Abstract: Protocols and architecture for secure virtual private networks. Intraenterprise data communications are supported in a secure manner over the Internet or other public network space with the implementation of secure virtual private networks. Members of a virtual private network group exchange data that may be compressed, encrypted and authenticated, if the exchange is between members of the group.

Abstract: The invention provides a method and process for transmitting data without using additional CPU cycles and memory accesses to calculate checksums. The transmitting device obtains data from internal or external data source and stores data in memory. Data is then divided into zones and checksums are calculated for each zone. Checksums are recorded on a checksum array. A data pointer containing an address for data stored in memory, a description of the data and address for the checksum array is transferred through data transfer protocol to network and transmission layers. Network and transmission layers are then able to access and send data without having to either copy data through data transfer protocol to network and transfer layers or read all of the data to calculate the checksums. This method and process uses fewer CPU cycles and memory accesses to transmit data and is, therefore, more efficient than the prior art.

Abstract: Protocols and architecture for secure virtual private networks. Intraenterprise data communications are supported in a secure manner over the Internet or other public network space with the implementation of secure virtual private networks. Members of a virtual private network group exchange data that may be compressed, encrypted and authenticated, if the exchange is between members of the group.

Abstract: A method of generating IP identification numbers for IP datagrams. A plurality of IP identification number generators are maintained. A plurality of receiving stations are associated with the plurality of IP identification number generators such that each receiving station has an IP identification number generator associated therewith. An IP identification number is generated for a datagram sent to a receiving station based on an output of the associated IP identification number generator. Also, a method of reducing a likelihood of misassembly of received data fragments from fragmented IP datagrams. The data fragments have an IP identification number. All received data fragments of the datagram are discarded upon detection of receipt of an overlapping data fragment having the IP identification number. Timeouts for reassembling datagrams are reduced. First, timeouts for reassembling the datagrams are reduced to less than a standard timeout.

Abstract: The invention provides a method and process for transmitting data without using additional CPU cycles and memory accesses to calculate checksums. The transmitting device obtains data from an internal or external data source and stores that data in memory. The data is then divided into zones and checksums are calculated for each zone. The checksums are recorded on a checksum array. A data pointer containing an address for the data stored in memory, a description of the data and an address for the checksum array is transferred through data transfer protocol to network and transmission layers. The network and transmission layers are then able to access and send the data without having to either copy the data through data transfer protocol to network and transfer layers or read all of the data to calculate the checksums. This method and process uses fewer CPU cycles and memory accesses to transmit data and is, therefore, more efficient than the prior art.

Abstract: The present invention provides a method and an apparatus for establishing a virtual private network that operates over a public data network. One embodiment of the present invention includes a system that selects a plurality of entities coupled to the public data network to include in the virtual private network. The system next assembles a plurality of identifiers for the plurality of entities. These identifiers are used to identify communications between the plurality of entities, so that these communications can be transferred securely over the public data network. A variation on this embodiment includes defining encryption, authentication and compression parameters for the virtual private network. In another variation, selecting the plurality of entities includes, assembling entities coupled to the public data network into groups, and selecting groups of entities to include in the virtual private network.

Abstract: Protocols and architecture for secure virtual private networks. Intraenterprise data communications are supported in a secure manner over the Internet or other public network space with the implementation of secure virtual private networks. Members of a virtual private network group exchange data that may be compressed, encrypted and authenticated, if the exchange is between members of the group.

Abstract: One embodiment of the present invention provides a computer system with a plurality of storage memories, each storage memory storing an operating system program, and an identifier for identifying a storage memory containing an operating system program to be loaded when the unit is booted. The identifier is selectively switchable between storage memories so that the computer system may be selectively booted with an alternate operating system program. This facilitates loading a new version of an operating system, and then rapidly switching back to an old version of the operating system if the new version fails to function properly.

Abstract: One embodiment of the present invention includes a system that translates addresses in a data packet based upon a user identifier in the data packet. The system receives the data packet sent from a source node to a destination node by a user. This data packet includes a source address of the source node, a destination address of the destination node and the user identifier that identifies the user. The system uses the user identifier to look up communication privileges associated with the user. If the communication privileges allow the user to communicate with the destination node, the system replaces the source address in the data packet with a privileged address, and forwards the data packet to the destination node. In a variation on this embodiment, the privileged address is recognized by a system firewall so that it facilitates passage of the packet through firewall.