Abstract: Methods and apparatus for supporting secure packet communications, e.g., SRTP, which use implicit index numbers for synchronization and sequencing of received packets. The secure communications methods and apparatus having an adaptive index learning mode of operation and a non-adaptive index learning mode of operation. The adaptive index learning mode of operation being used to determine a correct estimated sequence number roll over counter number and the implicit index number for one of a plurality of secure packets received when an adaptive index learning process condition is satisfied.

Abstract: The present invention relates to communications methods, apparatus and systems for correlating registrations with subsequent requests for service, e.g., calling or other services or active calls. In one embodiment requests and corresponding registrations are determined through a method of operating a session border controller (SBC) which includes the assignment of a registration instance identifier by the SBC to each registration request, sending a first message including the registration instance identifier to each user device in response to each registration request, and determining if subsequent requests correspond to the registration instance based on the registration instance identifier being included in subsequent requests. In another embodiment, after a SBC switchover, the new SBC forks a mid-dialog request received for a first call to all active registered devices having the same address of record and determines based on the responses which device has an active dialog corresponding to the first call.

Abstract: Systems and methods which provide resource sharing techniques implementing opportunistic shared resource utilization using dynamic traffic shaping are disclosed. Embodiments implement a multi-part transmission frame generation process in which data packets of various different traffic flows are selected for the transmission frame to fill the frame capacity. For example, scheduling logic may apply traffic shaping logic to select data packet queues from which data packets are to be included in a frame and to initially determine a number of packets to be included in the frame from each selected data packet queue according to the traffic shaping logic. Thereafter, the frame may be analyzed to determine if excess capacity remains. The scheduling logic may then apply traffic shaping logic to the data packet queues to implement an opportunistic scheme for including additional data packets in the frame and thereby fill the excess capacity.

Abstract: Described are methods, systems, and apparatus, including computer program products for executing, at local nodes, centrally provisioned telephony services. A telephony service can be provisioned at a central node. The telephony service is transmitted to a first local node. The telephony service is executed at the first local node.

Abstract: The invention features systems and methods for detecting and mitigating network attacks in a Voice-Over-IP (VoIP) network. A server is configured to receive information related to a mitigation action for a call. The information can include a complexity level for administering an audio challenge-response test to the call and an identification of the call. The server also generates i) a routing label based on the identification of the call, and ii) a script defining a plurality of variables that store identifications of a plurality of altered sound files for the audio challenge-response test. Each altered sound file is randomly selected by the server subject to one or more constraints associated with the complexity level. The server is further configured to transmit the script to a guardian module and the routing label to a gateway.

Abstract: Methods and apparatuses, including computer program products, are described for synchronization of shared initial filter criteria in an IP Multimedia Subsystem (IMS) network. A first computing device in the IMS network transmits a registration request to a second computing device in the IMS network. The first computing device receives a response to the registration request from the second computing device, including an identifier associated with a shared initial filter criteria set stored at the first computing device. The first computing device determines whether the shared initial filter criteria set corresponding to the identifier is stored at the first computing device and transmits a retrieval request to the second computing device if the shared initial filter criteria set corresponding to the identifier is not stored. The first computing device receives the shared initial filter criteria set from the second computing device, and stores the shared initial filter criteria set.

Abstract: Systems and methods for user device registration are disclosed. In certain embodiments, at least a first edge device in a group of edge devices enters a mass-restart mode. The first edge device receives a request for registration from a user device and determines whether the user device is currently registered through the first edge device. The first edge device generates a notification associated with the user device if the user device is not currently registered through the first edge device. A second edge device in the group of edge devices receives the notification and determines whether the user device is currently registered through the second edge device based on the notification. Registration information about the user device is deleted from the second edge device if the user device is currently registered through the second edge device.

Abstract: Methods and apparatus for authenticating a user equipment device (UE) requesting services through a session border controller (SBC) are described. In some embodiments the SBC stores the challenge and response for a successfully authenticated UE and uses this information to authenticate the UE when the UE seeks access to a service, e.g., establishing a new TCP connection. In some other embodiments, in response to receiving an Invite request from a UE requesting service the SBC generates and sends a Registration request to an authentication entity on behalf of the UE to trigger an authentication process. If the UE is authenticated the SBC allows service access, e.g., allows a call to proceed, otherwise denies service to the UE.

Abstract: The present invention relates to a point code emulation apparatus and method for dividing a Common Channel Signaling System No. 7 (or SS7) signaling network into two or more networks. The point code emulator is adapted to receive TCAP messages from two or more subnets and converts, for the messages crossing over the subnets, the information of the TCAP messages, including originating point code, destination point code, and transaction identifier, (and optionally, calling party number and called party number), and forwards to the other one of the two or more subnets. Correspondence among the two or more subnets may be provisioned by an authorized user of the system, may be learned automatically by the system based on ISUP message correspondences or previous TCAP transactions, or may be automatically discovered by the system broadcasting messages to nodes in the destined one of the two or more subnets.

Abstract: A first media packet from a first endpoint of an access network behind a NAPT device is received by a media device between a core network and the access network. The first media packet includes a first source IP address and port combination identifying the first endpoint. An UPDATE request or a reINVITE request is transmitted by the media device. A second IP address and port combination for the media device to receive future media packets from the first endpoint is negotiated. The media device compares a first IP address of the first source IP address and port combination to a second IP address of a second source address and port combination for a second media packet received on the second IP address and port combination. If the first and second IP addresses match, the media device relays media packets from the core network to the first endpoint.

Abstract: A computer-implemented method for authorizing access by a user device to at least one service offered over an Internet Protocol (IP) network is provided. A server receives a message from the user device. The message indicates that the user device is configured to support the at least one service. The server then retrieves from a database policy data associated with the user device. The server validates based on the policy data that the user device is authorized to advertise the at least one service and the at least one service is available for access by the user device. If the at least one service is unauthorized or unavailable for access by the user device, the server modifies the message to indicate one or more authorized and available services for the user device without including the at least one service.

Abstract: Methods and apparatus for supporting secure packet communications, e.g., sRTP/sRTCP, which are resistant to denial of service attacks are described. A received packet is identified to correspond to a particular stream being received, the stream having a current expected set of packet sequence numbers, e.g., a current window including a next expected packet sequence number and at least one packet sequence number in the expected packet window on each side of the expected packet sequence number. Unencrypted information from the received packet, e.g., a received packet sequence number, is used to determine at least one of: to drop the received packet, or to assign the packet to one of a plurality of policing levels. If the packet passes policing at its assigned policing level, the packet may undergo authentication and decryption to determine if it is a valid packet.

Abstract: Methods and apparatus for processing and using TCP packets to communicate RTP packets are described. Head of line blocking is avoided by operating a TCP packet processing module to output RTP packet data to an application irrespective of whether or not a preceding TCP packet was received. Since output of packet data to an application using RTP packets is not delayed when there is a missing TCP packet, head of line blocking is avoided. RTP packet data is subjected to pattern matching in order to identify and process RTP packets in the case where RTP header information such as packet length information is missing due to the failure to receive a TCP packet. The methods are particularly well suited for the communication of audio and/or video by devices operating behind firewalls which block UDP or other types of packets other than TCP packets.

Abstract: Methods and apparatus for sharing bandwidth over a link in a packet-oriented telecommunications system or network that supports multiple types of traffic including, e.g., real time packet flows, opportunistic rate packet flows, control and signaling traffic, are described. In one exemplary embodiment the method includes the steps of receiving a bandwidth allocation request requesting allocation of a required amount of bandwidth for a new real time packet flow, allocating the requested bandwidth from bandwidth reserved for newly-allocated real time packet flows, updating the measure of the total amount of bandwidth allocated to real time packet flows to reflect the allocation of the bandwidth to the new real time packet flow, and generating new bandwidth allocations for existing opportunistic rate packet flows based on a measure of the total amount of bandwidth allocated to real time packet flows. Some embodiments of the invention include methods to enforce the dynamic bandwidth allocations.

Abstract: The invention features a computer-implemented method for playing back an announcement message to a user device. The method includes initiating, by a computing device, an announcement session in response to a user device establishing communication with the computing device and determining, by the computing device, the announcement message to be played back to the user device. The method includes loading, by the computing device, into a queue associated with the announcement session, a descriptor referencing a memory buffer on the computing device. The memory buffer includes a plurality of memory partitions, each memory partition storing at least one portion of the announcement message encoded at a different rate. The method includes the computing device scheduling play back of the announcement message, playing the announcement message to the user device at a first rate and receiving a request from the user device for playback at a second rate.

Abstract: Methods and apparatus for aggregating and distributing contact information for a user with multiple user identifiers in a plurality of domains. In one embodiment a set of user identifiers corresponding to a first user includes a first user identifier corresponding to a first domain and a second user identifier corresponding to a second domain. A request is made using the first user identifier for contacts associated in the first domain with the first user identifier and a request is made using the second user identifier, for contacts associated in the second domain with the second user identifier. An aggregated contact list corresponding to the first user is generated from a first contact list received from the first domain and from a second contact list received from the second domain. In some embodiments the aggregated contact list and associated user presence information is distributed to the first and second domains.

Abstract: A non-intrusive objective speech quality assessment is performed on a degraded speech signal. The methods are well suited for systems where random and bursty packet losses may occur and/or packet stream regeneration may also occur prior to speech signal quality assessment. In one embodiment received packetized speech is analyzed to determine to an overall final signal quality score. A limited set of trained neural networks, e.g., 5, corresponding to different signal features, each determine a signal feature quality score. A trained joint quality score determination module determines a joint quality score based on the signal feature quality scores. Packet loss is estimated based on received packet header information and/or detected gap durations. The determined joint quality score is adjusted, based on estimated packet loss information obtained from examining the speech signal, network level statistics and/or codec parameters to generate the final quality score.

Abstract: The invention features systems and methods for detecting and mitigating network attacks in a Voice-Over-IP (VoIP) network. A server is configured to receive information related to a mitigation action for a call. The information can include a complexity level for administering an audio challenge-response test to the call and an identification of the call. The server also generates i) a routing label based on the identification of the call, and ii) a script defining a plurality of variables that store identifications of a plurality of altered sound files for the audio challenge-response test. Each altered sound file is randomly selected by the server subject to one or more constraints associated with the complexity level. The server is further configured to transmit the script to a guardian module and the routing label to a gateway.

Abstract: Independent IMS and WebRTC communications networks are integrated via an applications server including IMS and WebRTC functionality. A user equipment device including IMS and WebRTC capability is registered via the same application server with both the IMS and WebRTC networks. The application server is configured to make a routing determination whether to route a communications session over an IMS communications path or an RTC communications path when it is determined that parallel independent paths are available.

Abstract: Data associated with an E.164 number mapping (ENUM) request can be received from an element of a telecommunications network. Logical trunk-group information and gateway information can be associated with the ENUM request. A call is managed by the computing element through a packet-based network based at least in part on the logical trunk-group information and the gateway information.