Abstract: An exemplary system and method for using a network access system, such as a virtual private network (VPN), are provided. A user device may have a user session with a home agent. Additionally, an initiating security gateway may be in communication with the home agent, and a terminating security gateway may be in communication with the initiating security gateway via a tunnel (e.g., Internet Protocol in Internet Protocol (IP-in-IP) or Internet Protocol security (IPsec) tunnel). Further, a virtual local area network (VLAN) tag associated with the user session may map to a selector operable in a security policy database. The selector may be used to find a security policy defining an IPsec procedure, and the security policy may be applied to the tunnel. Also, the initiating security gateway may also include a Quality of Service (QoS) module that determines QoS markings for a packet traveling along the tunnel.

Abstract: Permission information (110), including a security parameter index SPI and a digital signature (120), form a digital rights key (140) in a digital rights management system. The security parameter index SPI identifies and algorithm for digital signature calculation (130) and of the digital rights key (140). A digital rights source generates the digital rights key (140) using the security parameter index SPI for digital rights management of licenses to an application. A digital rights client receives the digital rights key (140) and interprets it using an algorithm identified by the security parameter index SPI.

Abstract: A multilevel hierarchical feature rights management system (100) provides an efficient way of allocating feature keys. Sub-agents (140) are provisioned or activated with application software having features. The sub-agents request permissions from feature rights management agents (120) to use these features. The feature rights management agents (120) receive feature keys over a network (130) from a feature rights server (110). The feature rights management agents (120) then permit sub-agents (140) to use their provisioned features. In a further aspect of the invention the sub-agents (140) voluntarily release feature permissions rather than the server (110) or the agents (120) forcing the sub-agents (140) to revoke rights.

Abstract: A high density network access server implements a tunneling protocol between a modem module and a route server module. PPP and routing control packets received from the PPP link are tunneled to the route server for processing. The IP data packet forwarding function for the network access server is distributed directly to the modem modules. The combination of distributed PPP processing and distributed IP data packet forwarding enables the capacity of the network access server to be scaled to orders of magnitude greater than previously known, to handle thousands or even tens of thousands of simultaneous data sessions.

Abstract: An exemplary system and method for using a network access system, such as a virtual private network (VPN), are provided. A user device may have a user session with a home agent. Additionally, an initiating security gateway may be in communication with the home agent, and a terminating security gateway may be in communication with the initiating security gateway via a tunnel (e.g., Internet Protocol in Internet Protocol (IP-in-IP) or Internet Protocol security (IPsec) tunnel). Further, a virtual local area network (VLAN) tag associated with the user session may map to a selector operable in a security policy database. The selector may be used to find a security policy defining an IPsec procedure, and the security policy may be applied to the tunnel. Also, the initiating security gateway may also include a Quality of Service (QoS) module that determines QoS markings for a packet traveling along the tunnel.