Abstract: Techniques are disclosed for allocating shared resources to nodes in a distributed computing network system. Nodes request a lock for each instance of a computing resource (e.g., a virtual IP address associated with a service provided by the distributed computing network system) from a distributed lock manager. The distributed lock manager maintains a queue of requests for each instance of the shared resource. Upon receiving a lock from the distributed lock manager, the receiving node performs a fairness allocation protocol to determine whether to accept the lock. If so determined, the shared computing resources associated with the lock is configured.

Abstract: Techniques are disclosed for allocating shared resources to nodes in a distributed computing network system. Nodes request a lock for each instance of a computing resource (e.g., a virtual IP address associated with a service provided by the distributed computing network system) from a distributed lock manager. The distributed lock manager maintains a queue of requests for each instance of the shared resource. Upon receiving a lock from the distributed lock manager, the receiving node performs a fairness allocation protocol to determine whether to accept the lock. If so determined, the shared computing resources associated with the lock is configured.

Abstract: A lock associated with a computing resource is received. It is determined whether to accept the lock based on a fairness allocation protocol. The lock is accepted based on a determination of the fairness allocation protocol.

Abstract: Techniques are disclosed for allocating shared resources to nodes in a distributed computing network system. Nodes request a lock for each instance of a computing resource (e.g., a virtual IP address associated with a service provided by the distributed computing network system) from a distributed lock manager. The distributed lock manager maintains a queue of requests for each instance of the shared resource. Upon receiving a lock from the distributed lock manager, the receiving node performs a fairness allocation protocol to determine whether to accept the lock. If so determined, the shared computing resources associated with the lock is configured.

Abstract: Techniques are disclosed for allocating shared resources to nodes in a distributed computing network system. Nodes request a lock for each instance of a computing resource (e.g., a virtual IP address associated with a service provided by the distributed computing network system) from a distributed lock manager. The distributed lock manager maintains a queue of requests for each instance of the shared resource. Upon receiving a lock from the distributed lock manager, the receiving node performs a fairness allocation protocol to determine whether to accept the lock. If so determined, the shared computing resources associated with the lock is configured.

Abstract: Techniques are described for providing encryption and authentication for different types of routing protocol communications based on a variety of factors. A method comprises configuring, on a network router, a set of logical interfaces for communicating routing protocol messages with one or more peer routing devices, maintaining a set of security associations that define corresponding authentication information and encryption information for the routing protocol messages, and maintaining one or more descriptor sets that each specify a set of criteria, wherein, for at least one of the descriptor sets, the set of criteria specifies one of the logical interfaces of the network router. The method further comprises selecting one of the descriptor sets having criteria that match an individual flow, selecting one of the security associations based on the selected descriptor set, and applying the selected security association to secure the outbound flow of the routing protocol messages.

Abstract: By using an extended bitmap window and arrival sequence numbers, a multiprocessor system may perform anti-replay checks on incoming packets in a similar order as a single processor system. In one implementation, a device may provide an anti-replay check window that includes an original window and an extension window, the original window being contiguous to the extension window. In addition, the device may receive a packet with an anti-replay sequence number and receive another packet whose anti-replay sequence number is within a range of the original window. In addition, the device may determine if the packet has arrived before the other packet by less than a threshold if the anti-replay sequence number of the packet falls within a range of the extension window. Further, the device may retain the packet if the packet has arrived before the other packet by less than the threshold.

Abstract: A process for managing encrypted group communication according to a single security association (SA) for network traffic from a sender includes receiving a request for an encrypted communication among a plurality of network devices. A common decryption key and a common security parameters index (SPI) are provided to each of the network devices participating in the communication. The common security parameters index facilitates locating, in respective databases associated with each of the network devices, security association information that is associated with the common security association. Information is encrypted based on the common security association, and unicasted to each of the network devices. In an embodiment, the common security parameters index provided to each network device is established by the sender. For example, the SPI is established by a conference server and sent to each device participating in a voice conference.

Abstract: An intrusion detection system and method for a computer network includes a processor and one or more programs that run on the processor for application inspection of data packets traversing the computer network. The one or more programs also obtaining attribute information from the packets specific to a particular application and comparing the attribute information against a knowledge database that provides a baseline of normal network behavior. The processor raises an alarm whenever the attribute information exceeds a predetermined range of deviation from the baseline of normal network behavior. It is emphasized that this abstract is provided to comply with the rules requiring an abstract that will allow a searcher or other reader to quickly ascertain the subject matter of the technical disclosure. It is submitted with the understanding that it will not be used to interpret or limit the scope or meaning of the claims.