Abstract: A group of servers (GS) comprising a proxy server (PS) and one or more server computers (SCx). The group of servers (GS) is designed for supporting a mechanism for connection establishment which mechanism comprises an allocation of a predictable sequence number according to a given function shared between the group of servers (GS).

Abstract: Provides methods, systems and devices for reading a storage medium. A method for reading a storage medium according to the invention includes the following steps: First, it is determined if an access sequence requested by an application to data stored on the disk drive is a part of a known access sequence. Then, if the requested access sequence is part of a known access sequence, the data are read from a data arrangement stored on the medium in addition to an original data arrangement which additional data arrangement differs in its arrangement of data from the arrangement of data in the original data arrangement.

Abstract: The invention provides methods, apparatus and systems for detecting distributed denial of service (DDoS) attacks within the Internet by sampling packets at a point or points in Internet backbone connections to determine a packet metric parameter. The packet metric parameter which might comprise the volume of packets received is analysed over selected time intervals with respect to specified geographical locations in which the hosts transmitting the packets are located. The expected behaviour can be employed to identify traffic distortions revealing a DDoS attack. In a complementary aspect, the invention provides a method of authenticating packets at routers in order to elevate the QoS of authenticated packets. This method can be used to block or filter packets and can be used in conjunction with the DDoS attack detection system to defend against DDoS attacks within the Internet in a distributed manner.

Abstract: Methods for searching a range in a set of values in a network with distributed storage nodes. An example of a method for searching a range in a set of values in a network with distributed storage nodes according to the invention comprises the following steps. First, the range is divided up into a set of subranges by means of a hierarchical structure. Then, a query packet is generated for said set of subranges and transmitted to the distributed storage nodes for performing the query.

Abstract: The present invention relates to a method and an apparatus for determining a remainder in a polynomial ring. The apparatus for determining a remainder in a polynomial ring according to the invention comprises a value buffer (18) for storing a polynomial value, a factor memory (8.1, 8.2) for storing factors and a polynomial multiply unit (1) connected to the factor memory (8.1, 8.2) for generating a polynomial product out of the factors and an input polynomial. The apparatus further comprises a matrix multiply unit (5) connected to the polynomial multiply unit for generating a reduced product with reduced polynomial degree by multiplying the polynomial product with a reduction matrix. Finally the apparatus includes a multiplexer means (13.1, 13.2, 17, 39.1, 39.2) for either conducting the reduced product or the polynomial value as the input polynomial to the to the polynomial multiply unit (1).

Abstract: A method of distributing streaming media to one or more users. The method includes partitioning the media into segments that each include data associated with at least a portion of one or more of the successive data units in the media. Each segment also includes information for positioning the data relative to the order of the data units. A transmission sequence having a plurality of successive time slots is defined for the segments to enable reconstruction of an i-th data unit from Li segments. A server transmits each of the segments according to the defined transmission sequence during one of the time slots. A client processes the transmitted segments based on the positioning information to reconstruct the media.

Abstract: A method, a network device and a computer program element are introduced for controlling data packet flows in a network device by manipulating data packets according to an actual manipulation rate. Amongst data packets received by a network device such as a router, data packets are identified that are marked with a pattern according to a congestion notification scheme. A pattern rate of data packets comprising such a pattern is determined, and the actual manipulation rate is determined subject to the pattern rate.

Abstract: A method of distributing streaming media to one or more users. The method includes partitioning the media into segments that each include data associated with at least a portion of one or more of the successive data units in the media. Each segment also includes information for positioning the data relative to the order of the data units. A transmission sequence having a plurality of successive time slots is defined for the segments to enable reconstruction of an i-th data unit from Li segments. A server transmits each of the segments according to the defined transmission sequence during one of the time slots. A client processes the transmitted segments based on the positioning information to reconstruct the media.

Abstract: Fast, scalable methods and devices are provided for layer four switching in a router as might be found in the Internet. In a first method, a grid of tries, which are binary branching trees, is constructed from the set of routing filters. The grid includes a dest-trie and a number of source tries. To avoid memory blowup, each filter is stored in exactly one trie. The tries are traversed to find the lowest cost routing. Switch pointers are used to improve the search cost. In an extension of this method, hash tables may be constructed that point to grid-of-tries structures. The hash tables may be used to handle combinations of port fields and protocol fields. Another method is based on hashing, in which searches for lowest cost matching filters take place in bit length tuple space. Rectangle searching with precomputation and markers are used to eliminate a whole column of tuple space when a match occurs, and to eliminate the rest of a row when no match is found.

Abstract: A system for secure multicast including a plurality of participants that can send and receive multicast messages. A traffic distribution component is coupled to the participating entities, where the traffic distribution component supports multiple receiver communication. A participant key management component operates within each participant entity where the participant key management component uses a first key that is shared with all of the other participants, and a second key that is shared with a subgroup of participants. A group key management component is implemented using a flat data structure having a size that is logarithmically proportional to the number of participants.

Abstract: A system for secure multicast including at least one sending entity operating on a sending computer system, the sending entity with a sending multicast application running on the sending computer system. A number of receiving entities each running on a receiving computer system, the receiving entities having a receiving multicast application running. A traffic distribution component coupled to the sending entity and each of the receiving entities, where the traffic distribution component supports a connectionless datagram protocol. A participant key management component operates within each receiver entity where the participant key management component holds a first key that is shared with the sender and all of the receiving entities, and a second key that is shared with the sender and at least one but less than all of the receiving entities. A group key management component is coupled to the traffic distribution component and includes a data structure for storing all of the participant first and second keys.

Abstract: A method and apparatus for an exponentially faster technique than is presently utilized in routers for looking-up destination addresses and matching them to a prefix in order to determine an output data link for routing of the data message to a destination. The basic algorithm includes arranging the prefix and corresponding output data link information in sub-databases arranged by prefix length and then using a multi-step prefix length binary search algorithm to sort through the sub-databases to determine a best matching prefix for routing of the data packet. Various refinements of the basic algorithm are disclosed to further enhance the search time including adding markers representative of sub-database entries having a longer prefix length and also various searching methodologies to minimize the number of searching steps including rope searching in various formats.