A network device may receive, from an application on a user device, a first network packet associated with a packet flow. The network device may identify an application identifier of the first network packet, wherein the application identifier identifies the application on the user device. The network device may select, based on the application identifier, a security protocol, wherein the security protocol is associated with at least one of an authentication header (AH) or an encryption algorithm. The network device may selectively apply, to a second network packet associated with the packet flow, at least one of the AH or the encryption algorithm, associated with the security protocol, to generate a protected network packet. The network device may transmit the protected network packet.

A segmentation server updates enforcement of a segmentation policy based on detection of core services. The segmentation server obtains characteristics of workloads and identifies workloads that provide core services using port matching, supervised learning based classification, semi supervised learning based classification, or a combination thereof. The segmentations server applies labels to workloads identified as core service providers indicative of the detection. Rules of the segmentation are distributed to enforcement modules based on the label sets of associated workloads to enable the enforcement modules to enforce the segmentation policy. Detection of core services reduces the likelihood of administrator inadvertently enforcing a policy that blocks essential core services.

A voice call method applied to a terminal including a first subscriber module and a second subscriber module, including: monitoring a network quality of the first subscriber module while performing an Internet protocol Multimedia Subsystem (IMS) session; and in response to determining that the network quality of the first subscriber module while performing the IMS session does not satisfy a preset network quality condition, and the second subscriber module satisfies a predetermined switching condition, switching to the second subscriber module to continue the IMS session.

Methods, apparatus and systems for address configuration for integrated access and backhaul (IAB) links are disclosed. In one embodiment, a method performed by a first network node is disclosed. The method comprises: obtaining, from an operations administration and maintenance (OAM) or a second network node, a first address information related to at least one Internet Protocol security (IPsec) address; generating, based on the first address information, a second address information; and transmitting, to the second network node, the second address information based on a radio resource control (RRC) message, wherein the first network node and the second network node are connected via a backhaul link in an integrated access and backhaul (IAB) network.

A secure private network connectivity system (SNCS) within a cloud service provider infrastructure (CSPI) is described that provides secure private network connectivity between external resources residing in a customer's on-premise environment and the customer's resources residing in the cloud. The SNCS provides secure private bi-directional network connectivity between external resources residing in a customer's external site representation and resources and services residing in the customer's VCN in the cloud without a user (e.g., an administrator) of the enterprise having to explicitly configure the external resources, advertise routes or set up site-to-site network connectivity. The SNCS provides a high performant, scalable, and highly available site-to-site network connection for processing network traffic between a customer's on-premise environment and the CSPI by implementing a robust infrastructure of network elements and computing nodes that are used to provide the secure site to site network connectivity.

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for generating signed addresses. One of the methods includes receiving, by a component from a device, a plurality of first requests, each first request for a physical address and including a virtual address, determining, by the component, a first physical address using the virtual address, generating a first signature for the first physical address, and providing, to the device, a response that includes the first signature, receiving, from the device, a plurality of second requests, each second request for access to a second physical address and including a second signature, determining, by the component for each of the plurality of second requests, whether the second physical address is valid using the second signature, and for each second request for which the second physical address is determined to be valid, servicing the corresponding second request.

A device within a small cell may establish a first secure communication channel between the device and a network device based on a first type of encryption. The device within the small cell may transmit data between the small cell and a core network via the first secure communication channel. The device within the small cell may receive information associated with a second type of encryption, wherein the second type of encryption is different from the first type of encryption. The device within the small cell may terminate the first secure communication channel. The device within the small cell may establish a second secure communication channel between the device and the network device based on the information associated with the second type of encryption. The device within the small cell may transmit further data between the small cell and the core network via the second secure communication channel.

Technologies for bi-directional encryption and decryption for underlay and overlay operations are described. One network device includes multiple ports, a network processing element, a programmable path-selection circuit, and a security IC. The programmable path-selection circuit is configured to operate in a first mode in which first outgoing packets are routed to the security integrated circuit to be encrypted before sending on one of the ports, and first incoming packets, received on one of the ports, are routed to the security integrated circuit to be decrypted. The programmable path-selection circuit is configured to operate in a second mode in which second incoming packets are routed to the security integrated circuit to be encrypted before processing by the network processing element and route second outgoing packets to the security integrated circuit to be decrypted after processing by the network processing element.

Computing devices and method for performing a secure neighbor discovery. A local computing device transmits an encrypted local node identifier and an encrypted local challenge to a remote computing device. The remote computing device generates a local challenge response based on the local challenge; and transmits an encrypted remote node identifier and an encrypted local challenge response to the local computing device. The local computing device determines that the received local challenge response corresponds to an expected local challenge response generated based on the local challenge. The remote computing device further transmits an encrypted remote challenge. The local computing device generates a remote challenge response based on the remote challenge; and transmits an encrypted remote challenge response to the remote computing device. The remote computing device determines that the received remote challenge response corresponds to an expected remote challenge response generated based on the remote challenge.

A software defined data security level method, computer program product, and data processing system. One embodiment may comprise intercepting, by a processor at a data security layer, an input/output (IO) request from a local software application, wherein the IO request includes a header and a data payload, analyzing, by the processor at the data security layer, the data payload of the IO request relative to a service level agreement (SLA), assigning, by the processor at the data security layer, a security level to the IO request based on the analysis.