Abstract: Limiting or controlling access to various services thereby performing a firewall function. An access router may permit or deny a packet based on at least a portion of a unique bit string (or context information) which replaced layer 2 header information (e.g., the layer 2 (e.g., MAC) address). Further, a particular quality of service may be indicated by at least a part of the unique bit string (or context information). The service provided to a group of customers, that group of customers being defined by at least a portion of the unique bit string (or context information), may be monitored. Multicast groups may be supported by checking at least a part of the unique bit string (or context information) to determine whether or not a customer associated with that port is permitted to join the multicast group.

Abstract: Supporting virtual private networks by using a new layer 3 address to encapsulate a network-bound packet so that its context information, from which a layer 2 (e.g., MAC) address can be derived, is preserved. If this encapsulation was not done, the layer 2 address would change over each segment of the network. Thus, the encapsulation preserves the concept of group identification, using at least a part of the context, over the entire network and not just at the edge of the network. If a packet is received from the network (to be forwarded to a customer), the layer 3 address that was added in the encapsulation is stripped off. The original layer 3 destination address may be used with a client device addressing table to determine a new context information, and a layer 2 (e.g., MAC) address of a destination client device.

Abstract: A computer network includes first and second Ethernet access domain networks, each of Ethernet access domain networks including a user-facing provider edge (u-PE) device, and a stack group of network-facing provider edge (n-PE) devices coupled with the u-PE device, the n-PE devices running a bidding protocol to select one of the n-PE devices as a primary n-PE device for a single pseudowire connection path between the first and second Ethernet access domain networks. It is emphasized that this abstract is provided to comply with the rules requiring an abstract that will allow a searcher or other reader to quickly ascertain the subject matter of the technical disclosure. It is submitted with the understanding that it will not be used to interpret or limit the scope or meaning of the claims. 37 CFR 1.72(b).

Abstract: A computer network includes first and second Ethernet access domain networks, each of Ethernet access domain networks including a user-facing provider edge (u-PE) device, and a stack group of network-facing provider edge (n-PE) devices coupled with the u-PE device, the n-PE devices running a bidding protocol to select one of the n-PE devices as a primary n-PE device for a single pseudowire connection path between the first and second Ethernet access domain networks. It is emphasized that this abstract is provided to comply with the rules requiring an abstract that will allow a searcher or other reader to quickly ascertain the subject matter of the technical disclosure. It is submitted with the understanding that it will not be used to interpret or limit the scope or meaning of the claims.

Abstract: A Service Provider (SP) authentication method includes receiving a message from a subscriber-premises device, the message being compatible with an authentication protocol and being transported from the subscriber-premises device to a u-PE device operating in compliance with an IEEE 802.1x compatible protocol. Access to the SP network is either allowed or denied access based on a logical identifier contained in the message. It is emphasized that this abstract is provided to comply with the rules requiring an abstract that will allow a searcher or other reader to quickly ascertain the subject matter of the technical disclosure. It is submitted with the understanding that it will not be used to interpret or limit the scope or meaning of the claims. 37 CFR 1.72(b).

Abstract: Techniques for inserting a network service in an Ethernet access network operated by an access service provider include sending routing data to customer premises equipment. The access network is between a physical layer link with customer premises equipment and a remote packet switched network. The routing data indicates a logical network address for an access gateway for access to the remote packet switched network, and a logical network address for an ancillary gateway for an ancillary service different from access to the remote packet-switched network. A data packet is received from customer premises equipment and it is determined whether a layer 2 destination address indicates the ancillary gateway. If so the data packet is directed to the ancillary gateway instead of the access gateway. Thus, the ancillary service is provided topologically closer to the customer premises equipment.

Abstract: A communication system providing telephony communication across combined circuit switched and packet switched networks, such as a telephone network and the Internet, which are connectable to terminals, such as telephones and computers, for selective communication therebetween. The communication system includes an authorization and account control object in the packet switched network, multiple gateways between the circuit switched and packet switched networks providing controlled connectivity between those networks, and an information retrieval object in the packet switched network, wherein the authorization and account control object maintains a substantially real time record of user accounts and usage, and the information and retrieval object provides substantially real time retrieval of selected information from the authorization and account control object.

Abstract: Offering vertical services to subscribers and service providers is an avenue to immediately improve the competitiveness of digital subscriber line access service, for example of the type offered by a local exchange carrier. To deliver high-quality vertical services, however, the underlying ADSL Data Network (ADN) or the like needs to establish Quality of Service (QoS) as a core characteristic and offer an efficient mechanism for insertion of the vertical services. The inventive network architecture introduces QoS into the ADN, in a manner that enables the delivery of sophisticated and demanding IP-based services to subscribers, does not affect existing Internet tiers of service, and is cost-effective in terms of initial costs, build-out, and ongoing operations.

Abstract: A method involving receiving, at a network device, a first layer 2 network packet from a client, the first layer 2 network packet encapsulating a layer 3 network packet; forwarding the first layer 2 network packet to a server by associating the layer 3 destination host with a particular server connected to the network device, creating a modified first layer 2 network packet by overwriting the layer 2 destination address of the first layer 2 network packet with the layer 2 network address of the server, and sending the modified first layer 2 network packet over a network; receiving, at the network device, a second layer 2 network packet from the server; and forwarding the second layer 2 network packet to the client by creating a modified second layer 2 network packet by overwriting the layer 2 source address of the second layer 2 network packet with the layer 2 network address of the network device and sending the modified second layer 2 network packet over a network.

Abstract: Limiting or controlling access to various services thereby performing a firewall function. An access router may permit or deny a packet based on at least a portion of a unique bit string (or context information) which replaced layer 2 header information (e.g., the layer 2 (e.g., MAC) address). Further, a particular quality of service may be indicated by at least a part of the unique bit string (or context information). The service provided to a group of customers, that group of customers being defined by at least a portion of the unique bit string (or context information), may be monitored. Multicast groups may be supported by checking at least a part of the unique bit string (or context information) to determine whether or not a customer associated with that port is permitted to join the multicast group.

Abstract: The quality of service existing in a data packet network during the course of communication of a voice call through a data network, such as the Internet, is monitored. A minimum acceptable level of service may be predefined with a threshold quality level stored in the user's Call Processing Record (CPR) in the AIN Integrated Services Control Point (ISCP). If the monitored quality is maintained in excess of the stored threshold, communication of the call continues through the established course of transmission. If the measured quality of service on the data network is not satisfactory, the routing of the call is changed to communication solely through a voice telephone network connection, which may include an Interexchange Carrier link, without terminating the call. The packet data network is thereby bypassed to obtain voice grade quality while maintaining the call.

Abstract: The advanced intelligent network (AIN) to determine routing of voice calls alternatively between the public switched telephone network (PSTN) and a data packet network, such as the Internet, in accordance with the quality of service existing in the data packet network at the times of call origination. The user's acceptable level of service may be predefined with a threshold quality level stored in the user's Call Processing Record (CPR) in the AIN Integrated Services Control Point (ISCP). On a per call basis, the caller linked to a first public switched network may indicate a preference to route through the Internet. This indication is recognized by the AIN system, in response to which the quality of service currently present on the Internet for completion of the call is measured. If the result exceeds the stored threshold, the call is setup and routed through the Internet to the switched network link to the destination party.

Abstract: Offering vertical services to subscribers and service providers is an avenue to immediately improve the competitiveness of digital subscriber line access service, for example of the type offered by a local exchange carrier. To deliver high-quality vertical services, however, the underlying ADSL Data Network (ADN) or the like needs to establish Quality of Service (QoS) as a core characteristic and offer an efficient mechanism for insertion of the vertical services. The inventive network architecture introduces QoS into the ADN, in a manner that enables the delivery of sophisticated and demanding IP-based services to subscribers, does not affect existing Internet tiers of service, and is cost-effective in terms of initial costs, build-out, and ongoing operations.

Abstract: Redundancy for Virtual Private Network (VPN) service with an Ethernet access network is provided by a full-mesh of dedicated pseudowires connected among the network-facing provider edge (n-PE) devices, each of which is associated with the same Ethernet access network. A provider Bridge Protocol Data Unit (BPDU) generated by a provider bridge node in the Ethernet access network and received at an input interface of one n-PE device is relayed (without being processed) to all other n-PEs associated with that access network over the full-mesh of dedicated pseudowires. It is emphasized that this abstract is provided to comply with the rules requiring an abstract that will allow a searcher or other reader to quickly ascertain the subject matter of the technical disclosure. It is submitted with the understanding that it will not be used to interpret or limit the scope or meaning of the claims.

Abstract: A computer network includes a core network connected with first and second Ethernet access domain networks, each of Ethernet access domain networks including a user-facing provider edge (u-PE) device, a primary network-facing provider edge (n-PE) device, a redundant n-PE device, and a plurality of aggregation provider edge (Agg-PE) devices providing connectivity between to the u-PE device and the primary and redundant n-PE devices, the Agg-PE devices running a spanning-tree protocol (STP) algorithm. A primary data path is provided along with first and second redundant data paths that include first and second redundant pseudowires (PWs), respectively, connected across the core network, the first and second redundant data paths being blocked by the STP algorithm when the primary data path is available, the STP algorithm unblocking either the first or second redundant data path in response to a failure of the primary data path.

Abstract: Limiting or controlling access to various services thereby performing a firewall function. An access router may permit or deny a packet based on at least a portion of a unique bit string (or context information) which replaced layer 2 header information (e.g., the layer 2 (e.g., MAC) address). Further, a particular quality of service may be indicated by at least a part of the unique bit string (or context information). The service provided to a group of customers, that group of customers being defined by at least a portion of the unique bit string (or context information), may be monitored. Multicast groups may be supported by checking at least a part of the unique bit string (or context information) to determine whether or not a customer associated with that port is permitted to join the multicast group.

Abstract: Supporting virtual private networks by using a new layer 3 address to encapsulate a network-bound packet so that its context information, from which a layer 2 (e.g., MAC) address can be derived, is preserved. If this encapsulation was not done, the layer 2 address would change over each segment of the network. Thus, the encapsulation preserves the concept of group identification, using at least a part of the context, over the entire network and not just at the edge of the network. If a packet is received from the network (to be forwarded to a customer), the layer 3 address that was added in the encapsulation is stripped off. The original layer 3 destination address may be used with a client device addressing table to determine a new context information, and a layer 2 (e.g., MAC) address of a destination client device.

Abstract: A method involving receiving, at a network device, a first layer 2 network packet from a client, the first layer 2 network packet encapsulating a layer 3 network packet; forwarding the first layer 2 network packet to a server by associating the layer 3 destination host with a particular server connected to the network device, creating a modified first layer 2 network packet by overwriting the layer 2 destination address of the first layer 2 network packet with the layer 2 network address of the server, and sending the modified first layer 2 network packet over a network; receiving, at the network device, a second layer 2 network packet from the server; and forwarding the second layer 2 network packet to the client by creating a modified second layer 2 network packet by overwriting the layer 2 source address of the second layer 2 network packet with the layer 2 network address of the network device and sending the modified second layer 2 network packet over a network.

Abstract: A method and apparatus for using a service provider network that supports point-to-point channels is disclosed. One or more encryption parameters are associated with a channel from among a set of one or more predefined point-to-point channels provided by the service provider to connect customer points for a customer different than the service provider. Payloads for a particular flow of one or more data packets directed through the channel are encrypted at a first customer point, using the set of encryption parameters associated with the particular channel, to generate a set of one or more encrypted payloads. The encrypted payloads are inserted in the particular flow sent through the channel of the service provider network. The encrypted payloads are decrypted at a second customer point connected to the first customer point by the channel.

Abstract: Simple peering is provided in a novel network in which transport technology is independent of network access technology. An out-of-band network may be used to carry advertisements to an update facility. The update facility may use layer 3 destination address information and at least a part of context information (to identify customers uniquely) to determine a layer 3 address of an edge device of the transport network associated with an addressed customer device. Virtual private networks are supported, as context information is used to distinguish different customers with overlapping layer 3 addresses.