10 results about "Middlebox" patented technology

The present disclosure relates to systems, methods, and computer-readable media for increasing resiliency in distributed units of a virtual radio access network (vRAN) of a telecommunications network (e.g., a 5G telecommunications network), particularly when performing a planned handover operation between the distributed units. The examples described herein specifically relate to implementing an inter-distributed unit handover between distributed units that are serviced by the same radio unit. In some examples, this handover is initiated by a middlebox entity that is positioned between the distributed units and a centralized unit. In some instances, features of the middlebox entity are implemented within the framework of a centralized unit. By allowing a quick handover as described herein, the distributed units can provide uninterrupted service to a UE while allowing the distributed units to perform various upgrades or modifications to the distributed unit without service interruptions.

This document relates to techniques for providing connectivity features in a radio access network. For instance, the disclosed techniques can employ a middlebox to process fronthaul traffic relating to communications between distributed units and radio units of a radio access network. The processing can provide various connectivity features, such a distributed antenna system connectivity feature, a distributed multiple-input and multiple-output connectivity feature, and / or a radio unit sharing feature that involves sharing of a particular radio unit among two or more distributed units. The processing can also provide an application programming interface for accessing scheduling information, signal quality measurements, buffer status, random access attempts, and / or network load relating to the fronthaul traffic.

The invention discloses a vehicle-mounted data credible generation method and device and a storage medium. And the vehicle-mounted terminal collects power supply voltage in the time window and generates physical side characteristics, collects vehicle bus data to generate logic side characteristics and performs time alignment, and calculates consistency measurement to obtain a judgment result. Generating an abstract from the data block to be reported according to the normalized code, and binding the abstract with the window identifier, the monotonic counter reference information and the measurement rule version identifier; when it is judged that a preset condition is met, a security component (security unit / trusted execution environment) executes a signature or an authentication code on the abstract to generate a state verification voucher; and if not, outputting a failure reason code and optionally generating an abnormal audit voucher capable of being verified. In some embodiments, a lightweight digital twinning model or predictive model is executed within a security component, physical / logical side observability measurements at the next moment are predicted based on load-related characteristics, and gating is performed on predicted residuals to identify smart simulator attacks. According to the scheme, playback, injection and middle box playback are inhibited, and the authenticity and proof performance of the afterloading OBD scene data are improved.

Some embodiments provide a novel method for migrating virtual machines (VMs) from a first host computer to a second host computer. The first host computer is connected to a physical network interface card (PNIC) that performs middlebox service operations for flows associated with the VMs. At the PNIC, the method receives a notification that a VM is to be migrated from the first to the second host computer. The method configures an embedded hardware switch of the PNIC to forward a set of flows associated with the VM to a firewall of the PNIC. The embedded hardware switch was initially programmed to process the set of flows instead of the firewall. The method synchronizes flow cache information regarding the set of flows from the embedded hardware switch to the firewall. The method processes the set of flows at the firewall until the VM is migrated to the second host computer.

A system and method for secure transport resumption during post-quantum migration. A server negotiates a handshake and issues a session ticket embedding scope metadata that identifies a key-exchange class (e.g., hybrid post-quantum and classical, or classical), and may include a schema version, service-identity scope, policy flags, a rollout epoch, and a site identifier. On a subsequent connection the client presents the ticket with a resumption binder. The server selects an expected binder class from the scope metadata, verifies the binder using a pre-shared key derived for the selected class, and accepts or refuses resumption accordingly. Binding resumption to the negotiated class mitigates cross-class replay and downgrade while remaining compatible with classical endpoints and middleboxes. Optional embodiments include certificate-transparency enforcement via policy flags, point-of-presence scoping, epoch-based rollout and rollback, and hardware-security-module-gated key activation with quorum approval and attestation. The approach enables black-box verifiability and incremental, standards-conformant deployment.

Various aspects of the present disclosure generally relate to wireless communication. In some aspects, a network entity may receive, from a security service device, a middlebox security policy, wherein the middlebox security policy is associated with a user equipment (UE) and a service device, and wherein the middlebox security policy indicates a set of authorization policies relating to one or more of the UE or the service device. The network entity may receive a communication on a communication link between the UE and the service device. The network entity may transmit the communication in accordance with the middlebox security policy. Numerous other aspects are described.

Some embodiments provide a novel method of migrating a particular virtual machine (VM) from a first host computer to a second host computer. The first host computer of some embodiments has a physical network interface card (PNIC) that performs at least one of network forwarding operations and middlebox service operations for the particular VM. The first host computer sends, to the PNIC of the first host computer, a request for state information relating to at least one of network forwarding operations and middlebox service operations that the PNIC performs for the particular VM. The first host computer receives the state information from the PNIC. The first host computer provides the state information received from the PNIC to the second host computer as part of a data migration that is performed to migrate the particular VM from the first host computer to the second host computer.

Some embodiments of the invention provide novel methods for facilitating distributed SNAT (dSNAT) middlebox service operations of a first network at a host computer in the first network and at a gateway device between the first network and a second network on which middlebox service operations are performed. The novel methods enable dSNAT of stateful middlebox services to be provided at multiple host computers, thus avoiding the bottleneck problem associated with providing stateful middlebox services at gateways, and also significantly reduce the need for redirection of packets received at the wrong host by using the capabilities of off-the-shelf gateway devices to perform IPv6 encapsulation of IPv4 packets and assign locally unique IPv6 addresses to each host executing a dSNAT middlebox service instance used by the performing gateway device.

A middlebox is inserted downstream from a bottleneck and a marking node is inserted upstream from the bottleneck. When a non-TCP message is received at the middlebox, the middlebox sends a message to the marking node to mark messages being downloaded as enabled for a particular protocol and marked to reflect an expedited forwarding (e.g., DCSP 45). When a node having the bottleneck receives the message having the ECT(1) marking, if there is congestion, the ECT(1) marking is changed to Congestion Experienced (CE). The middlebox reacts to the marking by controlling the sender to follow a scalable congestion controller response curve achieved by (1) NonTCP QB flows are controlled by delaying acknowledgments and selectively dropping messages and (2) TCP flows are controlled by overwriting the receive window in acknowledgments. Alternatively, TCP flows where the server supports L4S can be controlled by echoing congestion via ‘Accurate ECN’.

This invention discloses a service-aware NFV network routing method and apparatus, belonging to the field of communication network and network function virtualization technology. After acquiring network topology, link load / bandwidth, node intermediate box processing capacity and space resources, and flow request information, the method determines the dependencies of required intermediate boxes and configures a traffic change rate ratio for each intermediate box type. Under the constraint of dependency, the partial-order service set is converted into a full-order service chain based on the ratio. Then, based on the full-order service chain, the shortest path calculation is performed in stages to jointly determine the routing path and intermediate box service location. When the processing capacity of existing instances is insufficient, new instances are started based on the remaining space. Finally, the SDN controller issues flow tables to realize forwarding. This invention can effectively reduce end-to-end latency and packet loss rate, improve flow success rate, and achieve network load balancing.