Abstract: A transparent gateway having increased throughput during a file transfer protocol (ftp) session is provided. This increase is enabled through generalized network address translator (gNAT) at the kernel level that is under user-mode proxy control through an application programming interface (API). Initially, the proxy commands the API to generate a dynamic port-redirect in the gNAT for all connection requests for a port twenty-one to itself at the local port to which it is bound. The proxy may then establish a session on the client's behalf with the ftp server, establish a session on the client's behalf with a different ftp server, etc. The proxy then requests that the API command an address translation in the gNAT to open an ftp data session so that data from the ftp server need not pass up to the user-mode, but may be dynamically redirected within the kernel-mode.

Abstract: A system and method are presented that enhance the performance of single and multiple-processor servers by taking advantage of the half-duplex nature of many HTTP requests. Upon receipt of an HTTP Get resource request, a single send and disconnect IRP is generated. The semantics of the send and disconnect IRP completion recognizes the half-duplex nature of the transaction by indicating a graceful close of the TCP/IP connection. This send and disconnect IRP is also completed without a queuing stage (queuelessly) on the processor that serviced the client request. To further enhance performance, the server FIN message to the client is included in the last data frame transmitted to the server. The invention also contemplates transmission of a single HTTP get and disconnect request by a client to allow acknowledgementless disconnection of the TCP/IP connection once a requested resource has been sent.

Abstract: A method and system for mapping security parameters to a plurality of network sessions is provided. A responding computer maps the security parameters to the combination of packet parameters and a mapped port value used in each of the plurality of sessions. The packet parameters includes IP source and destination addresses, application source and destination ports and protocol type. The mapped port value is assigned by the responding computer to maintain a unique mapping between each security association and each network session.

Abstract: An application programming interface for translation of transport-layer sessions is presented. The system includes kernel-mode support for application-controlled network address translation and user-mode implementation of the redirect API routines. An application process may request that a network gateway modify the source and/or destination of a given network session in a manner transparent to the original source host and/or the replacement destination host. With the generalized NAT (gNAT) of the instant invention and its associated API, both the source and the destination addresses of message packets may be changed. The address changes are mapped in the gNAT, and may result in apparent sessions between different clients and servers. Depending on the protocol in use (e.g. TCP or UDP), the address translation may be made dynamically by the gNAT, under the command of the application, and take place at the kernel level.

Abstract: Updates for an enterprise's software product are made available to user devices on-line, even when network resources of the enterprise are unavailable. Software update sets and notifications concerning the update sets may be published by an enterprise for consumption by content distribution partners of the enterprise and parties not affiliated with the enterprise. Each abstraction relating to an update, including update notifications and update sets may include a cryptographic signature for later use in authenticating the source of the abstraction. Update notifications also may include information indicative of: available update sets; and network locations at which the update sets can be accessed. Further, an update notification may be configured with a time-to-live (TTL) value indicating a value of time after which the notification expires. TTL values give the enterprise some control over the distribution of update sets by limiting the lifespan of the update notifications corresponding to the update sets.

Abstract: An application programming interface for translation of transport-layer sessions is presented. The system includes kernel-mode support for application-controlled network address translation and user-mode implementation of the redirect API routines. An application process may request that a network gateway modify the source and/or destination of a given network session in a manner transparent to the original source host and/or the replacement destination host. With the generalized NAT (gNAT) of the instant invention and its associated API, both the source and the destination addresses of message packets may be changed. The address changes are mapped in the gNAT, and may result in apparent sessions between different clients and servers. Depending on the protocol in use (e.g. TCP or UDP), the address translation may be made dynamically by the gNAT, under the command of the application, and take place at the kernel level.

Abstract: A method of payload editing in an intelligent transparent gateway is provided. Certain applications include addressing information within the data streams of their sessions. When running on clients that are sharing a connection, such applications would send private, unreachable addressing information to remote peers, and the latter would be unable to respond to the clients's requests. The system of the instant invention supports an extensible means of modifying a session's application-layer data in flight, beyond the modifications made to the session's network-layer and transport-layer addressing information. Extensibility is achieved by allowing drivers to inspect the application-layer data in each packet received for a session, and to edit the application data in each packet. These editors register themselves with the gNAT of the instant invention as handlers for a specific TCP/UDP port number, and are henceforth invoked for each message translated in matching sessions.

Abstract: Creating different congestion control modules (CCMs) that can be plugged into a network communications stack (e.g., a TCP/IP stack). Software abstractions defining transport control events, congestion control algorithms and other information may be exposed by an application programming interface, e.g., of an operating system, and these abstractions may be used to define a CCM. The network communications stack may be configured to select one of multiple available CCMs to control congestion for a given connection. This selection may be based on any of a variety of factors including, but not limited to: network environment; connection path characteristics; connection link characteristics; a value of a socket parameter of an application; other factors; and any suitable combination of the foregoing. Thus, CCMs may be selected and implemented on a per-connection basis.

Abstract: A networked computer system in which a gateway is selected for efficient transmission over a network using a layered protocol. When a transmission over the network fails, information at multiple protocol layers indicates the usability of the gateway through which the failed transmission was made. In a layered protocol with an application or connection layer, a path layer and a link layer, information at the link layer is used to determine whether retransmission through the same gateway should be attempted. Information at the path layer is used to determine whether the gateway is faulty. Information from the application or connection layer is used to determine whether responses are received to transmissions. These determinations are used in setting the status of the gateway, which in turn is used to prioritize gateways when selecting a gateway for future transmissions.

Abstract: The present invention is directed to a method and system for managing concurrent access to multiple resources. Resources are assigned to sets in such a way that it is safe to concurrently access any combination of resources in a resource set. For each resource set, a virtual machine is defined and associated with the resource set. An application is assigned to a virtual machine. When an application requests access to a resource not in the application's virtual machine, access control lists are consulted to determine whether the access should be allowed, given the other resources already accessed by the application.

Abstract: A method to offload a network stack connection is presented. A request, which includes a list of resource requirements from each software layer in the stack, to offload the network stack connection is sent through the stack to the peripheral device. The device allocates resources for the list and sends a handle to each of the software layers for communication with the device. The state for each layer is sent to the device that includes state variables that are classified as a constant, a cached variable handled by the CPU, or a delegated variable handled by the device.

Abstract: Methods of tuning a receive window. A receiving device and a sending device may be in communication over a network. The receiving device may advertise a receive window to the sending device. The size of the receive window may be adjusted over time based on one or more connection parameters, application parameters and/or operating system parameters.

Abstract: A method to synchronize and upload an offloaded network stack connection between a host network stack and peripheral device is presented. A state object for each layer in the stack is sent to the device that includes state variables that are classified as a constant, a cached variable handled by the host, or a delegated variable handled by the device. State that must be updated by the network stack and the peripheral device is cleanly divided. For example, statistics are tracked by the host, the device, or the host and the device. A statistic tracked by both the host and peripheral device is divided into non-overlapping portions and combined to produce the statistic. Once an upload is initiated, the device achieves a consistent state and hands delegated states to the stack. Each layer in the stack takes control of its delegated state and resources at the device are freed.

Abstract: A method to synchronize and upload an offloaded network stack connection between a host network stack and processing device is presented. A state object for each layer in the stack is sent to the device that includes state variables that are classified as a constant, a cached variable handled by the host, or a delegated variable handled by the device. State that must be updated by the network stack and the processing device is cleanly divided. For example, statistics are tracked by the host, the device, or the host and the device. A statistic tracked by both the host and processing device is divided into non-overlapping portions and combined to produce the statistic. Once an upload is initiated, the device achieves a consistent state and hands delegated states to the stack. Each layer in the stack takes control of its delegated state and resources at the device are freed.

Abstract: A unified architecture for enabling remote access to a network is provided. The network may comprise, as examples, a virtual private network (VPN) and/or a peer-to-peer network. In one embodiment, the architecture includes components installed on a client device/node and a gateway/supernode. Components implemented on the client device may facilitate access in a manner similar to that of a traditional VPN, while components on the gateway may facilitate access in a manner similar to an application proxy. Communication between the client device and gateway may occur, as an example, via a Secure Sockets Layer (SSL) communication protocol.

Abstract: A new communications connection timer management framework for handling network communications protocol timers is disclosed. The timer management framework separates transmission control blocks (TCBs) having scheduled actions from the set of all TCBs maintained by a server. The TCBs having scheduled actions are referenced by a time-space partitioned data structure having time-slots corresponding to a current protocol timer “tick” value. The active TCBs are placed within particular ones of the time-space partitions based upon their expiration times. During each timer check sequence (e.g., once every 100 millisecond timer tick for TCP protocol timers), the timer management framework accesses a partition associated with a current timer value and checks the TCBs referenced within the current partition.

Abstract: A method to offload a network stack connection is presented. A request, which includes a list of resource requirements from each software layer in the stack, to offload the network stack connection is sent through the stack to the peripheral device. The device allocates resources for the list and sends a handle to each of the software layers for communication with the device. The state for each layer is sent to the device that includes state variables that are classified as a constant, a cached variable handled by the CPU, or a delegated variable handled by the device.

Abstract: A method to offload a network stack connection is presented. A request, which includes a list of resource requirements from each software layer in the stack, to offload the network stack connection is sent through the stack to the peripheral device. The device allocates resources for the list and sends a handle to each of the software layers for communication with the device. The state for each layer is sent to the device that includes state variables that are classified as a constant, a cached variable handled by the CPU, or a delegated variable handled by the device.

Abstract: In accordance with certain aspects of the present invention, improved methods and arrangements for controlling access to a network server in a client-server environment are provided. In accordance with certain implementations, user software selectively specifies a list of network interfaces or addresses on which connections are to be accepted. This “listing” is provided to the network server software and used to selectively filter (accept/reject) connection requests associated with a wildcard socket. The network server software essentially treats the wildcard socket as if the network server bound it not to the wildcard address, but instead to all of the network interfaces and/or addresses specified. The various methods and arrangements are applicable to file-sharing software, all TCP-based and UDP-based client-server software, including HTTP servers, digital media servers, DNS servers, database servers, etc.

Abstract: In accordance with certain aspects of the present invention, improved methods and arrangements for controlling access to a network server in a client-server environment are provided. In accordance with certain implementations, user software selectively specifies a list of network interfaces or addresses on which connections are to be accepted. This “listing” is provided to the network server software and used to selectively filter (accept/reject) connection requests associated with a wildcard socket. The network server software essentially treats the wildcard socket as if the network server bound it not to the wildcard address, but instead to all of the network interfaces and/or addresses specified. The various methods and arrangements are applicable to file-sharing software, all TCP-based and UDP-based client-server software, including HTTP servers, digital media servers, DNS servers, database servers, etc.

Abstract: A rubber composition for tire having improved processability, wear resistance, rebound resilience and heat build-up comprises 20.about.70 parts by weight of a specified butadiene polymer, 30.about.80 parts by weight of at least one rubber selected from natural rubber, high cis-1,4 polyisoprene rubber and styrene-butadiene copolymer rubber, and 0.about.30 parts by weight of high cis-1,4 polybutadiene and/or low cis-1,4 polybutadiene, and contains 35.about.100 parts by weight of carbon black, 0.about.50 parts by weight of process oil, 0.5.about.5 parts by weight of aliphatic carboxylic acid and 0.1.about.3 parts by weight of sulfur based on 100 parts by weight of the above rubber components.