Abstract: A network device may define a container LSP that includes multiple member LSPs. Each of the multiple member LSPs defines a path from the network device through a network of a plurality of network devices. The network device may receive traffic that includes multiple packet flows. The network device may identify a first set of packet flows that are intolerant to packet reordering. The network device may identify a second set of packet flows that are tolerant to packet reordering. The network device may distribute each of the first set of packet flows to a corresponding one of the multiple member LSPs. The network device may process the second set of packet flows to determine a distribution sequence for the second set of packet flows. The network device may distribute the second set of packet flows among the multiple member LSPs based on the distribution sequence.

Abstract: A disclosed method may include (1) generating a configuration file that represents a specific configuration of a network device included in a network, (2) storing the configuration file that represents the specific configuration of the network device among a set of configuration files available via an NMS, (3) assigning to the configuration file via the NMS, a configuration identifier that uniquely identifies the configuration file among the set of configuration files available via the NMS, (4) receiving, via the NMS, a rollback request to restore the network device to the specific configuration based at least in part on the configuration identifier, and then in response to receiving the rollback request, (5) restoring the network device to the specific configuration based at least in part on the configuration file. Various other systems, methods, and computer-readable media are also disclosed.

Abstract: A live broadcast method includes: receiving, by a live broadcast client, a push-stream address sent by the live broadcast management server; sending, by the live broadcast client, a proxy push-stream request to a live broadcast proxy client; and sending, by the live broadcast client, collected live broadcast data to the live broadcast proxy client, and pushing the live broadcast data to a live broadcast server over an uplink of a dedicated network connected to the live broadcast proxy client.

Abstract: A computer-implemented method is disclosed. The method includes determining whether a level of resource utilization of an organization having a first index and a first cluster requires that the organization is assigned to a second cluster, if the level of resource utilization requires that the organization is assigned to the second cluster, creating a second index for the organization in the second cluster, adding a consul entry in a consul that points to the second index, and upon completion of a data migration operation, changing an entry of the cluster routing controller for the organization, from the first index to the second index. A connection is established using the consul entry.

Abstract: A technique for acquiring and correlating session-related information from an Internet Protocol Multimedia Subsystem, IMS, is described. The technique comprises the acquisition of control plane information from control plane signalling tapped at an IMS control entity, the acquisition of user plane information from user plane traffic tapped at an IMS user plane entity, and the acquisition of context information from tapped signalling between the IMS control entity and the IMS user plane entity. The acquired context information permits to correlate the control plane information and the user plane information acquired for a particular session.

Abstract: The present technology provides a system, method and computer readable medium for steering a content request among plurality of cache servers based on multi-level assessment of content popularity. In some embodiments a three levels of popularity may be determined comprising popular, semi-popular and unpopular designations for the queried content. The processing of the query and delivery of the requested content depends on the aforementioned popularity level designation and comprises a acceptance of the query at the edge cache server to which the query was originally directed, rejection of the query and re-direction to a second edge cache server or redirection of the query to origin server to thereby deliver the requested content. The proposed technology results in higher hit ratio for edge cache clusters by steering requests for semi-popular content to one or more additional cache servers while forwarding request for unpopular content to origin server.

Abstract: An electronic device is described. The electronic device includes a stack of computer network devices, such as a stack of switches and/or routers. This stack of computer network devices includes data planes and ports for directing packets or frames in a wireless network based at least in part on destinations of the packets or frames. Moreover, the electronic device may include multiple controllers (such as processors) that operate as master nodes and that perform network functions for the stack of computer network devices using a database. This database may include a common database that is accessible by the multiple controllers or multiple instances of the database in the multiple controllers, where the multiple instances of the database are synchronized.

Abstract: An integrated circuit. The circuit includes a communication module including shared ports, and an error management module for managing at least one case of an error. The circuit is configured to communicate on multiple internal communication channels via the ports. The error management module includes at least one hardware path for selectively switching off the individual communication channels in the case of an error.

Abstract: Methods and systems for performing an electronic security assessment of a building automation system are provided. The building automation system includes a controller and a network of electronic devices connected in electronic communication. The method includes requesting, by the controller, an electronic security scan of the controller with a data set of the controller via a secured channel to a cloud-based service. The method also includes initiating the electronic security scan of the controller based on the data set of the controller. The method further includes electronically assessing security vulnerabilities of the building automation system. The method also includes electronically assessing, by the controller, security vulnerabilities of the network of electronic devices connected in electronic communication with the controller.

Abstract: A method, apparatus, electronic device, and computer readable storage medium for communication between private networks are provided. An embodiment of the method may include: receiving a communication request sent by a first sub-instance provided in a first private network, the first sub-instance being created based on that the first private network initiates a network registration request to a master instance; determining a second private network as a destination based on the communication request; and sending the communication request to the second private network through a second sub-instance provided in the second private network, the second sub-instance being created based on that the second private network initiates a network registration request to the master instance, wherein the first private network, the second private network, and a cloud enterprise network provided with the master instance forms a star topology centered on the cloud enterprise network.

Abstract: While presenting on a display apparatus videos of high picture quality obtained from portable video processing apparatuses such as a camera and a cellular, it is possible to communicate with the Internet and/or a home network. A display apparatus includes a first radio communication unit capable of receiving video information by radio from an external video processing apparatus, a second radio communication unit capable of connecting by radio to a network, and a control unit for controlling assignment of connection by radio transmission for each of the first and second radio communication units. The control unit assigns connection of the first radio communication unit with higher priority and controls the assignment of the transmission rate such that the transmission rate between the first radio communication unit and the external video processing apparatus is more than that between the second radio communication unit and the network.

Abstract: A network adapter includes a network interface, a host interface and processing circuitry. The network interface connects to a communication network for communicating with remote targets. The host interface connects to a host that accesses a Multi-Channel Send Queue (MCSQ) storing Work Requests (WRs) originating from client processes running on the host. The processing circuitry is configured to retrieve WRs from the MCSQ and distribute the WRs among multiple Send Queues (SQs) accessible by the processing circuitry.

Abstract: The present disclosure provides a method and an apparatus for processing a service request. The method includes: sending a query request for querying a domain name of a server to a DNS; receiving a query response returned according to the query request, where the query response carries a first identifier of an IDGW; sending a service request to the IDGW according to the first identifier, where the service request is used for the IDGW to convert the first identifier into a second identifier of the server and forward the service request to the server according to the second identifier; and receiving a service response message returned from the server in response to the service request.

Abstract: Techniques are described for buffering data traffic destined for a mobile device when a data path to a base station for the mobile device is unavailable. For example, a network device comprises: a control unit comprising processing circuitry, wherein the control unit is configured to allocate, in response to determining that a data path from the network device to the base station for a mobile device is unavailable, a hardware queue of a packet processor of the network device to the data path; and a forwarding component with access to the hardware queue, wherein the forwarding component is configured to store data traffic for the mobile device to the allocated hardware queue, wherein the control unit is configured to, in response determining that the data path is available, configure the forwarding component to output the data traffic from the allocated hardware queue to the base station along the data path.

Abstract: The technology is directed to cache admission control. One or more processors may categorize access requests for data items in a cache storage into a plurality of categories and collect information on the access requests over time. Based on the collected information, a utility value for caching data items in each category of the plurality of categories may be determined. Newly requested data items may be admitted into the cache storage in an order according to the corresponding utility values of their respective categories.

Abstract: Some embodiments provide a method for a managed forwarding element (MFE). At the MFE, the method receives a first packet from a particular tunnel endpoint. The first packet originates from a particular data compute node associated with multiple tunnel endpoints including the particular tunnel endpoint. Based on the first packet, the method stores an association of the particular tunnel endpoint with the particular data compute node. The method uses the stored association to encapsulate subsequent packets received at the MFE and having the particular data compute node as a destination address with the particular tunnel endpoint as a destination tunnel endpoint.

Abstract: This disclosure describes techniques for applying a policy proximate to a source of data traffic in a network. The techniques include indicating to a destination edge node that a policy relevant to the data traffic has not been applied at a source edge node. The destination edge node may send the policy to the source edge node. The source edge node may apply the policy to a subsequent packet of the data traffic. Application of the policy proximate to the source of the data traffic may conserve network resources and improve performance of the network.

Abstract: A Network Access Point (NAP) in an ICN may have multiple clients requesting the same resource. Instead of sending multiple link-local unicast transmissions, the multiple clients may subscribe to a response bucket based on their unicast address and the NAP may send a multicast response to the group based on previously issued HTTP requests. The response bucket may contain multiple clients attached to the NAP. A multicast address of the response bucket may be used by the NAP to send the multicast response. A class D octet in the multicast group address may be derived from a class C octet of the individual client IP addresses.

Abstract: A network system comprises: a terminal(s) that is connectable to a sensor(s), converts data collected by the sensor(s) into second data by performing predetermined processing on the collected data, and transmits the second data to the predetermined apparatus(es) arranged in a physical network(s); the physical network(s) that includes the predetermined apparatus(es); and a control apparatus that controls a virtual network(s) established between the terminal(s) and the predetermined apparatus(es) so that the second data transmitted from the terminal(s) reaches the predetermined apparatus(es).

Abstract: Aspects of the present disclosure involve systems, methods, computer program products, and the like, for an orchestrator device associated with a scrubbing environment of a telecommunications network that receives one or more announced routing protocol advertisements from a customer device under an attack. In response to receiving the announcement, the orchestrator may configure one or more scrubbing devices of the network to begin providing the scrubbing service to packets matching the received routing announcement. A scrubbing service state for the customer may also be obtained or determined by the orchestrator. With the received route announcement and the customer profile and state information, the orchestrator may provide instructions to configure the scrubbing devices of the network based on the received information to dynamically automate scrubbing techniques without the need for a network administrator to manually configure the scrubbing environment or devices.

Abstract: A cloud computing system including a cloud-based system in communication with a client system including an application gateway that receives from a client application, a request for services associated with a workload and a plurality of cloud-based application services, the plurality of cloud-based application services in operable communication with the application gateway. The system also includes a cloud-based tuning service in operable communication with the cloud-based application services and the application gateway, the cloud-based tuning service identifies a set of application requirements needed to fulfill the request, the cloud-based tuning service coordinating with a client-based tuning service and the application gateway to assign selected application services to fulfill the request, wherein the assignment of selected application services includes assigning at least a portion of the services associated with the workload the client system.

Abstract: A method for combining multiple interactions into a single record entry is disclosed. A data package can be created that represents a set of interactions, and each entity associated with an interaction can review the data package. Each entity can indicate agreement with the interactions by digitally signing the data package. Once signed by each involved entity, the data package can be stored in a record such as a blockchain.

Abstract: A monitoring system monitors authentication sessions both on the air interface between the terminals and the network, and on at least one wired network-side interface between network-side elements of the network. The monitoring system constructs a database of sets of network-side authentication parameters using network-side monitoring. Each set of network-side authentication parameters originates from a respective authentication session and is associated with the International Mobile Station Identity (IMSI) of the terminal involved in the session. In order to start decrypting the traffic of a given terminal, the system obtains the off-air authentication parameters of that terminal using off-air monitoring, and finds an entry in the database that matches the air-interface authentication parameters. From the combination of correlated network-side and off-air authentication parameters, the processor is able to extract the parameters needed for decryption.

Abstract: A method of configuring a hybrid, multi-cloud gateway configuration system for executing an application programming interface (API) may comprise receiving, via a network interface device of the API service control plane system, gateway operation policies in a first format for execution of an API at a first gateway type and a second gateway type, generating via one of a plurality of gateway type policy translators and transmitting to a gateway of the first gateway type, a first configuration file in a second format, instructing the gateway of the first gateway type to provision the API to meet the gateway operation policies, and generating via another one of the plurality of gateway type policy translators and transmitting to a gateway of the second gateway type, a second configuration file in a third format, instructing the gateway of the second gateway type to provision the API to meet the gateway operation policies.

Abstract: There are provided measures for service function chain interworking. Such measures exemplarily comprise recognizing, that said terminal is roaming in said visited network, detecting, that said visited network supports utilizing service functions of said service chaining, and applying, at a control function entity controlling said service function chaining, a service function of said service function chaining to a service data flow of said terminal, said service function being determined based on information on said roaming of said terminal in said visited network.

Abstract: A node in a Segment Routing network includes a plurality of ports and a switching fabric between the plurality of ports, wherein, for an Ethernet Tree (E-tree) service, a port is configured to transmit a packet with a plurality of Segment Identifiers (SID) including a first SID, a second SID, and a third SID, wherein the first SID identifies one of multicast, ingress replication for broadcast, and a destination node including any of a node SID and an anycast SID, wherein the second SID identifies a service including the E-tree service, and wherein the third SID identifies a source of the packet. A second port of the node is connected to a customer edge, and wherein the third SID is based on whether the customer edge is a leaf node or a root node in the E-tree service.

Abstract: Systems, methods, and computer-readable media for localizing faults in a network policy are disclosed. In some examples, a system or method can obtain TCAM rules across a network and use the TCAM rules to perform an equivalency check between the logical model and the hardware model of the network policy. One or more risk models are annotated with output from the equivalency check and the risk models are used to identify a set of policy objects of the network policy that are likely responsible for the faults. The identified set of policy objects are correlated with various logs of the network. Based on the correlation, specific policy objects of the set of policy objects that are associated with physical-level causes of the fault.

Abstract: A server, includes a virtual machine identifier assigning section to assign an identifier of a virtual machine operating on the server; and a network interface to transmit a packet including a Layer 2 header information which includes the identifier of the virtual machine and a first packet field for a VLAN-Tag, wherein the network, interface transmits the packet to a packet encapsulate section which encapsulates a second packet field including the Layer 2 header information with a virtual network identifier representing a virtual network to which the virtual machine belongs.

Abstract: This disclosure proposes systems and methods employing dynamic skill endpoints by allowing skills to register themselves with a language processing system. The language processing system allows the skill system to open a persistent network connection to the language processing system. This connection does not require the machine(s) running the skill system to have an Internet routable address; rather the skill system can contact the language processing system, which can remain at a static address, through any local routers or firewalls which may block connections from being initiated from outside the local area network. This registration opens the connection between the skill system and the language processing system. When the language processing system receives a skill invocation request indicating the skill, the language processing system can check its registry for a dynamic endpoint corresponding to the skill, and route the request over the network connection to the registered endpoint.

Abstract: A system designed for increasing network communication speed for users, while lowering network congestion for content owners and ISPs. The system employs network elements including an acceleration server, clients, agents, and peers, where communication requests generated by applications are intercepted by the client on the same machine. The IP address of the server in the communication request is transmitted to the acceleration server, which provides a list of agents to use for this IP address. The communication request is sent to the agents. One or more of the agents respond with a list of peers that have previously seen some or all of the content which is the response to this request (after checking whether this data is still valid).

Abstract: A system includes first electronic devices and a digital signature carrier. Each of the first electronic devices has a network identifier distinct from another. The digital signature carrier is configured for recording a connective information list. The connective information list includes the network identifiers of all of the first electronic devices. A second electronic device includes a digital signature reader. The second electronic device is configured to read the digital signature carrier by the digital signature reader, extract the connective information list comprising the network identifiers and pair the second electronic device with each of the first electronic devices according to the network identifiers.

Abstract: A method and network device for forwarding data packets. Specifically, the method and network device disclosed herein separate the known data packet forwarding architecture in network devices, often implemented using a single component, into two components. In implementing the pair of components, functionalities directed to forwarding data packets versus buffering data packets, based on the detection of data packet collisions, are segregated. Further, the segregation of these functionalities reduces the latency observed in the communication of the data packets from these network devices to other devices to which these network devices may be connected through a network.

Abstract: In one embodiment, a device in communication with a service provider network obtains first information regarding a first call leg of a media session associated with a first endpoint. The device also obtains second information regarding a second call leg of the media session associated with a second endpoint. Both of the first and second endpoints are anchored in the service provider network. The device makes a determination that the media session is being hairpinned, based on the first and second information. The device sends, based on the determination, an indication message using Session Traversal Utilities for Network Address Translators (STUN) along the first call leg that causes the first endpoint to begin sending a flow of media packets.

Abstract: Described herein are systems, methods, and software to enhance network traffic management. In one implementation, a first host identifies a packet to be transferred from a first virtual machine on the first host to a second virtual machine on a second host. In response to identifying the packet, the first host identifies a source logical port for the first virtual machine, and transferring a communication to the second host, wherein the communication encapsulates the data packet and the source logical port. Once the packet is received by the second host, the second host may use the source logical port to determine a forwarding action for the packet.

Abstract: While presenting on a display apparatus videos of high picture quality obtained from portable video processing apparatuses such as a camera and a cellular, it is possible to communicate with the Internet and/or a home network. A display apparatus includes a first radio communication unit capable of receiving video information by radio from an external video processing apparatus, a second radio communication unit capable of connecting by radio to a network, and a control unit for controlling assignment of connection by radio transmission for each of the first and second radio communication units. The control unit assigns connection of the first radio communication unit with higher priority and controls the assignment of the transmission rate such that the transmission rate between the first radio communication unit and the external video processing apparatus is more than that between the second radio communication unit and the network.

Abstract: One embodiment provides a system and method for managing, at a network node, a data structure indicating neighbor node address information. During operation, the system can determine, based on a media access control (MAC) address or an Internet protocol (IP) address associated with an entry in the data structure, a type of the entry, and set a timeout value for the entry based on the determined type. In response to detecting that an entry corresponding to the MAC address expires in a MAC table maintained by the network node, the system can identify an interface on the network node to which a neighbor associated with the MAC address was previously coupled and transmit a unicast neighbor-probe packet on the identified interface to determine a connection status of the neighbor.

Abstract: Techniques for achieving virtual hardware resources that are individualized across desktop virtual machines (VMs) are identified. Custom resource templates include virtual resource settings that are targeted for specified desktop VMs and that differ from the parent image (i.e., a template or snapshot). A customization manager processes the custom resource templates and applies the corresponding virtual resource settings directly to the specified desktop VMs. To achieve such customization using conventional techniques requires tedious and error-prone manual intervention as well as memory and time-consuming individualized recompose or re-creation operations. Advantageously, by automating and streamlining the customization process, the identified techniques decrease both memory usage and the time required to individualize the desktop VMs.

Abstract: An in-vehicle relay device prevents an anomaly of a control command exchanged over networks having different transmittable data sizes in a frame. The in-vehicle relay device relays communication between multiple control devices in a vehicle over the networks to which the control devices are connected. The in-vehicle relay device receives control data from a first control network. The control data includes, in a frame, a plurality of control commands to be executed by at least one of the control devices. The in-vehicle relay device determines, as a first determination, whether types of the control commands included in the frame form a first combination that is preset as a combination of control commands that are executable simultaneously. The in-vehicle relay device thereafter determines, as a second determination, whether the control data is anomalous by using the result of the first determination, and outputs the result of the second determination.

Abstract: The present disclosure provides a data packet routing method and a data packet routing device. The data packet routing method includes receiving and resolving an initial route resolution request message to obtain a requested domain name in the initial route resolution request message; determining whether there is a specified domain name resolution server corresponding to the requested domain name; if there is a specified domain name resolution server corresponding to the requested domain name, modifying a default destination address of the initial route resolution request message to an address of the specified domain name resolution server, so as to obtain a routing information request message; searching for routing information corresponding to the routing information request message; and sending a data packet to a destination address corresponding to the requested domain name.

Abstract: A LAN controller performs lighting control upon LEDs, which are configured to be subjected to lighting control by the LAN controller, on the basis of the start-up status of an apparatus after communicating with an external apparatus.

Abstract: A method of authorizing an access point includes receiving a first transmission signal from a first access point. The first transmission signal comprises identifying information of the first access point that includes a first token. The method includes receiving a second transmission signal from a client device. The second transmission signal includes a second token that is received by the client device from an un-provisioned access point. When a match is determined between the first token and the second token, the first access point is identified as the un-provisioned access point. The method includes transmitting the identifying information of the first access point and a request to the client device to authorize the un-provisioned access point. The method includes receiving a third transmission signal from the client device that includes an authorization verification of the un-provisioned access point that authorities the un-provisioned access point to connect to a cloud-managed network.

Abstract: Novel tools and techniques might provide for implementing extension of customer local area networks (“LANs”) and/or implementing isolated service overlays over a network. In some embodiments, a network service point that is located external to a demarcation point at each of a plurality of customer premises might establish a connection between a service provider network and a customer LAN, which has already been established within a customer premises. The system subsequently extends the customer LAN, via this connection, to span between the network service point and the customer premises. Alternatively, or additionally, the system might establish two or more isolated service overlays across the customer LAN between the network service point and the customer premises, each of the two or more isolated service overlays having network traffic that is isolated from network traffic transmitted along another of the two or more isolated service overlays.

Abstract: The embodiments herein relate to a method in a policy node for handling a UEs access to a mobile communications network. The policy node comprises policy information for the UEs access rights to the mobile communications network. The policy node obtains, from a subscriber database, subscription information for a subscriber associated with the UE. Based on the subscription information and the policy information, the policy node determines which geographical areas comprised in the mobile communications network the UE is allowed or denied access to. The policy node transmits, to a mobility node, access information indicating which geographical areas comprised in the mobile communications network the UE is allowed or denied access to.

Abstract: The described technology is generally directed towards adaptively changing which transmission scheme a user equipment is to use based on a Doppler metric (e.g. Doppler frequency) as evaluated against a threshold Doppler value. A network instructs a user equipment to use a Rank-1 precoder cycling transmission scheme if the Doppler metric of user equipment is above a threshold value, or to use a closed loop MIMO transmission scheme if the user equipment has a Doppler metric below the threshold value. The network can instruct the user equipment via a suitable message, or by switching off TPMI and notifying the user equipment thereof.

Abstract: A network appliance having a control plane and a data plane can process substantially every input packet at wire speed in a programmable packet processing pipeline of the data plane. Sensors, which can be processes implemented within the pipeline, can measure parameters of the network traffic flows and of the network appliance in accordance with monitoring policies. Reporting policies can be triggered when any one of many criteria are met by the parameters. The reporting policy can result in a report being sent to an outside recipient. Alternatively, the reporting policy can result in the network appliance implementing additional monitoring or reporting policies.

Abstract: The present disclosure relates to a system, a computing apparatus, a board card, and an electronic device for data accelerated processing. The computing apparatus may be included in a combined processing apparatus. The combined processing apparatus may also include a universal interconnection interface and other processing apparatuses. The computing apparatus interacts with other processing apparatuses to jointly complete computing operations specified by the user. The combined processing apparatus may also include a storage apparatus which is respectively connected to the computing apparatus and other processing apparatuses and is used for storing data of the computing apparatus and other processing apparatuses. The solution of the present disclosure can be applied to various electronic devices.

Abstract: A routing method and a device to provide a routing path that satisfies a quality of service (QoS) requirement, where the routing method includes performing QoS measurement on a path between the first routing node and a reachable adjacent routing node, to obtain a QoS parameter set of the path between every two adjacent routing nodes, reporting the QoS parameter set to the control node, receiving one or more routing tables of routing performed from the first routing node to the other routing node that are delivered by the control node, and receiving a packet, determining, from the one or more routing tables, a routing table corresponding to an identifier of the packet, and forwarding the received packet based on the routing table.

Abstract: A method, system and computer program product assess risk of an unauthorized API login and mitigate damage from an unauthorized API login. The method includes collecting in a database license attributes of a user license, user profile attributes, and database content change attributes; receiving an API login request; comparing features of the API login request to at least one of the database license attributes, user profile attributes, and database content change attributes against a predetermined threshold; assessing a risk of the an unauthorized API login request based on a result of the comparison; and based on a level of the assessed risk, implemented protective action to mitigate harm that may result from an unauthorized user from accessing information or services from a computer system by way of an API.

Abstract: Adaptive state detection can be provided for conferencing solutions. A monitoring service can be executed on the computing system employed by each participant to access a conference. The monitoring service on a presenter computing system can detect when the presenter has commenced sharing his/her screen or application and can identify a schema for performing state detection. The monitoring service shares the schema with the monitoring services on the listener computing systems. As the screen content is shared, the monitoring services can implement the schema to cause state notifications to be provided to the monitoring service on the presenter computing system. The state notifications can represent whether the listener computing systems are receiving the shared screen content and/or to what extent the shared screen content is delayed.

Abstract: Techniques for protecting an online service against network-based attacks are described. In some cases, protection is performed by way of a scalable protection service including a dynamically scalable set of virtual machines hosted by a cloud service that is distinct from a data center that hosts the online service. The protection service is coupled to the online service via a private link. When an attack is detected by the online service, network traffic bound for the online service is redirected from the public network to the protection service. The protection service then processes the network traffic, such as by dropping network traffic associated with the attack and forwarding legitimate network traffic to the online service via the private link.