are distributed to multiple processing resources for processing the commands in parallel. This architecture allows multiple unique functionalities each with their own separate outcome (execution of commands, doing service chaining, performing telemetry, allows virtualization and path steering) to be performed concurrently with simplified packet architecture without incurring additional encapsulation overhead.

Abstract: Technologies for providing I/O channel abstraction for accelerator device kernels include an accelerator device comprising circuitry to obtain availability data indicative of an availability of one or more accelerator device kernels in a system, including one or more physical communication paths to each accelerator device kernel. The circuitry is also configured to determine whether to establish a logical communication path between a kernel of the present accelerator device and another accelerator device kernel and establish, in response to a determination to establish the logical communication path as a function of the obtained availability data, the logical communication path between the kernel of the present accelerator device and the other accelerator device kernel.

Abstract: A communication method in which access network devices belonging to a same network instance have different network addresses, where the method includes uniquely identifying an access network device based on a network address of the access network device and a first network instance identifier to which the access network device belongs, and determining a packet forwarding rule for sending a packet to the access network device. In this way, the packet can be accurately routed.

Abstract: One or more computing devices, systems, and/or methods for monitoring levels of activity of client devices using a cluster of servers having a decentralized network architecture are provided, where over-counting, which may be caused by an uneven distribution of requests transmitted by the client devices to the cluster of servers, may be mitigated. For example, a request may be received by a first server, of the cluster of servers, from a client device. A first counter value associated with a level of activity of the client device may be incremented by a first number. One or more data packets may be transmitted to one or more servers of the cluster of servers. Each data packet of the one or more data packets may comprise an instruction to increment a counter value associated with the client device by a second number, which may be different than the first number.

Abstract: A method and an apparatus for controlling a network traffic path are provided. The method includes: receiving routing advertisement information from a first network to a second network; determining all routing nodes included in a path through which data pass when flowing from the second network to the first network according to the routing advertisement information; and configuring a next hop routing node for each determined routing node, where the next hop routing node is a node in all the routing nodes included in the path and is adjacent to the routing node for which the next hop routing node is configured, and the routing node for which the next hop routing node is configured does not include a routing node of the first network or a routing node of the second network.

Abstract: Various aspects of the present disclosure generally relate to wired and/or wireless communication. In some aspects, a device may receive a plurality of data packets at a modem of the device. The device may group, at the modem of the device, payloads of a first subset of the plurality of data packets into a container. The device may transfer, to a processor of the device and using the modem, the container via a first interface channel. The device may transfer, to the processor and using the modem, a second subset of the plurality of data packets via a second interface channel. Numerous other aspects are provided.

Abstract: Some embodiments provide a set of one or more network controllers that communicates with a wide range of devices, ranging from switches to appliances such as firewalls, load balancers, etc. The set of network controllers communicates with such devices to connect them to its managed virtual networks. The set of network controllers can define each virtual network through software switches and/or software appliances. To extend the control beyond software network elements, some embodiments implement a database server on each dedicated hardware. The set of network controllers accesses the database server to send management data. The hardware then translates the management data to connect to a managed virtual network.

Abstract: Embodiments of this application disclose a method for discovering a forwarding path and a related device thereof, to discover a forwarding path. The method includes: receiving, by a first device, a packet that is sent by a second device and that is used to discover a forwarding path; searching, by the first device based on a first forwarding entry of a data plane, for forwarding information used to forward the packet; and sending, by the first device, path information to the second device based on a second forwarding entry of an autonomic control plane virtual routing and forwarding (ACP VRF) instance, where the first forwarding entry and the second forwarding entry are isolated from each other. In the embodiments, the first forwarding entry and the second forwarding entry are isolated from each other, and returning of the path information is not affected by a data plane fault.

Abstract: It is disclosed a method for managing a PDU session in a wireless communication system and an apparatus for supporting the same. Particularly, a method for performing handover of a User Equipment (UE) performed by a source Radio Access Network (RAN) that includes a processor, a memory and a communication module in a wireless communication system may include determining to initiate handover to a target RAN; and transmitting a Handover Required message to a source Access and Mobility Management Function (AMF), and the handover is a handover in a case that there is no interface between the RANs or AMF change is required, and the Handover Required message includes a PDU session Identifier (ID) of an activated Protocol Data Unit (PDU) session.

Abstract: A data processing system may store a data set at a plurality of data centers. The data centers and hosts within the data centers may, for example, be organized according to a multi-tiered ring arrangement. A hashing arrangement may be used to implement the ring arrangement to select the data centers and hosts where the writing and reading of the data sets occurs. Version histories may also be written and read a the hosts and may be used to evaluate causal relationships between the data sets after the reading occurs.

Abstract: Some embodiments establish for an entity a virtual network over several public clouds of several public cloud providers and/or in several regions. In some embodiments, the virtual network is an overlay network that spans across several public clouds to interconnect one or more private networks (e.g., networks within branches, divisions, departments of the entity or their associated datacenters), mobile users, and SaaS (Software as a Service) provider machines, and other web applications of the entity. The virtual network in some embodiments can be configured to optimize the routing of the entity's data messages to their destinations for best end-to-end performance, reliability and security, while trying to minimize the routing of this traffic through the Internet. Also, the virtual network in some embodiments can be configured to optimize the layer 4 processing of the data message flows passing through the network.

Abstract: To realize a low power consumption and a small area of a network communication system and a semiconductor device for mounting the same. In the processing method of the network router or network communication frame, the received frame is input to the hash generator, to obtain an address based on the resulting hash value, the position of the address in the rule table, stores the rule corresponding to the received frame.

Abstract: Presented are systems and methods for automatically creating and labeling training data for training-based radio, comprising receiving, at a receiver, a frame that comprises a modulated radio frequency (RF) signal comprising a set of waveforms that correspond to payload data. The payload data comprises a sequence of random bits. In embodiments, until a stopping condition is met one or more steps are performed, comprising detecting the frame; demodulating the modulated RF signal to reconstruct the sequence of random bits; using the reconstructed sequence to determine whether the payload data has been correctly received; in response to determining that the payload data has not been correctly received, discarding it and, otherwise, accepting the sequence of random bits as a training label; associating the training label with the modulated RF signal to generate labeled training data; and appending the labeled training data to a labeled training data set.

Abstract: Methods and systems are disclosed. The method comprises: designating a first plurality of links from a first stack segment to a second stack segment as a first etherchannel link; designating a second plurality of links from the first stack segment to a third stack segment as a second etherchannel link, where the second stack segment and the third stack segment are in communication with a fourth stack segment; designating the first etherchannel link and the second etherchannel link as members of a hierarchical etherchannel link; and sending a packet from the first stack segment to the fourth stack segment using the hierarchical etherchannel link.

Abstract: A wireless device receives, from a base station, a radio resource control message comprising at least one packet data convergence protocol (PDCP) configuration parameter indicating Ethernet header compression for a data radio bearer. The wireless device receives, from the base station and based on the at least one PDCP configuration parameter, mapping information between: a source medium access control (MAC) address and a destination MAC address; and a corresponding header compression index. The wireless device receives a compressed Ethernet packet: compressed based on the mapping information; and comprising the corresponding header compression index.

Abstract: An end-user computing device may utilize an imaging device to capture input from an electronic tag of a physical asset. The end-user computing device may generate supplemental digital data associated with the input. The end-user computing device may transmit the input and the supplemental digital data to an authentication and digital assets server. The authentication and digital assets server may authenticate the physical asset and transmit the authentication results to the end-user computing device, which may display the authentication results. If the authentication of the physical asset is successful, the authentication and digital assets server may select one or more digital assets and transmit the one or more digital assets to the end-user computing device. The end-user computing device may display the one or more digital assets.

Abstract: An example method is provided in one example embodiment and may include receiving traffic associated with at least one of a mobile network and a Gi-Local Area Network (data-plane), wherein the traffic comprises one or more packets; determining a classification of the traffic to a service chain, wherein the service chain comprises one or more service functions associated at least one of one or more mobile network services and one or more data-plane services; routing the traffic through the service chain; and routing the traffic to a network using one of a plurality of egress interfaces, wherein each egress interface of the plurality of egress interfaces is associated with at least one of the one or more mobile network services and the one or more data-plane services.

Abstract: A service processing method and a network device, where the network device includes a network processor (NP) and a central processing unit (CPU). The NP is configured to receive a first packet, obtain a packet feature of the first packet, obtain a processing rule corresponding to the packet feature, process the first packet based on the processing rule, to obtain a second packet, and send the second packet to the CPU. The CPU is configured to receive the second packet, and process the second packet. Before the CPU processes the first packet, the NP processes the first packet, and sends the second packet obtained after processing to the CPU.

Abstract: A traffic flow based map cache refresh may be provided. A computing device may receive a dropped packet message when a packet associated with a flow having a destination and a source was dropped before it reached the destination. Next, in response to receiving the dropped packet message, a map request message may be sent to a Map Server (MS). In response to sending the map request message, a map response message may be received indicating an updated destination for the flow. A map cache may then be refreshed for the source of the flow based on the updated destination from the received map response message.

Abstract: A network device includes at least one communication ingress port, ingress packet processing circuitry and a packet-action cache memory (PACM). The at least one communication ingress port is configured to receive packets including packet headers from a network. The ingress packet processing circuitry is configured to receive the packets and to process the packets in accordance with respective packet actions specified for the packets. The PACM is configured to store one or more of the packet actions in association with one or more respective fingerprints which are calculated over the packet headers of the corresponding packets, for use by the ingress packet processing circuitry. The fingerprints are smaller than the corresponding packet headers.

Abstract: Techniques for reducing network congestion are disclosed. In one embodiment, a method is disclosed comprising receiving, by a computing device, a packet from a sender over a network; retrieving, by the computing device, congestion information; inserting, by the computing device, congestion data representing the congestion information into a header option of the packet to generate an augmented packet; transmitting, by the computing device, the augmented packet to a receiver; receiving, by the computing device, a response packet, the response packet including the congestion data; and transmitting, by the computing device, the response packet to the sender.

Abstract: A network load balancing apparatus has a data buffer for each communication path of a received packet's transfer destinations, calculates a first hash value using a field value contained in the packet, determines, based on the field value of the packet or the first hash value, a communication path of a transfer destination of the packet subject to external transfer control for transmission to a predetermined external server, determines, based on the first hash value, a communication path of a transfer destination of the packet to be subject to priority control, determines, based on a second hash value based on the first hash value, a communication path of a transfer destination of the packet to be subject to load balancing control, to match a preset load balancing situation of the data buffer, and transmits the packet to a data buffer corresponding to the communication path of the transfer destination.

Abstract: Techniques are disclosed relating to enhancing communication of network traffic. In various embodiments, a computer system receives topology information and traffic information. The topology information describes resources of a network that are usable to communicate a plurality of streams among nodes in the network and includes information about a first path and a second path connecting two nodes. Traffic information describes demands for communicating the plurality of streams and indicates demands for communicating a first stream and a second stream between the two nodes. In such an embodiment, the computer system determines, using the topology information and the traffic information, a network schedule that indicates that the first stream is to be communicated over the first path and that the second stream is to be communicated over the second path.

Abstract: Systems, methods and computer software are disclosed for providing network address translation with a tunnel identifier (TEID) in a cellular network. A HetNet Gateway (HNG) allocates at least a portion of a unique TEID for a user equipment (UE). The HNG receives a packet having a source field in the packet header including an Internet Protocol (IP) address. The HNG replaces the IP address in a source field of the packet header of the packet with the unique TEID for the UE and forwards the packet using the unique TEID to a packet gateway (PGW).

Abstract: A method for transmitting broadcast signals, includes encapsulating input packets including Internet Protocol (IP) packets or Transport Stream (TS) packets into link layer packets in a link layer, each header of the link layer packets including packet type information representing a type of the input packets in a payload of each link layer packet and payload configuration information representing a configuration of the payload of each link layer packet, wherein for a first link layer packet including a single packet, the payload configuration information of the header in the first link layer packet has a value representing that the first link layer packet carries the single packet, the header further includes header mode information representing a length related to the first link layer packet.

Abstract: A first edge server of multiple edge servers of a distributed edge computing network receives a request from a client device regarding a resource hosted at an origin server according to an anycast implementation. The first edge server modifies the request to include identifying information for the first edge server prior to sending the request to the origin server. The origin server responds with a response packet that includes the identifying information of the first edge server. Instead of routing the response packet to the client device directly, one of the multiple edge servers receives the response packet due to the edge servers each having the same anycast address. If the edge server that receives the response packet is not the first edge server, that edge server transmits the response packet to the first edge server, who processes the response packet and transmits the response packet to the client device.

Abstract: A method and system for classifying data packet fields are disclosed. They associate a final tag to each of the fields in a data packet in relation to a set of classifying rules, and involve building a decision tree using a recursive algorithm to apply the set of classifying rules on the data packet fields, mapping each node of the built decision tree respectively to a processing element of a FPGA, each processing element comprising a processor and a memory, pipelining all mapped processing elements, and processing the data packet fields through the pipelined and mapped processing elements.

Abstract: Systems and methods of vertical auto-scaling a networking stack by adjusting the number of packet engines executing on a device are provided. A device intermediary to clients and servers executes first packet engines to process network traffic of a first set of connections. The device determines to adjust the number of packet engines executing on the device based on trigger parameters. The device activates second packet engines to process network traffic for a second set of connections. The device mirrors the network traffic from the first and second set of connections. The first packet engines reject the traffic from the second connections, and the second packet engines reject the traffic from the first connections. The device deactivates the first packet engines when the first connections timeout.

Abstract: Techniques are described for providing end-to-end segment routing paths across metropolitan area networks. For example, a method comprises receiving, by an area border router (ABR) connected to one or more metropolitan area networks and a core network, a packet including a segment routing label stack including at least a label of the ABR, a context label associated with a routing instance of the ABR, and a subsequent label identifying a device in the segment routing path, determining, from a lookup of the context label in the metro routing table, a table next hop to the core routing table (or metro routing table); in response to determining the table next hop, determining, from a lookup of the subsequent label in the core routing table (or metro routing table), a next hop in the segment routing path; and sending, by the ABR, the packet toward the device in the segment routing path.

Abstract: Technologies for filtering network traffic on ingress include a network interface controller (NIC) configured to parse a header of a network packet received by the NIC to extract data from a plurality of header fields of the header. The NIC is additionally configured to determine an input set based on the field vector, retrieve a matching list from a plurality of matching lists, and compare the input set to each of the plurality of rules to identify a matching rule of the plurality of rules that matches a corresponding portion of the input set. The NIC is further configured to perform an action on the network packet based on an actionable instruction associated with the one of the plurality of rules that matches the corresponding portion of the input set. Other embodiments are described herein.

Abstract: A pull-release closure apparatus and method. The apparatus comprises a separable fastener, comprising a male portion having a lug, a corresponding female portion having a hook detachably coupled to the lug, the hook further comprising a first substantially circular opening mounted on a peg, a second substantially circular opening, and a protrusion resting against a wall of the female portion. The apparatus comprises a cord coupled to the second substantially circular opening and extending outward from the separable fastener. The apparatus comprises a first garment attachment member comprising a first substantially rectangular opening, the first garment attachment member coupled to the male portion, and a second garment attachment member comprising a second substantially rectangular opening, the second garment attachment member coupled to the female portion.

Abstract: A communication system includes a network device including a plurality of communication ports and a plurality of communication nodes coupled with the network device through the plurality of communication ports. The communication system further includes a controller that is configured to generate a security key and to send a new configuration along with a message authentication code to the network device, wherein the controller is further configured to break the security key into parts and send the parts of the security key to at least some of the plurality of communication nodes such that each of the at least some of the plurality of communication node receiving one part of the parts of the security key. The network device is configured to retrieve the parts of the security key from the at least some of the plurality of communication nodes, to assemble the security key from the retrieved parts of the security key and using the assembled security key to authenticate the new configuration.

Abstract: A communication system includes multiple Point-of-Presence (POP) interfaces and one or more processors. The multiple POP interfaces are distributed in a Wide-Area Network (WAN) and are configured to communicate with at least a client and a server connected to the WAN. The one or more processors are coupled to the POP interfaces and are configured to (i) assign respective Internet Protocol (IP) addresses to the client and to the server, including embedding state information in the assigned IP addresses, and (ii) route traffic over the WAN between the client and the server, in a stateless manner, based on the state information embedded in the IP addresses.