Abstract: Methods and apparatus for enhanced overlay state maintenance in a peer-to-peer overlay network. A first method includes inferring that a first node is leaving the overlay network, and transmitting a decrement message to decrement a size counter value. A second method includes identifying a set of nodes associated with a first node of an overlay network, obtaining a segment length associated with each node of the set of nodes, and determining a size of the overlay network by dividing the total number of nodes in the set of nodes by the sum of the segment lengths. A third method includes identifying a set of nodes associated with a first node of an overlay network, obtaining a size estimate associated with the first node and with each node of the set of nodes, and determining a size of the overlay network by averaging the size estimates.

Abstract: Multiple protocol tunnels (e.g., IPsec tunnels) are deployed to enable an access terminal that is connected to a network to access a local network associated with a femto access point. A first protocol tunnel is established between a security gateway and the femto access point. A second protocol tunnel is then established in either of two ways. In some implementations the second protocol tunnel is established between the access terminal and the security gateway. In other implementations the second protocol tunnel is established between the access terminal and the femto access point, whereby a portion of the tunnel is routed through the first tunnel.

Abstract: Methods and apparatus for reducing the effectiveness of chosen location attacks in a peer-to-peer overlay network. A method includes determining that new node identifiers are to be generated for a plurality of nodes in the network, inputting parameters to a hash function to generate a selected node identifier, and adopting a location in the network associated with the selected node identifier. Another method includes receiving a node identifier associated with a selected node, inputting parameters associated with the selected node to a hash function to generate a corresponding node identifier, comparing the node identifier with the corresponding node identifier, and determining that the selected node is a potential attacker if the node identifiers do not match. Another method includes detecting responsibility for initiating an update to one or more node identifiers, generating parameters to generate the node identifiers, and transmitting the parameters on the network.

Abstract: Techniques for performing registration with a wireless network using integrity protection and/or ciphering are described. A user equipment (UE) may perform a security procedure with the wireless network for a first session and may generate UE security context data at the UE. The UE security context data may include a cipher key used for ciphering, an integrity key used for integrity protection, a temporary UE identity, and/or other information. The UE may use the UE security context data for secure communication with the wireless network during the first session. The UE may store the UE security context data upon termination of the first session. The UE may thereafter use the stored UE security context data for registration with the wireless network for a second session following the first session. The UE may perform integrity protection and/or ciphering for message(s) for registration based on the stored UE security context data.

Abstract: Multiple protocol tunnels (e.g., IPsec tunnels) are deployed to enable an access terminal that is connected to a network to access a local network associated with a femto access point. A first protocol tunnel is established between a security gateway and the femto access point. A second protocol tunnel is then established in either of two ways. In some implementations the second protocol tunnel is established between the access terminal and the security gateway. In other implementations the second protocol tunnel is established between the access terminal and the femto access point, whereby a portion of the tunnel is routed through the first tunnel.

Abstract: Methods, apparatus, and systems to perform secure registration of a femto access point for trusted access to an operator-controlled network element. Method steps include establishing a security association for at least one said femto access point, making a request using the security association to an operator-controlled network element, which requests a secure registration credential from an authorizing component. The operator-controlled network element constructs a secure registration credential and sends the secure registration credential to the requesting femto access point, thus authorizing trusted access by the requesting femto access point to access operator-controlled network elements. Embodiments include establishing a security association via an IPsec security association received from a security gateway which is within an operator-controlled domain and using an operator-controlled database of IPsec inner addresses.

Abstract: Methods and apparatus for proxying of devices and services using overlay networks. A method for operating a proxy includes obtaining meta-data associated with at least one of a device and a service, generating a searchable index of the meta-data, and publishing the searchable index on the overlay network as at least one of a distributed index and a centralized index. Another method includes receiving a request from a device or a service using a non overlay protocol to receive at least one of data and services from the overlay network, searching an index of meta-data on the overlay network based on the request, identifying a node associated with the at least one of data and services based on the index, establishing a direct connection with the node, and obtaining the at least one of data and services using the direct connection.

Abstract: A spatio-temporal random voting scheme is provided that incorporates location distribution, spatial randomness, and temporal randomness in the collection of information from a plurality of sensing devices within the cognitive network. The region is divided into a plurality of sectors, where each sector is a portion of the region. A subset of sectors is selected from the plurality of sectors in the region to provide spatial randomness. A device is randomly selected from each sector in the subset of sectors to provide additional spatial randomness to the information collection process. Temporal randomness may be introduced by randomly selecting a timeslot within a sensing window period in which devices are to scan a frequency spectrum band to determine if a signal energy above a threshold is detected. Sensing reports are then collected from the selected sensing devices and used to determine whether the frequency spectrum band is available or in use.

Abstract: Storage authorization and access control of data stored on a peer-to-peer overlay network is provided. A publishing node stores data on a storage node in the overlay network. The publishing node is adapted to facilitate data storage authorization by generating a resource identifier as a function of a usage string associated with a data type to be stored. A storage request is generated that includes the resource identifier and data to be stored. The storage request may be sent to the storage node. The storage device receives the storage request sent by a publishing node, including a resource identifier and data to be stored. Independent storage authorization is performed by the storage node at an overlay level by verifying the resource identifier. The data in the storage request is stored at the storage node if the resource identifier is successfully verified.

Abstract: Methods and apparatus for optimal participation of devices in a peer-to-peer overlay network. A method for dynamically configuring a node includes operating on an overlay network using a first participation mode, obtaining at least one configuration parameter, selecting a second participation mode for operation on the overlay network based on local policy and the at least one configuration parameter, and configuring the node to participate on the overlay network based on the second participation mode. An apparatus for dynamic node configuration includes a memory coupled to a processor and configured to operate on an overlay network using a first participation mode, obtain at least one configuration parameter, select a second participation mode for operation on the overlay network based on local policy and the at least one configuration parameter, and configure the node to participate on the overlay network based on the second participation mode.

Abstract: Methods and apparatus for discovery of peer-to-peer overlay networks. In an aspect, a method includes receiving a request to discover information about overlay networks of interest, generating a search query that comprises at least one parameter associated with the overlay networks of interest, and transmitting the search query to nodes on a local area network. In another aspect, an apparatus includes a memory comprising an overlay database of meta-data associated with one or more known overlay networks and a processor coupled to the memory and configured to obtain a search query that comprises at least one parameter associated with overlay networks of interest, determine one or more selected overlay networks from the overlay database based on the at least one parameter, and transmit meta-data associated with the one or more selected overlay networks in response to the search query.

Abstract: Methods, apparatus, and systems to perform secure registration of a femto access point for trusted access to an operator-controlled network element. Method steps include establishing a security association for at least one said femto access point, making a request using the security association to an operator-controlled network element, which requests a secure registration credential from an authorizing component. The operator-controlled network element constructs a secure registration credential and sends the secure registration credential to the requesting femto access point, thus authorizing trusted access by the requesting femto access point to access operator-controlled network elements. Embodiments include establishing a security association via an IPsec security association received from a security gateway which is within an operator-controlled domain and using an operator-controlled database of IPsec inner addresses.

Abstract: Multiple protocol tunnels (e.g., IPsec tunnels) are deployed to enable an access terminal that is connected to a network to access a local network associated with a femto access point. A first protocol tunnel is established between a security gateway and the femto access point. A second protocol tunnel is then established in either of two ways. In some implementations the second protocol tunnel is established between the access terminal and the security gateway. In other implementations the second protocol tunnel is established between the access terminal and the femto access point, whereby a portion of the tunnel is routed through the first tunnel.

Abstract: Storage authorization and access control of data stored on a peer-to-peer overlay network is provided. A publishing node stores data on a storage node in the overlay network. The publishing node is adapted to facilitate data storage authorization by generating a resource identifier as a function of a usage string associated with a data type to be stored. A storage request is generated that includes the resource identifier and data to be stored. The storage request may be sent to the storage node. The storage device receives the storage request sent by a publishing node, including a resource identifier and data to be stored. Independent storage authorization is performed by the storage node at an overlay level by verifying the resource identifier. The data in the storage request is stored at the storage node if the resource identifier is successfully verified.

Abstract: Multiple protocol tunnels (e.g., IPsec tunnels) are deployed to enable an access terminal that is connected to a network to access a local network associated with a femto access point. A first protocol tunnel is established between a security gateway and the femto access point. A second protocol tunnel is then established in either of two ways. In some implementations the second protocol tunnel is established between the access terminal and the security gateway. In other implementations the second protocol tunnel is established between the access terminal and the femto access point, whereby a portion of the tunnel is routed through the first tunnel.

Abstract: A spatio-temporal random voting scheme is provided that incorporates location distribution, spatial randomness, and temporal randomness in the collection of information from a plurality of sensing devices within the cognitive network. The region is divided into a plurality of sectors, where each sector is a portion of the region. A subset of sectors is selected from the plurality of sectors in the region to provide spatial randomness. A device is randomly selected from each sector in the subset of sectors to provide additional spatial randomness to the information collection process. Temporal randomness may be introduced by randomly selecting a timeslot within a sensing window period in which devices are to scan a frequency spectrum band to determine if a signal energy above a threshold is detected. Sensing reports are then collected from the selected sensing devices and used to determine whether the frequency spectrum band is available or in use.

Abstract: Techniques for performing registration with a wireless network using integrity protection and/or ciphering are described. A user equipment (UE) may perform a security procedure with the wireless network for a first session and may generate UE security context data at the UE. The UE security context data may include a cipher key used for ciphering, an integrity key used for integrity protection, a temporary UE identity, and/or other information. The UE may use the UE security context data for secure communication with the wireless network during the first session. The UE may store the UE security context data upon termination of the first session. The UE may thereafter use the stored UE security context data for registration with the wireless network for a second session following the first session. The UE may perform integrity protection and/or ciphering for message(s) for registration based on the stored UE security context data.

Abstract: Methods and apparatus for reducing the effectiveness of chosen location attacks in a peer-to-peer overlay network. A method includes determining that new node identifiers are to be generated for a plurality of nodes in the network, inputting parameters to a hash function to generate a selected node identifier, and adopting a location in the network associated with the selected node identifier. Another method includes receiving a node identifier associated with a selected node, inputting parameters associated with the selected node to a hash function to generate a corresponding node identifier, comparing the node identifier with the corresponding node identifier, and determining that the selected node is a potential attacker if the node identifiers do not match. Another method includes detecting responsibility for initiating an update to one or more node identifiers, generating parameters to generate the node identifiers, and transmitting the parameters on the network.

Abstract: Methods and apparatus for event distribution and routing in peer-to-peer overlay networks. A method is provided for event distribution and routing in a peer-to-peer overlay network that comprises a plurality of nodes. The method includes identifying a plurality of buckets on the overlay network, wherein each bucket includes one or more nodes, respectively, identifying bucket groups, wherein each bucket group includes a selected number of buckets, respectively, distributing events based on the bucket groups, and updating a routing table based on the events. A node includes a transceiver and a processor coupled to the transceiver and configured to identify a plurality of buckets on the overlay network, wherein each bucket includes one or more nodes, respectively, identify bucket groups, wherein each bucket group includes a selected number of buckets, respectively, distribute events based on the bucket groups, and update a routing table based on the events.

Abstract: Methods and apparatus for proxying of devices and services using overlay networks. A method for operating a proxy includes obtaining meta-data associated with at least one of a device and a service, generating a searchable index of the meta-data, and publishing the searchable index on the overlay network as at least one of a distributed index and a centralized index. Another method includes receiving a request from a device or a service using a non overlay protocol to receive at least one of data and services from the overlay network, searching an index of meta-data on the overlay network based on the request, identifying a node associated with the at least one of data and services based on the index, establishing a direct connection with the node, and obtaining the at least one of data and services using the direct connection.