Abstract: A method and apparatus for modifying the Multimedia Internet KEYing (MIKEY) protocol to support an extended key-management message (KMM), wherein the apparatus programs a computer to perform the method, which includes: determining that a KMM is directed to a target device; determining that the KMM is an extended KMM related to a key-management operation that is not supported by the standard MIKEY protocol; signaling the extended KMM in at least one field of a MIKEY message; and sending the MIKEY message to the target device.

Abstract: A method as provided enables mutual authentication of nodes in a wireless communication network. The method includes processing at a first node a beacon message received from a second node, wherein the beacon message comprises a first nonce value (step 405). An association request message comprising a certificate of the first node, a first signed block of authentication data, and a second nonce value is then transmitted from the first node to the second node (step 410). The second node can then verify a signature of the certificate of the first node and verify a signature of the first signed block of authentication data. An association reply message received from the second node is then processed at the first node (step 415), whereby the first node verifies a signature of a certificate of the second node and verifies a signature of a second signed block of authentication data.

Abstract: A certificate authority selection unit implements a method for selecting one of a plurality of certificate authorities servicing a plurality of administrative domains in a communication system. The method includes: receiving, from an end-entity via an interface, a certificate service request associated with an identifier; selecting, based on the identifier, one of the plurality of administrative domains in the communication system, wherein the plurality of administrative domains are serviced by a plurality of certificate authorities; retrieving a security profile for the end-entity; and selecting, based on the security profile for the end-entity, one of the plurality of certificate authorities to process the certificate service request.

Abstract: A method and system for updating a multicast state of a multicast group at a first mesh access point as provided improves network efficiency. According to one aspect, the method includes processing a multicast member join request for the multicast group received from a first wireless node. A proxy update message for the first wireless node received from a third mesh access point is then processed. The first wireless node connects to a second mesh access point after joining the multicast group via the first mesh access point, and the third mesh access point is a root node of a mesh tree of which the second mesh access point is a node. An Internet Group Management Protocol (IGMP) query message for the multicast group is then generated. A multicast update (MUPD) packet is then transmitted to an upstream node, whereby a multicast state is updated at the upstream node.

Abstract: Multiple-configuration communication apparatus includes: a communication device (130) simultaneously maintaining at least a first and a second channel; a storage device (114, 116, 118) storing a plurality of communication configurations; and a configuration controller (120) determining a first time frame and during the first time frame, selecting a first communication configuration of the plurality of communication configurations and controlling the communication device to configure itself to the first communication configuration to at least one of transmit and receive information over the first channel, and determining a second time frame that is different from the first time frame and during the second time frame, selecting a second communication configuration of the plurality of communication configurations, and controlling the communication device to configure itself to the second communication configuration to at least one of transmit and receive information over the second channel.

Abstract: A method as provided enables mutual authentication of nodes in a wireless communication network. The method includes processing at a first node a beacon message received from a second node, wherein the beacon message comprises a first nonce value (step 405). An association request message comprising a certificate of the first node, a first signed block of authentication data, and a second nonce value is then transmitted from the first node to the second node (step 410). The second node can then verify a signature of the certificate of the first node and verify a signature of the first signed block of authentication data. An association reply message received from the second node is then processed at the first node (step 415), whereby the first node verifies a signature of a certificate of the second node and verifies a signature of a second signed block of authentication data.

Abstract: An IP mobility solution for mobile network(s) (110) defining mobile routers (112) detachably connected to one or more mobile nodes (116). When attached to the router, the nodes create a binding between their home address and a home address of their attached router. The router creates a binding between its mobile subnet prefix (or home address) and a care of address. The bindings are sent to various correspondent nodes (126) having sent packets to the nodes. The bindings are updated, as appropriate, responsive to movement of the mobile network to other networks, including other mobile networks, and/or responsive to the nodes detaching from the mobile network and roaming independently to other networks, including other mobile networks. The correspondent nodes store the bindings and updates, if any, in a binding cache (208) and consult the binding cache to determine how packets should be directed on next attempt(s) to reach the node.

Abstract: An apparatus and method for multicast data stream selection in a communication system includes a first step 300 of providing an intermediate server between a service entity and mobile clients. A next step 302 includes receiving a join request from a mobile client. A next step 304 includes deriving subgroups with each subgroup having at least one associated multicast data stream. A next step 310 includes deriving subgroup outer tunnels. A next step 316 includes encoding different data streams for the associated subgroups. A next step 320 includes mapping each data stream to the respective outer tunnels for each subgroup. A next step 322 includes sourcing the mapped streams to each subgroup. A next step 324 includes converting the mapped streams to a form that can be recognized by the mobile clients.

Abstract: An intermediate device of a network includes network and transport layers, a dispatcher, a splitter and a connections database. The splitter intercepts a message packet in the network layer and modifies the network routing header and transport header of the message packet to form a modified message packet. The dispatcher receives modified message packets from the transport layer, recovers information from the message packets, passes the modified message packets back to the transport layer and adapts the transport layer to adapt communication dependent upon the information recovered from the message packets. The connections database stores the original source address, the original destination address, the original source port identifier and the original destination port identifier of an incoming message packet. A message packet is modified, with reference to the connections database, so that message packets from the first and second nodes are routed through the dispatcher.

Abstract: A method and system for updating a multicast state of a multicast group at a first mesh access point as provided improves network efficiency. According to one aspect, the method includes processing a multicast member join request for the multicast group received from a first wireless node. A proxy update message for the first wireless node received from a third mesh access point is then processed. The first wireless node connects to a second mesh access point after joining the multicast group via the first mesh access point, and the third mesh access point is a root node of a mesh tree of which the second mesh access point is a node. An Internet Group Management Protocol (IGMP) query message for the multicast group is then generated. A multicast update (MUPD) packet is then transmitted to an upstream node, whereby a multicast state is updated at the upstream node.

Abstract: A method for multicast packet communication by mobile entities (113) using one or more radio access networks (RANs) (107, 109, 111) that include receiving a multicast message at a router (105) and then determining multicast capabilities of a mobile entity (ME) (113). An optimal multicast delivery mode is selected for delivering a multicast message to the ME (113) at the radio access network (107, 109, 111). The multicast message is then delivered to the ME (113) at the radio access network (107, 109, 111) according to the selected delivery mode.

Abstract: A method (200, 300, 400) of communicating an IPv6 packet (120) over an IPv4 based network (102). The method can include receiving the IPv6 packet to be communicated to a remote unit (104), encapsulating the IPv6 packet in an IPv4 transition packet (122), and communicating the IPv4 transition packet to an IPv4 MVPN (114) server configured to communicate the packet to the remote unit via infrastructure of an IPv4 radio access network. Another aspect of the present invention relates to a method of processing an IPv6 packet received over an IPv4 based network. The method can include receiving from an MVPN server an IPv4 formatted packet that is being communicated to a remote unit, and removing from the packet at least one IPv4 header to result in the packet being formatted in accordance with IPv6.

Abstract: Techniques are provided for enabling application steering/blocking in a secure network which includes a network entity, and a first tunnel endpoint coupled to the network entity over an encrypted tunnel. The first tunnel endpoint associates at least a first Security Parameter Index (SPI) to a first application identifier to generate first mapping information (MI), communicates the first MI to the network entity, and transmits an encrypted message to the network entity over the encrypted tunnel. The encrypted message includes an encrypted packet and an unencrypted header including the first SPI. The network entity determines the first SPI from the unencrypted header, determines the first application identifier based on the first SPI and the first MI, and identifies a first application associated with the first application identifier. The network entity can still perform application steering/blocking even though traffic passing through the tunnel is encrypted.

Abstract: A system and method is provided for enabling operation of a native Internet Protocol (IP) multicast application in a mobile station having a wireless interface that does not support native IP multicast messages. The mobile station includes a link layer interface that is configured to communicate with various base stations using a wireless broadband data protocol. Each mobile station also includes a proxy module that operates as a middleware layer above the link layer interface. The proxy module is configured to intercept multicast messages being passed to and from the link layer interface, and convert any multicast messages from a native IP multicast protocol, to an Application Program Interface (API) call specific to the link layer interface, or vice versa.

Abstract: An IP mobility solution for mobile network(s) (110) defining mobile routers (112) detachably connected to one or more mobile network nodes (116). When attached to the mobile router, the mobile network nodes create a binding between their home address and a home address of their attached mobile router. The mobile router creates a binding between its mobile subnet prefix (or home address) and a care of address. The bindings are sent to various correspondent nodes (126) having sent packets non-optimally to the mobile network nodes. The bindings are updated, as appropriate, responsive to movement of the mobile network to other networks, including other mobile networks, and/or responsive to the mobile nodes detaching from the mobile network and roaming independently to other networks, including other mobile networks.