International Business Machines Corporation

Charles A Kunzinger

Jacqueline Hegedus Wilson

Guha Prasad Venkataraman

Gaurav Batra

Dave Kemper

A data processing system, method, and product are disclosed for automatically configuring IP security tunnels. A security policy specification format is established that is capable of being utilized by any one of multiple different operating systems and any one of multiple different machine types. An IP security tunnel is automatically configured utilizing the security policy specification format.

Standard format specification for automatically configuring IP security tunnels

The present invention provides a method, system, and computer program product for enhancing security within a distributed computing network while enabling fine-grained access control for packets traveling through the network. The disclosed techniques enable this fine-grained access control while simultaneously providing broad-brush application-independent and user-independent security for Internet Protocol (IP) packets that are in transit over both secure networks (such as a corporate intranet) and non-secure networks (such as the public Internet). Access control decisions are delegated to an access control engine, and are based upon mutually authenticated identity information (e.g. of a system user and/or application) that is extracted from information exchanged as part of an underlying security service (such as the Internet Key Exchange of the IP Security Protocol).

Integrated system for network layer security and fine-grained identity-based access control

A method, system, and computer program product for providing consistent, end-to-end protection within a computer network for user datagrams (i.e. packets) traveling through the network. The network may comprise network segments that are conventionally assumed to be secure (such as those found in a corporate intranet) as well as network segments in non-secure networks (such as the public Internet or corporate extranets). Because security breaches may in fact happen in any network segment when datagrams are unprotected, the present invention discloses a technique for protecting datagrams throughout the entire network path by establishing cascaded tunnels. The datagrams may be exposed in cleartext at the endpoints of each tunnel, thereby enabling security gateways to perform services that require content inspection (such as network address translation, access control and authorization, and so forth). The preferred embodiment is used with the 'IPSec' (Internet Protocol Security Protocol) and 'IKE' (Internet Key Exchange) protocols, thus providing a standards-based solution.

Establishing consistent, end-to-end protection for a user datagram

The invention relates to asynchronous transfer mode (ATM) connections that are segmented into separate feedback control loops. A virtual destination (VD) of a given segment provides feedback to the virtual source (VS) of the same segment. The feedback is based on flow control information provided by the VS of the adjacent downstream segment. Information is transferred across segment boundaries by using a data table shared by the VS of one segment and the VD of the adjacent upstream segment. The actual Allowable Cell Rate for a segment is written into the table, from which it can be extracted by the VD of the next upstream segment. VS/VD switches are implemented in either a centralized or a distributed configuration.

Use of shared table in operation of segmented ATM connections

NTSC composite color video signals captured in a freeze-frame videoconferencing system can be decomposed into luminance and chrominance components using simple digital addition and subtraction. The necessary apparatus includes a conventional color camera, an analog-to-digital converter, and a superframe buffer, organized into four field buffers. The analog signal is sampled at phase angles which are displaced at 135 degree increments. The preferred phase angles are 0, 135, 270, 45, 180, 315, 90 and 225 degrees relative to the phase of the color burst for the current scan line. Due to the reversal of the color burst phase on a frame-to-frame basis, a luminance or Y value can be obtained for each pel by adding the digital values stored in corresponding pel positions in corresponding fields (odd or even) in two successive frames of the same image. A chrominance or C value can be obtained by subtracting the same two values. The I and Q components of chrominance can be obtained directly as a result of the subtraction process at certain of the angles or indirectly through calculation at other of the angles.

System for decomposition of NTSC color video signals using two frame

Distributed transmission control for a TDMA system including one or more user networks. A time synchronized burst modem, one at each earth station in a system, transfers TDMA frame timing signals to an interconnected data processing machine. The interconnected data processing machine is then capable of synchronizing information transfer to the time synchronized burst modem in accordance with the received TDMA frame timing signals. Accordingly, each network has available to it, at each data processing machine in the network, TDMA frame timing signals. Accordingly, optimizing information transfer can be effected on a network-by-network basis, wholly independent of overall system TDMA information transfer optimization.

Growing community of inventors

Morrisville, NC, United States of America

Charles A Kunzinger