Abstract: Described herein are methods, systems and computer products for supporting user interactive actions in workflows integrating multiple disparate web applications by adding (embedding) one or more User Interface (UI) elements in one or more webpages of one or more web applications and linking them with respective workflows. Users visiting these webpages may engage with the added UI elements to interact with the linked workflows. Further described are methods, systems and computer products for enhancing performance of one or more workflows integrating multiple disparate web applications by adjusting the workflows to asynchronously initiate actions which are independent of each other such that the independent actions are executed simultaneously.

Abstract: A method of manipulating a three-dimensional image file including a virtual object includes obtaining image information in a processing device of a non-instrumented physical object manipulated by a user, such image information including movement information; and causing virtual movement of the virtual object based on the movement information. A method of shaping a virtual object includes obtaining image information including movement information; and determining a shape of the virtual object based on the movement information. A method of modifying a virtual object includes obtaining image information including movement information; and altering a virtual surface appearance of at least a part of the virtual object based on the movement information. Systems and computer-readable media are also described.

Abstract: A wearable device that communicates with a host device can be used to initiate a communication functionality of the host device (e.g., telephone calls, text messages). The wearable device can obtain user input indicating a recipient of the communication and in some instances content for the communication and can provide an instruction to the host device. The host device can use the indicated recipient and content to initiate communication and where applicable to send the content. Recipients and/or content can be selected from predefined lists available on the wearable device.

Abstract: Systems and methods for altering the character of data originating from a Virtual Private Network (VPN) are provided. First data is received from the VPN by a first network interface. The first data comprises a first plurality of packets. A message is generated by combining the first plurality of packets. Second data is generated by segmenting the message into a second plurality of packets. A third plurality of packets in the second plurality of packets is equal to the network maximum transfer unit allowed by the Internet and the last packet in the second plurality of packets is less than the network maximum transfer unit allowed by the Internet. The second data is forwarded to the second network interface. The second network interface sends the data to a web server.

Abstract: A system and method support can subnet management in a cloud environment. During a virtual machine migration in a cloud environment, a subnet manager can become a bottleneck point that delays efficient service. A system and method can alleviate this bottleneck point by ensuring a virtual machine retains a plurality of addresses after migration. The system and method can further allow for each host node within the cloud environment to be associated with a local cache that virtual machines can utilize when re-establishing communication with a migrated virtual machine.

Abstract: A method for determining the location of mobile devices, comprising providing at least one mobile device and at least two access points distributed over two or more locations; noting the identity of access points the device is connected to over time; noting transitions between access points a device is connected to and identifying two or more access points as belonging to the same location if the mobile device transitions between connecting to said access points within a certain time period; allocating a first location to a group of access points to which a device transitions within said certain period of time and a second or further location to access points to which a device does not transition to from the first set of access points within said certain period of time; thereby associating groups of one or more access points with one or more locations, and determining the location of the device when it is subsequently connected to one of the located access points.

Abstract: A segmentation server configures and distributes rules for enforcing a segmentation policy that includes one or more virtual patches. The rules including the virtual patches are enforced by distributed enforcement modules that may execute on host devices or on network devices upstream from the host devices. An enforcement module enforces the rules using traffic filters that filter traffic based on network layer data. To implement a virtual patch, the traffic filters are configured to redirect traffic to or from an application being patched to a transparent application proxy. The transparent application proxy implements an application layer filter that filters traffic based on application layer data to block specific types of traffic associated with a vulnerability addressed by the virtual patch.

Abstract: Disclosed is a method for selecting a path in a communication network. The method comprises transmitting, through a device connected to a target node, a beacon, to one or more nodes in the communication network. The beacon comprises a set of informative parameters. The method comprises calculating, by each node, a selective score towards one more paths to be selected for reaching the target node in the communication network. The method further comprises identifying, by each node, a target path from the one or more path. The target path is a path having a highest value of the selective score as compared to selective score for other paths in the one or more paths. The method further comprises selecting, by each node, the target path from the one or more paths for reaching the target node.

Abstract: In general, various aspects of the techniques are described in this disclosure for distributed label assignment for labeled routes. In one example, a method includes obtaining, by a first thread of a plurality of execution threads for at least one routing protocol process executing on processing circuitry of a network device, an allocation of first labels drawn from a label space for a network service; adding, by the first thread, the first labels to a first local label pool for the first thread; generating, by the first thread, after obtaining the allocation of the first labels, a labeled route comprising a route for the network service and a label assigned by the first thread from the first local label pool; and outputting, by the network device, the labeled route.

Abstract: Services with policy control may be provided. A computing device may receive registration information associated with a border device. The registration information may comprise information identifying a service provided by a server associated with the border device, information identifying the border device, and policies associated with the service. Then an address for the server may be determined. Next a request may be received comprising the information identifying the service provided by the server. In response to receiving the request comprising the information identifying the service provided by the server, the address for the server, the information identifying the border device, and the policies associated with the service may be provided.

Abstract: Trusted nodes in a network perform secure out-of-band symmetric encryption key delivery to user devices. A first trusted node receives a request from a first user device to deliver symmetric encryption keys to the first user device and a second user device, as a pair of user devices. The first trusted node delivers a second symmetric encryption key to the second user device, via trusted nodes. The first trusted node receives confirmation of delivery of the second symmetric encryption key. Responsive to the confirmation of delivery, the first trusted node delivers the first symmetric encryption key to the first user device.

Abstract: Examples include registering a device driver with an operating system, including registering available hardware offloads. The operating system receives a call to a hardware offload, inserts a binary filter representing the hardware offload into a hardware component and causes the execution of the binary filter by the hardware component when the hardware offload is available, and executes the binary filter in software when the hardware offload is not available.

Abstract: Devices and techniques for Information Centric Network (ICN) packet transmission control are described herein. An interest (or data) packet may be received at an ICN router. Here, the packet includes quality of service (QoS) information. For an interest packet, the ICN router creates a pending interest table (PIT) entry for the packet. The ICN router determines that it does not have a route for the packet. Thus, if it is an interest packet, there is no forward route in a forwarding information base (FIB). If it is a data packet, there is no corresponding PIT entry. However, after extracting the QoS information from the packet, the ICN router broadcasts the packet in accordance with the QoS information.

Abstract: Various example embodiments relate generally to supporting flow-specific fast rerouting of source routed packets in communication networks. Various example embodiments for supporting flow-specific fast rerouting of source routed packets may be configured to support flow-specific fast rerouting of source routed packets based on use of various source routing protocols which may be based on various underlying communication protocols. Various example embodiments for supporting flow-specific fast rerouting of source routed packets in communication networks may be configured to support flow-specific fast rerouting of source routed packets by supporting use of a source routed packet including a payload and a header where the header encodes a set of hops of a primary path for the source routed packet and where the header also encodes a set of hops of a protection path configured to protect one of the hops of the primary path for the source routed packet.

Abstract: In a mobile network, an identity of a security group associated with user equipments (UEs) may be obtained. A segment route (SR) path for session communications in the mobile network for the UEs may be selected based on the identity of the security group. The SR path may be one of a plurality of SR paths in a transport network used by the mobile network and defined at least in part by one or more segment IDs (SIDs). An identity of a virtual network associated with the security group may also be obtained. The selected SR path and the identity of the virtual network may be provisioned in one or more routers of the transport network, such that IP messages communicated for the UEs in the mobile network are forwarded via the selected SR path and (at least ultimately) via the tunnel associated with the security group.

Abstract: A method for operating a mobile device in a mobile communication network. The method comprises transmitting a mobile device component identifier to a network node within the mobile communication network. The mobile device component identifier identifies at least one hardware or software component of the mobile device. The mobile device component identifier is indicative of capability information specifying at least one capability of the mobile device for communication with the mobile communication network. A corresponding method for operating a network node is also provided.

Abstract: A method for displaying differences between a first executable dataflow graph and a second executable dataflow graph includes comparing a specification of the first executable dataflow graph and a specification of the second executable dataflow graph, including at least one of identifying a particular node or link of the first dataflow graph that does not correspond to any node or link of the second dataflow graph; and identifying a first node or link of the first dataflow graph that corresponds to a second node or link of the second dataflow graph, and identifying a difference between the first node or link and the second node or link. The method includes formulating and displaying a graphical representation of at least some of the nodes or links of the first dataflow graph or the second dataflow graph, the graphical representation including a graphical indicator of at least one of the identified particular node or link the identified difference between the first node or link and the second node or link.

Abstract: Embodiments relate generally to systems and methods for transitioning a system from a tradition network to a Software Defined Network (SDN) enabled network. In some embodiments, the systems and methods may comprise the use of a Path Computation Element (PCE) as a central controller. Smooth transition between traditional network and the new SDN enabled network, especially from a cost impact assessment perspective, may be accomplished using the existing PCE components from the current network to function as the central controller of the SDN network is one choice, which not only achieves the goal of having a centralized controller to provide the functionalities needed for the central controller, but also leverages the existing PCE network components.

Abstract: Various examples are directed to systems and methods for searching application rules. A rule management system may access application rule data describing a first application rule and generate a first textual summary of the first application rule. The rule management system may encode the first textual summary to generate a first rule vector. The rule management system may receive a application rule query. The application rule query may include a query description. The rule management system may encode the query description to generate a first query vector and select the first application rule as responsive to the application rule query using the first rule vector and the first query vector. The rule management system may return the first application rule in response to the application rule query.

Abstract: A method is provided that is performed by a smart network interface card (SmartNIC) that is in communication with a host device that serves as a forwarder in an Hybrid Information-Centric Network (hICN). The method includes storing in a memory of the SmartNIC, mapping information that maps a subset of names of content contained in a content store that is stored in a memory of the host device to corresponding addresses of the content. The method further includes receiving at the SmartNIC, from a requester, an interest that includes a name, and determining whether the name of the interest is included in the mapping information stored in the SmartNIC. The method includes processing the interest based on whether the name of the interest is contained in the mapping information stored in the memory of the SmartNIC.

Abstract: On-circuit data activity monitoring may be performed for a systolic array. A current data activity measurement may be determined for changes in input data for processing at a systolic array and compared with a prior data activity measurement. Based on the comparison, a throttling recommendation may be provided to a management component to determine whether to perform the throttling recommendation.

Abstract: According to an example aspect of the present invention, there is provided a method, comprising: performing a second web browser accessible by a first web browser in a remote user device, communicating with a first web application in the first web browser of the user device, performing a second web application in the second web browser configured to communicate with an automation service of an automation system and provide a user interface to the automation service, receiving first feature information from the first web application, and providing, on the basis of the received first feature information, second feature information for adapting the user interface to the automation service for the user device.

Abstract: A client device may, as part of a remote access or cloud-based network environment, access a resource either by using a connection to a gateway or by using a connection that bypasses the gateway. Which connection is used may be based on the network location of the resources provided by the network environment and network location of the client device. For example, if the client device and a resource are located at the same network location or connected to the same local network, the client device may access the resource by using a connection that bypasses the gateway. If the client device and the resource are located at different network locations or are connected to different local networks, the client device may connect to the gateway to access the resource.

Abstract: A workflow construction system for constructing automation workflows that automate user specific processes. The workflow construction system may include a template library including workflow templates and pre-configured attributes. The workflow template can accelerate the design and construction of custom automation workflows. An orchestration layer included in the workflow construction system will also improve the performance of systems that execute the automation workflows by dynamically scaling the processing capacity, memory, and storage of servers and other systems hosting the model file instances of the automation workflows to ensure the available resources meet the demands of users completing processes using the automation workflows.

Abstract: Techniques are disclosed for service-based tunnel selection for forwarding network traffic. In one example, a network device obtains, based on service parameters associated with a network service, a service-specific tunnel selection scheme. The tunnel selection scheme identifies a primary mapping mode for mapping the network service to a primary transport tunnel and fallback mapping modes for mapping the network service to fallback transport tunnels. The primary mapping mode is categorized according to a first type comprising tunnel colorization, while the fallback mapping modes are categorized according to types other than tunnel colorization. In response to determining that the network service cannot be mapped to the primary transport tunnel according to the primary mapping mode, the network device, maps, based on the fallback mapping modes, the network service to the fallback transport tunnels.

Abstract: A graph data structure for a packet processing system is generated. The structure comprises graph data objects representing classifier nodes of a packet processing graph. The classifier nodes include a root node and leaf nodes. The root node is connected to each of the leaf nodes through respective corresponding packet processing paths through the graph. Each graph data object includes node match data indicative of at least one match to be applied by the respective classifier node. One or more n-type match graph data objects are identified, which include node match data indicative of an n-type match corresponding to content from n header field types. One or more (n+m)-type match graph data objects are identified, which include node match data indicative of an (n+m)-type match corresponding to a combination of content from a (n+m) different header field types. n and m are integer values of 1 or more.

Abstract: One example method, which may be performed at an end device configured to communicate with an edge station, includes listening for a broadcast signal from the edge station, joining a broadcast channel, receiving edge station information, selecting an edge station, transmitting a manifest to the selected edge station, receiving route information from the selected edge station, accessing a container identified in the route information, and issuing a call to the selected edge station to execute an application workload on the container.

Abstract: A classification apparatus includes: a crawler unit that acquires access result data for a website, the access result data including website application information, web server information, and the like that are updated by an administrator of the website; an update history generation unit that generates an update history of the website by making comparison in chronological order between pieces of information included in the access result data for the website; a classifier generation unit that generates a classifier that classifies a website having a possibility of being abused in the future, by using, as a feature value, the update history of the website; and a classification unit that classifies, through the classifier generated, the website having the possibility of being abused in the future.

Abstract: A request is received from a client device over a Virtual Private Network (VPN) tunnel. The request is received at a first one of a plurality of edge servers of a distributed cloud computing network. A destination of the request is determined and an optimized route for transmitting the request toward an origin server is determined. The optimized route is based at least in part on probe data between edge servers of the distributed cloud computing network. The request is transmitted to a next hop as defined by the optimized route.

Abstract: User devices configured to select subsets of network identities and network devices configured to deliver messages based on those subsets are described herein. The user devices each receive multiple network identities for a service account, select a subset of the network identities based on preferences, and provide the selected subset to the telecommunication network in message headers. The preferences indicate network identities for which a user wishes the user device to receive communications. A network device receives and caches the subsets. The network device further utilizes the subsets in determining which user device to deliver messages to.

Abstract: A system and method for management of communications for components of a global accelerator system is provided. The global accelerator system includes client devices communicating with a global access point via a public network to access various endpoints that can host services. In turn, a global access point communicates to various endpoints, which are organized into different data centers, via a private network. The global access point creates and manages separate TCP connections between the client and global access point and the client and endpoint to improve latency experienced by clients. Additionally, each TCP connection can be managed by specifying different congestion control and windowing parameters to leverage higher throughput between the global access point and a selected endpoint.

Abstract: A configuration in which a reception device can determine whether or not data reception via a network is permitted on the basis of signaling data is implemented. A class identifier indicating a group of reception devices or users that are permitted to perform data reception via a network is recorded in signaling data transmitted from a transmission device to a reception device. A reception device determines whether or not a class identifier is identical to a class identifier set to a reception device or a user and performs data reception via a network when the class identifiers are identical to each other. A URL base pattern applied to data reception via a broadcast wave or a network is recorded in signaling data, and a reception device performs data acquisition to which the URL base pattern is applied.

Abstract: In an example, there is disclosed a data exchange layer (DXL) broker, including: a hardware platform including a processor and a memory; a DXL service store; a traditional internet protocol (IP) network stack; a DXL driver to operate a DXL layer on top of the traditional IP network stack; and instructions encoded within the memory to: enumerate a plurality of DXL endpoints connected to the DXL broker via the traditional IP network stack; store IP network routing information and DXL identification information for the DXL endpoints in the DXL service store; receive a DXL message for a DXL endpoint, the DXL message including DXL identification information for one of the plurality of DXL endpoints; and route the DXL message to the one of the plurality of DXL endpoints via the IP network routing information for the one of the plurality of DXL endpoints.

Abstract: The predictive overlay network architecture of the present invention improves the performance of applications distributing digital content among nodes of an underlying network such as the Internet by establishing and reconfiguring overlay network topologies over which associated content items are distributed. The present invention addresses not only frequently changing network congestion, but also interdependencies among nodes and links of prospective overlay network topologies. The present invention provides a prediction engine that monitors metrics and predicts the relay capacity of individual nodes and links (as well as demand of destination nodes) over time to reflect the extent to which the relaying of content among the nodes of an overlay network will be impacted by (current or future) underlying network congestion.

Abstract: Disclosed herein are systems and methods for providing and using a decentralized network using a blockchain. A provider (and/or miner) may provide network coverage to one or more devices in return for tokens on the blockchain. The blockchain may employ a proof-of-coverage scheme to verify (and even guarantee) that the miners are honestly representing the wireless network coverage they are providing. In some instances, the proof of coverage may require the providers to prove coverage periodically, upon demand, and/or at random intervals.

Abstract: A system for estimating contact duration between a pair of communication apparatuses. The system includes a storage device and a monitoring apparatus connected to the apparatuses to collect ARP packets broadcast in the network by a first communication apparatus, and to add timestamp information to the ARP packets, and to store the ARP packets with the timestamp in the storage device DB. The monitoring apparatus further extracts selected ARP packets from the ARP packets stored in the storage device DB, wherein the selected ARP packets includes destination MAC address which is the same as a MAC address of a second communication apparatus, wherein the timestamp information of the selected ARP packets is within a predetermined time range TM. The monitoring apparatus further estimates contact duration between the first and second communication apparatuses based on timestamp information of the selected ARP packets.

Abstract: System and method for efficiently implementing scalable, highly efficient decentralized proxy services through proxy infrastructures situated in different geo-locations. In one aspect, the systems and methods enable users from any geographical location to send requests to the geographically closest proxy infrastructure. One exemplary method described allows proxy infrastructures to gather, classify, and store metadata of exit nodes in its internal database. In another aspect, systems and methods described herein enable proxy infrastructures to select metadata of exit nodes from its internal database and forward requests from a user device to respective proxy servers or proxy supernodes to which the selected exit nodes are connected.

Abstract: The disclosed embodiments relate to securely transferring data between a source node and a destination node using an application whitelist. A control flow may be established between a source node and a perimeter gateway. the perimeter controller may receive a request to establish a node flow between an application executing on the source node and the destination node. the perimeter controller may determine whether the first application is included in an application whitelist that includes applications allowed to transfer data to nodes in a private network via a node flow. A node flow between the source node and destination node may be established upon determining that the first application is included in the application whitelist to facilitate secure data transfer between the source node and destination node.

Abstract: A method for managing a mailbox based on user activity comprises receiving output signals from each of a plurality of mailbox workloads. The output signals may be indicative of user activity for each workload. A last user action time may be determined based on the received output signals using pre-determined, workload specific criteria. A pre-determined action may be performed on the mailbox responsive to a lapsed duration from the last user action time increasing above a threshold.

Abstract: Systems and methods for using tunnels to provide communication channels between nodes in a network, where the tunnels may be, for example, multi-purpose UDP tunnels. Different nodes may be in different networks where at least one network may comprise a complex array of both static and moving communication nodes (e.g., the Internet of moving things) that may include, for example, autonomous vehicles.

Abstract: Data transmitted from an information transmission device can be stored in a distributed manner, without the need to duplicate or transmit/receive data among information storage devices. Under the control of a data write unit, end points to be assigned are determined in each of the information storage devices, based on the preset information indicating a correspondence between the information storage devices and end points assigned to the information storage devices. The data transmitted together with the identifier corresponding to the assigned end point is acquired from among the data transmitted from the information transmission devices, based on a first correspondence table stored in a shared setting storage unit for associating the end points with the identifiers of the types of data acquired by the end points, and the acquired data is stored in the data storage unit.

Abstract: There is disclosed in one example an apparatus, including: a plurality of interconnects to communicatively couple an accelerator device to a host device; and an address translation module (ATM) to provide address mapping between host-physical address (HPA) and guest-physical address (GPA) spaces for the accelerator device, wherein the plurality of devices share a common GPA domain and wherein address mapping is to be associated with only one of the plurality of interconnects.

Abstract: A network device receives a data packet including a source address and a destination address. The network device drops the data packet before it reaches the destination address and generates an error message indicating that the data packet has been dropped. The network device encapsulates the error message with a segment routing header comprising a list of segments. The first segment of the list of segments in the segment routing header identifies a remote server, and at least one additional segment is an instruction for handling the error message. The network device sends the encapsulated error message to the remote server based on the first segment of the segment routing header.

Abstract: The invention, forming a mutual/collaborative puzzle, message/letter chain consisting of information chains that form graphs, lists, or groups, the ability to use defined or calculated measuring units such as distance measured in hops, volume measured in followers, and/or the nature of relationship, according to needs and purposes, using/defining measurements for various needs, to facilitate socializing, sharing, with a search engine accessing information on social networks more efficiently, in a more detailed and speedy way while preventing information pollution, by doing Word, Picture, audio etc. searches, to be used not just for social purposes but research and rapid information attainment, not only for apps but for social media, TV, games.

Abstract: Aspects of the disclosure are directed to a telecommunications network architecture. In accordance with one aspect, a scalable telecommunications network architecture includes at least one infrastructure switching node; at least one user switching node for receiving a session request, wherein the session request includes at least one user attribute; and at least one controller coupled to the at least one user switching node, the at least one controller for examining the session request a) to allocate at least one bandwidth or at least one data rate for the at least one user switching node based on a resource allocation policy and b) to allocate a quantity of switch elements in the at least one infrastructure switching node based on an interconnection policy. In one example, the at least one controller establishes a communications session for a user terminal based on the session request.

Abstract: A logical router includes disaggregated network elements that function as a single router and that are not coupled to a common backplane. The logical router includes spine elements and leaf elements implementing a network fabric with front panel ports being defined by leaf elements. Control plane elements program the spine units and leaf to function a logical router. The control plane may define operating system interfaces mapped to front panel ports of the leaf elements and referenced by tags associated with packets traversing the logical router. Redundancy and checkpoints may be implemented for a route database implemented by the control plane elements. The logical router may include a standalone fabric and may implement label tables that are used to label packets according to egress port and path through the fabric.

Abstract: Systems and methods are provided for dynamic grammar augmentation for editing multiple network switch configuration files as a single file. The method includes identifying a first base grammar of a first network switch; identifying a second base grammar of a second network switch; identifying first and second patch grammars for the first and second network switches; generating an augmented grammar based on the first and second patch grammars and the first and second base grammars; identifying a first configuration file for the first network switch; identifying a second configuration file for the second network switch; generating a base merged configuration file, the base merged configuration file representing the first and second configuration files modified according to the augmented grammar.

Abstract: The disclosure herein describes generating a protected entity of a VCI. A state document is generated based on the metadata state of the VCI and an entity data stream is set to a URI associated with the data of the VCI. Components and associated URIs of the VCI are identified. A combined data stream is set to a URI configured to provide access to the state document, the entity data stream, and the URIs of the components of the VCI. A snapshot API for providing a snapshot of the state of the protected entity, a serialization API for providing a serialized version of the protected entity, and a de-serialization API for converting a serialized version of the protected entity into a de-serialized version of the protected entity are defined. The protected entity is configured to enable the data and metadata of the VCI to be efficiently backed up.

Abstract: A transfer apparatus configured to control transfer of a packet from a transmission source node to a destination node through segment routing includes: a storage unit storing node management information T1 indicating, for each node that functions as a transmission source node or a destination node, an SID list acquisition method of the nodes; a packet reception unit for receiving a reception packet from the destination node; an information setting unit for, if a destination-side SID list acquisition method of the destination node and a transmission source-side SID list acquisition method of the transmission source node do not match each other based on the node management information T1, setting the information that is needed to execute the transmission source-side SID list acquisition method in the reception packet; and a packet transmission unit configured to transmit the reception packet that was subjected to the setting to the transmission source node.

Abstract: Embodiments of the present disclosure relate to methods and apparatuses for downlink control information (DCI) transmission and receiving in a wireless communication system. A DCI configuration parameter can be first transmitted to a terminal device; and then DCI is transmitted to the terminal device, wherein the DCI configuration parameter indicates time-frequency resources for the DCI. With embodiments of the present disclosure, the UE could perform a flexible DCI monitoring according to the DCI configuration parameter and thus it may support the DCI monitoring occasion change due to numerology and scheduling unit size.