Abstract: Methods and apparatus are provided for user authentication using a Public Key Infrastructure (PKI) in an IP-based telephony environment, such as an IMS network. A user of a user device attempting to access an IP-based telephony network can be authenticated by obtaining one or more private keys of the user from a secure memory associated with the user device; generating an integrity key and a ciphering key; encrypting the integrity key and the ciphering key using a session key; encrypting the session key with a public key of the IP-based telephony network; and providing the encrypted session key, encrypted integrity key and encrypted ciphering key to the IP-based telephony network for authentication. A network-based method is also provided for authenticating a user in an IP-based telephony network.

Abstract: A system for monitoring the communication with a connected Internet of Things (IoT) device is provided. The system includes a first computing device including a least one processor in communication with at least one memory device. The at least one memory device stores a plurality of instructions, which when executed by the at least one processor cause the at least one processor to execute an IoT device communication application. The IoT device communication application monitors the IoT device. The instructions also cause the at least one processor to store IoT device data including a current location of the IoT device, determine an optimal communication path between the IoT device communication application and the IoT device based on the IoT device data, and transfer execution of the IoT device communication application to a second computing device based on the optimal communication path.

Abstract: A system for monitoring the security of a connected Internet of Things (IoT) device is provided. The system includes a network doppelgänger (ND) computer device. The ND computer device is in communication with the IoT device and a service provider computer device associated with the IoT device. The ND computer device is programmed to store a plurality of policies associated with the service provider computer device. The ND computer device is also programmed to receive a communication from the IoT device addressed to the service provider computer device. The ND computer device is further programmed to analyze the communication in view of the plurality of policies to determine whether the communication is approved. If the communication is approved, the ND computer device is programmed to route the communication to the service provider computer device.

Abstract: A client access network includes a cluster of servers. The cluster of servers includes a boot node, an administrator node, a computing node, and a storage node. The client access network further includes a plurality of segregated subnetworks. The plurality of segregated subnetworks includes a boot subnetwork, an administration subnetwork, a public subnetwork, and a private subnetwork. The client access network further includes at least one hardware security module, a dedicated subnet in operable communication with the at least one hardware security module and each of the plurality of segregated subnetworks, and a router in operable communication with the at least one hardware security module and each of the cluster of servers. The router is further configured to route traffic among the plurality of segregated subnetworks and the dedicated subnet.

Abstract: A remote attestation system for a computer network includes an attestation operations subsystem configured to manage attestation procedures for the remote attestation system, and an attestation server pool including a plurality of attestation servers. The plurality of attestation servers is configured to perform attestation of at least one host in a data center. The system further includes an attestation state database configured to store a state of attestation of the at least one host, an attestation policy database configured to store at least one operator policy of the computer network, and an end-user service portal configured to provide access to the remote attestation system by users of the computer network.

Abstract: Improved virtualized application performance is provided through disabling of unnecessary functions, such as unnecessary encryption and decryption operations. An example method performed by a hypervisor includes the steps of obtaining a request to one or more of encrypt and decrypt a communication between a first virtual machine and a second virtual machine; determining if the first and second virtual machines execute on a same host as the hypervisor (e.g., by evaluating a context of the communication); and processing the communication without encrypting or decrypting the communication if the first and second virtual machines execute on the same host. Lawful Interception is performed by forwarding an unencrypted version of the communication to an authorized agency.

Abstract: Methods and apparatus are provided for user authentication using a Public Key Infrastructure (PKI) in an IP-based telephony environment, such as an IMS network. A user of a user device attempting to access an IP-based telephony network can be authenticated by obtaining one or more private keys of the user from a secure memory associated with the user device; generating an integrity key and a ciphering key; encrypting the integrity key and the ciphering key using a session key; encrypting the session key with a public key of the IP-based telephony network; and providing the encrypted session key, encrypted integrity key and encrypted ciphering key to the IP-based telephony network for authentication. A network-based method is also provided for authenticating a user in an IP-based telephony network.

Abstract: Techniques for enabling improved electronic mail handling in communication networks include a method of handling an electronic mail message in an electronic mail system. The method includes establishing a secure connection between a client of a message sender and a server of a message recipient in the electronic mail system. The method also includes participating in an authentication exchange to verify the identity of the message sender. The method further includes the message sender depositing an electronic mail message with the server of the message recipient upon successful verification of the identity of the client of the message sender.

Abstract: The present invention sets forth a methodology that allows involved processes to partition among themselves a pre-defined set of multi-type resources in a way that all processes end up satisfied with the outcome of the partitioning, and no central mediation for such partitioning is required. One exemplary embodiment of the invention sets forth a method of allocating multiple type resources among a distributed set of processes that includes the steps of selecting a process from the set of processes for partitioning the resources; partitioning the resources at the selected process; sharing results of the partitioning with others of the set of processes, wherein said other processes select a partition from the partitioned resources; the selected process being able to select a partition subsequent to the other processes having selected a partition. The method also repeats the above steps until all currently involved processes are satisfied by a selected partition of available resources.

Abstract: In a communication network, assume a first computing device is an end user device, a second computing device is a gateway server, and a third computing device is an application server. A method comprises the following steps. The second computing device authenticates one or more packets received from the first computing device. The second computing device marks the one or more packets with a first-layer identity before routing the one or more packets toward the third computing device such that the third computing device is able to authenticate the one or more packets from the first computing device by confirming an association between the first-layer identity and a second-layer identity. For example, the first-layer identity may comprise a link layer identity assigned to the first computing device and the second-layer identity may comprise an application layer identity assigned to the first computing device.

Abstract: In a communication network wherein a first computing device represents a resource owner and a second computing device represents a resource requestor, the resource owner detects an occurrence of an event, wherein the event occurrence represents a request to access one or more resources of the resource owner stored in a resource residence. The resource owner sends an authorization token to the resource requestor in response to the event occurrence, the authorization token serving as a proof of authorization delegated by the resource owner to be presented by the resource requestor to the resource residence so as to permit the resource requestor to access the one or more requested resources stored in the resource residence.

Abstract: Techniques are disclosed for enabling improved electronic mail handling in communication networks. For example, a method of handling an electronic mail message in an electronic mail system comprises the following steps. A secure connection is established between a client of a message sender and a server of a message recipient in the electronic mail system. An authentication exchange is employed to verify the identity of the message sender. The message sender deposits an electronic mail message with the server of the message recipient upon successful verification of the identity of the client of the message sender.

Abstract: Techniques are disclosed for optimally scheduling computations that involve multiple factors, the cost of evaluations and probabilities of success of which are known. For example, a methodology is provided for determining an optimal schedule of a multi-factor test in sub-quadratic time. While the methodology has wide ranging application, we illustrate a particular applicability to a security application involving multi-factor authentication in a cloud computing environment, as well as applicability to the contact center agent scheduling.

Abstract: Techniques are disclosed for enabling operators of communication networks to provide one or more identity services such as, for example, an authentication service. For example, in a communication network, assume that a first computing device is a client device, a second computing device is an application server, and a third computing device is a server under control of an operator of the communication network. A method may comprise the following steps.

Abstract: Techniques are disclosed for optimally scheduling computations that involve multiple factors, the cost of evaluations and probabilities of success of which are known. For example, a methodology is provided for determining an optimal schedule of a multi-factor test in sub-quadratic time. While the methodology has wide ranging application, we illustrate a particular applicability to a security application involving multi-factor authentication in a cloud computing environment, as well as applicability to the contact center agent scheduling.

Abstract: The invention that addresses the problem of authentication of the transport packet stream (which constitutes a flow within a session), which has been admitted into a managed packet network. Authentication and the subsequent policing of the flows supporting an identified client's authorized service prevent a large class of denial of service attacks described below. Specifically, the invention addresses two different matters: 1) key distribution and management 2) various forms of using a shared key for the authentication of transport packets on the user-to-network-interface (UNI).

Abstract: Techniques are disclosed for efficient authentication of an end user device at an application server of a communication network. For example, wherein it is assumed that, in a communication network, a first computing device is an end user device, a second computing device is a gateway server, and a third computing device is an application server, a method comprises the following steps. The second computing device authenticates one or more packets received from the first computing device. The second computing device marks the one or more packets with a first-layer identity before routing the one or more packets toward the third computing device such that the third computing device is able to authenticate the one or more packets from the first computing device by confirming an association between the first-layer identity and a second-layer identity. For example, the first-layer identity may comprise a link layer identity assigned to the first computing device (e.g.

Abstract: In a communication network wherein a first computing device represents a resource owner and a second computing device represents a resource requestor, the resource owner detects an occurrence of an event, wherein the event occurrence represents a request to access one or more resources of the resource owner stored in a resource residence. The resource owner sends an authorization token to the resource requestor in response to the event occurrence, the authorization token serving as a proof of authorization delegated by the resource owner to be presented by the resource requestor to the resource residence so as to permit the resource requestor to access the one or more requested resources stored in the resource residence.

Abstract: A method and apparatus for supporting end-to-end quality of service (QoS) reservations for an implicit reservations model are provided. The invention teaches how to implement implicit resource reservations using the open-standard Resource and Admission Control Function (RACF). A request for resources for a given reservation between an originating and a terminating point in a network is received. A central controller for that domain processes the request for a given domain to determine whether routes for said reservation are available and whether necessary bandwidth for said reservation is available. An implicit reservation and a release of the bandwidth are respectively accomplished with a specific number of messages. If the routes and bandwidth are available, the reservation for the given domain is confirmed and the reservation request is passed to another central controller for a next domain having resources required to satisfy the reservation request.

Abstract: Techniques are disclosed for enabling operators of communication networks to provide one or more identity services such as, for example, an authentication service. For example, in a communication network, assume that a first computing device is a client device, a second computing device is an application server, and a third computing device is a server under control of an operator of the communication network. A method may comprise the following steps.