Abstract: Resources used by a connection are released when a connection is terminated, for example due to a failure on the network. When the connection is to be redialed, an indication of the released resources is collected and provided to the network element that will perform a redial operation to determine the new path for the connection. This allows the network element to determine the new path using up-to-date information, while not allowing other nodes on the network to know about the recently released resources, so that the head-end node has an initial opportunity to use the recently released resources for the redialed connection. Subsequently any unused resources will be advertised on the network for use by other nodes. The head-end network element may be notified of the resources released from termination of the previous connection by causing a termination message to propagate from the tail-end node to the head-end node and collect feedback along the terminating connection path.

Abstract: A high capacity switching node comprises a lattice structure of low-latency switch units and a plurality of balanced connectors interfacing electronic edge nodes to diagonal subsets of said switch units. The edge nodes may be collocated with the switch units or remotely located. The switch units may be bufferless, having optical switch-fabrics for example, thus requiring a compound vacancy-matching process. Using switch units each of dimension 64×64, a fast switching node having a dimension of the order of 10,000×10,000 can be constructed. With a typical wavelength-channel capacity of 10 Gb/s, the fast-switching node would scale to a capacity of 100 terabits per second, which is orders of magnitude higher than the capacity of known fast optical switches. A fast-switching optical switch of such scalability significantly reduces network complexity and cost.

Abstract: Methods and apparatus for scheduling transfer of data bursts in a network comprising electronic edge nodes interconnected by bufferless core nodes are disclosed. Each edge node comprises a source node and a sink node, and each core node comprises several bufferless space switches operating in parallel. Each space switch has a master controller and one of the master controllers in a core node functions as a core-node controller. Each master controller has a burst scheduler for computing a schedule for transfer of data bursts, received from source nodes, to respective destination sink nodes. A core-node controller receives requests for bitrate allocations from source nodes and assigns each request to one of the master controllers of the core node. In one embodiment, a scheduler determines schedules for concatenated reconfiguration periods. In another embodiment, parallel schedulers determine schedules for overlapping reconfiguration periods.

Abstract: A first level of control over operation of slave Digitally Controlled Frequency Selectors (DCFSs), such as DCOs or DDSs, may occur by periodic transmission of control words from the master clock to the slave clocks. To allow enhanced control over the output of the slave clocks, the frequency of the local oscillator used to generate the synthesized output of the master clock may also be conveyed to the slave clocks to allow a second level of control to take place. The second level of control allows the local oscillators at the slave clocks to lock onto the frequency of the master local oscillator to thereby allow the slave local oscillators to operate the slave DCFSs using the same local oscillator frequency. The first level of control synchronizes operation of the DCFSs while the second level control prevents instabilities in the local oscillators from causing long term drift between the slave and master clock outputs. Timestamps may be used to synchronize the master and slave local oscillators.

Abstract: In the service architecture of the invention, each service is viewed as a hierarchical arrangement of service components. At least one management agent is associated with each layer, and is used to manage and preserve the expected performance of the service components. The management agents cooperatively exchange management information regarding the service components at their layers to permit service self-management and self-healing, enabling restoration and recovery with minimum or no human intervention.

Abstract: A future-proof network comprising multiple independent core media and universal edge nodes is disclosed. The edge nodes are equipped to evaluate the performance of each of the core media. Network-fabric decoupling and, more importantly protocol decoupling, permit graceful retirement of inferior core media and growth of superior core media.

Abstract: Method and apparatus that enable secure transmission of data in a scalable private network are described. Each station that is to be part of a private network registers with a key table. A group security association associated with the private network is forwarded to each trusted ingress and egress point that communicates with each member of the private network. When a member of the private network seeks to communicate with another member, it simply forwards the communication to the trusted ingress point. The trusted ingress point uses the security association associated with the private network to transform the communication and forwards the transformed communication through other intermediate stations in the network until it reaches a trusted egress point. The trusted egress point uses the stored security association to decode the transformed communication and forwards the communication to the appropriate destination.

Abstract: Multiple service label types may be used in a given network element to optimize scalability of the data plane, minimize overhead associated with service label management, and allow new services to be offered. Service label management may be done in a dynamic manner so that service labels may be selected for routes in a dynamic fashion as the network changes. VPNs handled by the network element may have different types of service labels, and different routes within a particular VPN may be allocated different service label types. Service label requests may be stored on the data plane to allow a service label request database to be restored from the data plane upon a control plane failure, so that new service labels are not required to be allocated after a control plane failure.

Abstract: In a communication network comprising nodes and links between the nodes, a controller node disseminates routing information including nodal routing tables. A nodal routing table for a given node comprises alternate routes from the given node to other nodes in the network. A controller of the network receives traffic information from nodes and, based on the received traffic information, determines a set of adaptive routing information corresponding to each said node and transmits each set of adaptive routing information to the respective node. Determining the set of adaptive routing information is performed according to a courteous routing scheme. The routing scheme is labeled as “courteous” because, in a contention state, a node-pair that would suffer the least by directing a part of its traffic away from a preferred path yields to node pairs that suffer more by redirecting their traffic. Courteous routing increases the payload throughput and decreases real-time processing effort.

Abstract: A method of supporting multiple quality of service (QoS) levels for data being transmitted between two networking devices, such as customer equipment (CE), that use Ethernet and Frame Relay (FR). The method supports multiple QoS services in a network where a first CE is connected to a first edge device (interworking unit) using the Ethernet protocol and a second CE is connected to a second edge device using the FR protocol. The edge devices may be directly connected together or they may be connected through a network backbone using any generally accepted network protocol. The first CE may be connected to the first edge device using a single Ethernet port, multiple Ethernet ports, a single virtual local area network (VLAN), or multiple VLAN's. The second CE is connected to an edge device using a single data link connection (DLC), or multiple DLC's. The method ensures QoS for data transmitted between the first and the second CE via the Ethernet protocol to the FR protocol and vice versa.

Abstract: A S-VPN gateway provides a signaling gateway to integrate SIP signaling and UNI/NNI signaling, and manage the mapping between SIP sessions and VPN connections. The mapping relationship reflects the access of user applications to the specific VPN tunnels, multiplexing of media service sessions to VPN tunnels, VPN service creation, service duration, VPN QoS, VPN service life cycle management, and VPN service charge based on a per-service-usage. The S-VPN gateway also provides VPN access policy/security management (i.e., inter-domain AAA process), VPN membership auto-discovery, service auto-discovery, network resource auto-discovery, address resolution service for both SIP and VPN naming space, VPN service mobility, and SLA management. The S-VPN gateway enables network VPN tunnels to be created in advanced and accessed on-demand, for example by enterprise VPN applications such as GRID applications, through a SIP interface.

Abstract: Each member of a group registers with the Security/Routing (S/R) device 30 and receives a Group Security Association (GSA) associated with the group. The member may register as part of a group by identifying the group and the other members. Alternatively, Routing Functionality auto-discovers the other members of the group. AS members are identified, Routing functionality reflects the routes of all members in the group to all other members of the group. The forwarding of the routes to the respective group members may be secured via the GSA associated with the group. Each member can forward communication directly to the group members, securing the communication using the group SA and standard tunneling techniques (such as IPsec, GRE, MPLS, etc.). Thus the S/R provides a mechanism for private networks to be built on top of an existing network without modification of any existing network components and much more scalable in operation and configuration than individual IP sec tunnels.

Abstract: A scheduling apparatus for a switch includes multiple schedulers which are assigned in a variety of ways to non-intersecting control domains for establishing connections through the switch. The control domains are defined by spatial and temporal aspects. The control domains may be dynamically selected and assigned to schedulers in a manner that achieves a high throughput gain. Control domains may be considered in a cyclic and/or a pipeline discipline for accommodating connection requests. The invention enables the realization of a highly scalable controller of a switching node of fine granularity that scales to capacities of the order of hundreds of terabits per second.

Abstract: A method for managing encryption keys in a communication system having a plurality of communication devices includes establishing a set of cryptographic keys for secure communication. Each of the cryptographic keys is associated with a geographic region. A geographic region is determined for a communication device and at least one cryptographic key is distributed to the communication device based on the geographic region of the communication device. At least one cryptographic key may be used to derive further cryptographic keys associated with a set of sub-regions of the geographic region associated with the communication device.

Abstract: A high capacity distributed switching system comprises electronic edge nodes connected to a balanced bufferless switch which may be electronic or optical. The balanced bufferless switch comprises a balanced connector and a switch fabric. The balanced connector comprises an array of temporally cyclic rotator units having graduated rotation shifts and each having a prime number of output ports. The switch fabric may be a mesh interconnection of switch modules. Due to the use of the balanced connector, establishing a path through the switch fabric requires at most a second-order time-slot matching process for a high proportion of connection requests with a much reduced need for a third-order time-slot matching process required in a conventional mesh structure.

Abstract: Burst-switching nodes using a common-memory or a time shared space switch and employing flow-rate control are disclosed. Within a switching node, data bursts are segmented into data segments of a fixed size with some segments containing information bits as well as null bits. A switching node handles data streams allocated different flow rates and, for any data stream, the internal flow rate through the switching node can be higher than the external flow rate due to null padding of segmented data. The switching node is provided with a sufficient internal capacity expansion in order to offset the effect of null padding. A controller of the switching node is provided with a flow-rate-regulation apparatus to enable scheduling the transfer of data segments across the switching node in a manner that guarantees adherence to the allocated information flow rates.

Abstract: Integrators are electronic components used to condition received analog signals, for example prior to Analog to Digital Conversion. Wide dynamic range, high gain and fine resolution are required of integrators and Analog to Digital Converters in order to limit the effects of noise, including quantization noise. Conventional integrators preceding Analog to Digital Converters are not capable of effectively meeting these requirements. A novel phase domain integrator that can meet effectively these requirements and is superior to conventional integrators for a wide range of applications is disclosed.

Abstract: A novel beacon-based position location technique for efficient location discovery of untethered clients in packet networks is disclosed. The position location technique utilizes the time-difference-of-arrival (“TDOA”) of a first signal transmitted by a beacon of known location and a second signal transmitted by an untethered client. The TDOA of these two signals is measured locally by at least three non-collinear signal receivers. For each of the receivers, the TDOA is used to calculate a perceived distance to the client. A circle is then calculated for each receiver, centered on the receiver and having a radius equal to the perceived distance. At least two lines defined by points of intersection of the calculated circles are then calculated. The point of intersection of the lines represents the location of the client. To facilitate operation, the signal receivers may be arranged on vertices which define a convex polygon as viewed from above.

Abstract: In a method of providing protection switching in a meshed communications network, a protection path between two nodes on the network is only established, on demand, as it is required, after a fault along a working path between the two nodes has been detected. After the protection path is established, carriage of traffic from the working path is switched to the protection path. Once the working path is restored, traffic is switched back from the protection path to the working path, and the protection path is torn down. Switching between working and protection channels may be effected using a path establishment protocol or using protection switching mechanisms of existing network protocols, such as SONET or ATM APS. Software and network nodes embodying the method are also disclosed.

Abstract: Capability based addressing in a communication network enables protocol data units (PDUs) to be addressed to network constructs such as network elements or interfaces with particular capabilities rather than with specific addresses. This allows PDUs to be addressed to network constructs without first identifying the network constructs or even knowing of the existence of the construct. By broadcasting a capability based PDU onto a network it is therefore possible to communicate with a particular type of device rather than with a particular identified device. This is applicable, for example, in connection with loop and backdoor detection. By broadcasting a PDU onto a network, e.g. using a hello-response protocol, it is possible to identify network constructs that should not be present on the network if the communication network is configured properly. An alarm or corrective action may be taken upon detection of a response.