Abstract: One embodiment of the present invention receives a plurality of network services, maps the plurality of network services to a single network service at a network layer higher than layer 2, and transmits the single network service. Another embodiment of the present invention receives a single network service at a network layer higher than layer 2, maps the single network service to a plurality of network services, and transmits the plurality of network services.

Abstract: A method and apparatus are provided for filtering incoming calls. A request for a call from a calling unit to a mobile subscriber unit is received and a check is performed to determine whether local time information indicates that the mobile subscriber unit is within a time zone in an inconvenient time period. An indication is sent to the calling unit to inform the calling unit that the mobile subscriber unit is in the time zone within the inconvenient time period when the checking of the local time information determines that the local time information is within the inconvenient period.

Abstract: A method and apparatus is directed towards managing fail-over in a network. At least one back-up device is configured to process traffic if a fail-over condition occurs. The back-up device includes a physical interface. A logical interface X associated with the physical interface is monitored to determine if the fail-over condition has occurred. If it is determined that the fail-over condition has occurred on interface X, then the back-up device processes traffic for another logical interface Y, associated with the physical interface. Accordingly, logical interface Y may be unmonitored. According to one embodiment, if it is determined that the fail-over condition has occurred, the back-up device processes traffic for every logical interface associated with the physical interface.

Abstract: A method for collocated nodes communicating over a first interface to agree on a conflict-free transmission schedule among themselves, which they can then use to collaborate with neighbors accessed through a second interface, for example through wireless links in order to obtain collision-free transfers of unicast, multicast and broadcast packets over wireless channels, and channel access delay guarantees. The collocated nodes behave as a single virtual node for the purpose of establishing a consistent transmission schedule throughout the nodes of a multihop wireless network.

Abstract: Methods, devices, and systems are directed to managing a proxy request over a secure network using inherited security attributes. Proxy traffic, such as HTTP proxy traffic, is tunneled through a secure tunnel such that the proxy request inherits security attributes of the secure tunnel. The secure attributes may be employed to enable proxy access to a server, thereby extending a security property of the secure tunnel to the proxy connection tunneled through it. A secure tunnel service receives a proxy request from a client and modifies the proxy request to include the security attribute. In one embodiment, the security attribute is an identifier that enables a proxy service may employ to determine another security attribute. The proxy service is enabled to employ the security attribute, and the security attribute to determine if the client is authorized access to the server.

Abstract: Methods and systems are directed to managing sessions between users and a plurality of management servers on a network appliance. A unified session manager authenticates a user requesting access to a network appliance. The unified session manager then establishes a brokering session with a management server associated with a component application. The unified session manager may translate graphical user interface (GUI) messages between the user and the management server, while the user is in session with the network appliance. This provides the user with a uniform interface for the plurality of management servers. In another embodiment, the unified session manager may modify network addresses between the user and the management server. In yet another embodiment, the unified session manager may make a program from the network appliance available to the user to download directly from the unified session manager.

Abstract: A system for authenticating a terminal includes a terminal capable of communicating within and/or across at least one network. The terminal is included within an organization including a plurality of terminals, where each terminal is located at one or more of a plurality of positions within the organization. The system also includes a primary CA capable of issuing an identity certificate to each terminal of the organization, and as such, to the terminal of the system. The system also includes a secondary CA capable of providing at least one role certificate to the terminal based upon the position(s) of the terminal within the organization. The organization includes a plurality of secondary CA's capable of issuing role certificate(s) to respective groups of terminals of the organization. The system further includes a server capable of authenticating the terminal based upon the identity certificate and the role certificate(s) of the terminal.

Abstract: Methods and systems are directed to authenticating a client over a network. The client generates a certificate and sends it to a server through a trusted mechanism. The server is configured to store the received certificate. When the client requests authentication over the network, it provides the certificate again, along with a parameter associated with a secure session. The server verifies the parameter associated with the secure session and determines if the certificate is substantially the same as the stored certificate. The server authenticates the client over the network, if the certificate is determined to be stored. In another embodiment, the client transmits the certificate that is generated by a third party Certificate Authority (CA) based, in part, on the client's public key.

Abstract: A queue scheduler that distributes a partition worth of bandwidth to a plurality of queues according to a weight assigned to each of the queues. The plurality of queues are arranged from a highest priority to a lowest priority. The queues are serviced by the scheduler until each of the corresponding weights is consumed for each queue. The higher priority queues are serviced before the lower priority queues.

Abstract: A system for authenticating a terminal includes a terminal included within an organization including a plurality of terminals, each having characteristic(s) and being at one or more positions within the organization. The system also includes a secondary certification authority (CA) capable of providing role certificate(s) to the terminal based upon the position(s) of the terminal, where the organization includes a plurality of secondary CA's capable of issuing role certificate(s) to respective groups of terminals of the organization. In addition, the system includes a tertiary CA capable of providing permission certificate(s) to the terminal based upon the characteristic(s) of the terminal, where the organization includes a plurality of tertiary CA's capable of issuing permission certificate(s) to respective sub-groups of terminals of the organization.

Abstract: The present invention provides a system and method for monitoring network appliances using formatted data files. A system for monitoring a network appliance by recording operational data in formatted data files includes a data management module and a data presentation module. The data management module is configured to determine selected operational data associated with the network appliance and to record the selected operational data in formatted data files. The selected operational data are a subset of data regarding transactions performed by the network appliance. The data management module is also configured to record the selected operational data with minimum processing. The data presentation module is configured to present statistical data. The statistical data is determined from the selected operational data in the formatted data files. The data presentation module is also configured to provide the statistical data in real-time.

Abstract: An efficient method and system for maintaining the data connectivity with the MLPPP peer in the event of failure of the processor running the Active MLPPP protocol engine, without requiring expensive, per-packet update messages between the redundant nodes is provided. Grouping of information from multiple bundles is implemented to implement multi-bundle redundancy.

Abstract: Methods and systems are directed to managing a protocol network failure in a network clustering system. A cluster master and each client member in the cluster are configured to determine a primary protocol network, a secondary protocol network, and the like, for exchanging a cluster protocol message. Each client member in the cluster determines its ‘active protocol network’ from at least the primary protocol network, and the secondary protocol network when it joins the cluster. Each client member tests its connectivity to the cluster master through the primary protocol network. If a client member detects a failure on the primary protocol network, it dynamically fails over to the secondary protocol network, or the like, without leaving the cluster. If connectivity to the primary protocol network is restored, the client member dynamically resumes the protocol message exchange on the primary protocol network without leaving the cluster.

Abstract: A router and routing protocol redundancy are disclosed to reduce service outage or degradation for a network device and thus to increase service availability on a network due to software and hardware failures of the network device. A network device such as router includes a redundancy platform having an active controller system and a standby controller system. A routing protocol state change is received or generated by the active controller system. The received or generated routing protocol state change is replicated to the standby controller system. By replicating the routing protocol state change, the standby controller system can maintain the routing protocol sessions for the network device if a failure occurs in the active controller system. Furthermore, the routing protocol states are maintained in realtime to handle the dynamic changes created by routing protocols.

Abstract: A method and apparatus for data source authentication in multicast communications is provided. Multicasting a packet may be divided into two actions. The first action includes unicasting the packet from a sending member to a group controller. The second action includes multicasting the packet from the group controller to the multicast group. The packet may be unicast to the group controller with a message authentication code (MAC) that may be generated by encrypting the packet with a symmetric key that is intended to be known only to the sending member and the group controller. After authenticating the MAC, the group controller multicasts the packet to the multicast group. The group controller includes with the packet a separate MAC for substantially each receiving member of the multicast group, each encrypted by a separate symmetric key. Each symmetric key may be intended to be known only by the receiving member and the group controller.

Abstract: Methods and systems for selectively capturing content and delivering the captured content to mobile communications devices via wireless communications are disclosed. In some embodiments, a mobile unit sends a request for content to a nearby content server, to which the content server may respond with a list of available content items. The mobile unit may send a second, refined request for a specific content item. The content server may send the requested content item to the mobile unit, or the content server may send a pointer to the mobile unit, which indicates a network location from which a user may later retrieve the actual content item. In another embodiment, a mobile unit sends a request to a content server for presently displayed content. The content server may capture a screen image and send the captured image to the mobile unit. Alternatively, the content server may send the file in a native file format of the file from which the displayed content was generated.

Abstract: An apparatus that includes a node having a scheduling cycle. The scheduling cycle is partitioned into amounts of data such that one of the partitioned amounts of data serviced per scheduling cycle corresponds to a data rate that corresponds to a highest speed grade managed by the node.

Abstract: Methods and systems are directed to enabling automatic delivery and installation software changes over a network to a network device, such as a network appliance. An update policy associated with the network device is generated that includes information associated with how to select a software change, when the software change is to be delivered, and when it is installed on the network device. The network device monitors a distribution service for available software changes based in part on the update policy. When a software change substantially satisfies the update policy, the network device is enabled to request delivery of that software change. The delivery of the software change may include the changed software and a component upon which the software change may be dependent. When and how the software changes are installed on the network device is determined in part by using the update policy.

Abstract: A technique for selecting the offset between data bursts and their respective control packets in an optical burst switching arrangement includes: randomly generating a plurality of tokens; receiving a plurality of sequentially generated data bursts; and receiving a plurality of control packets, each control packet corresponding to a respective one of the plurality of data bursts. One of the plurality of control packets is first outputted and its corresponding respective data burst is then outputted at a time corresponding to the generation of the first of the plurality of tokens which occurs at a time in which no data burst is being outputted, the outputting of the data burst being offset from the output of its corresponding respective control packet by a time period. The average rate at which the plurality of data bursts are outputted may be equal to the reciprocal of the mean of the probability distribution used to generate the plurality of tokens.

Abstract: An apparatus and method is provided for facilitating the seamless handoff of IP connections between access routers in an IP network. The mobile IP network includes two or more access routers each serving a different geographic service area. When a mobile terminal moves from the first service area to the second service area, the mobile terminal transmits to the second access router the IP address of the previous access router. The second access router uses this information to learn capabilities of the first access router (e.g., bandwidths supported, security schemes, and the like) for use in future handoff decisions, and exchanges capability information with the first access router. The assumption is made based on the exchanged information that the access routers are geographically proximate.