Abstract: A system and method for automated determination of quasi-identifiers for sensitive data fields in a dataset are provided. In one aspect, the system and method identifies quasi-identifier fields in the dataset based upon a static analysis of program statements in a computer program having access to - sensitive data fields in the dataset. In another aspect, the system and method identifies quasi-identifier fields based upon a dynamic analysis of program statements in a computer program having access to -sensitive data fields in the dataset. Once such quasi-identifiers have been identified, the data stored in such fields may be anonymized using techniques such as k-anonymity. As a result, the data in the anonymized quasi-identifiers fields cannot be used to infer a value stored in a sensitive data field in the dataset.

Abstract: The present invention relates to the reduction of handoff delays for mobile telematics applications. In particular, the present invention provides a method employing GPS technology to define IP addresses in a mobile environment in order to reduce delays and transient data loss caused by handoff from one network to another.

Abstract: A system and method for aggregating and fragmenting packets is described. Data packets containing voice data and other data that suffer significantly in quality when delayed may be aggregated together and fragmented. The aggregation and fragmentation permits networks to push these time-sensitive packets more easily through a network based on priority given to fragmented data.

Abstract: A system and method for sizing transponder pools in a dynamic wavelength division multiplexing optical network having selected nodes designated to have a shared transponder pool is presented.

Abstract: In some of the preferred embodiments, a method for network discovery of a mobile device to use at least one of a plurality of access networks within an IP network includes: obtaining specified network information in the vicinity of a given location based on a set of criteria when a mobile is connected to the IP network from any location.

Abstract: A system and method for allowing mobile devices to simultaneously access a Subscriber Identity Module (SIM) are disclosed. The SIM contains a wireless transceiver, and the SIM may be located within a mobile phone, or it may be a stand-alone device. The mobile devices use a wireless protocol, such as Bluetooth, to retrieve identification information from the SIM. The devices then use this identification information to connect to a wireless communications network, such as a wireless local area network. Through this network the devices will be able to access the Internet. The SIM will never need to be removed and inserted from one device to another, and multiple devices can use the SIM simultaneously. Thus, the mobile phone will work regardless of whether other devices are also using the SIM.

Abstract: The preferred embodiments involve a mechanism to bootstrap Kerberos from EAP in which EAP is used for initial network access authentication and Kerberos is used for provisioning session keys to multiple different protocols. The preferred embodiments make use of an EAP extension method (EAP-EXT) to realize the mechanism.

Abstract: An inventive system and method for determining and presenting contextual suggestions on a mobile device is presented. The invention comprises a server having an incoming context handler, and a context presentation manager, a notifier, and a goal resolution component all on the mobile device, and user context, wherein the incoming context handler emits an event toward the mobile device, the goal resolution component determines the event causes a change in the user context and forwards notification to the context presentation manager, the notifier receives notification, renders notification on the mobile device, and presents the contextual suggestions based on the change in the user context on the mobile device. The system may further comprise a goal inferral component operable to determine detailed user context based on the event. In one embodiment, the notifier renders notification by causing the mobile device to vibrate, display multiple colors and/or emit sounds.

Abstract: A computer implemented fault diagnosis method employing both probabilistic models and statistical learning that diagnoses faults using probabilities and time windows learned during the actual operation of a system being monitored. In a preferred embodiment, the method maintains for each possible root cause fault an a-priori probability that the fault will appear in a time window of specified length as well as maintaining—for each possible resulting symptom(s)—probabilities that the symptom(s) will appear in a time window containing the fault and probabilities that the alarm will not appear in a time window containing the fault. Consequently, the method according to the present invention may advantageously determine—at any time—the probability that a fault has occurred, and report faults which are sufficiently likely to have occurred. These probabilities are updated based upon past time windows in which we have determined fault(s) and their cause(s).

Abstract: According to some embodiments, systems and methods for binding dynamic host configuration and network access authentication are provided related to, inter alia, interactions between a PAA (PANA Authentication Agent) and a DHCP (Dynamic Host Configuration Protocol) server, such as, e.g., for synchronization between the PANA SA state and the DHCP SA state, such as, e.g., maintaining synchronization when a connection is lost. In some embodiments, systems and methods for binding network bridge and network access authentication are also provided related to, inter alia, interactions between a PAA and a layer-2 switch, such as, e.g., for avoiding service thefts and the like (such as, e.g., MAC address and/or IP address spoofing) in the context of, e.g., the above. In some other embodiments, systems and methods for bootstrapping multicast security from network access authentication protocol are also provided related to, inter alia, key management for protected IP multicast streams, such as, e.g.

Abstract: A method of automatically creating functionally and structurally diverse equivalent copies of software executables using return oriented programming for the purpose of passing through a filter and other purposes includes starting with a program and a target runtime environment, creating a return oriented instruction library having a plurality of code fragments which end in a ‘return’ instruction from the program and chaining fragments together to automatically form diverse equivalent copies of software executables using return oriented programming.

Abstract: A system, method, and computer program product for enabling mediated access to information controlled by one or more information repositories by one or more application service providers. The information controlled by the one or more information repositories is associated with one or more subscribers of information-based services offered by the one or more application service providers.

Abstract: A packet data network gateway device may receive packet network data at a packet data network gateway device; filter the received packet network data to extract information associated with one or more messages in the packet network data; analyze the extracted information; and dynamically determine one or more of policy updates, rules, or thresholds based on the analyzing of the information and information associated with one or more of subscribers, location, existing policies, network operating condition and load.

Abstract: Method and system for improving personal productivity in home environments may store state information associated with an environment and one or more users in a knowledge base, detected activity of a user, infer location of the user based on the detected activity, and suggest one or more tasks to be performed based on the inferred user location.

Abstract: Mobile wireless devices may receive data streams from multiple remote sensors. The sensors may have limited power supplies and memory capacity. Aspects of the invention use statistical characteristics of the sensor data streams and the cost of acquiring a single element of each stream to determine what sequence the sensors should send their data streams in. The cost of acquiring the data may be modified dynamically, depending on parameters such as block size. Additional factors, such as a sensor's buffer capacity, may limit the amount of stream elements that may be cached and affect the sensors' stream transmit sequence. The evaluation order may be dynamically modified using an event processing engine, to reflect both changing statistics of underlying sensor stream tuples and time-varying acquisition costs associated with individual streams. This helps to increase in the operational lifetime of the sensors and associated monitoring applications.

Abstract: A system and method for route optimization in PMIP having a first mobile node having a local mobility anchor and anchored at an access router and a second mobile node anchored at an access router is presented. The method includes establishing a binding cache at one access router comprising a mapping of mobile node addresses to access router addresses, populating the binding cache, and updating the mapping of the mobile node addresses in response to a handoff of a mobile node from one access router to another access router, so that a packet is transmitted from the first mobile node to the second mobile node using the mapping in the binding cache. The second access router address is obtained by either transmitting the packet from the first mobile node to the local mobility anchor, or querying neighboring access routers, or broadcasting access router addresses from the local mobility anchor.

Abstract: Network management for providing and managing Quality of Service (QoS) in converged networks, and particularly management of bursty, short-lived data loads, in an opaque network where knowledge of or control over network elements is not required. Preferential treatment is provided to some subset of the network users that require better QoS assurances from the underlying network by applying probabilistic admission control decisions in conjunction with estimated network state provides improved performance for high priority data with bursty data loads.

Abstract: Network architecture configured for open communication between a plurality of sub-networks. Each of the plurality of sub-networks has a different routable network addressing scheme. The architecture includes at least one broker node adapted to communicate using at least two different routable network addressing schemes. The broker node comprises an identification management module configured to collect peer-application addresses for nodes currently accessing a specific application, the peer-application addresses being associated with a specific application, an address resolution module configured to map each of the peer-application addresses to a sub-network specific routable network address and a network coordination module configured to monitor and coordinate sub-network communication capabilities between the broker node and at least one other broker node and elect a primary broker node for each sub-network which the broker node and at least one other broker node is capable of communication.

Abstract: A system and method for automated determination of quasi-identifiers for sensitive data fields in a dataset are provided. In one aspect, the system and method identifies quasi-identifier fields in the dataset based upon a static analysis of program statements in a computer program having access to—sensitive data fields in the dataset. In another aspect, the system and method identifies quasi-identifier fields based upon a dynamic analysis of program statements in a computer program having access to—sensitive data fields in the dataset. Once such quasi-identifiers have been identified, the data stored in such fields may be anonymized using techniques such as k-anonymity. As a result, the data in the anonymized quasi-identifiers fields cannot be used to infer a value stored in a sensitive data field in the dataset.

Abstract: A system and methods are provided for converting a first temporally short and spectrally broad optical pulse into a train of spectrally narrow and distinct optical pulses. This involves receiving, on a first I/O channel, the first optical pulse associated with a plurality of wavelengths and performing wavelength division demultiplexing on the first optical pulse at an optical unit housed on an optical chip to output a plurality of second optical pulses on different ones of a plurality of second I/O channels, each of the second optical pulses associated with a unique wavelength range from the first optical pulse. This also involves receiving the second optical pulses at loop mirrors in the second I/O channels, wherein the second I/O channels are patterned as waveguides in the optical chip and reflecting, at the loop mirrors, the second optical pulses back to the optical unit.