Abstract: A method for Real-time Transport Protocol (RTP) packet authentication on a packet data network. In particular, the invention relates to a method for preventing toll fraud, privacy compromise, voice quality degradation, or denial of service (DoS) on Voice over IP networks. The Real-time Transport Protocol (RTP) is susceptible to several security attacks, including thirdparty snooping of private conversations, injection of forged content, and introduction or modification of packets to degrade voice quality. The Secure Real-time Transport Protocol (SRTP) provides confidentiality, message authentication, and replay protection for RTP traffic. However, SRTP incurs an additional overhead to verify the HMAC-SHA1 message authentication code for each packet. SRTP+ significantly decrease the verification overhead compared to SRTP and thereby increases the number of faked packets required to mount a successful denial of service attack. SRTP+ provides packet authentication but not integrity.

Abstract: A method and apparatus are disclosed for assessing the available resources in a network and using the assessment for admission control. A VoIP call can be established with a device only if the network has sufficient resources to accommodate the call or it is possible to make such resources available by curtailing ongoing data connections. A network utilization characteristic (NUC) provides a measure of network capacity. The network utilization characteristic of a flow is the fraction of time the network is busy transmitting data for that flow. The sum of the network utilization characteristics of all flows yields the fraction of time the network is busy transmitting data. The difference between one and the sum of all flows indicates the time that the network is idle in the measured time interval. A new flow can be accommodated if the NUC of the new flow is smaller than this difference value.

Abstract: A method of authenticating a communications between a sender and a receiver includes agreeing, by a sender and receiver, on a shared secret, computing a first sequence of numbers at the sender using the shared secret, and computing a second sequence of numbers at the receiver using the shared secret. Successive values of the first sequence are respectively embedded in successive messages by the sender. Upon receiving a message, the receiver compares the embedded value of the first sequence with a list of values including at least one corresponding value from the second sequence and the received message to considered to originate from an authentic sender if the value of the first sequence matches the value of the second sequence. The method value is removed from a list of values in the second sequence for comparing.

Abstract: A method of transporting authentication information in a media stream packet includes embedding the authentication information in one of a heading and a payload of the media stream packet.

Abstract: An image projection module within a housing accessory is operative for causing selected pixels in a raster pattern to be illuminated to produce an image at different image planes of VGA quality. A personal media player is connected to the housing accessory and the image projection module to supply image signals for the image to be projected.

Abstract: A method for preventing or limiting the effects of Denial-of-Service attacks in a communication appliance having a packet-classification rule base which allows all legitimate packets to be forwarded to the communication appliance includes monitoring incoming packets to the communication appliance to determine whether conditions indicating a Denial-of-Service attack are present. If a Denial-of-Service attack is present, a rule base subset of the packet-classification rule base is selected from a plurality of rule base subsets based on a current one of a plurality of operating states of the communication appliance.

Abstract: A method for detecting intrusions that employ messages of two or more protocols is disclosed. Such intrusions might occur in Voice over Internet Protocol (VoIP) systems, as well as in systems in which two or more protocols support some service other than VoIP. In the illustrative embodiment of the present invention, a stateful intrusion-detection system is capable of employing rules that have cross-protocol pre-conditions. The illustrative embodiment can use such rules to recognize a variety of VoIP-based intrusion attempts, such as call hijacking, BYE attacks, etc. In addition, the illustrative embodiment is capable of using such rules to recognize other kinds of intrusion attempts in which two or more protocols support a service other than VoIP. The illustrative embodiment also comprises a stateful firewall that is capable of employing rules with cross-protocol pre-conditions.

Abstract: A method for Real-time Transport Protocol (RTP) packet authentication on a packet data network. In particular, the invention relates to a method for preventing toll fraud, privacy compromise, voice quality degradation, or denial of service (DoS) on Voice over IP networks. The Real-time Transport Protocol (RTP) is susceptible to several security attacks, including thirdparty snooping of private conversations, injection of forged content, and introduction or modification of packets to degrade voice quality. The Secure Real-time Transport Protocol (SRTP) provides confidentiality, message authentication, and replay protection for RTP traffic. However, SRTP incurs an additional overhead to verify the HMAC-SHA1 message authentication code for each packet. SRTP+ significantly decrease the verification overhead compared to SRTP and thereby increases the number of faked packets required to mount a successful denial of service attack. SRTP+ provides packet authentication but not integrity.

Abstract: A call processing system, which may include multiple distributed call center sites, utilizes a local back-off approach to endpoint registration. The call processing system comprises a plurality of endpoints and at least a first server, wherein the endpoints register with the first server in order to send and receive calls in the call processing system. Responsive to an end-to-end connectivity failure or other designated event, a registration process is initiated in the call processing system for a given one of the endpoints. The issuance of at least one message of the sequence for the given endpoint is controlled so as to provide a local random back-off or other local back-off of the controlled message at that endpoint. For example, a second server implemented as an aggregation server may be operative to control the issuance of messages by the endpoints so as to provide a local random back-off for each of the plurality of endpoints by staggering the delivery of failure notifications to the endpoints.

Abstract: The “what” and “how” of policy-based management is integrated in a single framework that enables a system administrator to specify service-level quality of service (QoS) goals for automatic enforcement. Automatic enforcement of the specified “high-level” QoS goals is realized through the execution of “low-level” rule-based or procedural logic, without the client having to specify the low level logic. Specifically, one embodiment of the invention employs a management server including a graphical interface that allows a user, e.g. a system administrator, to easily specify parameters for service-level QoS goals. A QoS goal is defined by the administrator selecting a client, a service and a QoS expression that specifies the desired service-level QoS. The state of the network is monitored and one or more defined QoS goals are selected for evaluation in a continuous process. The QoS delivered for the selected goal is determined and compared to the desired QoS for the selected QoS goal.

Abstract: A technique for lessening the likelihood of congestion in a congestible node is disclosed. In accordance with the illustrative embodiments of the present invention, one node—a proxy node—drops protocol data units to lessen the likelihood of congestion in the congestible node. In some embodiments of the present invention, the proxy node receives a metric of a queue at a congestible node and, based on the metric, decides whether to drop protocol data units en route to the congestible node. In some other embodiments of the present invention, the proxy node estimates a metric of a queue at a congestible node and, based on the metric, decides whether to drop protocol data units en route to the congestible node.

Abstract: A technique for lessening the likelihood of congestion in a congestible node is disclosed. In the illustrative embodiment, the proxy node resides in the path of the protocol data units en route to a congestible node and the proxy node decides whether to drop protocol data units en route to the congestible node. In some embodiments of the present invention, the proxy node comprises a larger queue for the protocol data units than does the congestible node. The illustrative embodiment of the present invention is useful because it enables the manufacture of “lightweight” nodes without large queues and without the horsepower needed to run an algorithm, such as the Random Early Detection algorithm, for deciding which protocol data units to drop. Furthermore, the illustrative embodiment is useful because it can lessen the likelihood of congestion in legacy nodes.

Abstract: A wireless local area network (LAN), and a method of operating the same, prevents unauthorized users from accessing the wireless LAN. A signal strength of a station attempting to access the wireless LAN is measured. If the signal strength is less than a predetermined threshold value, the system concludes that the station is outside of an authorized geographical area. Such a station attempting to establish a connection is characterized as an unauthorized station, and access to the wireless LAN is denied. The system may also periodically verify that authorized stations remain within the authorized geographical area. A station that has moved outside of the authorized geographical area can be notified or denied further access to the wireless LAN.

Abstract: A distributed computing system includes a number of computers, workstations or other computing machines interconnected by a network. One or more service managers are introduced that provide a management interface to corresponding middleware services. The service manager monitors the corresponding middleware service, as well as the underlying distributed computer environment on which an application process that utilizes the middleware service is executing, and allows the middleware service to operate more efficiently, in response to run-time environmental conditions. A fault-tolerance service manager is provided as a management interface to a fault-tolerance service. The fault-tolerance service manager monitors the fault-tolerance service, as well as the underlying distributed computer environment, to make globally optimal decisions, based on run-time environmental data, and to provide the resulting information to the fault-tolerance service.

Abstract: A policy-based network management system is realized by enabling policy-based management programs to be defined via run-time loading of “policy packages” that are collections of reusable “policy components”. Such reusable policy components may be written by the vendor of the policy-based management system, or by system-administrators, who are the users of policy-based management systems or even by third-party people, who may be experts in the management of specific application domains such as vendors of network devices. In the latter case, these policy components can be assembled into a functionally complete policy package by system administrators. Alternatively, the system administrators can also load a pre-assembled policy package into a management server and only have to specify the desired service level goals.

Abstract: A method and apparatus are disclosed for assessing the available resources in a network and using the assessment for admission control. A VoIP call can be established with a device only if the network has sufficient resources to accommodate the call or it is possible to make such resources available by curtailing ongoing data connections. A network utilization characteristic (NUC) provides a measure of network capacity. The network utilization characteristic of a flow is the fraction of time the network is busy transmitting data for that flow. The sum of the network utilization characteristics of all flows yields the fraction of time the network is busy transmitting data. The difference between one and the sum of all flows indicates the time that the network is idle in the measured time interval. A new flow can be accommodated if the NUC of the new flow is smaller than this difference value.

Abstract: A method and system for controlling the bandwidths of data traffic over virtual private networks are provided. The method includes classifying the data traffic for the virtual private network into different flows, monitoring a current bandwidth usage by at least one of the flows, comparing the current bandwidth usage with a predetermined threshold for the flow, and performing a bandwidth control operation for the flow if the current bandwidth usage exceeds the predetermined threshold for that flow.

Abstract: A distributed computing system includes a number of computers, workstations or other computing machines interconnected by a network. A non-interactive process arriving in a host machine of the system is migrated for execution to at least two remote machines. For example, first and second executions of the process may be started on respective first and second remote machines. One of the first and second executions of the process is then used to provide an on-demand checkpoint for the other execution of the process in the event the other execution is terminated, such that an additional execution of the process can be started from the on-demand checkpoint. This on-demand checkpointing is augmented with periodic checkpointing performed on at least one of the multiple executions of the process.