Abstract: An apparatus is disclosed to compress packets, the apparatus comprising; a data analyzer to identify a new destination address and a protocol identifier of an input packet corresponding to a new destination node and a communication system between the new destination node and a source node; a compression engine to utilize a plurality of compression functions based on the new destination address and the protocol identifier and reduce a size of the input packet; a compression analyzer to identify a reduced packet and a compression function identifier corresponding to the reduced packet, the compression function identifier associated with one of the compression functions; and a source modifier to construct a packet to include the compression function identifier by modifying unregistered values of a protocol identifier by a difference associated with the compression function identifier, the packet to inform the new destination node of a compression function.

Abstract: The present application relates to the field of data processing, and provides a method for deploying a face sample library, and a method and an apparatus for business processing based on face recognition. The method for deploying a face sample library, comprises: obtaining historical business information of users corresponding to face samples in a password face sample library under a condition that a number of face samples in the password face sample library is greater than or equal to a preset sample number threshold, wherein confidential business passwords of the users corresponding to the face samples in the same password face sample library are the same; dividing the password face sample library to obtain M levels of face sample sub-libraries according to the historical business information, where M is a positive integer. Use of the technical solution of the present application improves the accuracy of business processing using face recognition.

Abstract: Disclosed herein is a device configured to covertly communicate state information within a transmitter address field of a message. The device comprises a memory configured to store a state key and state information of the device, and a controller in communication with the memory. The controller is configured to apply a one-way function, using the state key, to the state information to produce a transmitter address, and transmit the message, including the transmitter address in the transmitter address field of the message.

Abstract: This application relates to the field of communication technologies, and discloses a method and an apparatus for determining a link for forwarding a service flow, and a storage medium. A first forwarding device obtains identification information of a first service flow; and determines, based on the identification information of the first service flow, a link bandwidth matrix, and link statuses respectively corresponding to N links, a first link for forwarding the first service flow. A hash operation does not need to be performed based on a device identifier of each forwarding device, and a specific forwarding device that performs forwarding does not need to be determined by comparing a plurality of hash values.

Abstract: A system for using hash keys to preserve privacy across multiple tasks is disclosed. The system may provide training batch(es) of input observations each having a customer request and stored task to an encoder, and assign a hash key(s) to each of the stored tasks. The system may provide a new batch of input observations with a new customer request and new task to the encoder. The encoder may generate a new hash key assigned to the new customer request and determine whether any existing hash key corresponds with the new hash key. If so, the system may associate the new batch of input observations with the corresponding hash key and update the corresponding hash key such that it is also configured to provide access to the new batch of input observations. If not, the system may generate a new stored task and assign the new hash key to it.

Abstract: There is disclosed in one example a computing apparatus, including: a hardware platform including a processor, a memory, and a network interface; and instructions encoded within the memory to instruct the processor to: receive an incoming packet via the network interface; extract from the incoming packet a source port and a source internet protocol (IP) address; correlate the source port and source IP to a device identifier (ID); receive a network policy for the device ID; and apply the network policy to the incoming packet.

Abstract: Apparatus, methods, and systems for tuple space search-based flow classification using cuckoo hash tables and unmasked packet headers are described herein. A device can communicate with one or more hardware switches. The device can include memory to store hash table entries of a hash table. The device can include processing circuitry to perform a hash lookup in the hash table. The lookup can be based on an unmasked key include in a packet header corresponding to a received data packet. The processing circuitry can retrieve an index pointing to a sub-table, the sub-table including a set of rules for handling the data packet. Other embodiments are also described.

Abstract: Some embodiments provide a method for securing communication of data messages of a particular machine that includes a dynamic first level address. The method identifies a fixed second level address for a particular data. The fixed second level address is associated with an interface of the particular machine. Based on the fixed second level address, the method identifies a set of security policies for securing the communication of the particular data message. The method applies the set of security policies to the particular data message.

Abstract: Systems and methods include, responsive to defining a routing graph that includes vertices for each node of a plurality of nodes in a network and edges for links interconnecting the plurality of nodes, receiving a request for k shortest paths, where k is an integer>0, between a source node and a destination node of the plurality of nodes; and determining the k shortest paths utilizing a k-shortest path algorithm that utilizes two threads in parallel for each shortest path query, wherein the two threads include i) a shortest path query from the source node to the destination node and ii) a shortest path query from the destination node to the source node. The determining further includes, responsive to a first thread in each shortest path query obtaining a result, utilizing the result from the first thread and terminating a second thread.

Abstract: Systems, methods, and computer-readable media analyzing memory usage in a network node. A network assurance appliance may be configured to determine a hit count for a concrete level rule implemented on a node and identify one or more components of a logical model, wherein each of the one or more components are associated with the concrete level rule. The network assurance appliance may attribute the hit count for the concrete level rule to each of the components of the logical model, determine a number of hardware level entries associated with the each of the one or more components, and generate a report comprising the one or more components of the logical model, the hit count attributed to each of the one or more components of the logical model, and the number of hardware level entries associated with the one or more components of the logical model.

Abstract: A computer-implemented method includes: receiving, by a computing device, an input file defining correct spellings of one or more transliterated words; generating, by the computing device, suffix outputs based on the one or more transliterated words; generating, by the computing device, a dictionary that maps the suffix outputs to the one or more transliterated words; recognizing, by the computing device, an alternatively spelled transliterated word included in a document as one of the one or more correctly spelled transliterated words using the dictionary; and outputting, by the computing device, information corresponding to the recognized transliterated word.

Abstract: Techniques for acknowledging communications from multiple devices are described herein. For example, a device may broadcast a group acknowledgement message indicating that communications from multiple devices have been received by the device. Each acknowledgement in the group acknowledgement message may include a device identifier for a device that sent a communication (e.g., a Medium Access Control (MAC) address of the device, a hash of the MAC address of the device, etc.) and a communication identifier for the communication (e.g., a sequence number of the communication, a Cyclic Redundancy Check (CRC) code for the communication, etc.).

Abstract: A computer comprising a plurality of processing nodes is provided. Each processing node has at least one processor configured to process input data to generate an array of data items. The processing nodes are arranged in cliques in which each processing node of a clique is connected to each other processing node in the clique by first and second clique links. The cliques are inter-connected in rings such that each processing node is a member of a single clique and a single ring. The processing nodes of all cliques are configured to exchange in each exchange step of a machine learning collective via the respective first and second clique links at least two data items with the other processing node(s) in its clique, and all processing nodes are configured to reduce each received data item with the data item in the corresponding position in the array on that processing node.

Abstract: In an approach, a processor receives a request to deploy a workload in a container environment, where: the container environment comprises a plurality of external providers running container environment clusters; and the request (i) includes one or more requirements of the workload and (ii) does not specify a particular external provider of the plurality of external providers. A processor determines a cluster, from the plurality of external providers running the container environment clusters, that meets the one or more requirements of the workload. A processor deploys the workload on the determined cluster.

Abstract: A multimedia connector cable having a cable encasing a plurality of optical fibers. The cable having a proximal end and a distal end. The proximal end having an electrical connector in optical communication with the plurality of optical fibers. The distal end having an optical connector in optical communication with the plurality of optical fibers.

Abstract: A Multiprotocol Storage Controller (MPSC) System on a Chip (SOC) comprising multiple heterogeneous network interface ports, a switch core, a global memory mapper and a frame router. The interface ports capable of interconnecting networks of devices with differing data and signaling protocols and differing number of data and signal lines.

Abstract: A packet parser generates a key from TCP metadata of a data packet for a specific session. A packet cache stores recent network policy identifiers associated with a plurality of network sessions, wherein the key is used as an index to search the packet cache. The packet cache responsive to a cache miss, checks a TFO cookie field for a rule ID stored by the client during a previous session as generated by the network processor. If there is no rule ID, a classification pipeline is activated. On the other hand, responsive to a cache hit, or responsive to identifying a rule ID for the session from the TFO cookie, the classification pipeline is bypassed for the data packets of the specific session.

Abstract: A vehicle communication connection device and a method thereof are provided. The method includes determining at least one class identifier (CID) level applicable to a target application, determining at least one communication interface (CI) level applicable to the target application, mapping the determined CID level and the determined CI level to a predefined CID/CI mapping table, determining a final CID level to be used for the target application, and determining a final CI level corresponding to the determined final CID level.

Abstract: A plurality of memory maps may be allocated that represents the hash table on a memory device to store keys and values. The memory maps may comprise at least a primary map and a secondary map. A hash table operation may be performed on the primary map based on a first position computed using a first hash function, and if not successful, a bounded linear probing that probes a defined primary probe region in the primary map. Responsive to determining that the hash table operation on the primary map is not successful, the hash table operation may be performed on the secondary map based on a second position computed using a second hash function, and if not successful, a bounded linear probing that probes a defined secondary probe region in the secondary map.

Abstract: A network device intercepts, from an application associated with a user space, a request message associated with obtaining information regarding a network state from a kernel. The network device directs the request message to a service daemon of the user space based on intercepting the request message, and determines, using the service daemon, network state information regarding the network state. The network device intercepts, from the service daemon, a response message associated with providing the network state information to the application, and directs an altered response message to the application based on intercepting the response message such that the altered response message identifies the kernel as a source of the response message and not the service daemon as the source of the response message.

Abstract: Disclosed is a method that includes calculating, at a collector receiving a data flow and via a hashing algorithm, all possible hashes associated with at least one virtual attribute associated with the data flow to yield resultant hash values. Based on the resultant hash values, the method includes computing a multicast address group and multicasting the data flow to n leafs based on the multicast address group. At respective other collectors, the method includes filtering received sub-flows of the data flow based on the resultant hashes, wherein if a respective hash is owned by a collector, the respective collector accepts and saves the sub-flow in a local switch collector database. A scalable, distributed netflow is possible with the ability to respond to queries for fabric-level netflow statistics even on virtual constructs.

Abstract: A method implemented by a network device for selection of a routing table in a Policy Based Routing (PBR) system is described. The method may include receiving a packet from a first network domain; generating a firewall mark for the packet, wherein the firewall mark includes a network domain indication and a packet classification indication; determining a match between the network domain indication of the packet and a selector of a matched rule in a set of rules; and upon determining the match between the network domain indication of the packet and the selector of the matched rule, inputting the firewall mark to a function of the matched rule to identify a routing table for the packet.

Abstract: A source proxy for transmitting one or more TCP packets sent from a source device to a destination device over a wireless link is provided. Each TCP packet comprises a TCP data section and a TCP packet header.

Abstract: Disclosed are techniques for generating and examining a signature that corresponds to a plurality of data packets. The data packets can be packets forwarded by a network device. By examining the signature, information pertaining to the plurality of data packets can be determined. A determination can be made if one of the plurality of data packets is not received by the network device.

Abstract: Systems and methods for increasing layer 2 visibility of layer 3 network devices so as to facilitate implementation of device-oriented policy actions by layer 3 network devices are provided. According to one embodiment, unique physical addresses of one or more host devices are retrieved by a dynamic host configuration protocol (DHCP) agent that is operatively coupled with a DHCP server. The physical addresses are mapped to corresponding Internet Protocol (IP) addresses assigned by the DHCP server to the one or more host devices. The mapping is relayed directly or indirectly to a network security device. Network traffic management/security policies are defined within the network security device corresponding to at least one of the unique physical addresses.

Abstract: Aspects of the subject disclosure may include, for example, embodiments that include obtaining a first data pool of different types of data. The different types of data include a first group of IPv4 addresses. Further embodiments include selecting a first portion of the first group of IPv4 addresses using artificial intelligence techniques and storing the first portion of the first group of IPv4 addresses in a first table of IPv4 addresses. Additional embodiments can include assigning a first IPv4 address in the first table to a first computing device in response to determining the first IPv4 address in the first table is not currently being used. Other embodiments are disclosed.

Abstract: The present inventions relate systems and methods for monitoring and managing electronic messages in one or more computer networks. More particularly, the systems and methods of the present invention provide a substantially global or unified approach to messaging management within one or more computer networks that allows network administrators or other authorized users to define and identify electronic messages of interest within the network and store selected messages such that they can be retrieved and examined in connection with an audit or other inquiry.

Abstract: A method for a sender side assisted flow classification is disclosed. In an embodiment, a method comprises detecting a packet by a network virtualization layer engine implemented in a hypervisor on a sender side of a virtualization computer system; and determining, by the network virtualization layer engine, whether the packet requires special processing. In response to determining that the packet requires special processing, a special processing flag is inserted in a certain field of an outer header of the packet; and the packet is forwarded toward a destination of the packet for a PNIC on a receiver side to process the packet.

Abstract: A computer-implemented method includes generating a hash key using a number of least significant bits (LSBs) for indexing an indirection table in a computing system including multiple processing cores. In generating the hash key, symmetry constraints for a request packet and a response packet through a same communication channel are computed. The symmetry constraints include at least a condition where the LSBs of a hash value corresponding to a source or destination IP address of the request packet are equal to the LSBs of a hash value corresponding to a destination or source IP address of the response packet, wherein the LSBs of the hash value of the request and response packets are of a number same as the number of LSBs used for indexing the indirection table. A string of bits are subjected to the symmetry constraints and adjusted to satisfy the symmetry constraints to generate the hash key.

Abstract: Examples herein disclose a generation of a hash table. The examples identify a prefix length from a routing table of various prefix lengths and corresponding distribution of entries. The identified prefix length corresponds to a larger distribution of entries in the routing table. The examples generate the hash table in accordance with the identified prefix length.

Abstract: A network-based recovery method implemented by one or more nodes configured to manage Internet Protocol (IP) configuration in a network includes during normal operation, discovering clients, providing IP configuration information to each of the clients, and maintaining a list of the clients and a database of the IP configuration information; responsive to a failure of any of the one or more nodes, sending a request to each client in the list for that client's associated IP configuration information; and, responsive to receiving a response from the sending to each client, repopulating the database with the client's associated IP configuration information.

Abstract: A method commences upon accessing a set of data items that describe computing nodes to be organized into failure-tolerant configuration. The failure-tolerant configuration is characterized by system availability characteristics such as a replication factor and such as a hierarchical distribution of computing nodes. Characteristics of the topology include boundaries that define two or more hierarchically-related availability domain levels. Computing nodes are situated within these boundaries. Instances of a target hierarchical availability domain level are sorted, and instances of a hierarchically lower availability domain level are also sorted to form a multi-level sort order of computing nodes. Computing entities are mapped onto the computing nodes by observing the multi-level sort order.

Abstract: Systems and methods for automatically executing an efficient longest internet protocol prefix match on non-relational and/or No-SQL databases, such as Cassandra. Clustering prefixes around common and/or standard prefix lengths ensures efficient use of Cassandra's underlying mechanisms and minimizes costly scan operations.

Abstract: Described herein are various embodiments of a network element including an access control list processing module to process an access control list of the network element. In one embodiment the access control list processing module converts the access control list into set of subsections of rules, where each rule of a subsection mutually exclusive of each other rule in the subsection. The network element may then make forwarding decisions for network data using the set of subsections of rules. In one embodiment, semantics preserving transformations can be applied to rules and data to enable more efficient processing of filtering or rules.

Abstract: Some embodiments provide a method for a hardware forwarding element. The method adds a received packet to a buffer. The method determines whether adding the packet to the buffer causes the buffer to pass one of multiple flow control thresholds, each of which corresponds to a different packet priority. When adding the packet to the buffer causes the buffer to pass a particular flow control threshold corresponding to a particular priority, the method generates a flow control message for the particular priority.

Abstract: Systems for distributed data storage. A method commences upon accessing a set of data items that describe computing nodes to be organized into a ring topology. The ring topology and distributed data storage policies are characterized by quantitative failure-resilient characteristics such as a replication factor. Various characteristics of the topology serve to bound two or more availability domains of the ring into which the computing nodes can be mapped. A set of quantitative values pertaining to respective quantitative failure-resilient characteristics are used for enumerating candidate ring topologies where the computing nodes are mapped into the availability domains. Using the quantitative failure-resilient characteristics, alternative candidate ring topologies are evaluated so as to determine a configuration score for candidate ring topologies. A candidate ring topology is configured based on a computed configuration score surpassing a threshold score.

Abstract: A method is implemented by a transparent proxy to support graceful switchover in a network, where the transparent proxy proxies one or more Transmission Control Protocol (TCP) connections involving a destination Internet Protocol (IP) address. The method includes starting a switchover timer for the destination IP address in response to receiving an instruction from an Application Flow Controller (AFC) to start the switchover timer for the destination IP address and transmitting an indication to the AFC that all of the one or more TCP connections involving the destination IP address that are proxied by the transparent proxy have ended or the switchover timer for the destination IP address has expired in response to a determination that all of the one or more TCP connections involving the destination IP address that are proxied by the transparent proxy have ended or the switchover timer for the destination IP address has expired.

Abstract: Disclosed herein are techniques for classifying input network packets evenly into a plurality of classes. An apparatus includes an input port configured to receive a plurality of network packets. The apparatus also includes processing logic configured to receive the plurality of network packets from the input port and classify each packet of the plurality of network packets. For each packet, whether a condition is met is determined, a most recently used hash operation is selected when the condition is not met or a new hash operation is selected when the condition is met; and the selected hash operation is performed on the packet using at least a portion of the packet as an input value to classify the packet. The most recently used hash operation and the new hash operation are configured to classify packets having the same input value into different classes.

Abstract: An example embodiment includes a first subsystem, a second subsystem, and a third subsystem in different locations, where the first subsystem is configured to receive a request to deliver a set of packets to the third subsystem, send the set of packets to the second subsystem, and send, through first nodes, a first data stream containing the a set of packets to the third subsystem. The second subsystem is configured to receive the a set of packets and send, through second nodes that differ from the first nodes, a second data stream containing a set of packets to the third subsystem. In addition, the third subsystem is configured to receive the first and second data streams, determine that each data stream comprises the a set of packets, and send the set of packets from one of the first and second data streams to a downstream component.

Abstract: A repeater includes input ports for inputting packets from modules, input buffers configured to store the input packets, output ports for outputting packets to modules, output buffers configured to store the packets before output, a switch connected between the input buffers and the output buffers, and a controller. The controller selects any of the input buffers, acquires any of the packets from the selected input buffer, and based on a result of comparison between a destination of a packet previously transferred to the output buffer corresponding to the destination of the acquired packet and the destination of the acquired packet and on the availability of the output buffer, determines propriety of transfer of the acquired packet. The controller controls the switch to transfer the packet determined to be transferable, from the input buffer to the output buffer.

Abstract: Some embodiments provide a method for securing communication of data messages of a particular machine that includes a dynamic first level address. The method identifies a fixed second level address for a particular data. The fixed second level address is associated with an interface of the particular machine. Based on the fixed second level address, the method identifies a set of security policies for securing the communication of the particular data message. The method applies the set of security policies to the particular data message.

Abstract: In accordance with an embodiment, described herein is a system and method for partitioning classification resources in a network device in a high performance network. Classification resources can be configured into a plurality of levels of partitions, with one or more hardware-based partitions configured to store flow entries associated with frequently-used or performance-sensitive flows, and a firmware-based partition to access large lookup tables stored in one or more additional memories for classification resource scalability. A lookup key can be used for search for a flow entry match in the hardware-based partitions first. If there is a miss, the lookup key can be presented to the firmware-based partition for further search. Results from the firmware-based level can be dispatched back to a hardware-based parser for further processing. Flow entries can be moved between lookup tables by a partition management block based on utilization of the flow entries.

Abstract: A cache-and-overflow memory handles both cache and overflow data in a single hardware structure so as to increase speed and reduce supporting hardware structure needed to implement an effective memory system. A single hash value can be used to access either a cache data value or an overflow data value stored in the combined cache-and-overflow memory. If there are a small number of overflow entries, the combined cache-and-overflow memory provides more availability for cache entries. However, overflow entries are provided priority over cache entries. As a result, the combined cache-and-overflow memory dynamically reallocates its space to efficiently store as much as cache as possible until space is needed for overflow data. At that time, the cache data is evicted in a priority order to make space for the overflow data.

Abstract: A computer-implemented method includes constructing an overall Bloom filter representing a set of legal parameter values of a plurality of parameters useable for querying one or more endpoints. In the overall Bloom filter, each parameter of the plurality of parameters is offset based on a respective unique identifier of the parameter. A first set of desired parameter values is determined corresponding to first desired data to be retrieved from a first endpoint of the one or more endpoints. Using a computer processor, a first query Bloom filter is constructed representing the first set of desired parameter values. A first Bloom filter search is performed of the first query Bloom filter against the overall Bloom filter. Responsive to not finding a match through the first Bloom filter search, it is opted not to query the first endpoint with the first set of desired parameter values.

Abstract: A collection method for information as to a user viewing videos can be executed in a device. The device comprises at least a decoder and at least one video application providing video content. The decoder decodes video contents. The device monitors pages of the video application and configures a table of browsing record for each of the pages. When it is monitored that a target page of the video application is opened and that the decoder is running, the device collects viewing information associated with the video content and records the viewing information in a table of target browsing record. On termination of the target page of the video application, the device transmits the table of target browsing record to a server. A processing method for viewing information, a device, and a server are also disclosed.

Abstract: A host connected to at least one data network has a processor having a plurality of cores, and a memory. A network interface controller is coupled to the host, and configured to transmit and receive data packets via multiple distinct physical ports. The host and the network interface controller are cooperative upon receiving a packet for storing the packet in a receive buffer of the memory, deciding in the host, responsively to a destination identifier in the packet, to forward the packet from the host to the at least one data network via another one of the physical ports, and selecting one of the cores to perform a send operation.

Abstract: Methods of load-balancing in a network are provided herein. One such method includes steps of receiving network traffic at a network device, the network traffic having a destination address and of performing a look-up in a multipath group table using the destination address. The multipath group table includes entries for recursive next-hops, each recursive next hop being associated with a connected next hop in the multipath group table. The method also include a step of hashing the network traffic according to a number of recursive next-hops associated with the destination address in the multipath group table. Additional methods and information handling system are also provided.

Abstract: Embodiments of the present invention include systems and methods for detecting and correcting mismatches between a flow's size and the path maximum transmission unit (PMTU) size. In embodiments, a controller is notified of a new flow's size and compares that to the route path's MTU size. If the controller recognizes a mismatch, it informs an information handling device, such as the first-hop router, to notify the sender of the correct path MTU size—thereby effectively and efficiency notifying the sender to correct the MTU size for that flow.

Abstract: A virtual network device includes several different virtual network device sub-units, which collectively operate as a single logical network device. An interface bundle includes interfaces in more than one of the different virtual network device sub-units included in the virtual network device. The interface bundle is coupled to a virtual link bundle, which connects the virtual network device to another device. The interface bundle is managed as a single logical interface.

Abstract: Systems, methods, and computer-readable storage media for load-balancing are disclosed. An access point receives a communication request and an identifier from a wireless device. The access point determines a plurality of potential endpoints and selects at least one preferred potential endpoint for the wireless device, based on the identifier and the plurality of potential endpoints. The access point establishes a tunnel between the access point and the preferred endpoint for routing traffic associated with the wireless device.