Abstract: Methods, apparatus and other means for providing path characterisation information to a data sender relating to a network characteristic such as congestion experienced by data units traversing a path across a data network from the data sender towards one of a plurality of data receivers, the data units having associated therewith information indicative of the network characteristic, the path being traversed by the data units having at least a first path portion between said data sender and a proxy node along which data units may traverse conveying a measure indicative of the network characteristic that is representable by any of a first set of codepoints, the data receivers being operable to provide data acknowledgement units in respect of data units they receive via a second path portion in which information indicative of the network characteristic may only be representable using codepoints of a second set of codepoints having less codepoints than the first set of codepoints.

Abstract: Control apparatus (30), systems and methods for enabling access to one or more information systems (36) by one or more entities (34) on a path across a supply network to be controlled, access to the or each information system (36) being policed by means of an access-policer (38), the network comprising: at least one token-issuer (32) operable to issue an access pre-authorisation token, the access pre-authorisation token having associated therewith an information identifier and a digital signature, and to forward the access pre-authorisation token towards one or more entities (34) on a path across the network; and at least one receiver entity (34) operable to receive an access pre-authorisation token issued by the at least one token-issuer (32).

Abstract: Apparatus and system for verifying a route taken during movement of an RFID tag, comprising a trusted platform module; sealed storage (80) comprising one or more stores (50, 52) for storing a public key (64), a private key (68) and a policy (62); and processors arranged to: receive data (60) read-out from the RFID tag (4) and comprising an RFID tag identity and an encrypted signature (9); use the public key (64) to decrypt the encrypted signature (9); verify that the decrypted signature (9) corresponds to a first entity from which, according to the policy (62), a second entity is authorised to receive the given RFID tag (4); use the private key (68) to provide an encrypted signature (9); and forward data comprising the encrypted signature (9) to an RFID tag writer (22).

Abstract: Methods and systems for policing usage by one or more users (12) of a data network (14), said one or more users (12) being able to send, to receive, or to send and receive data over the network via one or more of a plurality of access nodes (42), the usage of the data network resulting from respective data units consuming network resources along respective paths across the data network (14), each of said data units being associated with one of a plurality of subsets of the usage of the data network, said data units having congestion indications associated therewith indicating a measure of their congestion impact.

Abstract: A control device, method and system for controlling data exchange between entities and item identification devices associated with said control device; said entities having an associated data exchange means for exchanging data with item identification devices; said data exchange means being arranged to provide authentication data indicative of the entity with which they are associated; and said control device comprising means for enabling exchange of data between said item identification devices and the entity with which said data exchange means is associated in accordance with an applicable access policy for that entity.

Abstract: Data collected by sensors (10, 30) is transmitted to data collection points (31, 61) over a network using an epidemic protocol in which data received by a relay (3) is forwarded to a randomly-selected group of further relays (4, 5, 6) unless the same data has been previously received by the relay (3) or the data is time-expired. Data received by a relay (3) from different sources (1, 2, 30) in the same time-frame is aggregated using a Bloom filter process so that in each time frame only a single Bloom filter message is transmitted by each relay.

Abstract: One or more users of a present state are notified of at least one property of an entity. A request message is received from a user over a first communications channel, the message containing information indicative of at least one property of an entity in which the user is interested. The present state of the at least one property is determined, as is an identifier of a second communications channel onto which future messages containing information relating to future changes of state of the at least one property of the entity will be transmitted. A reply message is transmitted to the user, the reply message containing information indicative of the present state of the at least one property and of the identifier of the second communications channel.

Abstract: Methods and apparatus for updating a policy store associated with a policy decision point of an access control system, the policy decision point being arranged to provide, in response to received decision requests, access control decisions in dependence on one or more policies stored in said policy store, each policy specifying a predetermined access control decision to be provided in response to a particular access request made in respect of a particular attribute or combination of attributes, the policy decision point being associated with at least one policy enforcement point arranged to implement access control in accordance with access control decisions provided by said policy decision point in response to decision requests submitted by said policy enforcement point, said policy enforcement point having associated therewith an attribute store providing data relating to attributes in respect of which access requests have previously been made via said policy enforcement point.

Abstract: Methods and systems for use in enabling verification by entities on a path across a supply network of an item identification means traversing said path, the network comprising: at least one supplier entity able to introduce into the network an item identification means having stored therein an item identifier and a digital signature associated with said supplier entity, and to forward said item identification means along a path across said network; at least one intermediate entity able to receive said item identification means from said at least one supplier entity or from another intermediate entity in said network and forward said item identification means along said path; and at least one receiver entity able to receive said item identification means from an intermediate entity in said network.

Abstract: A processing node for processing data items in a data network, comprising means for receiving data items, means for receiving characterization metrics associated with the data items and identifying characteristic values in respect thereof, and a process selection means, said process selection means comprising means for deriving a collective value from characteristic values associated with a plurality of the data items, means for comparing characteristic values associated with a plurality of the data items with a predetermined target value, means for subjecting data items in respect of which the characteristic values are on a first side of the predetermined target value to a first process, means for selecting at least some of the data items in respect of which the characteristic values are on a second side of the predetermined target value, and means for subjecting the selected data items to a second process which is different from the first process.

Abstract: An RFID device such as an RFID tag (2) and method comprising: storing a current read key and a current ownership key; receiving, from the RFID reader system (4), a change read key command and an indication that the RFID reader system (4) holds the current ownership key; and in response, replacing the current read key with a new current read key enabling the RFID device (2) to be read by an RFID reader system (4) holding the new current read key. Also, an RFID reader system (4) and method for an RFID reader system (4) to process an RFID device (2), comprising: issuing a take ownership command to an RFID device (2); receiving a new ownership key from the RFID device (2); applying for authorisation of the new ownership key; and receiving from the authorisation apparatus (6) the new ownership key and an acknowledgement that may be communicated to the tag as evidence of authorisation.

Abstract: A method, apparatus and system for verifying a route taken during movement of an RFID tag (4) between different entities of an authorized route. The method comprises: first verification apparatus (10) associated with a first entity using a first private key (68) to provide a first encrypted signature (9) that is written to an RFID tag (4); second verification apparatus (20) associated with a second entity using a public key (64) to decrypt the signature (9) from data read out from the RFID tag (4); and the second verification apparatus (20) verifying that the decrypted signature (9) corresponds to an entity from which the second entity is authorized to receive the given RFID tag identity. The second verification apparatus (20) may use a second private key (68) to provide a second encrypted signature (9) that is written to the RFID tag (4).

Abstract: Apparatus and system for verifying a route taken during movement of an RFID tag, comprising a trusted platform module; sealed storage (80) comprising one or more stores (50, 52) for storing a public key (64), a private key (68) and a policy (62); and processors arranged to: receive data (60) read-out from the RFID tag (4) and comprising an RFID tag identity and an encrypted signature (9); use the public key (64) to decrypt the encrypted signature (9); verify that the decrypted signature (9) corresponds to a first entity from which, according to the policy (62), a second entity is authorised to receive the given RFID tag (4); use the private key (68) to provide an encrypted signature (9); and forward data comprising the encrypted signature (9) to an RFID tag writer (22).

Abstract: An announcement thread addressing format which comprises a first sub-part concatenated with a second sub-part is described. The first sub-part is preferably the address of the party which generates the addressing identifier, whereas the second sub-part may be random data. An announcer apparatus may then use these address formats by including only those parts of an announcement thread address which render the address unique within the particular index message in which it is to be included, but not necessarily globally unique.

Abstract: Methods and devices for enabling a user to obtain item information relating to an item (10), the item having associated therewith an item identification means (12) and an RFID response means (14) arranged to provide a predetermined response on being subjected to a currently applicable trigger signal; the method comprising steps of: establishing from the item identification means (12) item identification information; using the item identification information to determine from an item information source (30) a currently applicable trigger signal for the RFID response means (14); subjecting the RFID response means (14) to the currently applicable trigger signal; receiving a predetermined response from the RFID response means (14); and using the predetermined response to obtain item information from the item information source (30); wherein the RFID response means (14) is arranged to generate a new currently applicable trigger signal and a new predetermined response associated therewith following subjecting of th

Abstract: A key distribution server maintains a tree of nodes. Members of a group who are allowed access to information are associated with respective leaf nodes of the tree. The information is encrypted with a key comprising a join key field and a leave field, and these are associated with the root node of the tree. The join key is updated each time a member joins the group and the leave field is updated each time a member leaves. Further respective leave keys are associated with the other nodes of the tree. The leave keys of the tree are related so that a member knowing the leave key of its node can work out the leave key of the root node and hence decrypt the information. The key distribution server transmits offset messages to the members to allow them so to calculate the root node leave key. The system of offset messages reduces the amount of communication required between the key distribution server and the group members.

Abstract: A network channel is used as a waiting channel, wherein members of a group other than a first member join the waiting channel while performing an action or process, and then leave the waiting channel once the action or process has been performed. Once all of the members have left the waiting channel the first member of the group then performs an action or process. In order to indicate to the first member that all of the other members have left the waiting channel, a protocol such as the Multicast Source Notification of Interest Protocol (MSNIP) may be used.

Abstract: A network includes a server and a number of clients, which will in operation of the network require authentication by the server. The server distributes authentication information to other clients when a session is initialized. When the server needs to authenticate a client, it hands out a server request to the client which asks client for authentication information which it must obtain from other clients. The client to be authenticated then sends these requests to the clients specified in the authentication request to obtain the authentication information from those clients. Once the client to be authenticated has received the relevant authentication information from the other clients it returns it to the server and is authenticated or not accordingly.

Abstract: Data collected by sensors (10, 30) is transmitted to data collection points (31, 61) over a network using an epidemic protocol in which data received by a relay (3) is forwarded to a randomly-selected group of further relays (4, 5, 6) unless the same data has been previously received by the relay (3) or the data is time-expired. Data received by a relay (3) from different sources (1, 2, 30) in the same time-frame is aggregated using a Bloom filter process so that in each time frame only a single Bloom filter message is transmitted by each relay.

Abstract: The invention relates to data networks, to nodes making up parts of data networks, and to information relating to the characterisation of paths taken by data travelling between nodes in the networks. Path characterisation information is arranged to be conveyed to nodes such that it may be used by nodes subsequently forwarding data. In particular the invention relates to nodes receiving such path characterisation information from upstream nodes, deriving therefrom information indicative of characteristics of a path downstream of said nodes, and using such information to make informed decisions such as routing decisions when forwarding data onward in data networks.