Alcatel Lucent

Alcatel Canada Inc.

Alcatel-lucent Canada Inc.

Alcatel

Sound View Innovations, LLC

Carl Rajsic

Shawn P McAllister

Peter Roberts

Maged Edward Shaker

David Ker

Walter Prager

Denis A Proulx

Bassem Abdel-Aziz

John C Fischer

Jason Rusmisel

John Coffell

Shay Nahum

Arnold Jansen

Mudashiru Busari

Michael Ellsworth Weedmark

Hansen Chan

Mohammad Reza Rokui

Rajesh Kumar Paida

Alexander Kutman

Dale Kevin Burnett

Shawn Mcallister

Various embodiments include a method for managing a group of devices in communication with each other and sharing a set of keys. The method may include opening a secure channel with each of two devices from the group; providing the set of keys to the two devices from the group, wherein the set of keys include an encryption and an authentication key; indicating to the two devices to begin using the set of keys; and performing an audit process including verifying that nodes within a key group have the same copy of encryption and authentication keys. Embodiments of the method may include synchronization, active/standby redundancy and the ability to manage the network when some nodes perform the data encryption and some node do not, do, or when both encrypted and non-encrypted tunnels and services can work together.

Policy based cryptographic key distribution for network group encryption

In one embodiment, a tunnel to be affected by configuration of a service in a network is identified and key information for the identified tunnel is obtained from a corresponding router. The tunnel is assigned to a key group based on the key information, and provisioning information associated with the tunnel on the router is updated based on the assigned key group in conjunction with configuration of the service. The updating of the provisioning information may comprise altering the key information on the router to include a key associated with the assigned key group. Also, one or more keys not associated with the assigned key group may be deleted from the router and from a management entity of the network.

Secure service management in a communication network

A method for providing service plane encryption in IP/MPLS and GRE networks is disclosed. The method for providing service plane encryption in IP/MPLS and GRE networks includes receiving a first Security Parameter Index with associated first encryption key and associated first authentication key at a first network element supporting the first Service Distribution Point; receiving an instruction at the first network element to encrypt data entering the first Service Distribution point with the first encryption key; receiving an instruction at the first network element to associate a data communication service provided at the first network element to the first Service Distribution Point; providing an encryption label; and providing data associated with the first communication service to the first Service Distribution Point for transmission to the second Service Distribution Point. The method for providing service plane encryption in IP/MPLS and GRE networks provides encryption advantages over systems known in the art by providing capability for selectively encrypting services connected via a data tunnel.

Service plane encryption in IP/MPLS networks

A method for providing control plane encryption in layer 3 networks is disclosed. The method for providing control plane encryption in layer 3 networks includes for a network having a subset of network elements forming a secured domain; the steps of at a network element which is in the secured domain, encrypting all unencrypted Layer 3 packets as they egress an encryption enable egress interface; unencrypting all encrypted Layer 3 packets as they egress an egress interface is not enabled for encryption; and leaving encrypted all encrypted Layer 3 packets as they egress an encryption enable egress interface. A system and machine readable storage media are also disclosed.

Control plane encryption in IP/MPLS networks

A system and method are provided for securely establishing Layer-3 SVCs or SPVCs across an ATM network. An originating multiservice switch that generates the connection setup message for the Layer-3 connection includes security information within the setup message, such as a Closed User Group Interlock Code. When the destination multiservice switch receives the setup message, it extracts the embedded security information and compares it with stored security information corresponding to the connection. The correspondence may be determined from the destination user. If the embedded security information matches the stored security information, the destination multiservice switch allows the connection to be established.

Method and apparatus for securely establishing L3-SVC connections

Communication network connection failure protection methods and systems are disclosed. Control information is communicated in a communication network, and causes network elements of the communication network to establish connection monitoring for respective segments of the network connection. Connection monitoring information which is communicated on the segments allows failures such as loss of continuity to be detected and reported. Responsive to an indication of a failure on a segment, the segment on which the failure occurred is identified, and the network connection can be rerouted around that segment.

Communication network connection failure protection methods and systems

A method for establishing a pseudo-wire connection between first and second switches in a packet switched network, the method comprising: sending a label mapping message to the second switch requesting that the pseudo-wire connection be established with the first switch; reserving resources for the pseudo-wire connection at the first switch; receiving a label withdraw message from the second switch if the second switch has insufficient resources for the pseudo-wire connection and, in response to the label withdraw message, releasing the resources for the pseudo-wire connection at the first switch; and, activating the pseudo-wire connection if the second switch has sufficient resources for the pseudo-wire connection, thereby optimizing resources for establishing pseudo -wire connections of each of the first and second switches.

Method and system for optimizing resources for establishing pseudo-wires in a multiprotocol label switching network

A method and apparatus are provided for protecting a connection during implementation of an Active Connection Modify request. Before initiating the ACM request, an alternate connection between the source node and the destination node of the connection are established using Domain-Based Rerouting. The alternate connection may be established in conformance either with the traffic parameters of the existing connection or with the new traffic parameters specified in the ACM request. If the connection along the original connection is to be torn as a result of lost ACM signaling messages, the connection is first switched to the alternate connection in a hitless manner. If the alternate connection is established in conformance with the new traffic parameters, and the ACM request can not be implemented along the original connection, due for example to resource shortage along the original connection, then the connection is switched to the alternate connection in a hitless manner. In this way, connections are protected in the event of lost ACM messages resulting from signal congestion, and the ACM may be implemented even in the event of resource shortage along the original connection.

Protected and high availability paths using DBR reroute paths

A method for policy-based routing of calls between nodes in a network, comprising: entering policy constraint indices for selected addresses in respective entries of an address translation table, the address translation table for accessing by a first node of the network to selectively translate attributes of calls based on respective addresses prior to transmission over the network to a second node, the policy constraint indices pointing to respective policy constraints for routing calls between the first and second nodes; receiving a call at the first node, the call including an address; accessing the address translation table using the address to determine whether the call requires assignment of a policy constraint by presence of an entry for the address in the address translation table and by presence of a policy constraint index in the entry; and, if the call requires assignment of a policy constraint, identifying a policy constraint with the policy constraint index, assigning the policy constraint to the call, and routing the call between the first and second nodes in accordance with the policy constraint.

Method and system for policy-based routing in a private network-to-network interface protocol based network

The present invention provides a method for permitting fully detailed advertising of reachability information for some addresses in a network while efficiently summarizing reachability information for other addresses. At least one embodiment is implemented as part of a process used by logical nodes for advertising reachability information for members of a group of nodes represented by the logical node. At least one embodiment provides an 'exception' instruction that allows detailed reachable address information to be advertised for an address that would otherwise be included in summary address information. At least one embodiment allows detailed reachability information to be advertised for the particular address while still allowing summarization of reachable address information for addresses sharing a common prefix with the 'exception' address. At least one embodiment thereby allows detailed information to be advertised where needed while allowing summary address information to be advertised where such detailed information is not needed.

Method for advertising reachable address information in a network

A method and apparatus for emulating VPLS within an ATM network. Provider Edge devices are configured for VPLS connections. For each pair of provider edge devices supporting the same VPLS ID, one device establishes a virtual circuit between the pair. Thus, a full mesh of virtual circuits is established between provider edge devices, and a VPLS-like service can be offered to users without having to implement MPLS. Establishing the virtual circuits within a PNNI hierarchy maybe facilitated by each provider edge device propagating through the hierarchy an information group containing an association between the ATM address of the device and a VPLS ID, so that each provider edge device learns all ATM addresses to be associated with each VPLS ID. The method of advertising ATM addresses can be applied to other services requiring a number of interconnections between provider edge devices, such as Virtual Private Networks.

Providing VPLS-like service over native ATM networks

There is provided a method of forwarding a traffic flow in a communications network having at least one network node for which network traffic is selectively prevented from transiting the network node. The method includes the step of selecting a specified category of network traffic that is to be prevented from transiting the network node. The method also includes the step of determining a path within the network for forwarding the traffic flow, whereby the network node is excluded for transit in establishing the path where the traffic flow is identified with the specified category of network traffic.

Forwarding of network traffic in respect of differentiated restricted transit network nodes

A method and apparatus for establishing a test connection to verify the ability to automatically re-establish control plane connections, if necessary, in a PNNI network. Certain routing features such as restricted transit feature and policy based routing features or the current stat of the network itself can limit access to nodes and links between nodes. If these features are implemented in a network or the network state changes after a control plane connection has been established, then these changed conditions will not affect the current connection but may prevent the re-establishment of the connection if it is unintentionally dropped. According to the invention a test connection is periodically set-up through the network and if the test connection fails an alarm or other notice is given. This allows for preventative action to be taken in order to avoid disruption to the network.

Control plane stability in communications networks

The invention provides a system and method of a selecting an egress connection from egress connections at a node for a call being established in a network along a path being associated with the node. Each connection has sufficient bandwidth to carry the call and terminates at a same destination point in said path. The system and method comprise utilizing at least a bandwidth load balance value for each connection in a set of the connections to select the egress connection from the set. An administrative factor score may be used to further define members of the set.

Growing community of inventors

Nepean, Canada

Carl Rajsic