Abstract: Embodiments are directed to towards cloud scale automatic identity management. A floating network may be established using agents operative on hosts across one or more networks. Each node of the floating network is resident on host (computer or cloud instance) that includes an agent configured to perform one or more networking tasks that establish the floating network. Parent nodes may be nodes designated as points in the floating network for adding additional nodes. Accordingly, each parent node includes at least one parent agent that includes at least parent credentials. Agent installers provided to a host may generate a child agent for the host that includes child credentials generated based on its parent credentials. An unambiguous identity value for the new child node may be determined by tracing a trust relationship path from the child node to the root node of the floating network.

Abstract: Threshold cryptography (secret sharing) is used for exchanging a secret between a server and a client over an unreliable network. Specifically, a secret is computationally divided into N shares using a threshold encryption scheme such that any M of the shares (M less than or equal to N) can be used to reconstruct the secret. The N shares are spread over a number of transmitted messages, with the assumption that some number of the messages including a total of at least M shares will be received by the client. Upon receiving at least M shares, the client uses the at least M shares to reconstruct the secret using the threshold encryption scheme.

Abstract: A method and apparatus for correlating faults in a networking system. A database of fault rules is maintained along with and associated probable causes, and possible solutions for determining the occurrence of faults defined by the fault rules. The fault rules include a fault identifier, an occurrence threshold specifying a minimum number of occurrences of fault events in the networking system in order to identify the fault, and a time threshold in which the occurrences of the fault events must occur in order to correlate the fault. Occurrences of fault events in the networking system are detected and correlated by determining matched fault rules which match the fault events and generating a fault report upon determining that a number of occurrences for the matched fault rules within the time threshold is greater than or equal to the occurrence threshold for the matched fault rules.

Abstract: A system for providing quality of service routing functions in a connectionless network having multiple nodes. The system generates a link resource advertisement for each node in the network. Each link resource advertisement includes information regarding link resources available on a particular node in the network. The system also generates resource reservation advertisements for each node in the network. Each resource reservation advertisement includes information regarding a particular node's current reservations for a data flow. Network paths are calculated in response to a quality of service request. The calculations are performed based on information contained in the link resource advertisements and resource reservation advertisements.

Abstract: In a network device such as a network switch having a port coupled to a communications medium dedicated to a single virtual local area network and another port coupled to a communications medium shared among multiple virtual local area networks for transmitting data frames between the dedicated communications medium and the shared communications medium, a method of identifying the virtual network associated with each data frame received by the network switch when transmitting the data frames over the shared communications medium.

Abstract: A method for searching for keys of arbitrary width in a table in a memory of a computer system by repeatedly executing lookup instructions on a lookup processor. The lookup processor executes a lookup instruction to find a key in a table. The execution of the lookup instruction results in a key being found, or a key not being found. If the key is not found, the process is requeued by a scheduler with the program counter register for the process pointing to the instruction immediately following the lookup instruction, i.e., the next instruction. In the event the key is found in the table, the entry in the table associated with the key contains the memory address of the next instruction to be executed. This memory address is loaded into the program counter register associated with the process in which the lookup instruction was executed. The scheduler requeues the process, later dequeues it, and the instruction pointed to by the program counter register is fetched by an instruction fetch unit.

Abstract: A method and apparatus for generating an error detection code, such as a Cyclic Redundancy Checksum (CRC), for a modified binary data block. The modified data block, such as a VLAN frame, is derived from an original binary data block, such as an ethernet frame, having a first error detection code associated therewith. In one embodiment, the method requires modifying the original data block utilizing first data, in the form of VLAN header information, to generate the VLAN frame, whereafter a second error detection code is calculated exclusively for the VLAN header information. More specifically, where the original data block is modified by the insertion of the VLAN header information into the original data block, a CRC is calculated using the VLAN header information shifted to a position corresponding to its position within the modified data block.

Abstract: A search key having a first length is presented to a universal hashing process. The search key is hashed using a universal hash function to generate a bucket ID having a second length, smaller than the first length. The bucket ID is used to address a table stored in a computer readable medium and a pointer is retrieved from an associated storage location. The pointer is used to index a hash bucket containing one or more entries, each of which can be compared to the search key to determine whether any of the entries match the search key. For the case where the method is used in a Ethernet switch, the search key may comprise a virtual LAN identification and media access control address. The table is made up of number of hash buckets, each of which may have one or more entries. New entries are stored in one of the hash buckets according to the universal hash function so long as no overflows of any hash bucket would be created.

Abstract: A method and apparatus for monitoring the performance of a dedicated communications medium in a switched data networking environment wherein a probe having a bypass circuit allows promiscuous monitoring of all traffic between a switch and a network device, such as a file server, in either direction, and in full duplex mode. Additionally, the bypass circuit eliminates the requirement for a separate repeater between the switch and the network device.

Abstract: A printed circuit board including a terminated power plane is described. Specifically, the power-ground plane construction includes a dielectric layer, a power plane having a peripheral edge, and a ground plane. The ground plane is spaced from the power plane by the dielectric layer, and is positioned in an opposed relationship to the power plane. The power-ground plane construction also includes a termination element coupling the power plane, at or adjacent the peripheral edge thereof, to the ground plane so as to terminate the power plane. In one embodiment, a plurality of termination elements couple the power plane, at or adjacent the peripheral edge thereof, to the ground plane. The termination elements are spaced from each other at substantially regular intervals. In another embodiment, a termination element is a strip or sheet element coupling continuous lengths of the peripheral edge of the power plane to ground plane.

Abstract: A system for providing explicit routing functions in a connectionless network. A specific router selects a path through the connectionless network to a destination. Explicit routing advertisements are generated by the specific router and contain information regarding the selected path. Routing state is installed according to information contained in the explicit routing advertisements. The explicit routing advertisements are forwarded to each next hop router. Each next hop router installs routing state, generates the explicit routing advertisement, and forwards the explicit routing advertisement to further propagate the routing information.

Abstract: A circuit board having a load is inserted into a chassis of a digital system while the system remains in operation. During insertion, a ground potential is provided to the circuit board. Next, one or more voltage potentials are provided, however, no electrical path is provided from the voltage potentials, through the load, to ground. An enhancement voltage is provided to the circuit board, allowing the load to charge. Finally, a backplane is connected to the circuit board after the load has charged. The circuit board includes a soft start circuit that allows the load to charge gracefully after the enhancement voltage is provided. In one embodiment, the soft start circuit includes an RC circuit connected to a switch which gradually turns on as the RC circuit charges, thereby providing an electrical path from the circuit board load to ground through the switch. The switch may be a MOSFET.

Abstract: In a search method for a radix search tree, a logic circuit for computing the actual offset of an entry in a node in a tree. The logic circuit accepts a pointer to a node in the tree, along with an associated bit mask indicating which entries are present in the node. The logic circuit further receives an entry value, the offset of which from the beginning of the node is to be computed by the logic circuit. The logic circuit utilizes Boolean AND gates to mask off higher order bits in the bit mask above the bit position corresponding to the entry value received by the logic circuit. The lower order bits in the bit mask, up to but not including the bit position corresponding to the entry value, are added together to determine the number of entries that exist at a lower offset in the node than the entry indicated by the entry value. The logic circuit combines the pointer received with the sum computed to calculate the offset memory address at which the entry is located in the node.

Abstract: A system for servicing a plurality of queues containing data cells for transmission over a communication medium. Each queue has an associated queue priority. A queue service sequence is generated in response to the queue priorities and represents a specific order for servicing the plurality of queues. A particular queue is selected for servicing in response to the queue service sequence. When a particular queue has been selected, a data cell is transmitted from the selected queue across the communication medium.

Abstract: An apparatus and method for connecting a plurality of LAN workstations to the internet via an on-line server/interface that does not require a PC operating system dedicated to the server. The server operates in TCP/IP protocol for communication over the Internet. Only a single connection to the Internet is required in order to permit the entire LAN to operate simultaneously on the Internet. Specifically, only a single phone line is required to simultaneously serve all LAN workstations. The system is equally well suited to connect via a telephone line connection to an Internet providers's slip or PPP or via an Ethernet connection to a router or direct connection by any available means. The system does not disturb the native LAN protocol, while communicating via the internet protocol such as, by way of example, TCP/IP. The LAN is provided with a complete internet protocol service, supporting functions not generally available in the dedicated stacks previously provided for individual PCs.

Abstract: To determine congestion within a shared memory switch, the global memory usage and the individual address queue memory usage of the switching fabric for the switch are measured. These two types of memory usage are combined to determine a net congestion state for a switching fabric. A similar congestion determination is made for line cards coupled to the main switching fabric. Specifically, the global memory usage within the line card is combined with the individual queue memory usage within the card to generate a line card congestion state. The switching fabric congestion state is then combined with the line card congestion state to determine a net congestion state. Using the net congestion state, an explicit rate can be determined for adjusting ER, CI & NI fields in the RM cell. Two methods of determining an explicit rate are disclosed. The first method modifies the explicit rate found within RM cells.

Abstract: A computer implemented method for searching for a key in a radix search tree in a memory of a computer system. A table of keys is organized in a radix search tree stored in a memory of a computer system. The keys are divided into a string of symbols. Each node in the tree corresponds to a symbol. A path from a root node to a leaf node at level n in the tree represents a string of n symbols comprising a key. Each node is capable of having m possible entries corresponding to m possible symbol values. Each entry comprises a pointer to a son node and an existence map indicating which entries exist in the son node. In the preferred embodiment, the existence map is a bit mask that indicates, based on bit positions enabled and disabled in the bit mask, which entries exist in the son node pointed to by the pointer. By providing an existence map along with the pointer to a son node, m memory locations for m entries are allocated for the son node only if all of the m possible entries are used.

Abstract: A system for managing virtual circuits and determining proper routing of packets in a network environment. The network includes a connection-oriented subnetwork and an arrangement of routers coupled to the connection-oriented subnetwork. The system determines paths to each exit router by considering all possible paths through the connection-oriented subnetwork. The system also determines paths to each exit router by considering existing virutal circuits through the connection-oriented subnetwork. Finally, the system determines and establishes a most beneficial new virtual circuit for the network. Additionally, the rate at which new virtual circuits are established may be regulated by the system.

Abstract: The switch fabric of the ATM switch, i.e., the ATM switch backplane bus, switches a cell based on routing information provided by the source LAN or ATM module to an output port on a destination LAN or ATM module of the switching hub. In the described system, the ATM switch is preconfigured to provide a fully connected topology between ports of all modules. In one embodiment, ATM cells transmitted across the ATM switch fabric between a source LAN or ATM module and a destination LAN module, e.g., Token Ring, FDDI or Ethernet, is accomplished by way of a routing tag prepended on the ATM cells. The routing tag provides both unicast and multicast group destination information such that the ATM cells are routed to the appropriate port on a given destination module without the need to establish a virtual circuit between the source module and the destination module using VPI/VCIs.

Abstract: A method for determining the topology of a mixed-media network is provided. According to the method, the network is divided into communities of devices that support a common topology mechanism ("spheres"). On each sphere, one or more sphere topology agents generate and accumulate topology data for the devices on the sphere using the topology mechanism that is supported by the devices within the sphere. A global topology agent collects the topology data for each sphere from the various sphere agents and assembles the data to determine the global topology of the mixed-media network. The global topology agent begins by collecting data from a current sphere and identifies additional spheres based on data stored in boundary devices within the current sphere. The global topology agent then repeats the same process with the additional spheres until topology data has been collected from all of the spheres in the mixed-media network.