Abstract: A security server distributes security polices to the client computers. Each security policy includes an identifier identifying the process to which the policy pertains, and security rules for use with that process. The identifier includes a version hash and a code hash. The version hash of a process is likely to remain unchanged if the process is modified by a legitimate agent, such as by a software update. The code hash of a process is likely to change if the process is modified by a malicious agent. When a process executing on the client computer requests access to a resource, the client computer generates a version hash of the process and uses it to identify the security policy pertaining to the process. If the version hash matches a version hash in a security policy, but the code hash does not match, the client computer declares the process potentially malicious.

Abstract: In an embodiment, an apparatus, method, and/or system support a service request made by a computer user in an Internet café or similar electronic service environment. A user may operate a café-provided user terminal in a multi-terminal network controlled by a café service console. The user may operate a switch on the terminal to transmit a service request to the service console. A visible and/or audible indication may be provided to the user, via a suitable indicator on the terminal, regarding the status of the user's service request. The user's service request may cause service-related information to be displayed on a second display of the user terminal for selection by the user. The user may speak with a service administrator using a voice over Internet protocol module built into the terminal. Other embodiments are described and claimed.

Abstract: A method for wireless LAN communication using multiple channels is provided. An ATIM containing channel information is generated when there is data to be sent, and the ATIM is transmitted via a main channel after a predetermined period of time. When a station loses a channel reservation competition, the station generates and transmits via the main channel another ATIM containing channel information regarding another channel to be used from data transmission. The station then performs channel switching to the other channel corresponding to the channel information, transmits the data via the other channel, and switches the channel back to the main channel at the time of a subsequent beacon.

Abstract: Generation of a mapping for use by a data forwarding entity having communication interfaces and instantiating multiple logical forwarding sub-systems associated with respective mappings including a first mapping and a second mapping. The first mapping specifies a next hop interface for data elements received at the interfaces, at least one next hop interface belonging to a set of logical interfaces. The second mapping specifies a second next hop interface for certain data elements for which the next hop interface specified by the first mapping belongs to the set of logical interfaces, at least one second next hop interface belonging to the plurality of communication interfaces. A consolidated mapping is created by replacing each portion of the first mapping that specifies a next hop interface belonging to the set of logical interfaces by a corresponding portion of the second mapping that specifies a second next hop interface.

Abstract: Employing an asymmetric protocol, multiple sources reliably broadcast dynamically changing routing tables incrementally across multiple consumers from a single distributor. Each of multiple sources sends current tables to the distributor using a snapshot mechanism. Messages are buffered, segmented, paced by timers, and broadcast to the consumers repetitively at the distributor. Negative acknowledgments from the consumer request missing messages from the distributor after receipt of a keepalive message from the distributor. The distributor marks the missing messages and retransmits replacements from a history buffer only after firing of a resend timer. A unique Session ID included in all messages originating from each particular source facilitates reliable table distribution from multiple sources to multiple consumers via a single distributor.

Abstract: A method, system and application for address-based service identification. The method includes the steps of: obtaining service information and service feature list information, wherein the service information includes at least an SP ID and a service ID; generating address fields complying with the address specifications according to each of the service information and the service feature list information; and combining the address fields of the same service into an address of the service. The system includes: a service provisioning module, an addressing module and an address generating module. When applied to service subscription and service routing, address information of a service subscription is generated according to the service information in the service subscription request of a user, and service address lists complying with this address information of the service subscription is sent to the user.

Abstract: A method of discovering and operating a payload node (104) includes in a computer network (100) having a central node (102) coupled to a payload node slot (110), coupling the payload node to the payload node slot. The payload node executing a payload boot algorithm (120) located at the payload node. The payload boot algorithm discovers a hardware capability set (122) of the payload node. The payload boot algorithm communicating the hardware capability set to a payload discovery manager (114) at the central node. The payload discovery manager selecting a software set (116) based on the hardware capability set. The payload discovery manager communicating the software set to the payload node and the payload node transitioning from the payload boot algorithm to the software set while bypassing rebooting the payload node to the software set.

Abstract: A method, program, and server for estimating the bandwidth of a network connection between a client and a server includes requesting the server to serve first and second objects back-to-back to the client. The first and second objects are sent to the client. The client determines the time interval between delivery of the first and second objects. The time interval is used, in conjunction with information about the size of the second object, to estimate the bandwidth. The requests for the first and second objects preferably identify the first and second objects with URL's that are unique on the network to prevent the request from being serviced by a file cache. The first and second objects may be transmitted to the client from a content distribution network server that is architecturally close to the client's ISP to improve the reliability of the bandwidth estimation.

Abstract: In response to a command to restrict a communication service for a computer, a countermeasures apparatus replaces the communication address of a second computer, which has been stored in a first computer, with the communication address of the countermeasures apparatus, and replaces a communication address of the first computer, which has been stored in the second computer, with the communication address of the countermeasures apparatus. Accordingly, the countermeasures apparatus acquires a packet from the first computer to the second computer and determines whether this acquired packet is to be transmitted to the second computer.

Abstract: An overlay communication system (120) aides determining a route between nodes (101-103) in an underlay communication system (110). In particular, when a first node (102) wishes to discover a route to a second node (103), the first node notifies the overlay communication system, which notifies all nodes in the underlay communication system of the desire. Both the first and the second nodes begin flooding the underlay system simultaneously. When a node in the underlay system hears both the flood messages from the first and the second node, the overlay communication system is notified and stops all flooding. The route information is then provided to the first and the second nodes via the overlay communication system.

Abstract: A method of remotely controlling a client device is provided within a network having a network server coupled to a first side of a firewall from a web server coupled to a second side of the firewall. The network server initiates a service request for the client device through the transmission of an HTTP request through a conventional TCP/IP socket in the firewall to the web server. The web server dynamically alters content that in turn may be accessed by a user, which may either be a human user or an automated user. In response to downloading the altered content, the user transmits an HTTP request to the web server, which causes the web server to alter content that may then be downloaded by the network server. The network server interprets this altered content so as to control the device accordingly.

Abstract: A system, device, and method for receiver access control in a multicast communication network treats each subscriber location as a separate subnetwork having one and only one multicast receiver. An access device is situated at each subscriber location. Each access device connects to a separate port of a multicast distribution device. Each subscriber device accesses the multicast network through the access device that is situated at its subscriber location. Each access device acts as a proxy for its respective subscriber devices by joining and leaving multicast groups on behalf of the subscriber devices and acting as the sole multicast receiver for the subscriber location. The access devices run a multicast group management protocol for joining and leaving various multicast groups, and therefore the access devices appear to the multicast distribution device as the ultimate multicast receivers for multicast information.

Abstract: A distributed content registry for unique content identification is provided herein.

Abstract: The invention facilitates SIP Enabled devices creating and exchanging augmented data communication messages. An initiating SIP Enabled device may be configured to create an augmented message that includes a call-type and/or a network identification. The augmented data may be configured for a SIP Enabled device by either an administrator or a system user. Furthermore, the system user may customize the default settings either indefinitely or temporarily. Upon receiving an augmented SIP communication request, a receiving SIP Enabled device may identify the request as augmented and subsequently extract the augmented data. The receiving SIP enabled device may be configured to execute functionality based on the extracted augmented data. For example, if the augmented data includes a “hotline” call-type, the receiving SIP enabled device may be configured to play a certain ringtone or display a “hotline” identifier on the device's display.

Abstract: Various embodiments of a system and method for processing a request in a distributed software application are disclosed. In response to a client request, one or more server computers may modify a plurality of different portions of state information. The system may operate to ensure that the portions of state information are all modified atomically. The system may also operate to provide transparent connection failover functionality for the network connection between the client computer and the one or more server computers.

Abstract: A method for populating location wiremap databases. In particular implementations, a method includes establishing a link layer connection with a client on a switch port, where the switch port is associated with a port identifier and is mapped to a location; identifying one or more connection attributes of the connection, where the connection attributes comprise a network layer address of the client; and transmitting the port identifier and the network layer address of the client to a location server.

Abstract: A monitoring system, method, and computer-program product tracks events and device states in a device and sends those events and states to a remote central service center using an Internet access module. The remote central service center monitors the received events and states for errors or warnings. The monitoring software (e.g., a dynamic link library) supports multiple data formats and multiple protocols to more effectively communicate the event and state information.

Abstract: Methods, systems, and products are provided for tunneling IPv6 packets. Embodiments include receiving, by an origin IPv6 border router from an origin IPv6 host, an IPv6 packet having an IPv6 destination address; receiving, by an origin IPv6 border router from an origin IPv6 host, an IPv4 address for a destination IPv6 border router retrieved from a data structure associating IPv6 destination addresses with IPv4 addresses for destination IPv6 border routers; encapsulating, by the origin IPv6 border router, the IPv6 packet in an IPv4 packet; and sending the encapsulated packet to a destination IPv6 border router at the IPv4 address. In many embodiments, encapsulating, by the origin IPv6 border router, the IPv6 packet in an IPv4 packet is carried out by adding an IPv4 header to the IPv6 packet.

Abstract: Various embodiments and techniques are described for discovery in a network, and for automatically discovering one or more nodes of the network. In an embodiment a discovery loop may be implemented to detect new nodes that may have been added to the network. The data transmission from the nodes may be paused, and undiscovered nodes may be requested to identify themselves. Each node that identifies itself may then be configured by, for example, having a time slot assigned for data transmission from the node. Separate time slots may be assigned to allow multiple nodes to transmit data over certain types of networks without colliding with each other. Data transmission from the nodes may then be resumed.

Abstract: Systems and methods for routing messages between applications in a network are disclosed. Messages are routed from a sending application to one or more receiving applications according to one or more routing rules. Each routing rule is used for determining the one or more receiving applications, and is associated with at least one routing object. The routing object is configured to associate the routing rule to the message based on content of the message. The routing objects are stored in a repository of design-time descriptions of the applications. The routing rules are stored in a directory of runtime descriptions of applications in the runtime landscape, and are accessed by a runtime engine for executing the routing.

Abstract: A method and system for monitoring hardware information associated with a network device in an enterprise system are provided. In one embodiment, a method for monitoring hardware information associated with a network device in an enterprise system includes retrieving hardware information associated with a network element, the hardware information including information on one or more hardware characteristics. A display dynamically presents the information.

Abstract: Disclosed is a system and method for transmitting AV/C data over one or more transports. Further disclosed is a system and method for transmitting AV/C data over non-FCP communication media. The disclosed system and method includes an AV/C transaction delivery system which operates in conjunction with communicatively coupled AV/C protocol layers, AV/C transport layers, and AV/C transport controllers to effectuate transmission of AV/C transaction data without regard to protocol.

Abstract: An example of a solution provided here comprises: providing a logical design, including at least one hub containing central management tools, and a plurality of lower tiers containing local management tools; placing components according to the design; and providing, from the hub, one or more management functions. The lower tiers include one or more elements chosen from RIM's, spokes, and POD's.

Abstract: Determining authorization for actions includes defining a plurality of groups, defining a plurality of action types and corresponding levels of authorization for each of the groups, for at least a subset of the action types, defining a plurality of devices on which corresponding actions may be performed, wherein at least some of the devices correspond to portions of a data storage device, and, for the at least one of the groups, determining authorization for a requested action, where if the action corresponds to one of the devices, authorization is determined by examining the levels of authorization for action types corresponding to the at least one group and by examining the plurality of devices corresponding to the requested action and where if the action does not correspond to one of the devices, authorization is determined by examining the levels of authorization for action types corresponding to the at least one group. The action types may include system calls to the data storage device.

Abstract: A method for transferring data, by establishing network links between a private and a public network. Each link is associated with a respective unique public-network-address. Each session of one or more data packets within the private network is allocated an extended-private-address, the private network being adapted to transfer each data packet in a respective session using at least part of the extended-private-address as an identifying private-network-address. For each session the extended-private-address is translated to an extended-public-address, which includes one of the unique public-network-addresses. The data packets of each session are conveyed between the private and public networks via the link associated with the public-network-address of the respective session, and are transmitted within the public network using at least part of the extended-public-address as an identifying public-network-address.

Abstract: An object of the present invention is to provide network devices and a network device control method which enable control network devices connected to an IP network, AV devices connected over 1394IF through gateway devices from the IP network, and home devices connected to ECHONET to be controlled without distinction among them. To achieve this object, a network device to serve as a controller comprises a controller application that detects a service of a target network device, using a message complying with an information exchange protocol common to the network, collects information such as an access method for the service, a function name, and parameters, and controls the network device upon request, and an information exchange protocol processing part that exchanges messages according to a protocol common to the network devices.

Abstract: A videophone. The videophone can include an imaging mechanism for taking a video picture of a scene. The videophone can include a mechanism for producing a first video stream of the scene and a second video stream of the scene from the video picture and sending the first video stream and the second video stream onto a network at the same time, the producing mechanism in communication with the imaging mechanism. The videophone can include a mechanism for receiving a plurality of video streams of different scenes from a network. The videophone can include a mechanism for displaying the different scenes of the plurality of video streams alongside each other. A method for a video call.

Abstract: A method and system for checking whether customer orders for transactions of financial instruments conform to business logic rules. Executable rule files are created and stored in a repository. New executable rule files can be created by scripting the new business logic rules in a script file which is converted into a corresponding source code file written in a computer programming language. The source code file is compiled to create an individual executable rule file. A rule selection repository contains identification of groups of selected executable rule files. The invention determines the category of the customer order and reads, from the rule selection repository, a group of executable rule files that correspond to the identified category of the customer order. The selected executable rule files are executed to check the conformance of the customer order. Execution results are stored in a status repository for subsequent retrieval and analysis.

Abstract: An application implemented on a server in a network of storage servers can be provided to manage the data replication relationships implemented between the storage servers of the network. In one embodiment, this server can be designated the manager server, and can include a network adapter to connect the manager server to a network, the network including a plurality of storage servers, the plurality of storage servers implementing a plurality of data replication relationships, and a storage facility to contain a data structure representing the plurality of data replication relationships to enable a user to centrally manage the plurality of data replication relationships.

Abstract: A network administration system for triggering commands in response to receipt of error logs, comprising a user interface for programming execution sets of commands in association with predetermined error logs, and means for receiving error logs and for each of the predetermined ones of the error logs triggering execution of the commands in the execution sets.

Abstract: A system that enables creation of URL addresses in which the path information is partially or entirely symbolic. The symbolic path information is maintained even after the physical path information is altered, whereby users do not have to learn or provide constantly changing URL addresses to accommodate changes in the organization and presentation of evolving or changing web sites. To this end, web servers interface with a URL resolution database tool that contains information that enable the conversion of the symbolic path information to physical path information. Alternatively, the conversion from symbolic to physical path information is carried by augmented web browsers which have access to symbolic path information conversion servers located on the Internet at a centrally distributed location, or even locally, so that web servers receive only physical path information.

Abstract: A network includes a plurality of wirelessly interconnected self-organizing network (SON) devices for relaying signals in a self-organizing network and a field device for originating output signals. The sensor is configured to transmit the output signals to at least one of the SON devices, and the SON devices do not originate signals but only relay signals originated externally. At least one of the SON devices is self-powered by harvesting energy from an adjacent energy source.

Abstract: In an interactive broadcast system signals transmitted by a service provider (30) are passed via a gateway (12) to a subscriber terminal (2). In order to gain access to services, the subscriber terminal (2) transmits an authorization request message via the gateway (12) to the RADIUS server (18). This RADIUS server (18) transmits in response to the authorization request message an authorization challenge message to the subscriber terminal (2). In return the subscriber terminal responds to the challenge message with a challenge response. This challenge response is checked by the RADIUS server (18) and if correct, the RADIUS server (18) transmits a message to the gateway to give the subscriber terminal access to the service.

Abstract: Methods and apparatus for transparently managing outbound traffic from an internal user of a private network destined for a public network are disclosed. Embodiments include a firewall device operable between an internal user of a private network and an IP-compliant network. The firewall device being configured to assign a proxy agent to process a request by the internal user to form a connection with a public network element through the IP-compliant network. Disclosed embodiments include the proxy agent forming a connection only if the internal user is authorized to access the public requested network element.

Abstract: A firewall for authenticating a user access request is disclosed. The firewall device may include a proxy process for processing incoming connection requests. The proxy is configured to receive an access request from a user over a first communication medium and prompt the user for a username over the first communication medium. The firewall may then send a password to the user over a communication medium other than said first communication medium responsive to receiving a valid username from the user. The firewall may then verify the access request responsive to receiving the password from the user through the first communication medium. The firewall may send passwords to a mobile device for verification.

Abstract: A directory enabled network element, which in one embodiment, is a network device that has an element that enables querying, accessing, and updating directory information that is managed by a directory service of a network. An application programming interface (API) is configured to receive directory services requests from application programs (APs) and provide the directory services requests to the directory enabling element. A locator service is accessible using the API and configured to locate servers that provide the directory services. A bind service in the directory enabling element is coupled to a security protocol. An event service is configured to receive registration of an event and an associated action from an AP, notify the AP when the event occurs, and execute the associated responsive action. The network device can thereby automatically authenticate itself to a directory service.

Abstract: A monitoring system, method, and computer-program product tracks events and device states in a device and sends those events and states to a remote central service center using an Internet access module. The remote central service center monitors the received events and states for errors or warnings. The monitoring software (e.g., a dynamic link library) supports multiple data formats and multiple protocols to more effectively communicate the event and state information.

Abstract: The present invention is directed to a system and method for administering Peer to Peer (P2P) query messages within a P2P network. The present invention collects a plurality of metrics for each host that it is aware of in a P2P network, most often by a host information or query hit message. The metrics collected aid in determining a set of P2P hosts best able to fulfill a query message, without having knowledge of specific content. The metrics collected also aid in managing query messages in that they determine when to drop query messages or when to resend query messages.

Abstract: A channel merging method for a VOD system, said method comprises the steps of: in response to requests from a plurality of clients for a video program, establishing a root channel (S1) and at least one sub-channel (S11), said root channel (S1) being established according to a request from a client that makes the earliest request, each of said sub-channels (S11) being established in response to a request from a client that makes a later request; and monitoring variation of the number of the clients that are using each of said established channels, and maintaining the channel if the number of the clients using the monitored channel is not zero, and closing the channel if the number of the clients using the monitored channel becomes zero.

Abstract: A gatekeeper connected to an H323 network, includes a first message receiving section, a transport data transmitting section, and a control section. The first message receiving section receives a gatekeeper discovery message from an end point. The control section determines whether the gatekeeper has the lightest load among a plurality of gatekeepers including the gatekeeper, and controls the transport data transmitting section to transmit transport data to the end point in response to the gatekeeper discovery message, when it is determined that the gatekeeper has the lightest load.

Abstract: In one embodiment, a router is deployed on a local area network (LAN) in addition to any routers deployed on a wide area network (WAN) coupled with the LAN having the router. A service management device is coupled between the two routers. The service management device provides management processing, for example, quality of service (QoS) processing, traffic shaping, type of service (ToS) processing, or class of service (CoS) processing. For messages between devices both coupled to the WAN router, the WAN router sends the messages to the LAN router. The LAN router then routes the messages back to the WAN router through the service management device, which provides management processing. The WAN router then sends the processed message to the destination device.

Abstract: A system and method are provided for monitoring traffic in an enterprise network. Similar hosts may be grouped using flow information. Network policy may then be created at the group level based on the signatures of the hosts and groups of hosts in the enterprise. Hosts may be arranged in hierarchical clusters. Some of these clusters may be selected as groups based on a desired degree of similarity between hosts in a group. The similarity between hosts may be determined based on similarity of network behavior of the hosts.

Abstract: A data security having parsing and dispersion aspects enables the user to parse, disperse and reconstruct the original, plain text data or data object, thereby enabling secure storage of the data. The original data may be maintained in its original state, encrypted or it may be destroyed. For example, financial data maintained by an institute, stored as is customary, be parsed with an algorithm, the parsed segments dispersed off-site (that is, separated and stored in extract and remainder stores or computer memories) and away from the financial institute, and, upon appropriate security clearance, the dispersed data can be reconstructed to duplicate the data. Large distribution of parsed data is contemplated by the system. The original data remains stable, operable and immediately useful in its customary storage location (or alternatively destroyed). The secured dispersed data is a back-up of the original data.

Abstract: A monitoring system, method, and computer-program product tracks events and device states in a device and sends those events and states to a remote central service center using an Internet access module. The remote central service center monitors the received events and states for errors or warnings. The monitoring software (e.g., a dynamic link library) supports multiple data formats and multiple protocols to more effectively communicate the event and state information.

Abstract: Numerous embodiments of a method and apparatus for managing network traffic are disclosed.

Abstract: A method and a Fibre Channel switch element are provided that allows communication between a host system and a target device attached to a proprietary switch fabric in a network. The Fibre Channel switch element includes a first port that communicates with the target device through the proprietary switch fabric by logging on behalf of the host system so that the proprietary switch behaves as if it was directly communicating with the host system; and a second port that communicates with the host system and collects host bus adapter (“HBA”) identification information, wherein the HBA identification information is used to map the first port to the second port so that when the host system communicates with the target device the Fibre Channel switch element is transparent to the proprietary switch fabric.

Abstract: A system, apparatus, and method to assist in the discovery of music or other content by members of a social network. The present invention permits network members to network together and share information about their music collections and listening habits with a processing platform and with each other. The processing platform processes music library content and playback related data to produce similarity and compatibility measures between artists (that is, an artist-to-artist measure) and between network members (that is, a network member-to-network member measure). By combining the content and playback related data with filtering mechanisms, recommendation techniques (which may be based on the calculated measures), and set membership concepts, the present invention provides network members of the network with tools to discover artists and/or songs that are likely to be of interest to them.

Abstract: The invention relates to a method for obtaining content objects in a communication system. In the method is obtained at least one search criterion at a first node. At least one entity entry is determined from an entity contact information list. An identity of a second network node is determined from the entity entry. An address is determined for the second network node using the identity. A search is submitted to the second network node. The search criteria are matched to a number of metadata objects to obtain result metadata objects, from which is provided at least a content object identifier to the first network node. The first network node obtaining a content object using said content object identifier from a third network node to the first network node.

Abstract: A system for remote assembly of messages to create a control message includes a shared coordination space for assembly of messages, and a plurality of components for performing predefined actions and for exchanging messages according to a predetermined ontology. The plurality of components includes a first component for directing other ones of the components to publish information on the coordination space and in response gather several distinct pieces of the information and assemble the distinct pieces as a message by which to control the actions of the component. According to a preferred embodiment, the shared coordination space is a tuple space, one of the components is a call control application for controlling a communication switch, and at least one other component is a directory application containing location information.

Abstract: A network that supports VPNs is enhanced to allow users in one VPN to communicate with users in another VPN in the course of executing a predefined application, such as VoIP. This capability is achieved dynamically by enabling a device that can communicate with the network elements that operate to normally prohibit inter-VPN communication to direct those network elements to enable such communication, at least for the purposes the purposes of specific applications.