Abstract: A computer-implemented method for authorizing access by a user device to at least one service offered over an Internet Protocol (IP) network is provided. A server receives a message from the user device. The message indicates that the user device is configured to support the at least one service. The server then retrieves from a database policy data associated with the user device. The server validates based on the policy data that the user device is authorized to advertise the at least one service and the at least one service is available for access by the user device. If the at least one service is unauthorized or unavailable for access by the user device, the server modifies the message to indicate one or more authorized and available services for the user device without including the at least one service.

Abstract: The present invention relates to a point code emulation apparatus and method for dividing a Common Channel Signaling System No. 7 (or SS7) signaling network into two or more networks. The point code emulator is adapted to receive TCAP messages from two or more subnets and converts, for the messages crossing over the subnets, the information of the TCAP messages, including originating point code, destination point code, and transaction identifier, (and optionally, calling party number and called party number), and forwards to the other one of the two or more subnets. Correspondence among the two or more subnets may be provisioned by an authorized user of the system, may be learned automatically by the system based on ISUP message correspondences or previous TCAP transactions, or may be automatically discovered by the system broadcasting messages to nodes in the destined one of the two or more subnets.

Abstract: The present invention relates to a point code emulation apparatus and method for dividing a Common Channel Signaling System No. 7 (or SS7) signaling network into two or more networks. The point code emulator is adapted to receive TCAP messages from two or more subnets and converts, for the messages crossing over the subnets, the information of the TCAP messages, including originating point code, destination point code, and transaction identifier, (and optionally, calling party number and called party number), and forwards to the other one of the two or more subnets. Correspondence among the two or more subnets may be provisioned by an authorized user of the system, may be learned automatically by the system based on ISUP message correspondences or previous TCAP transactions, or may be automatically discovered by the system broadcasting messages to nodes in the destined one of the two or more subnets.

Abstract: Methods and apparatus for supporting secure packet communications, e.g., sRTP/sRTCP, which are resistant to denial of service attacks are described. A received packet is identified to correspond to a particular stream being received, the stream having a current expected set of packet sequence numbers, e.g., a current window including a next expected packet sequence number and at least one packet sequence number in the expected packet window on each side of the expected packet sequence number. Unencrypted information from the received packet, e.g., a received packet sequence number, is used to determine at least one of: to drop the received packet, or to assign the packet to one of a plurality of policing levels. If the packet passes policing at its assigned policing level, the packet may undergo authentication and decryption to determine if it is a valid packet.

Abstract: Independent IMS and WebRTC communications networks are integrated via an applications server including IMS and WebRTC functionality. A user equipment device including IMS and WebRTC capability is registered via the same application server with both the IMS and WebRTC networks. The application server is configured to make a routing determination whether to route a communications session over an IMS communications path or an RTC communications path when it is determined that parallel independent paths are available.

Abstract: Methods and apparatuses, including computer program products, are described for synchronization of shared initial filter criteria in an IP Multimedia Subsystem (IMS) network. A first computing device in the IMS network transmits a registration request to a second computing device in the IMS network. The first computing device receives a response to the registration request from the second computing device, including an identifier associated with a shared initial filter criteria set stored at the first computing device. The first computing device determines whether the shared initial filter criteria set corresponding to the identifier is stored at the first computing device and transmits a retrieval request to the second computing device if the shared initial filter criteria set corresponding to the identifier is not stored. The first computing device receives the shared initial filter criteria set from the second computing device, and stores the shared initial filter criteria set.

Abstract: The present invention relates to a point code emulation apparatus and method for dividing a Common Channel Signaling System No. 7 (or SS7) signaling network into two or more networks. The point code emulator is adapted to receive TCAP messages from two or more subnets and converts, for the messages crossing over the subnets, the information of the TCAP messages, including originating point code, destination point code, and transaction identifier, (and optionally, calling party number and called party number), and forwards to the other one of the two or more subnets. Correspondence among the two or more subnets may be provisioned by an authorized user of the system, may be learned automatically by the system based on ISUP message correspondences or previous TCAP transactions, or may be automatically discovered by the system broadcasting messages to nodes in the destined one of the two or more subnets.

Abstract: A first media packet from a first endpoint of an access network behind a NAPT device is received by a media device between a core network and the access network. The first media packet includes a first source IP address and port combination identifying the first endpoint. An UPDATE request or a reINVITE request is transmitted by the media device. A second IP address and port combination for the media device to receive future media packets from the first endpoint is negotiated. The media device compares a first IP address of the first source IP address and port combination to a second IP address of a second source address and port combination for a second media packet received on the second IP address and port combination. If the first and second IP addresses match, the media device relays media packets from the core network to the first endpoint.

Abstract: The invention features systems and methods for detecting and mitigating network attacks in a Voice-Over-IP (VoIP) network. A server is configured to receive information related to a mitigation action for a call. The information can include a complexity level for administering an audio challenge-response test to the call and an identification of the call. The server also generates i) a routing label based on the identification of the call, and ii) a script defining a plurality of variables that store identifications of a plurality of altered sound files for the audio challenge-response test. Each altered sound file is randomly selected by the server subject to one or more constraints associated with the complexity level. The server is further configured to transmit the script to a guardian module and the routing label to a gateway.

Abstract: The invention features a computer-implemented method for playing back an announcement message to a user device. The method includes initiating, by a computing device, an announcement session in response to a user device establishing communication with the computing device and determining, by the computing device, the announcement message to be played back to the user device. The method includes loading, by the computing device, into a queue associated with the announcement session, a descriptor referencing a memory buffer on the computing device. The memory buffer includes a plurality of memory partitions, each memory partition storing at least one portion of the announcement message encoded at a different rate. The method includes the computing device scheduling play back of the announcement message, playing the announcement message to the user device at a first rate and receiving a request from the user device for playback at a second rate.

Abstract: Methods, media gateways, and computer program products are described associated with call redundancy for a packet-based network. The described call redundancy involves a receiver module in communication with the packet-based network adapted to receive or transmit data associated with a plurality of calls from one or more signaling links. The data includes signaling information based on a publicly-switched telephone network (“PSTN”) standard. A first processor module is in communication with the receiver module and is adapted to process the data associated with the plurality of calls. A second processor module is in communication with the receiver module and the first processor module. The second processor module is adapted to receive at least a portion of the data associated with the plurality of calls. At least a portion of data maintained on the second processor module is synchronized with the corresponding data processed by the first processor module.

Abstract: A system and method is provided for adjusting a traffic rate for a Message Session Relay Protocol (MSRP) session established between two network nodes at a per session level. Each MSRP session has a traffic rate for which MSRP messages are transmitted over the MSRP session. The traffic rate per session can be adjusted, and the adjusted traffic rate per session can be communicated to adjacent nodes.

Abstract: Systems and methods for user device registration are disclosed. In certain embodiments, at least a first edge device in a group of edge devices enters a mass-restart mode. The first edge device receives a request for registration from a user device and determines whether the user device is currently registered through the first edge device. The first edge device generates a notification associated with the user device if the user device is not currently registered through the first edge device. A second edge device in the group of edge devices receives the notification and determines whether the user device is currently registered through the second edge device based on the notification. Registration information about the user device is deleted from the second edge device if the user device is currently registered through the second edge device.

Abstract: Methods and apparatuses, including computer program products, are described for identifying an application server in a plurality of application servers associated with a shared identifier in an Internet Protocol Multimedia Subsystem (IMS) network. The method includes receiving, from a Signaling System 7 (SS7) network, a message including a mobile device identifier associated with a mobile device connected to the IMS network and determining the identity of an application server in the plurality of application servers associated with the shared identifier. The determining step includes extracting the mobile device identifier from the message and retrieving, from a data storage module, an application server identifier associated with an application server based on the extracted mobile device identifier. The application server associated with the retrieved identifier provides service to the mobile device.

Abstract: Systems and methods for user device registration are disclosed. In certain embodiments, at least a first edge device in a group of edge devices enters a mass-restart mode. The first edge device receives a request for registration from a user device and determines whether the user device is currently registered through the first edge device. The first edge device generates a notification associated with the user device if the user device is not currently registered through the first edge device. A second edge device in the group of edge devices receives the notification and determines whether the user device is currently registered through the second edge device based on the notification. Registration information about the user device is deleted from the second edge device if the user device is currently registered through the second edge device.

Abstract: The invention features systems and methods for detecting and mitigating network attacks in a Voice-Over-IP (VoIP) network. A server is configured to receive information related to a mitigation action for a call. The information can include a complexity level for administering an audio challenge-response test to the call and an identification of the call. The server also generates i) a routing label based on the identification of the call, and ii) a script defining a plurality of variables that store identifications of a plurality of altered sound files for the audio challenge-response test. Each altered sound file is randomly selected by the server subject to one or more constraints associated with the complexity level. The server is further configured to transmit the script to a guardian module and the routing label to a gateway.

Abstract: Described are methods and apparatuses, including computer program products, for limiting server overload via client control. A first set of a plurality of requests are transmitted to a server at a first transmission rate during a first period of time. The first transmission rate is limited to be less than or equal to a first transmission limit rate. An overload value is determined based on whether at least two or more requests of the first set of requests for service satisfy an overload criterion. A second transmission limit rate is determined based on the overload value and the first transmission limit rate. A second set of a plurality of requests is transmitted to the server at a second transmission rate during a second period of time. The second transmission rate is limited to be less than or equal to the second transmission limit rate.

Abstract: Methods and apparatuses, including computer program products, are described for establishing secure communications sessions between computing devices located behind network security devices. The method includes receiving, from a first client computing device, a request for a secure connection with a second client computing device, the request including a first transport protocol role and a first security protocol role associated with the first device. The method includes transmitting the request to the second device. The method includes receiving, from the second device, a response to the request including a second transport protocol role and a second security protocol role associated with the second device, transmitting the response to the first device, and establishing the secure connection between the first device and the second device, where the first and second security protocol roles are determined independently from the first and second transport protocol roles.

Abstract: A computer-implemented method for inserting an out-of-band signaling packet into a real-time protocol (RTP) stream is provided. The method includes receiving the out-of-band signaling packet intended for transmission to a user device and forming a synthesized packet based on payload information from the out-of-band signaling packet and header information stored in a data structure describing the RTP stream. The method also includes inserting the synthesized packet into the RTP stream. The method further includes receiving an RTP packet intended for transmission to the user device via the RTP stream, analyzing an insertion sequence number and an insertion flag maintained in the data structure, and discarding or forwarding the RTP packet via the RTP stream based on the analyzing.

Abstract: A method for control of real-time traffic entry of a managed packet network includes the step of receiving, from a border element processor, a first message indicative of a new active registration request associated with a client. The border element processor is one of a plurality of border element processors at an edge of a managed packet network controlling packets (e.g., relating to real-time multimedia traffic) entering the managed packet network. The method also includes the step of load balancing, by a load balancing engine, the new active registration request across the plurality of border element processors and assigning the client to a designated border element processor. A second message is generated in response to the new activation registration request. The second message includes a parameter identifying the designated border element processor assigned to the client.