This application provides a packet processing method, a device, a system, and a storage medium. A first network device receives an original packet, generates an IPv6 packet based on the original packet and endpoint group (EPG) information, where the IPv6 packet comprises an IPv6 extension header and the original packet, and the IPv6 extension header comprises the EPG information, and sends the IPv6 packet. A second network device receives the IPv6 packet; obtains the EPG information from the IPv6 extension header, and processes the IPv6 packet according to a group based policy corresponding to the EPG information.

A method includes determining a corresponding level of a security model associated with each device of a plurality of devices connected to a network, each level of the security model having a corresponding tag; applying, to each of the plurality of devices, the corresponding tag based on the corresponding level of the security model with which each of the plurality of devices are associated; receiving, over a network connection, network traffic from at least one of the plurality of devices and the corresponding tag; analyzing the corresponding tag associated with the network traffic; determining a destination for the network traffic; applying one or more security measures to the network traffic based on the corresponding tag for the at least one device and a corresponding tag of the destination for the network traffic; and sending the network traffic to the destination with the corresponding tag of the destination.

A method of performing a virtual network function. The method comprises forking a user plane process on a computer by a virtual network function process that executes on the computer, forking a control plane process on the computer by the virtual network function process, adding blocks to a user plane blockchain by the user plane process that record user plane events, adding blocks to a control plane blockchain by the control plane process that record control plane events, creating a first package of information by the user plane process based on the user plane blockchain, self-terminating by the user plane process while passing the first package of information to the virtual network function process, creating a second package of information by the control plane process based on the control plane blockchain, self-terminating by the control plane process while passing the second package of information to the virtual network function process.

A device configured to receive a connection request that includes device authentication credentials and to determine the user device passes authentication in response to identifying a device profile associated with the device authentication credentials. The device is further configured to receive user credentials for a first user and identify a first user identity that corresponds with the user credentials. The device is further configured to establish a first network connection with the user device, to send a token request to the user device, and to receive a token via the first network connection. The device is further configured to identify a second user identity based on the token, to determine the first user identifier matches the second user identifier, and to establish a second network connection for the user device, wherein the network connection enables the user device to access the network.

Embodiments of the present disclosure relate to methods, systems, and computer program products for event management. In a method, a token is obtained at a first agent device that is included in a network system, the token is for authenticating a first packet that is transmitted in the network system, and the first packet is generated according to a first network format. A second packet is generated based on the first packet and the token according to a second network format. The second packet is transmitted to a second agent device that is included in the network system, here both of the first and second agent devices support the first and second network formats. With these embodiments, the packet may be authenticated in a more effective way.

Techniques are described to provide efficient protection for a virtual private network. In one example, a method is provided that includes obtaining a packet at a first network entity; determining that the packet is a packet type of an authentication type; determining whether authentication content for the packet matches known good criteria for the packet type of the authentication type; based on determining that the authentication content for the packet does not match the known good criteria, performing at least one of dropping the packet and generating an alarm; and based on determining that the authentication content for the packet does match the known good criteria, processing the packet at the first network entity or forwarding the packet toward a second network entity.

Systems and methods provide access to location-restricted resources outside of recognized locations. An example, a method includes receiving a request for a controlled access resource from a client device and determining that the request is not associated with a recognized location but that state data exists for the client device identifier. In response to identifying the state data, the method includes generating a link for accessing the controlled access resource at a server, generating an encrypted token including a timestamp, a random number, and licensed resource information from the state data, including the encrypted token in the link, and providing the link to the client device. The client device uses the link to request the controlled access resource from the server, which determines that the request includes the token, determines that the token is not expired, and provides the controlled access resource to the client device.

A method for fetching a content from a web server to a client device is disclosed, using tunnel devices serving as intermediate devices. The tunnel device is selected based on an attribute, such as IP Geolocation. A tunnel bank server stores a list of available tunnels that may be used, associated with values of various attribute types. The tunnel devices initiate communication with the tunnel bank server, and stays connected to it, for allowing a communication session initiated by the tunnel bank server. Upon receiving a request from a client to a content and for specific attribute types and values, a tunnel is selected by the tunnel bank server, and is used as a tunnel for retrieving the required content from the web server, using standard protocol such as SOCKS, WebSocket or HTTP Proxy. The client only communicates with a super proxy server that manages the content fetching scheme.

Embodiments described include systems and methods for providing peer-to-peer caching among client applications. A cache coordinator is configured to receive a first request to register an object stored in a cache by a first client application including a first embedded browser. The first embedded browser obtains the object via a session established by the first embedded browser with a first network application on a server of a second entity. The cache coordinator is configured to store a location of the first client application and a hash of the object. The cache coordinator is configured to receive a second request from a second client application. The second request requests the location of the object among peer client applications. The cache coordinator is configured to communicate identification of the location of the first client application to the second client application for retrieving the object from the cache of the first client application.

Virtual private network (VPN) service provider infrastructure (SPI) receives a request to access a VPN from a client device. The VPN SPI selects an Internet Protocol (IP) address for access to the VPN by the client device from a pool of IP addresses. The VPN SPI provides access to the VPN for the client device via the IP address. The VPN SPI receives one or more handshake notifications from the client device. The VPN SPI determines that a threshold time period has passed since a latest-in-time handshake notification of the one or more handshake notifications. The VPN SPI disconnects the client device from the VPN in response to determining that the threshold time period has passed. The VPN SPI adds the IP address to the pool of IP addresses in response to disconnecting the client device from the VPN.