Raytheon Bbn Technologies Corp.

Verizon Corporate Services Group Inc.

Bbn Technologies Corporation

Gte Internetworking Incorporated

Other

Stragent, LLC

Level 3 Communications, LLC

Bbnt Solutions Llc.

Craig Partridge

Walter Clark Milliken

William Timothy Strayer

David Bruce Cousins

David Patrick Mankins

Tushar Saxena

Luis Sanchez

W Timothy Strayer

Philip P Carvey

Jason Keith Redi

Stephen Douglas Milligan

Isidro Marcos Castineyra

Ronald L Pettyjohn

Gregory Stephen Lauer

Steven Kohalmi

Josh Forrest Karlin

Alden W Jackson

Stanley P Sassower

Niky Riga

Abraham I Matta

Alberto Antonio Medina

Rajesh Krishnan

A system for performing packet based data communications over a parallel set of sublinks is provided. A transmitter unit separates the sublinks into an available set of sublinks and a busy set of sublinks. This transmitter avoids processing delays by utilizing sublinks in the available sublink set and not waiting for sublinks in the busy sublink set to be released. To receive the packets, a receiver unit utilizes a sequence number associated with each packet. Accordingly, the receiver extracts the one or more packets of data received in parallel over the set of sublinks in sequential order. A packet window buffer is used to store packets in sequence if they are initially received out of order. The receiver utilizes a sliding window to provide packets in continuous sequential order and transmits the packets serially over a single communication link.

Method and apparatus for striping packets over parallel communication links

Embodiments of the invention reduce the probability of success of a DOS attack on a node receiving packets by decreasing the probability of random collisions of packets sent by a malicious user with those sent by honest users. The probability of random collisions may be reduced in one class of embodiments of the invention by supplementing the identification field of the IP header of each transmitted packet with at least one bit from another field of the header. The probability of random collisions may be reduced in another class of embodiments of the invention by ensuring that packets sent from a transmitting IPsec node to a receiving IPsec node are not fragmented.

Means of mitigating denial of service attacks on IP fragmentation in high performance IPSEC gateways

Systems, methods, and devices for decoy routing and covert channel bonding are described. The decoy routing system includes a client computing device, a decoy router, and a decoy proxy such that packets addressed to a decoy destination are re-routed by the decoy router to a covert destination via the decoy proxy. The decoy routing method may be applied to a covert channel bonding process, in which a plurality of packet data streams are sent to one or more decoy destinations, re-routed appropriately via one or more decoy routers and/or decoy proxies, and assembled together into a single packet data stream at either a decoy proxy, or a final covert destination.

Systems and methods for decoy routing and covert channel bonding

A system () detects transmission of potentially malicious packets. The system () receives, or otherwise observes, packets and generates hash values based on variable-sized blocks of the packets. The system () then compares the generated hash values to hash values associated with prior packets. The system () determines that one of the received packets is a potentially malicious packet when one or more of the generated hash values associated with the received packet match one or more of the hash values associated with the prior packets.

Hash-based systems and methods for detecting and preventing transmission of polymorphic network worms and viruses

The invention relates to a transport protocol and associated methods and stack architectures for improving the energy efficiency of transmitting packets through an ad hoc network. The protocol controls transmissions by taking into account per-packet energy limits, per-node loss tolerances, and/or minimum availability rates determined based on path quality measurements collected by packets traversing the network and application reliability requirements associated with various applications.

Systems and methods for energy-conscious communication in wireless ad-hoc networks

Means of mitigating denial of service attacks on IP fragmentation in high performance IPsec gateways

A system acquires information about communication among wired or wireless nodes [] in a network [] by intercepting chunks of data in the network by a wired or wireless tap [] located among the wired or wireless nodes [] in the network. Characteristic information [] about the intercepted chunks of data may be obtained. The characteristic information may include times of arrival [] of the chunks of data at the wired or wireless tap [] and identifiers of wired or wireless source nodes [] that sent the chunks of data. At least one signal may be constructed to represent the characteristic information over time.

Encoding of signals to facilitate traffic analysis

An arithmetic logic unit () improves the processing of information. The arithmetic logic unit () includes a register unit (), a ternary content addressable memory (), and an operations unit ().

Ternary content addressable memory embedded in a central processing unit

A system processes communication signals in a network [100, 200]. The system may obtain time of arrival information for chunks of data in the network and construct a signal [410, 420] to represent the time of arrival information. The signal may consist of data that is non-uniformly spaced. The system may process the signal using a Lomb technique to obtain periodicity information [600, 800] about the signal.

Methods and systems for passive information discovery using Lomb periodogram processing

A system for passively analyzing an aggregation of communication signals simultaneously passing through a network link performs spectral analysis on a trace of communication traffic through the network link. The spectral analysis identifies period components of the trace corresponding to different communication signals. A system for deterring the passive analysis of signals aggregates communication traffic through a network link, such that a plurality of signals simultaneously pass through the network link. The plurality of signals is regulated such that the data packets corresponding to the plurality of signals leave the network link at a common rate. A memory temporarily stores the data packets as they enter the network link, and a timer maintains a fixed time interval for releasing the data packets from the memory.

Method and system for passively analyzing communication data based on frequency analysis of encrypted data traffic, and method and system for deterring passive analysis of communication data

A system and method for performing source path isolation in a network. The system comprises an intrusion detection system (IDS), a source path isolation server (SS) and at least one router configured to operate as a source path isolation router (SR) operating within an autonomous system. When IDS detects a malicious packet, a message is sent to SS. SSin turn generates a query message (QM) containing at least a portion of the malicious packet. Then, QM is sent to participating routers located one hop away. SRuses the query message to determine if it has observed the malicious packet by comparing it with locally stored information about packets having passed through SR. SRsends a reply to SS, and SSuses the reply to identify the ingress point into the network of the malicious packet.

Method and apparatus for tracing packets

A computer system for transmitting packets includes a manager and scheduling elements for managing the transmission of the packets over one or more logical channels. The computer system can prioritize the transmission of packets based on the type of traffic and maintain quality of service (QoS) characteristics associated with a logical channel. In addition, the computer system can execute a threading process to ensure the efficient and timely transmission of certain types of packets without using any complex mathematical operations.

System and method for scheduling and rescheduling the transmission of cell objects of different traffic types

The router disclosed herein employs a plurality of forwarding processors and a matrix switch for selectively connecting input ports, output ports and the forwarding processors. Each of the input ports includes means for selecting a respective forwarding processor for each incoming data packet in accordance with data in the respective packet header and for transmitting the packet header to the selected forwarding processor. The selected forwarding processor operates to transmit to the originating input port the identity of an output port appropriate for the packet's next hop.

Data packet router

A communication technique for transmitting packet data over parallel communication sublinks coupled to a processor unit is provided. Initially, a method receives a packet of data from a first communication link which is coupled to a set of sublinks. The method distributes packets over each of the sublinks utilizing a unique byte-by-byte (BBB) striping technique. Logically, the data bytes associated with each sublink are collected into a slice of data and each set of slices are given a unique predetermined label. Each slice is then synchronously transmitted at the aggregate bandwidth of each sublink in parallel across each corresponding sublink to a receiver. A receiver receives the slices of data from the set of sublinks and aggregates the bandwidth of these two or more communication sublinks into a single communication link. Unless there are errors, a packet is transmitted in order using multiple slices. The system recreates the original packet of data from sets of slices having the same unique label. Specifically, the system uses the byte-by-byte striping technique to extract the appropriate bytes of information from each slice received over the parallel sublinks based upon a predetermined sublink sequence corresponding to the labels. This technique is advantageous in that it provides an optimal balance between preserving packet order and conserving network resources.

Growing community of inventors

East Lansing, MI, United States of America

Craig Partridge