Abstract: Mining information from network data traffic to determine interests of online network users is provided herein. A data packet received at a network interface device can be accessed and inspected at line rate speeds. Source or addressing information in the data packet can be extracted to identify an initiating and/or receiving device. The packet can be inspected to identify occurrences of keywords or data features related with one or more subject matters. A vector can be defined for a network device that indicates a relative rank of interest in various subject matters. Furthermore, statistical analysis can be implemented on data stored in one or more interest vectors to determine information pertinent to network user interests. The information can facilitate providing value-added products or services to network users.

Abstract: Methods and apparatus for supporting a session in Mobile IP are disclosed. A Mobile Node sends a first Mobile IP message identifying the Mobile Node to a Home Agent, wherein the first Mobile IP message indicates to the Home Agent that the Mobile Node is requesting dynamic configuration of a Mobile-Home authentication key to be shared between the Mobile Node and the Home Agent during the session. A Mobile-Home authentication key to be shared between the Home Agent and the Mobile Node is obtained or generated by the Mobile Node and the Home Agent, where the Mobile-Home authentication key is not valid after the session has ended or during another session.

Abstract: Mining information from network data traffic to determine interests of online network users is provided herein. A data packet received at a network interface device can be accessed and inspected at line rate speeds. Source or addressing information in the data packet can be extracted to identify an initiating and/or receiving device. The packet can be inspected to identify occurrences of keywords or data features related with one or more subject matters. A vector can be defined for a network device that indicates a relative rank of interest in various subject matters. Furthermore, statistical analysis can be implemented on data stored in one or more interest vectors to determine information pertinent to network user interests. The information can facilitate providing value-added products or services to network users.

Abstract: Techniques for restricting Address Resolution Protocol (ARP) table updates to updates originating from authorized subsystems is disclosed. According to an embodiment, an instruction to update an ARP table is received. It is determined whether a command interface from which the instruction originated is authorized. If the command interface is authorized, then the ARP table is updated based on the instruction. According to an embodiment, a DHCP Server may be configured to send an instruction to update an ARP table upon receiving a DHCP message indicating a network layer address that is not bound with a data link layer address. The DHCP Server may send the instruction over an authorized command interface, or be in other ways authorized to update the ARP table.

Abstract: Various security mechanisms may be used independently, or in combination with one another, to authenticate the identity of a node during the Mobile IP registration process. First, an Access Point receiving a packet from a node verifies that the source MAC address identified in the packet is in the Access Point's client association table. In addition, as a second mechanism, the Access Point ensures that a one-to-one mapping exists for the source MAC address and source IP address identified in the packet in a mapping table maintained by the Access Point. As a third mechanism, a binding is not modified in the mobility binding table maintained by the Home Agent unless there is a one-to-one mapping in the mobility binding table between the source MAC address and the source IP address. Similarly, the Foreign Agent may also maintain a mapping between the source IP address and the source MAC address in its visitor table to ensure a one-to-one mapping between a source IP address and the associated MAC address.

Abstract: Methods and apparatus for establishing an optimized route between a node and a Correspondent Node are disclosed. In a Mobile Router supporting Mobile IP, the Mobile Router having one or more networks associated therewith, a method of establishing a route between one or more nodes associated with one of the networks of the Mobile Router and a Correspondent Node includes composing a HOTI message on behalf of at least one of the nodes, which is sent from the Mobile Router to a Correspondent Node via a Home Agent supporting the Mobile Router. The Mobile Router sends a COTI message to the Correspondent Node on behalf of the node. The Mobile Router receives a HOT message from the Correspondent Node.

Abstract: Methods and apparatus for performing proxy registration on behalf of a node with a Home Agent supporting Mobile IP are disclosed. A first registration request is composed on behalf of the node and transmitted to the Home Agent via a first Local Mobility Anchor, wherein the first Local Mobility Anchor is a regional controller via which registration is performed when the node moves within a region associated with the first Local Mobility Anchor. When the node moves within a region or between regions, the node is re-registered. Specifically, a second registration request is composed and transmitted to the first Local Mobility Anchor when the node moves within the region associated with the first Local Mobility Anchor.

Abstract: Methods and apparatus for performing proxy registration on behalf of a node with a Home Agent supporting Mobile IP are disclosed. A first registration request is composed on behalf of the node and transmitted to the Home Agent via a first Local Mobility Anchor, wherein the first Local Mobility Anchor is a regional controller via which registration is performed when the node moves within a region associated with the first Local Mobility Anchor. When the node moves within a region or between regions, the node is re-registered. Specifically, a second registration request is composed and transmitted to the first Local Mobility Anchor when the node moves within the region associated with the first Local Mobility Anchor.

Abstract: Methods and apparatus for performing proxy registration on behalf of a node with a Home Agent supporting Mobile IP are disclosed. A first registration request is composed on behalf of the node and transmitted to the Home Agent via a first Local Mobility Anchor, wherein the first Local Mobility Anchor is a regional controller via which registration is performed when the node moves within a region associated with the first Local Mobility Anchor. When the node moves within a region or between regions, the node is re-registered. Specifically, a second registration request is composed and transmitted to the first Local Mobility Anchor when the node moves within the region associated with the first Local Mobility Anchor.

Abstract: In an embodiment, an existing transport protocol connection though a mobile device is recognized as having entered a state of disconnect. A lowest received sequence number is determined from received messages to be transmitted over a disconnected transport protocol connection. A disconnect acknowledgement message with a receive window of zero and a sequence number of one less than the lowest received sequence number is transmitted. The disconnect acknowledge message with a receive window of zero and a sequence number of one less than the lowest received sequence number is continued to be transmitted until the transport protocol connection exits the disconnect state to a connect state.

Abstract: Mining information from network data traffic to determine interests of online network users is provided herein. A data packet received at a network interface device can be accessed and inspected at line rate speeds. Source or addressing information in the data packet can be extracted to identify an initiating and/or receiving device. The packet can be inspected to identify occurrences of keywords or data features related with one or more subject matters. A vector can be defined for a network device that indicates a relative rank of interest in various subject matters. Furthermore, statistical analysis can be implemented on data stored in one or more interest vectors to determine information pertinent to network user interests. The information can facilitate providing value-added products or services to network users.

Abstract: Methods and apparatus for optimizing Mobile VPN communications are disclosed. When a data packet is transmitted between a Mobile Node that is a member of a VPN and a Correspondent Node, the data packet is transmitted between the Mobile Node and a Home Agent via a Mobile IP tunnel without transmitting the data packet via a VPN tunnel. However, the data packet is transmitted between the Home Agent and a VPN headend via a VPN tunnel.

Abstract: Techniques for restricting Address Resolution Protocol (ARP) table updates to updates originating from authorized subsystems is disclosed. According to an embodiment, an instruction to update an ARP table is received. It is determined whether a command interface from which the instruction originated is authorized. If the command interface is authorized, then the ARP table is updated based on the instruction. According to an embodiment, a DHCP Server may be configured to send an instruction to update an ARP table upon receiving a DHCP message indicating a network layer address that is not bound with a data link layer address. The DHCP Server may send the instruction over an authorized command interface, or be in other ways authorized to update the ARP table.

Abstract: In an embodiment, an existing transport protocol connection though a mobile device is recognized as having entered a state of disconnect. A lowest received sequence number is determined from received messages to be transmitted over a disconnected transport protocol connection. A disconnect acknowledgement message with a receive window of zero and a sequence number of one less than the lowest received sequence number is transmitted. The disconnect acknowledge message with a receive window of zero and a sequence number of one less than the lowest received sequence number is continued to be transmitted until the transport protocol connection exits the disconnect state to a connect state.

Abstract: Methods and apparatus for supporting a session in Mobile IP are disclosed. A Mobile Node sends a first Mobile IP message identifying the Mobile Node to a Home Agent, wherein the first Mobile IP message indicates to the Home Agent that the Mobile Node is requesting dynamic configuration of a Mobile-Home authentication key to be shared between the Mobile Node and the Home Agent during the session. A Mobile-Home authentication key to be shared between the Home Agent and the Mobile Node is obtained or generated by the Mobile Node and the Home Agent, where the Mobile-Home authentication key is not valid after the session has ended or during another session.

Abstract: An invention is disclosed that enables proxy Mobile IP registration to be performed in a secure manner. Various security mechanisms may be used independently, or in combination with one another, to authenticate the identity of a node during the registration process. First, an Access Point receiving a packet from a node verifies that the source MAC address identified in the packet is in the Access Point's client association table. In addition, as a second mechanism, the Access Point ensures that a one-to-one mapping exists for the source MAC address and source IP address identified in the packet in a mapping table maintained by the Access Point. As a third mechanism, a binding is not modified in the mobility binding table maintained by the Home Agent unless there is a one-to-one mapping in the mobility binding table between the source MAC address and the source IP address.

Abstract: Methods and apparatus are disclosed for performing layer 2 authentication of a Mobile Node supporting Mobile IP in an SSG based network. Layer 2 information including at least one of a MAC address and username associated with the Mobile Node is obtained. An orphaned host object including the layer 2 information (e.g., MAC address) is then generated. The orphaned host object is then unorphaned when an IP address associated with the layer 2 information (e.g., MAC address) is received such that the unorphaned host object includes the IP address and the layer 2 information.

Abstract: A method of restricting Address Resolution Protocol (ARP) table updates to updates originating from authorized subsystems is disclosed. According to one aspect of the method, an instruction to update an ARP table is received. It is determined whether a particular subsystem from which the instruction originated is authorized. If the particular subsystem is authorized, then the ARP table is updated based on the instruction.

Abstract: An invention is disclosed that enables proxy Mobile IP registration to be performed in a secure manner. Various security mechanisms may be used independently, or in combination with one another, to authenticate the identity of a node during the registration process. First, an Access Point receiving a packet from a node verifies that the source MAC address identified in the packet is in the Access Point's client association table. In addition, as a second mechanism, the Access Point (or Foreign Agent) ensures that a one-to-one mapping exists for the source MAC address and source IP address identified in the packet. As a third mechanism, a binding is not modified in the mobility binding table maintained by the Home Agent unless there is a one-to-one mapping in the mobility binding table between the source MAC address and the source IP address.

Abstract: Methods and apparatus for supporting a session in Mobile IP are disclosed. A Mobile Node sends a first Mobile IP message identifying the Mobile Node to a Home Agent, wherein the first Mobile IP message indicates to the Home Agent that the Mobile Node is requesting dynamic configuration of a Mobile-Home authentication key to be shared between the Mobile Node and the Home Agent during the session. A Mobile-Home authentication key to be shared between the Home Agent and the Mobile Node is obtained or generated by the Mobile Node and the Home Agent, where the Mobile-Home authentication key is not valid after the session has ended or during another session. The Home Agent allocates a home address to the Mobile Node for the session.