Patent application number | Description | Published |
20080298592 | TECHNIQUE FOR CHANGING GROUP MEMBER REACHABILITY INFORMATION - In one embodiment, a technique for updating an address associated with a first entity in a communications network with a second entity in the communications network wherein the address is used to forward information to the first entity from the second entity. The first entity registers a first address associated with the first entity with the second entity. The first entity determines that a second address associated with the first entity is to be used instead of the first address to communicate with the first entity. The first entity generates an update message containing the second address, the update message obviating having to register the second address with the second entity. The first entity forwards the update message to the second entity to cause the second entity to use the second address instead of the first address to forward information to the first entity. | 12-04-2008 |
20080317019 | Managing Mobile Nodes In A Lawful Intercept Architecture - In an embodiment, a care-of address associated with a first node coupled to a communications network via an access node is received. The care-of address may be contained in a notification message sent by a home agent associated with the first node or by a binding update message sent by the first agent. The access node is identified using the care-of address. A request to tap communications associated with the first node at the access node is generated and the request is forwarded to the access node to cause communications associated with the first node to be tapped at the access node. | 12-25-2008 |
20080320303 | VPN PROCESSING VIA SERVICE INSERTION ARCHITECTURE - In one embodiment, a method can include: (i) sending a request to join a group to a service broker; (ii) receiving from the service broker a list of key servers servicing the group; and (iii) sending registration information to a selected one of the key servers in the list. | 12-25-2008 |
20090034430 | INFRASTRUCTURE FOR MEDIATION DEVICE TO MEDIATION DEVICE COMMUNICATION - Methods and apparatus for providing a mediation device infrastructure that allows a mobile node to be tapped while roaming among and within service providers are disclosed. In one embodiment, a method includes determining when a node that is tapped by a first mediation device has moved from a first domain associated with the first mediation device into a second domain associated with a second mediation device. A first packet is sent to the second mediation device if the node has moved. The first packet provides an indication that the second mediation device is to tap the node. The method also includes opening a call data channel to the second mediation device, and receiving information from the second mediation device on the call data channel that is obtained by the second mediation device from the node. Finally, the method includes providing the information to the first mediation device. | 02-05-2009 |
20090034557 | METHOD AND SYSTEM FOR DYNAMIC SECURED GROUP COMMUNICATION - A system and method directed to carrying out dynamic secured group communication is provided. The method includes obtaining a first packet that includes a first header. The first header includes a first source address of a first source node of a first network, and a first destination address of a first destination node of the first network. The method also includes forming a frame that includes the first header in encrypted form, combining the first header and the frame to form a second packet, and forming a second header. This second header includes a second source address of a second source node of a second network, and a second destination address of a second destination node of the second network. The method further includes encapsulating the second packet with the second header to form a third packet, and communicating the third packet into the second network from the second source node for termination to the second-destination node. | 02-05-2009 |
20090037713 | OPERATION, ADMINISTRATION AND MAINTENANCE (OAM) FOR CHAINS OF SERVICES - In one embodiment, a method can include: selecting an operation, administration, and maintenance (OAM) type for a destination, where the destination is enabled for a service insertion architecture (SIA); encapsulating an OAM packet with the OAM type indicated in a service header therein; and sending the OAM packet to the destination. | 02-05-2009 |
20090052466 | COMMUNICATION PATH SELECTION - In an example embodiment, a method for selecting a communication path is provided. The method may comprise receiving data encapsulated in a transport protocol. In addition, a classification type and exit path information associated with the classification type may be received. The data is associated with the classification type and then is encapsulated in Stream Control Transmission Protocol (SCTP) based on the exit path information. This exit path information is associated with the classification type that is associated with the data. | 02-26-2009 |
20090059914 | METHODS FOR THE SECURED INTERCONNECTION OF VNET SITES OVER WAN - One embodiment provides a method to interconnect virtual network segments (VNETs) defined for a local-area network (LAN) infrastructure separated by a wide-area network infrastructure. The technique involves the routing device at the LAN-WAN interconnection points to impose or dispose the VNET-shim, which encodes the VNET-id information in a Layer 4 portion of the packet. In a data plane, a new IP protocol value may be used to signify the presence of the VNET-shim followed by cryptography specific information in an IP packet. In a control plane, the routing protocol is expanded to exchange the routing information along with the VNET information. | 03-05-2009 |
20090097417 | SYSTEM AND METHOD FOR IMPROVING SPOKE TO SPOKE COMMUNICATION IN A COMPUTER NETWORK - Various embodiments of the disclosed subject matter provide methods and systems for improved efficiency in spoke-to-spoke network communication. Embodiments provide systems and methods for registering a spoke with a hub, updating at least one database with spoke registration information at the hub, and advertising the spoke registration information to other spokes using a single control plane that includes transport security, peer discovery, and unicast routing information. | 04-16-2009 |
20090122985 | DISTRIBUTION OF GROUP CRYPTOGRAPHY MATERIAL IN A MOBILE IP ENVIRONMENT - In one embodiment, a Home Agent receives a Mobile IP registration request from a group member, where the group member is a Mobile Node. The Home Agent generates a mobility binding for the group member that associates the group member with a care-of address, wherein the group member is a member of one or more groups. The Home Agent generates a Mobile IP registration reply, where the Mobile IP registration reply identifies one or more key servers. Each of the one or more key servers serves at least one of the one or more groups and is adapted for distributing group cryptography material to members of each group that is served by the corresponding key server. The Home Agent sends the Mobile IP registration reply to the group member, thereby enabling the group member to obtain cryptography material for at least one of the one or more groups from at least one of the one or more key servers to enable the group member to use the cryptography group material to securely communicate with other group members. | 05-14-2009 |
20090157901 | SYSTEM AND METHOD FOR USING ROUTING PROTOCOL EXTENSIONS FOR IMPROVING SPOKE TO SPOKE COMMUNICATION IN A COMPUTER NETWORK - Systems and methods for using routing protocol extensions to improve spoke to spoke communication in a computer network are disclosed. Embodiments provide systems and methods to establish a tunnel between a first spoke and a hub, exchange routing information between the first spoke and the hub using a routing protocol, extend the routing protocol and an associated database to include next hop mapping information, and establish a tunnel between the first spoke and a second spoke according to information in the database. | 06-18-2009 |
20090175194 | IP SECURITY WITHIN MULTI-TOPOLOGY ROUTING - A method for IP Security within Multi-Topology Routing is disclosed. Disclosed methods may also include IKE extensions. A route eligible for IPSec protection is injected into a topology routing table. Network traffic can then be protected in accordance with a security session, such as an IPSec session, between a first network node and a second network node and forwarded through a selected topology to take advantage of the service-differentiation capabilities of MTR. | 07-09-2009 |
20090274042 | NETWORK BASED SWITCHOVER TO ORIGINAL CONTENT AFTER AD-INSERTION DEVICE FAILURE - In one embodiment, a network device joins a first multicast tree to receive post-ad-inserted video content. The network device also joins a second multicast tree to receive the pre-ad-inserted video content. The content from the first multicast tree is forwarded by the network device to the receiver(s). The network device determines if it does not receive the content on the first multicast tree due to any failure, in which case, it delivers the content from the second multicast tree to the receiver(s). This enables the receiver to receive the original (pre-ad-inserted) content during the failure in first multicast tree. When the failure is resolved, the network device can go back to sending the content from the first multicast tree to the receiver(s). | 11-05-2009 |
20100046511 | Automated Discovery of Network Devices Supporting Particular Transport Layer Protocols - Disclosed are, inter alia, methods, apparatus, computer-storage media, mechanisms, and means associated with automated discovery of network devices supporting particular transport layer protocols, such as, but not limited to Stream Control Transmission Protocol (SCTP). Packet switching devices automatically discover peer packet switching devices supporting a particular transport layer protocol, and then establish a session using the particular transport layer protocol between them for subsequent use in transporting packets. | 02-25-2010 |
20100054245 | SYSTEM AND METHOD FOR MULTICASTING IN AN INTERNET PROTOCOL VIRTUAL PRIVATE NETWORK ENVIRONMENT - A method is provided in one example implementation and includes sending a PIM join message to the second spoke router by the hub router. The second spoke router dynamically determines each interested remote spoke router by parsing a hub-sent PIM message and accordingly constructs the multicast routing entry such that the first and second spoke routers establish multicast communication independent of a hub router. In more specific embodiments, the PIM join/prune messaging includes a list of each downstream spoke router that sent a PIM join/prune, in a new attribute. The PIM join/prune message is sent by the hub router towards a multicast source. A new receiver-list attribute is created that the hub router populates with a non-broadcast multi-access (NBMA) address for each interested spoke router. | 03-04-2010 |
20100063988 | Service Insertion in a Computer Network Using Internet Protocol Version 6 Techniques - Apparatus, methods and computer programs enable carrying service insertion architecture data plane packets in IPv4 or IPv6 networks by packaging destination addresses using IPv6 mechanisms. For example, a data processing apparatus is configured for receiving, from a service broker, a service label and an Internet Protocol version 6 (IPv6) address of a first service node; receiving an IPv4 packet requesting a service associated with the first service node; creating an IPv6 packet comprising a service label in a Flow Label field of the IPv6 packet, the IPv6 address of the first service node in a destination address field of the IPv6 packet, and the IPv4 packet in a payload field of the IPv6 packet; forwarding the IPv6 packet to the first service node. Approaches allow service insertion architecture support for all-IPv6 traffic including tunneled and non-tunneled techniques for environments in which user applications place data in the flow label field. | 03-11-2010 |
20100080226 | SERVICE PATH SELECTION IN A SERVICE NETWORK - A service chain system is provided. The system includes a packet of data that is operable to pass through a network of service nodes as defined by a service chain; and a service classification device that is operable to change the service chain based on a system performance. | 04-01-2010 |
20100085977 | Optimized Dynamic Multipoint Virtual Private Network Over IPv6 Network - Method and apparatus including registering a first spoke router with a hub router, forwarding an Internet Protocol version Four (IPv4) data packet from the first spoke router to a second spoke router over an Internet Protocol version Six (IPv6) multipoint tunnel via the hub router, transmitting a binding information associated with the first spoke router from the hub router to the second spoke router, and establishing a direct communication path by the second spoke router with the first spoke router based on the received binding information are provided. | 04-08-2010 |
20100135294 | Any-to any multicasting in a tunnel based virtual private network - Systems, methods, and other embodiments associated with any-to-any multicasting in a tunnel based virtual private network (VPN) are described. One example method includes calculating a resolved address for an unknown reverse path forwarding (RPF) neighbor in an any-to-any multicasting route. The resolved address is calculated using next hop resolution protocol (NHRP) resolution. The address is to be resolved based on control plane traffic. The NHRP address resolution is not to affect unicast routing. The example method may also include establishing the any-to-any multicasting route. Since the multicasting route is any-to-any (e.g., spoke-to-spoke), the multicasting route is not required to include a hub in the logical hub-and-spoke network. | 06-03-2010 |
20100254385 | Service Insertion Architecture (SIA) in a Virtual Private Network (VPN) Aware Network - Systems, methods, and other embodiments associated with interworking a VPN and an SIA are described. One example apparatus includes a mapping data store to store a mapping between two logical groups of network devices having separate forwarding planes that are at least partially incompatible. The apparatus includes an instantiation logic to establish the mapping based on unique identifiers associated with the logical groups. The apparatus also includes an encoding logic to implicitly encode information to identify the first logical group in a packet received from the first logical group, provided to the second logical group, and then provided back to the first logical group. The implicitly encoded information is configured to be used without modification by the forwarding plane associated with the second logical group and is configured to facilitate a member of the second logical group resolving the mapping. | 10-07-2010 |
20110023090 | INTEGRATING SERVICE INSERTION ARCHITECTURE AND VIRTUAL PRIVATE NETWORK - Apparatus, methods, and other embodiments associated with providing service insertion architecture (SIA) differentiated services in a virtual private network (VPN) environment are described. Embodiments may provision an authentication, authorization, and accounting (AAA) server with user-to-SIA service-context mapping information. With the AAA server provisioned, embodiments may acquire, in an IPSec VPN hub, during IPSec tunnel user authentication, from the AAA server, the user-to-SIA service-context mapping information. With the mapping information available, embodiments may dynamically map an SIA service to an IPSec VPN tunnel user based on the service information acquired from the Service Broker or Pseudo-Service Broker. The dynamic mapping facilitates providing differentiated services in the SIA by facilitating forwarding an IPSec packet received on the IPSec VPN tunnel from the user to a service node associated with the SIA service based, at least in part, on the IPSec SADB entry modified using the service information. | 01-27-2011 |
20110035796 | Providing Differentiated Network Services and Priorities to VPN Routers/Clients - In one embodiment, a first network device receives a priority message from a second network device, wherein the priority message conforms to a connection establishment protocol and indicates a priority associated with the second network device. The first network device obtains the priority from the priority message and stores the priority. The first network device allocates resources for at least one of control or data plane processing to the second network device in accordance with the priority. | 02-10-2011 |
20120060029 | METHOD AND SYSTEM FOR DYNAMIC SECURED GROUP COMMUNICATION - A system and method directed to carrying out dynamic secured group communication is provided. The method includes: obtaining a first packet that includes a first header; forming a frame that includes the first header in encrypted form; combining the first header and the frame to form a second packet and forming a second header; encapsulating the second packet with the second header to form a third packet, and communicating the third packet into the second network from the second source node for termination to the second-destination node. The first header includes a first source address of a first source node of a first network, and a first destination address of a first destination node of the first network. The second header includes a second source address of a second source node of a second network, and a second destination address of a second destination node of the second network. | 03-08-2012 |
20130311778 | SYSTEM AND METHOD FOR SECURE CLOUD SERVICE DELIVERY WITH PRIORITIZED SERVICES IN A NETWORK ENVIRONMENT - An example method includes receiving a request for a cloud capability set during an Internet Key Exchange negotiation associated with a virtual private network (VPN) tunnel between a subscriber and a cloud, wherein the cloud capability set comprises one or more cloud capabilities, mapping the request to one or more cryptographic modules that can support the cloud capability set, and offloading the VPN tunnel to the one or more cryptographic modules. The request can be an Internet Security Association and Key Management Protocol (ISAKMP) packet listing the one or more cloud capabilities in a private payload. The method may further include splitting the VPN tunnel between the cryptographic modules if no single cryptographic module can support substantially all the cloud capabilities in the cloud capability set. In some embodiments, the request is compared with a service catalog comprising authorized cloud capabilities. | 11-21-2013 |
20140281508 | CHANGING GROUP MEMBER REACHABILITY INFORMATION - In an embodiment, a method comprises obtaining a second network address at a computer node, which has been already associated with a first network address and provided first keying information; sending, to a key server computer, an update message that comprises both the first network address and the second network address; using the first keying information to encrypt messages that the computer node sends from the second network address to one or more other members of a group. | 09-18-2014 |
20140328341 | COMMUNICATION PATH SELECTION - In an example embodiment, a method for selecting a communication path is provided. The method may comprise receiving data encapsulated in a transport protocol. In addition, a classification type and exit path information associated with the classification type may be received. The data is associated with the classification type and then is encapsulated in Stream Control Transmission Protocol (SCTP) based on the exit path information. This exit path information is associated with the classification type that is associated with the data. | 11-06-2014 |
20140365672 | PROVIDING DIFFERENTIATED NETWORK SERVICES AND PRIORITIES TO VPN ROUTERS/CLIENTS - In one embodiment, a first network device receives a priority message from a second network device, wherein the priority message conforms to a connection establishment protocol and indicates a priority associated with the second network device. The first network device obtains the priority from the priority message and stores the priority. The first network device allocates resources for at least one of control or data plane processing to the second network device in accordance with the priority. | 12-11-2014 |
20140372761 | SYSTEM AND METHOD FOR SECURE CLOUD SERVICE DELIVERY WITH PRIORITIZED SERVICES IN A NETWORK ENVIRONMENT - An example method includes receiving a request for a cloud capability set during an Internet Key Exchange negotiation associated with a virtual private network (VPN) tunnel between a subscriber and a cloud, wherein the cloud capability set comprises one or more cloud capabilities, mapping the request to one or more cryptographic modules that can support the cloud capability set, and offloading the VPN tunnel to the one or more cryptographic modules. The request can be an Internet Security Association and Key Management Protocol (ISAKMP) packet listing the one or more cloud capabilities in a private payload. The method may further include splitting the VPN tunnel between the cryptographic modules if no single cryptographic module can support substantially all the cloud capabilities in the cloud capability set. In some embodiments, the request is compared with a service catalog comprising authorized cloud capabilities. | 12-18-2014 |