Abstract: Embodiments are directed to towards cloud scale automatic identity management. A floating network may be established using agents operative on hosts across one or more networks. Each node of the floating network is resident on host (computer or cloud instance) that includes an agent configured to perform one or more networking tasks that establish the floating network. Parent nodes may be nodes designated as points in the floating network for adding additional nodes. Accordingly, each parent node includes at least one parent agent that includes at least parent credentials. Agent installers provided to a host may generate a child agent for the host that includes child credentials generated based on its parent credentials. An unambiguous identity value for the new child node may be determined by tracing a trust relationship path from the child node to the root node of the floating network.

Abstract: A method and apparatus are provided for scheduling unicast and multicast data in an input-queued network device. According to one aspect of the present invention, a combined schedule is created by pipelined staging of multicast and unicast scheduling. Multicast cells are scheduled for transmission among multiple interfaces of a crossbar by performing a multicast cell scheduling cycle for multiple classes of service that are supported by the network device. Then, unicast cells are scheduled for transmission among the interfaces at a lower priority than the previously scheduled multicast cells by performing a unicast cell scheduling cycle for the multiple classes of service using only those interfaces that remain unmatched after completion of the multicast cell scheduling cycle.

Abstract: Threshold cryptography (secret sharing) is used for exchanging a secret between a server and a client over an unreliable network. Specifically, a secret is computationally divided into N shares using a threshold encryption scheme such that any M of the shares (M less than or equal to N) can be used to reconstruct the secret. The N shares are spread over a number of transmitted messages, with the assumption that some number of the messages including a total of at least M shares will be received by the client. Upon receiving at least M shares, the client uses the at least M shares to reconstruct the secret using the threshold encryption scheme.

Abstract: A method and apparatus for correlating faults in a networking system. A database of fault rules is maintained along with and associated probable causes, and possible solutions for determining the occurrence of faults defined by the fault rules. The fault rules include a fault identifier, an occurrence threshold specifying a minimum number of occurrences of fault events in the networking system in order to identify the fault, and a time threshold in which the occurrences of the fault events must occur in order to correlate the fault. Occurrences of fault events in the networking system are detected and correlated by determining matched fault rules which match the fault events and generating a fault report upon determining that a number of occurrences for the matched fault rules within the time threshold is greater than or equal to the occurrence threshold for the matched fault rules.

Abstract: A system for providing quality of service routing functions in a connectionless network having multiple nodes. The system generates a link resource advertisement for each node in the network. Each link resource advertisement includes information regarding link resources available on a particular node in the network. The system also generates resource reservation advertisements for each node in the network. Each resource reservation advertisement includes information regarding a particular node's current reservations for a data flow. Network paths are calculated in response to a quality of service request. The calculations are performed based on information contained in the link resource advertisements and resource reservation advertisements.

Abstract: In a network device such as a network switch having a port coupled to a communications medium dedicated to a single virtual local area network and another port coupled to a communications medium shared among multiple virtual local area networks for transmitting data frames between the dedicated communications medium and the shared communications medium, a method of identifying the virtual network associated with each data frame received by the network switch when transmitting the data frames over the shared communications medium.

Abstract: A system for selecting an alternate route in a network using a connection-oriented protocol. The system is implemented in response to inadequate resources to a normal next hop node for a requested connection. The system may also be implemented if the normal next hop node is not capable of supporting the requested data flow. An alternate next hop node is identified having adequate resources for the requested connection. The connection request is then sent to the alternate next hop node. A refusal message is generated if the connection request sent to the alternate next hop node fails. The identification of alternate next hop nodes having adequate resources is performed on a limited basis.

Abstract: A method for searching for keys of arbitrary width in a table in a memory of a computer system by repeatedly executing lookup instructions on a lookup processor. The lookup processor executes a lookup instruction to find a key in a table. The execution of the lookup instruction results in a key being found, or a key not being found. If the key is not found, the process is requeued by a scheduler with the program counter register for the process pointing to the instruction immediately following the lookup instruction, i.e., the next instruction. In the event the key is found in the table, the entry in the table associated with the key contains the memory address of the next instruction to be executed. This memory address is loaded into the program counter register associated with the process in which the lookup instruction was executed. The scheduler requeues the process, later dequeues it, and the instruction pointed to by the program counter register is fetched by an instruction fetch unit.

Abstract: A method and apparatus for generating an error detection code, such as a Cyclic Redundancy Checksum (CRC), for a modified binary data block. The modified data block, such as a VLAN frame, is derived from an original binary data block, such as an ethernet frame, having a first error detection code associated therewith. In one embodiment, the method requires modifying the original data block utilizing first data, in the form of VLAN header information, to generate the VLAN frame, whereafter a second error detection code is calculated exclusively for the VLAN header information. More specifically, where the original data block is modified by the insertion of the VLAN header information into the original data block, a CRC is calculated using the VLAN header information shifted to a position corresponding to its position within the modified data block.

Abstract: A system for servicing multiple queues identifies a queue service time associated with each of the multiple queues. The queue servicing system selects a particular queue service time having the minimal value of all identified queue service times. The system services the queue associated with the selected queue service time. A new queue service time is determined for the queue associated with the selected queue service time. The queue servicing system continuously services the queues while at least one of the queues contains data. The queue service time associated with a particular queue is calculated in response to the size of the packet at the head of the particular queue and a bandwidth allocated to the particular queue.

Abstract: A search key having a first length is presented to a universal hashing process. The search key is hashed using a universal hash function to generate a bucket ID having a second length, smaller than the first length. The bucket ID is used to address a table stored in a computer readable medium and a pointer is retrieved from an associated storage location. The pointer is used to index a hash bucket containing one or more entries, each of which can be compared to the search key to determine whether any of the entries match the search key. For the case where the method is used in a Ethernet switch, the search key may comprise a virtual LAN identification and media access control address. The table is made up of number of hash buckets, each of which may have one or more entries. New entries are stored in one of the hash buckets according to the universal hash function so long as no overflows of any hash bucket would be created.

Abstract: A method and apparatus for monitoring the performance of a dedicated communications medium in a switched data networking environment wherein a probe having a bypass circuit allows promiscuous monitoring of all traffic between a switch and a network device, such as a file server, in either direction, and in full duplex mode. Additionally, the bypass circuit eliminates the requirement for a separate repeater between the switch and the network device.

Abstract: A printed circuit board including a terminated power plane is described. Specifically, the power-ground plane construction includes a dielectric layer, a power plane having a peripheral edge, and a ground plane. The ground plane is spaced from the power plane by the dielectric layer, and is positioned in an opposed relationship to the power plane. The power-ground plane construction also includes a termination element coupling the power plane, at or adjacent the peripheral edge thereof, to the ground plane so as to terminate the power plane. In one embodiment, a plurality of termination elements couple the power plane, at or adjacent the peripheral edge thereof, to the ground plane. The termination elements are spaced from each other at substantially regular intervals. In another embodiment, a termination element is a strip or sheet element coupling continuous lengths of the peripheral edge of the power plane to ground plane.

Abstract: A circuit board having a load is inserted into a chassis of a digital system while the system remains in operation. During insertion, a ground potential is provided to the circuit board. Next, one or more voltage potentials are provided, however, no electrical path is provided from the voltage potentials, through the load, to ground. An enhancement voltage is provided to the circuit board, allowing the load to charge. Finally, a backplane is connected to the circuit board after the load has charged. The circuit board includes a soft start circuit that allows the load to charge gracefully after the enhancement voltage is provided. In one embodiment, the soft start circuit includes an RC circuit connected to a switch which gradually turns on as the RC circuit charges, thereby providing an electrical path from the circuit board load to ground through the switch. The switch may be a MOSFET.

Abstract: A system for providing explicit routing functions in a connectionless network. A specific router selects a path through the connectionless network to a destination. Explicit routing advertisements are generated by the specific router and contain information regarding the selected path. Routing state is installed according to information contained in the explicit routing advertisements. The explicit routing advertisements are forwarded to each next hop router. Each next hop router installs routing state, generates the explicit routing advertisement, and forwards the explicit routing advertisement to further propagate the routing information.

Abstract: In a search method for a radix search tree, a logic circuit for computing the actual offset of an entry in a node in a tree. The logic circuit accepts a pointer to a node in the tree, along with an associated bit mask indicating which entries are present in the node. The logic circuit further receives an entry value, the offset of which from the beginning of the node is to be computed by the logic circuit. The logic circuit utilizes Boolean AND gates to mask off higher order bits in the bit mask above the bit position corresponding to the entry value received by the logic circuit. The lower order bits in the bit mask, up to but not including the bit position corresponding to the entry value, are added together to determine the number of entries that exist at a lower offset in the node than the entry indicated by the entry value. The logic circuit combines the pointer received with the sum computed to calculate the offset memory address at which the entry is located in the node.

Abstract: A system for servicing a plurality of queues containing data cells for transmission over a communication medium. Each queue has an associated queue priority. A queue service sequence is generated in response to the queue priorities and represents a specific order for servicing the plurality of queues. A particular queue is selected for servicing in response to the queue service sequence. When a particular queue has been selected, a data cell is transmitted from the selected queue across the communication medium.

Abstract: An apparatus and method for connecting a plurality of LAN workstations to the internet via an on-line server/interface that does not require a PC operating system dedicated to the server. The server operates in TCP/IP protocol for communication over the Internet. Only a single connection to the Internet is required in order to permit the entire LAN to operate simultaneously on the Internet. Specifically, only a single phone line is required to simultaneously serve all LAN workstations. The system is equally well suited to connect via a telephone line connection to an Internet providers's slip or PPP or via an Ethernet connection to a router or direct connection by any available means. The system does not disturb the native LAN protocol, while communicating via the internet protocol such as, by way of example, TCP/IP. The LAN is provided with a complete internet protocol service, supporting functions not generally available in the dedicated stacks previously provided for individual PCs.

Abstract: To determine congestion within a shared memory switch, the global memory usage and the individual address queue memory usage of the switching fabric for the switch are measured. These two types of memory usage are combined to determine a net congestion state for a switching fabric. A similar congestion determination is made for line cards coupled to the main switching fabric. Specifically, the global memory usage within the line card is combined with the individual queue memory usage within the card to generate a line card congestion state. The switching fabric congestion state is then combined with the line card congestion state to determine a net congestion state. Using the net congestion state, an explicit rate can be determined for adjusting ER, CI & NI fields in the RM cell. Two methods of determining an explicit rate are disclosed. The first method modifies the explicit rate found within RM cells.

Abstract: A method of sharing data between a sender application and a receiver application. The sender application and the receiver application execute on a computer system. The method comprises the following steps. The receiver application generates a receiver interface. The receiver application registers receiver data tokens in a registry. The data tokens correspond to the data. The sender application generates a sender interface. The sender application generates sender data tokens corresponding to the sender interface. A first token, of the sender data tokens, corresponds to one of the receiver data tokens. The sender interface receives the data and determines that the first token is registered by the receiver interface. The sender interface transmits the data to the receiver application.