Nokia Corporation

Future Wei Technologies, Inc.

Wichorus, Inc.

Nokia Siemens Networks Oy

Spyder Navigations LLC

Nokia Technologies Oy

Charles E Perkins

Rajeev Koodli

Vijay Devarapalli

Hannu Flinck

Jari T Malinen

Timothy J Kniveton

Outi Elisa Markki

Hossam Afifi

Huaimo Chen

T Benjamin Mack-Crane

Basavaraj Patil

Sam K Aldrin

Susan Hares

Michael G Williams

Dongfeng Jing

Manish Tiwari

Jon Graff

An apparatus comprising a receiver configured to receive a first path computation request (PCReq) message from a path computation client (PCC) requesting path computation for a label switched path (LSP) in a network, wherein the PCReq message indicates a time interval scheduled for the LSP to carry traffic, a processor coupled to the receiver and configured to compute a path in the network for the LSP by determining that the path satisfies a network constraint in the scheduled time interval, and reserve a network resource on a link along the path computed for the LSP, wherein the network resource is reserved in advance for the scheduled time interval, and a transmitter coupled to the processor and configured to send a path computation response (PCRep) message to the PCC indicating the path computed for the LSP in the scheduled time interval.

PCE for temporal tunnel services

System and method of ad hoc on-demand routing by virtue of central control. A central controller of a network can communicate directly with a route-requesting network device regarding discovery of a data transmission path and perform route computation. A source network device may query the central controller with a unicast route request. In response, the central controller can identify a feasible route based on the topology information of the network. The central controller may also receive a broadcast route request along with other network nodes. As a result, the source device can be offered to select from two resultant routes, one provided by the central controller in a centralized manner and the other provided by the destination device. Further, the central controller can be used specifically for computation of constrained routes by incorporating global constraints. The central controller may be a software defined network (SDN) controller.

Ad-hoc on-demand routing through central control

A method for providing a link identifier (LID), wherein the method comprises obtaining a first identifier block (IDB) that identifies an external interface within a first domain using a first identifying scheme, obtaining a second IDB that identifies a second external interface within a second domain using a second identifying scheme, creating the LID that comprises the first IDB and the second IDB, and advertising the LID to one or more external entities.

Linked identifiers for multiple domains

A method and system for improved network address translation (NAT) to enable efficient translation of packets destined for communication systems within a domain utilizing network addresses that are incompatible with the source and destination addresses indicated in packets delivered from the global Internet. Since the addresses are not compatible with global Internet addresses, delivery cannot be accomplished except by some method of address translation. Traditional systems have not been constructed to enable such inbound translations, providing instead only communications outbound from the incompatibly addressed domain towards the global Internet. An embodiment of the system employs deep packet inspection (DPI) search techniques known from widely deployed systems in use today, to acquire a resource identifier, and to attempt to match the resource identifier to complete the flow of traffic on a packet-by-packet basis.

Method and apparatus for network address translation

A method and system for improved NAT operation enable efficient translation for packets destined for communication systems within a domain utilizing network addresses that are incompatible with source and destination addresses indicated in packets delivered from the global Internet. Since the addresses are not compatible with global Internet addresses, delivery cannot be accomplished except by some method of address translation. Traditional systems have not been constructed to enable such inbound translations, providing, instead, only communication outbound from the incompatibly addressed domain towards the global Internet. Embodiments may employ application-specific knowledge for peer-to-peer based applications, associated over time with specific destinations. Embodiments may further employ an application-specific state machine in the NAT function to trace the development of the application protocol so that the resource identifier can be observed.

Network address translation based on recorded application state

An embodiment of the invention is a method and corresponding system for improved network address translation (NAT) operation, to enable efficient translation for packets destined for communication systems within a domain utilizing network addresses that are incompatible with source and destination addresses indicated in packets delivered from the global Internet. Since the addresses are not compatible with global Internet addresses, delivery cannot be accomplished except by some method of address translation. Traditional systems have not been constructed to enable such inbound translations, providing, instead, only communication outbound from the incompatibly addressed domain towards the global Internet. The example embodiment employs history and pattern matching between observable characteristics of the inbound payload, associated over time with specific destinations. The example embodiment may also employ DPI search techniques known from widely deployed systems in use today, to identify a field on which the pattern matching may operate.

Method and apparatus for performing network address translation

A method and system for supporting mobile routers in Internet Protocol version 6 (IPv6) is provided. A mobile router obtains a care-of-address associated with an address configuration. The mobile router registers the care-of-address with a home agent. A bi-directional tunnel is established between the mobile router and the home agent. Packets are then forwarded via the bi-directional tunnel.

Mobile router support for IPv6

A system and method for efficient state transfer in mobile networks provides improved performance by providing seamless transfer of updated reference state information across network access points during mobile node hand-off. This state transfer processing may be used in an Internet Protocol (IP) network and may include seamless transfer of header compression state.

System and method for efficient state transfer in mobile networks

The present invention provides location privacy against third parties while allowing route-optimized communication between the correspondent node and the mobile node. The mobile node's home address is hidden from an external observer thereby thwarting traffic analysis based attacks where a Home Address is correlated with a Care of Address of a mobile node (MN). A 'privacy label' is used in place of a home address associated with the mobile node. The privacy label is supplied by the mobile node to the correspondent node in a way that that allows the privacy label to be bound to the home address, but does not allow the home address to be visible during the exchange. The privacy label may be also used to help prevent against replay attacks.

Providing privacy to nodes using mobile IPv6 with route optimization

A digital 'baton' is provided from a firewall or other gateway, or other network device, to a device B outside the firewall, when a device A, which is inside the firewall, requests information from the device B. The device B may pass the digital baton to subsequent electronic devices that may respond to the request using the digital baton to send messages or information through the firewall to the device A. The firewall authenticates and filters the messages based on authentication of the batons contained within the messages.

Apparatus and method for traversing gateway device using a plurality of batons

A system and method for discovering capabilities of a network interface prior to a handover. The mobile node detects a beacon with a radio interface identifier that identifies a new access router (NR). Using the radio interface identifier, the mobile node obtains interface information on the NR through a current access router (CR). The interface information identifies the capabilities of the NR.

System and method for discovering network interface capabilities

A system and method for strong authentication achieved in a single round trip is disclosed, which reduces the amount of time needed for a mobile node to be authenticated by the network. In an embodiment of the present invention, the, authentication time is approximately three times faster than for 3GPP.

System and method for strong authentication achieved in a single round trip

A security key distribution and authentication protocol in AAA for Mobile IP has been described. In order to guarantee the secure protocol, messages between the MN, FA, AAAF, AAAH, and HA are encrypted and signed using public/private keys. IPSEC or PKI infrastructure is not required to support the AAA secure key distribution. This protocol enhances the security, flexible, scalability of AAA, and aids in protecting the Diffie-Hellman algorithm from man-in-the-middle attacks. Through this protocol, it is easy to set up a secure registration path in AAA for Mobile IP. This secure registration path provides a secretive and secure key distribution function for AAA.

Secure key distribution protocol in AAA for mobile IP

A system and method is provided that enables the transfer of policy resource tokens (PRT) in the process of a handover of a mobile node in a wireless network. The system includes a granting agent that grants the PRT to a first access router to enable the mobile node to access network resources. In one embodiment, in the process of handing over the mobile node, the first access router provides the PRT to the second access router, thereby reducing data latency, and a disruption for an application executing on the mobile node. In another embodiment, the mobile node provides the PRT to the second access router after connectivity is established. A PRT data structure also is provided that includes a data field of profile types. A profile type describes context authorization information for granting access to a network resource.

Growing community of inventors

Saratoga, CA, United States of America

Charles E Perkins