Abstract: A method of making data, published on a first publication/subscribe (pubsub) network, available to hosts within a second publication/subscribe network where the networks are interconnected via the Internet. The method comprises registering a publication identity of said data within a rendezvous system located within the Internet, forwarding Subscribe requests associated with said publication identity from said second network to said rendezvous system and, at the rendezvous system, identifying a location of said data within said first network. The Subscribe request can then be forwarded to said first network, and said data delivered from said first network to said second network via the Internet.

Abstract: Methods of providing packet routing information, according to various embodiments, may include encoding the packet routing information into a compact representation of set membership. The methods may include putting the compact representation of set membership into a header of a packet. Moreover, the methods may include computing the compact representation of set membership using input parameters that include at least one packet-specific, flow-specific or processing-context-specific parameter.

Abstract: A method of handling mobility of a sender in a multicast packet sending scenario. The method comprises firstly establishing a multicast tree across a packet data network and transmitting multicast packets from the sender to a plurality of receivers via said multicast tree. Prior to a mobility event in respect of said sender, a suitable transfer anchor node is identified within said network, and the tree re-rooted to that transfer anchor node. Subsequently, multicast packets are transmitted from said sender to said transfer anchor node and injected into the multicast tree at said transfer anchor node. Following said mobility event, said sender continues to send multicast packets to said transfer anchor node for injection into the multicast tree.

Abstract: A method of controlling traffic flow through a service node located within a packet network, which traffic flow originates at a plurality of sending nodes and is destined for a receiving node. The service node is one of a multiplicity of service nodes configured in a tree or other acyclic structure, e.g. of an overlay network. The method comprises receiving a challenge from said receiving node or a downstream service node, generating and caching a further challenge, and combining that further challenge with the received challenges to generate a modified challenge. The modified challenge is then sent to a sending node or to an upstream service node. Subsequently, a request is received, destined for said receiving node and originating at a sending node. A solution accompanying said request is validated using the cached further challenge, and the request forwarded towards said receiving node only if the solution is valid. Otherwise, the request is dropped.

Abstract: A network node (4) is adapted to insert a collecting Bloom filter into a packet, and send the packet towards a second network node (8) by a hop-by-hop routing protocol. The network node (4) subsequently receives a packet sent by the second network node (8), with the header of the packet sent by the second network node containing a Bloom filter or Bloom Filter equivalent that encodes forwarding information from the second network node (8) to the network node (4). The Bloom filter or Bloom Filter equivalent received at the network node (4) may also encode forwarding information from the network node (4) to the second network node (8). In this case, the network node (4) may then determine, from the forwarding information in the Bloom filter or Bloom Filter equivalent, a first hop for forwarding packets towards the second node (8).

Abstract: A network node (NB1) located within a domain is adapted to receive, from another node, a packet having an in-packet Bloom filter or Bloom filter equivalent encoding information about a route within the domain. The node reversibly modifies the in-packet Bloom filter or Bloom filter equivalent in a manner which is linear with respect to the operation used to add links to the Bloom filter or Bloom filter equivalent. The node then forward the packet with its header containing the modified Bloom filter or Bloom filter to another node (NA1). The invention allows secure Bloom filter-based routing in a domain (Domain B), while requiring that only routers (NB1) at the domain boundary are secure routers. Other routers (NB2, NB3, NB4) in the domain may operate conventionally, and may be secure routers or insecure routers. The modification may be a bit permutation.

Abstract: Packet routing information is encoded into a non-static compact representation of set membership, the compact representation of set membership being for inclusion into a header of a packet. The compact representation of set membership is computed using input parameters that include at least one packet-specific, flow-specific or processing-context-specific parameter. By making the compact representation of set membership packet-dependent, flow-dependent or processing-context-dependent it becomes harder for, for example, a potential attacker to obtain information needed to mount a DDoS attack. In a variant of the invention, the packet routing information is represented as a plurality of non-static identifiers for inclusion into a header of a packet.

Abstract: A method of handling mobility of a sender in a multicast packet sending scenario. The method comprises firstly establishing a multicast tree across a packet data network and transmitting multicast packets from the sender to a plurality of receivers via said multicast tree. Prior to a mobility event in respect of said sender, a suitable transfer anchor node is identified within said network, and the tree re-rooted to that transfer anchor node. Subsequently, multicast packets are transmitted from said sender to said transfer anchor node and injected into the multicast tree at said transfer anchor node. Following said mobility event, said sender continues to send multicast packets to said transfer anchor node for injection into the multicast tree.

Abstract: A method of controlling traffic flow through a service node located within a packet network, which traffic flow originates at a plurality of sending nodes and is destined for a receiving node. The service node is one of a multiplicity of service nodes configured in a tree or other acyclic structure, e.g. of an overlay network. The method comprises receiving a challenge from said receiving node or a downstream service node, generating and caching a further challenge, and combining that further challenge with the received challenges to generate a modified challenge. The modified challenge is then sent to a sending node or to an upstream service node. Subsequently, a request is received, destined for said receiving node and originating at a sending node. A solution accompanying said request is validated using the cached further challenge, and the request forwarded towards said receiving node only if the solution is valid. Otherwise, the request is dropped.

Abstract: A method of making data, published on a first publication/subscribe (pubsub) network, available to hosts within a second publication/subscribe network where the networks are interconnected via the Internet. The method comprises registering a publication identity of said data within a rendezvous system located within the Internet, forwarding Subscribe requests associated with said publication identity from said second network to said rendezvous system and, at the rendezvous system, identifying a location of said data within said first network. The Subscribe request can then be forwarded to said first network, and said data delivered from said first network to said second network via the Internet.