Abstract: A key management device according to an embodiment is a key management device managing an application key for encrypting a communication in an application network including a plurality of applications. The key management device includes a hardware processor configured to function as a collection unit, a calculation unit, a determination unit, and a communication unit. The collection unit collects, using quantum key distribution (QKD), resource information indicating a resource of a link for which a link key is generated. The calculation unit calculates metric for a key relay route including the link on the basis of the resource information. The determination unit determines a key relay route from among a plurality of key relay routes on the basis of the metric. The communication unit uses the key relay route determined by the determination unit to send, to a destination, an application key encrypted with the link key.

Abstract: Systems and methods are described for secure and seamless roaming between internal and external networks. Double and triple tunnels may be used to connect a mobile node to a correspondent host. A mobile node may include the ability to connect to two networks simultaneously to enable seamless roaming between networks.

Abstract: Systems and methods are described for secure and seamless roaming between internal and external networks. Double and triple tunnels may be used to connect a mobile node to a correspondent host. A mobile node may include the ability to connect to two networks simultaneously to enable seamless roaming between networks.

Abstract: A first confirmation unit performs a first confirmation of confirming presence of a connection to a correspondent node in a first communication layer, presence of a connection to a correspondent node in a second communication layer, and presence of a connection to a correspondent node in a third communication layer. A locating unit locates a failure point in communication based on a result of the first confirmation. An output unit outputs a result of the location.

Abstract: According to some embodiments, systems and methods for binding dynamic host configuration and network access authentication are provided related to, inter alia, interactions between a PAA (PANA Authentication Agent) and a DHCP (Dynamic Host Configuration Protocol) server, such as, e.g., for synchronization between the PANA SA state and the DHCP SA state, such as, e.g., maintaining synchronization when a connection is lost. In some embodiments, systems and methods for binding network bridge and network access authentication are also provided related to, inter alia, interactions between a PAA and a layer-2 switch, such as, e.g., for avoiding service thefts and the like (such as, e.g., MAC address and/or IP address spoofing) in the context of, e.g., the above. In some other embodiments, systems and methods for bootstrapping multicast security from network access authentication protocol are also provided related to, inter alia, key management for protected IP multicast streams, such as, e.g.

Abstract: Systems and methods are described for secure and seamless roaming between internal and external networks. Double and triple tunnels may be used to connect a mobile node to a correspondent host. A mobile node may include the ability to connect to two networks simultaneously to enable seamless roaming between networks.

Abstract: Systems and methods are described for secure and seamless roaming between internal and external networks. Double and triple tunnels may be used to connect a mobile node to a correspondent host. A mobile node may include the ability to connect to two networks simultaneously to enable seamless roaming between networks.

Abstract: The present invention provides improved quality of service through data transmission rate control in a network. Data rate control may be in the downlink or uplink direction and may be statically or dynamically configured. Rate control may be implemented at varying points in the network including but not limited to at the wireless host, at the access point, at a separate device such as a server or at a separate location within the network. In one example of the present invention, a rate enforcement function is provided for identifying data packets to be enforced or identifying mapping between each packet and corresponding access point. Also, a rate decision function is also provided for determining the data rate to be enforced for each of the access points or each of the wireless hosts.

Abstract: Systems and methods are described for secure and seamless roaming between internal and external networks. Double and triple tunnels may be used to connect a mobile node to a correspondent host. A mobile node may include the ability to connect to two networks simultaneously to enable seamless roaming between networks.

Abstract: Systems and methods are described for secure and seamless roaming between internal and external networks. Double and triple tunnels may be used to connect a mobile node to a correspondent host. A mobile node may include the ability to connect to two networks simultaneously to enable seamless roaming between networks.

Abstract: A packet transfer scheme in a network system capable of realizing a high speed, large capacity inter-network communication under an internet environment. A network interconnection apparatus (router) has a memory for storing a correspondence relationship between a virtual connection used in receiving a packet from one logical network and a virtual connection used in transmitting a packet to another logical network, and a transfer at a datalink layer is carried out according to the registered correspondence relationship, to effectively form a bypass pipe capable of transferring a packet by an datalink layer level processing alone over a plurality of networks from the transmission terminal to the destination terminal, so that a high speed packet transfer between networks can be realized.

Abstract: A first confirmation unit performs a first confirmation of confirming presence of a connection to a correspondent node in a first communication layer, presence of a connection to a correspondent node in a second communication layer, and presence of a connection to a correspondent node in a third communication layer. A locating unit locates a failure point in communication based on a result of the first confirmation. An output unit outputs a result of the location.

Abstract: A packet transfer scheme in a network system capable of realizing a high speed, large capacity inter-network communication under an internet environment. A network interconnection apparatus (router) has a memory for storing a correspondence relationship between a virtual connection used in receiving a packet from one logical network and a virtual connection used in transmitting a packet to another logical network, and a transfer at a datalink layer is carried out according to the registered correspondence relationship, to effectively form a bypass pipe capable of transferring a packet by an datalink layer level processing alone over a plurality of networks from the transmission terminal to the destination terminal, so that a high speed packet transfer between networks can be realized.

Abstract: Aspects of the invention provide a method and system for managing or coordinating data transmission in a Local Area Network (LAN) such that Quality of Service (QoS) concerns are met. A LAN resource manager (LRM) is provided for managing the LAN resources by providing solutions for providing users with several levels of QoS. Once the LRM admits a user at a certain QoS level, the level is assured within the LAN for as long as the user is in the LAN. A user may submit a request to transmit data to the LRM. The LRM may determine if time allocation is possible and allocate the time slots for data transmission. The LRM may send time slot allocation information to an Access Server in a LAN, which may inform the user of the time slot allocation and prepare a queue according to the slot allocation information.

Abstract: A node device and a label switched path loop detection method which are capable of detecting a label switched path loop efficiently and quickly are disclosed. In a node device for carrying out the label switching, an ingress node information is included in a message that is to be successively transmitted from the upstream side in order to set up a label switched path, and the fact that the message with the same ingress node information for the same packet flow will be received from a previous hop node that is different from before if the label switched path has a loop formed thereon is utilized. Also, at a time of transmitting a message for the purpose of setting up a label switched path, if a node at which the label switched path for that packet flow already exists on the upstream or downstream side is encountered, this already existing label switched path is traced along the same or opposite direction as the flow, and the label switched path is set up if no loop is detected after tracing to the end.

Abstract: According to some embodiments, systems and methods for binding dynamic host configuration and network access authentication are provided related to, inter alia, interactions between a PAA (PANA Authentication Agent) and a DHCP (Dynamic Host Configuration Protocol) server, such as, e.g., for synchronization between the PANA SA state and the DHCP SA state, such as, e.g., maintaining synchronization when a connection is lost. In some embodiments, systems and methods for binding network bridge and network access authentication are also provided related to, inter alia, interactions between a PAA and a layer-2 switch, such as, e.g., for avoiding service thefts and the like (such as, e.g., MAC address and/or IP address spoofing) in the context of, e.g., the above. In some other embodiments, systems and methods for bootstrapping multicast security from network access authentication protocol are also provided related to, inter alia, key management for protected IP multicast streams, such as, e.g.

Abstract: A communication resource management scheme capable of guaranteeing the communication quality with respect to the flow while not requiring the processing for each flow to nodes other than edge nodes is disclosed. The edge node stores an information for obtaining an available amount of communication resources that can be newly allocated in the network to one set of flows which share at least a route from that edge node to an egress node of the network.

Abstract: Systems and methods are described for secure and seamless roaming between internal and external networks. Double and triple tunnels may be used to connect a mobile node to a correspondent host. A mobile node may include the ability to connect to two networks simultaneously to enable seamless roaming between networks.

Abstract: A packet transfer scheme in a network system capable of realizing a high speed, large capacity inter-network communication under an internet environment. A network interconnection apparatus (router) has a memory for storing a correspondence relationship between a virtual connection used in receiving a packet from one logical network and a virtual connection used in transmitting a packet to another logical network, and a transfer at a datalink layer is carried out according to the registered correspondence relationship, to effectively form a bypass pipe capable of transferring a packet by an datalink layer level processing alone over a plurality of networks from the transmission terminal to the destination terminal, so that a high speed packet transfer between networks can be realized.

Abstract: A router device realizing a datagram transfer method for improving the datagram transfer efficiency by ascertaining the transfer target and/or the requested quality of service without referring to the datagram content. The router device has network interfaces connected with networks including at least one virtual connection oriented network, a table for registering a correspondence between a virtual connection identifier and a transfer target network interface and/or a quality of service, a connection identifier analysis unit for determining a transfer target network interface and/or a quality of service for a datagram entered from one virtual connection, by referring to the table according to a virtual connection identifier of that one virtual connection. The datagram can be transferred to the determined transfer target network interface, while applying a priority control for datagrams to be transferred by the router device according to the determined quality of service.