Abstract: A system for mapping and translating address information in a network is provided. The system includes a client-side address translator (120) and a server-side address translator (140). The client-side address translator (120) is configured to receive a data packet from a client (110). The data packet includes a first destination address representing the real destination address. The client-side address translator (120) maps the first destination address to another address using a mapping algorithm and transmits the data packet with the via the network (160). The server-side address translator (140) receives the data packet, translates the mapped address information back to the real destination address and forwards the data packet using the real destination address.

Abstract: A system facilitates the visualization of a network having multiple nodes. The system collects information from at least one of the nodes. The information describes network operation over a period of time. The system then reconstructs the network operation for the time period from the collected information and presents the reconstructed network operation to an operator.

Abstract: Systems and methods for geographically mapping a vulnerability of a network having one or more network points include receiving vulnerability information identifying a vulnerability of a point of the network, correlating the vulnerability information with location information for the identified network point, and network identification information for the identified network point, and generating a map displaying a geographical location of the vulnerability.

Abstract: A method and apparatus is disclosed for increasing the security of computer networks through the use of an Intrusion and Misuse Deterrence System (IMDS) operating on the network. The IMDS is a system that creates a synthetic network complete with synthetic hosts and routers. It is comprised of a network server with associated application software that appears to be a legitimate portion of a real network to a network intruder. The IMDS consequently invites inquiry and entices the intruder away from the real network. Simulated services are configured to appear to be running on virtual clients with globally unique, class “C” IP addresses. Since there are no legitimate users of the virtual network simulated by the IMDS, all such activity must be inappropriate and can be treated as such. Consequently, the entire set of transactions by an intruder can be collected and identified rather than just those transactions that meet a predefined attack profile.

Abstract: A system monitors performance in a network that includes several network resources. The system obtains a list of targets in the network. The targets include selected ones of the resources. The system sends a request to the targets, receives responses from the targets, and determines a status of the targets based on the received responses or a lack of responses from the targets. The system then analyzes the status of the targets to determine compliance with the service-level guarantee.

Abstract: A system facilitates the browsing of information of interest. The system obtains a transcription of the information and provides the transcription to a user. The system also retrieves the information in its original format and presents the information to the user in the original format.

Abstract: A system and method for registration of a network access device including a processor configured to identify power loss at a network access device, initiate backup power at the network access device, identify when the backup power at the network access device decreases to or below a first predetermined level, and identify when backup power at the network access device is restored to or above a second predetermined level, and a transmitter configured to transmit, to a server, a registration extension message to reconfigure conditions for handling inbound communications and a registration extension cancellation message to restore original conditions for handling inbound communications.

Abstract: Systems and methods for encoding packetized data include applying different codings to the header and the payload. The header of a data packet is encoded for error correction separately from the payload of the data packet. The use of separate error correction techniques for the header and payload of a packet permits optimization of each for use in a data network, and more particularly, in a wireless data network.

Abstract: A system for performing packet based data communications over a parallel set of sublinks is provided. A transmitter unit separates the sublinks into an available set of sublinks and a busy set of sublinks. This transmitter avoids processing delays by utilizing sublinks in the available sublink set and not waiting for sublinks in the busy sublink set to be released. To receive the packets, a receiver unit utilizes a sequence number associated with each packet. Accordingly, the receiver extracts the one or more packets of data received in parallel over the set of sublinks in sequential order. A packet window buffer is used to store packets in sequence if they are initially received out of order. The receiver utilizes a sliding window to provide packets in continuous sequential order and transmits the packets serially over a single communication link.

Abstract: Methods and systems for detection and/or prevention of network attacks can include the use of multiple and/or time-dependent addresses coupled with filtering by the directory or naming service. The directory service can respond to requests for the address of a resource by returning an address that can be relocated over time by coordinating the directory service entry with the host and network address configuration data and/or by returning an address specific to the requestor. Thus, the directory service can track and build profiles of matches between requestors and accesses. The methods and systems can use the time dependent addresses and profiles to distinguish legitimate accesses from unauthorized or malicious ones. Requests for non-valid addresses can be misdirected to “empty” addresses or to detection devices.

Abstract: An approach for enabling controlled access to a limited set of remote services associated with a device is described. A controlled access platform determines one or more network access descriptors to associate with a calling application of a device configured to access a remote service via a communication network. The controlled access platform initiates a limiting of the calling application to one or more allowed network interaction types with a remote service or a network access component associated with the device based on a profile for defining one or more allowed network interaction types between the calling application and the remote service.

Abstract: A method and apparatus is disclosed for increasing the security of computer networks through the use of an Intrusion and Misuse Deterrence System (IMDS) operating on the network. The IMDS is a system that creates a synthetic network complete with synthetic hosts and routers. It is comprised of a network server with associated application software that appears to be a legitimate portion of a real network to a network intruder. The IMDS consequently invites inquiry and entices the intruder away from the real network. Simulated services are configured to appear to be running on virtual clients with globally unique, class “C” IP addresses. Since there are no legitimate users of the virtual network simulated by the IMDS, all such activity must be inappropriate and can be treated as such. Consequently, the entire set of transactions by an intruder can be collected and identified rather than just those transactions that meet a predefined attack profile.

Abstract: Embodiments of the invention reduce the probability of success of a DOS attack on a node receiving packets by decreasing the probability of random collisions of packets sent by a malicious user with those sent by honest users. The probability of random collisions may be reduced in one class of embodiments of the invention by supplementing the identification field of the IP header of each transmitted packet with at least one bit from another field of the header. The probability of random collisions may be reduced in another class of embodiments of the invention by ensuring that packets sent from a transmitting IPsec node to a receiving IPsec node are not fragmented.

Abstract: Routing requests for data objects from clients includes receiving a request for a data object from a client, providing content servers capable of serving data objects, determining a server from the content servers, and informing the client of an address associated with the determined server accessible by the selected route. Determining a server includes, for each content server, identifying routes between the content server and the client, determining traversal times for the routes, and selecting a route from among the routes based on the traversal times.

Abstract: Systems and methods are described for forming and operating communication networks that support the needs of an enterprise. These systems and methods include: establishing a plurality enterprise network nodes overlaid on one or more common carrier networks; establishing independence between the enterprise network and the common carrier networks; designing services provided by the enterprise network to be consistent with the current modes of operation of the common carrier networks and employing existing services of the common carrier networks to transport enterprise data; employing redundancy in communications among enterprise network nodes and in the storage of enterprise data. Compared to current enterprise networks, a network based on these methods and systems is easier to implement, is less expensive, and could be deployed more quickly. This network is not limited by the coverage and services provided by any particular carrier.

Abstract: A translator is provided for translating predetermined portions of packet header information including an address of a data packet according to a cipher algorithm keyed by a cipher key derived by a key exchanger. A mapping device is also provided for mapping the address to a host table stored in memory. If the address does not match an entry in the host table, a security device is triggered.

Abstract: A method for testing a speaker (212) and microphone (216) of a communication device (110) is provided. The method includes playing a first audio signal through the speaker (212) and determining whether the first audio signal is audible. If the first audio signal is audible, the communication device (110) receives a second audio signal through its microphone (216) and plays the second audio signal through the speaker (212). If the second audio signal is audible the method determines that the microphone (216) is properly functioning. Such a method allows the communication device (110) to be quickly and easily tested.

Abstract: The disclosed systems and methods provide for the compression and decompression of packet headers. An uncompressed header can be compressed in size to form a smaller, compressed header, such that the compressed header can include values that can be used to re-produce the uncompressed header. A compressed header can include at least two such values. A first value of the at least two values can be computed based on a second, earlier uncompressed header and can be used to derive the uncompressed header. Similarly, a second value of the at least two values can be computed based on a third uncompressed header and can be used to derive the same uncompressed header. Accordingly, the uncompressed header can be derived based on the first value and the second uncompressed header, or based on the second value and the third uncompressed header. The uncompressed header, second uncompressed header, and third uncompressed header can be associated with different packets.

Abstract: A system and method for managing access to a Wi-Fi system include redirecting an access request, comprising a user credential, from a wireless user device to an authentication server, obtaining, from a first database, a list of a plurality of authentication databases from which users may be authenticated, the list including a protocol required for communication with each of the authentication databases, transmitting a request to each of the listed authentication databases using the identified protocol, and permitting the user access to the Internet through the Wi-Fi system if the user is authenticated by at least one of the listed authentication databases.

Abstract: Methods, apparatus, system and computer program are provided for concealing the identity of a network device transmitting a datagram having a network layer header. A unique local identifier and broadcast address are determined in accordance with a next-hop address. A partially encrypted network layer header is determined by encrypting a plurality of identifying portions of the network layer header, where one portion of the network layer header is the unique local identifier. The datagram is encapsulated with another network layer header whose address is set to the broadcast address. The encapsulated datagram can be received and detunneled, and an address of a recipient can be extracted from the network layer header. The datagram is then admitted into a network domain.