Alcatel Lucent

Matsushita Electric Industrial Co., Ltd.

Nokia Solutions and Networks Oy

Alcatel-lucent USA Inc.

Lucent Technologies Inc.

Panasonic Technologies, Inc.

Nokia Technologies Oy

Panasonic Corporation

Florida State University Research Foundation, Inc.

Nokia of America Corporation

Matsushita Electrical Industrial Co., Ltd.

Sarit Mukherjee

Sampath Rangarajan

Fang Hao

Hyunseok Chang

Sanjoy Paul

Katherine Hua Guo

Ibrahim Mostafa Kamel

Mostafa Uddin

Muralidharan Sampath Kodialam

Dennis Bushmitch

Walid G Aref

Limin Wang

T V Lakshman

Tejas Naik

Tirunell V Lakshman

David Alan Braun

Haoyu Song

Ashok Samal

Anand Kagalkar

Harish Viswanathan

Ranjan Sharma

Scott Corey Miller

Michael D Turner

Ramachendra Prahlada Batni

Ajay Rajkumar

Suman Das

Murali Kodialam

Girish P Chandranmenon

Sureshbabu P Nair

Sudhir Aggarwal

Priya Rajan

Lakshminath R Dondeti

Hemant Banavar

Krishan Kumar Sabnani

Dimitrios Stiliadis

Tirunellai V Lakshman

Sathya Narayanan

Pablo Rodriguez

Robert Fish

Kumar Venkata Vemuri

Tv Lakshman

Huanle Zhang

Cuneyt Akinlar

Pablo Rodriquez

Anil Takkallapalli

Sarang Moreshwar Gadgil

Muthukumar Ratty

Quin Shi

Fugui Wang

Prasant Mohapatra

Myung Jin Lee

Walid Abdelrahman

Sunghwan Ihm

Various example embodiments for supporting zero-trust policy enforcement in a communication system are presented herein. Various example embodiments for supporting zero-trust policy enforcement in a communication system may be configured to support zero-trust policy enforcement, including zero-trust authentication, for Remote Direct Memory Access (RDMA) communications. Various example embodiments for supporting zero-trust policy enforcement for RDMA communications may be configured to support transparent zero-trust policy enforcement for RDMA communications by leveraging programmable Smart Network Interface Cards (SmartNICs). Various example embodiments for supporting zero-trust policy enforcement for RDMA communications based on leveraging of programmable SmartNICs may be configured to support zero-trust policy enforcement for RDMA communications by applying zero-trust policies on a connection-by-connection basis within SmartNICs for RDMA connections between RDMA applications hosted on end hosts served by the SmartNICs.

Zero-trust authentication for secure remote direct memory access

A CPU implements a virtual network function (VNF) associated with flow processing and can offload at least some of the flow processing to a hardware accelerator. A module (e.g., TOR switch), external to the software-based processor and the hardware accelerator, examines packet flows and determines (e.g., using a top-K elephant-flow-detection algorithm) which ones are more suitable for offloading from the software-based processor to the hardware accelerator than others. The external module communicates the relative suitability for offloading to the CPU using packet tags or out-of-band messaging, and the CPU uses the relative suitability to determine which flows to offload or onload. In some implementations, the CPU can instruct the external module to change the value of K used in the algorithm.

In-network decision for end-server-based network function acceleration

An end-to-end telemetry system for a Remote Direct Memory Access (RDMA) communication network having multiple end-servers. The system includes an RDMA tracer for each end-server, one or more programmable data planes, and a telemetry collector. Each RDMA tracer extracts host-level telemetry information for one or more RDMA sessions associated with the corresponding end-server. Each programmable data plane extracts network-level telemetry information for one or more RDMA sessions associated with the programmable data plane. The telemetry collector (i) receives the host-level telemetry information from the RDMA tracers and the network-level telemetry information from the one or more programmable data planes and (ii) generates telemetry reports based on the host-level and network-level telemetry information. In some implementations, the system enables real-time monitoring of RDMA traffic at the RDMA protocol level granularity across all RDMA-enabled workloads for different use cases.

End-to-end RDMA telemetry system

System, method, and software for detecting anomalies in data generated by microservices. In one embodiment, an anomaly detector collects performance metrics for a microservice deployed in a data center for an application. The anomaly detector transforms the performance metrics into a time-series structured dataset for the microservice, and feeds the structured dataset to a machine learning system to determine whether an anomaly exists in the structured dataset based on an anomaly detection model. The anomaly detector performs an anomaly classification with the machine learning system based on an anomaly classification model and the structured dataset when an anomaly is detected in the structured dataset, and performs an action based on the anomaly classification.

Anomaly detection for microservices

Packet-processing circuitry including one or more flow caches whose contents are managed using a cache-entry replacement policy that is implemented based on one or more updatable counters maintained for each of the cache entries. In an example embodiment, the implemented policy enables the flow cache to effectively catch and keep elephant flows by giving to the caught elephant flows appropriate preference in terms of the cache dwell time, which can beneficially improve the overall cache-hit ratio and/or packet-processing throughput. Some embodiments can be used to implement an Open Virtual Switch (OVS). Some embodiments are advantageously capable of implementing the cache-entry replacement policy with very limited additional memory allocation.

Flow cache management

An apparatus may implement an ad hoc service switch to establish an ad hoc link between ad hoc devices, such that the apparatus is a transparent node in an ad hoc link between the ad hoc devices. The apparatus may implement rule-based control of at least one ad hoc device, based on processing a data packet received from an ad hoc device via the ad hoc link. Rule-based control may include performing at least one operation of selectively forwarding the data packet, selectively inhibiting the data packet from being forwarded, modifying the data packet, and generating and transmitting a new data packet. The apparatus may establish the ad hoc link via an initial ad hoc link between the apparatus and the first device, a network communication link between the apparatus and an external apparatus, and an ad hoc link between the external apparatus and the second device.

Ad hoc service switch-based control of ad hoc networking

A plurality of agents is instantiated on a corresponding plurality of servers that are running concurrent instances of a control plane application. A first agent is selected from the plurality of agents to mediate communication between a client and the concurrent instances of the control plane application running on the plurality of servers. The first agent replicates uplink packets received from the client for transmission to the plurality of agents. A first connection is used to convey the uplink packets. The first agent transmits a single copy of redundant downlink packets received from the plurality of agents to the client via the first connection. In some cases, the first connection is a stateful transmission control protocol (TCP) connection and the first agent replicates the uplink packets received in a single TCP stream. The first agent merges the redundant downlink packets into the single TCP stream.

Splicing concurrent connections into a high availability session

A packet splicer receives, from a first server of a plurality of servers, a first request for retransmission of an uplink packet that was received from a client and replicated to the plurality of servers. The plurality of servers is running concurrent instances of a control plane application configured to process information in the uplink packet. The packet splicer transmits the first request for retransmission of the uplink packet to the client. The packet splicer bypasses transmission of a second request for retransmission of the uplink packet received from a second server of the plurality of servers. In some cases, the packet splicer receives, from the client, a request for retransmission of a downlink packet that was redundantly transmitted by the plurality of servers. The packet splicer replicates the request for retransmission of the downlink packet to the plurality of servers.

Acknowledgment and packet retransmission for spliced streams

System, method, and software for managing packet forwarding by end devices that use Zigbee protocol. In one embodiment, a P4 switch is implemented at an edge of an IP network as an intermediary between the end devices that use Zigbee protocol so that packets forwarded by each of the end devices flow through the switch. The switch includes a transceiver configured to receive a packet forwarded by a first endpoint in an end device and destined for a second endpoint. The switch includes a P4 parser configured to parse the packet to identify fields of the packet, and a P4 analyzer configured to process a plurality of match-action tables and the fields of the packet to provide data plane handling of the packet.

Service automation for IoT devices using P4

Internet-of-Things messages can be transported, encoded and decoded using inventive source and destination attribute labels.

Systems and methods for encoding and decoding IoT messages

A method, apparatus, and computer program product are disclosed for determining, by a mobile wireless device, a likelihood that a first device ID of a target wireless device corresponds to a physical location of the first wireless device at a first measurement location, based on comparing a measured received signal strength of the target wireless device at the first and a second measurement locations and comparing the measured received signal strength of one or more other wireless devices at the first and second measurement locations. The mobile wireless device registers the first device ID of the target wireless device and associates the registered first device ID with the determined corresponding physical location of the target wireless device.

Augmented onboarding of internet-of-things devices

The invention is directed to providing cloud-based services using dynamic network virtualization. Embodiments of the invention provide a cloud-based service over a system that has a dynamic network virtualization architecture. The architecture includes a set of distributed forwarding elements with centralized control, and at least one virtual machine that is bound to one of the forwarding elements. These features enable the virtual machine to be migrated across a wide area network while maintaining its original IP address and service continuity.

Providing cloud-based services using dynamic network virtualization

Various exemplary embodiments relate to a method and related network node including one or more of the following: receiving, at the cloud controller, a request message including a first request for a first cloud resource; identifying a set of potential devices for providing the first cloud resource; calculating a plurality of weight values corresponding to at least a portion of the set of potential devices for providing the first cloud resource, wherein the plurality of weight values are calculated based on a plurality of delta values associated with the at least a portion of the set of potential devices; selecting a device based on the plurality of weight values to provide the first cloud resource; and updating the delta value associated with the selected device.

Resource placement in networked cloud based on resource constraints

A network comprises agents which act as proxies on behalf of devices, such as wireless game devices, phones and personal digital assistants. Each agent collects information concerning a 'presence status' of a device. An agent determines whether to forward messages on to a device depending on the collected presence status (e.g., active/inactive) of the device. For example, if the presence status indicates the device is active then messages will be forwarded. If, however, the status indicates the device is inactive the message will not be forwarded. Instead, the agent may act as a proxy for the device while it is inactive. By only forwarding messages when a device is active, valuable airlink time and/or bandwidth can be conserved.

Presence management proxying methods and devices

Growing community of inventors

Morganville, NJ, United States of America

Sarit Mukherjee