Parallel Wireless, Inc.

Enterasys Networks, Inc.

Ellacoya Networks, Inc.

Enterasys, Inc.

David Ruffen

Kurt A Dobbins

David L Cullerot

Brendan J Fee

Michael Skubisz

Chris Oliver

Kevin Yohe

Theodore C Len

Thomas A Grant

Laura Kane

Philip Andlauer

David H Bahi

Rajesh Kumar Mishra

Kaitki Agarwal

Sumit Garg

Ketan Supanekar

Robert Getschmann

Bruce E Caram

Mark Thomas Sexton

Jason P Poirier

Justin William Haddad

Brett A Miller

Stephen G Delahunty

Wouter Johan Weiss

Andre C Boutin

Adam Michael Lederman

Christopher Lawrence Cheetham

A method is disclosed, comprising: configuring, based on hardware characteristics of a radio access device, a first security certificate; setting up a first encrypted tunnel with a first security server using the first security certificate, the first security server configured to grant permission via the first security certificate for obtaining a second security certificate providing access to an operator core network; tearing down the first encrypted tunnel; and setting up a second encrypted tunnel to a second security server within the operator core network using the second security certificate, the second encrypted tunnel configured to allow the radio access device to securely communicate with the operator core network for providing connectivity for user devices to the operator core network, wherein the first encrypted tunnel and the second encrypted tunnel to use a single transport port to obtain the second security certificate via the first encrypted tunnel.

Multi-stage secure network element certificate provisioning in a distributed mobile access network

Methods are disclosed for incorporating a security gateway within a wireless mesh network. In one embodiment, the wireless mesh network is a heterogeneous mesh network. In one embodiment, a gateway node, which is part of the wireless mesh network, requests a connection to the core network through a security gateway. The security gateway responds by creating an IPSec tunnel and a GRE tunnel within the IPSec tunnel from itself to the gateway node. Once the gateway node is communicatively coupled to the security gateway via secure tunneling, the gateway node sends a mesh routing protocol to the security gateway.

Method of connecting security gateway to mesh network

In this invention we disclose methods for incorporating a security gateway within a wireless mesh network. In one embodiment, the wireless mesh network is a heterogeneous mesh network. In one embodiment, a gateway node, which is part of the wireless mesh network, requests a connection to the core network through a security gateway. The security gateway responds by creating an IPSec tunnel and a GRE tunnel within the IPSec tunnel from itself to the gateway node. Once the gateway node is communicatively coupled to the security gateway via secure tunneling, the gateway node sends a mesh routing protocol to the security gateway.

Connection-oriented services for packet switched data communications networks are provided, including distributed MAC and protocol alias addresses discovery. Link state topology exchanges provide each switch with network topology graphs to determine paths from source to destination end systems. Broadcast frames are resolved to unicast frames to reduce broadcast traffic. Policy restrictions may be applied prior to connection setup. Connection management includes source-routed mapping of connections on the desired path. Distributed call rerouting is provided so switches receive topology change notifications and unmap failed link connections. Broadcast/unknown services provide non-resolvable packet restricted flooding. Connection-oriented switching is provided based on source and destination MAC addresses. Resolution of networks outside the switch domain is enabled by listening for network and server route advertisements and maintaining best routes to the networks and servers. Route and path metrics may be combined to determine paths from access switches to egress switches connected to the external network.

Distributed connection-oriented services for switched communication networks

Method and apparatus providing connection-oriented services for packet switched data communications networks. Directory services include distributed discovery of MAC addresses and protocol alias addresses. Topology services include a link state topology exchange among switches, which provides each switch with a complete topology graph of the network. This enables an access switch receiving a data packet to determine a complete path from a source end system to a destination end system. Another service includes resolution of broadcast frames to unicast frames, in order to reduce the amount of broadcast traffic. Policy restrictions may be applied prior to connection setup. Path determination services enable multiple paths from a source to a destination. Connection management includes source routed mapping of connections on the desired path. A distributed call rerouting service is provided wherein if a link on an active path fails, each switch receives a topology change notification and unmaps any connection involving the failed link. A broadcast/unknown service provides restricted flooding of nonresolvable packets. Furthermore, connection-oriented switching is provided based on the source and destination MAC addresses as a connection identifier. Still further, resolution of networks outside the switch domain is enabled by access switches listening for network and server route advertisements and maintaining best routes to said networks and servers. The best route metrics may be combined with best path metrics to determine a path from a first access switch to an egress switch connected to the external network.

Content resources are managed. A request is received from a user for access to a source of content resources. It is determined that the user is authorized for access to the source. A portal Web page is generated based on a set of content element data applicable to the subscriber. The portal Web page is returned to the user. A system for use in managing content resources has a switch for receiving requests from Web browsers, a content resource management engine in communication with the switch, and a billing system in communication with the content resource management engine.

Managing content resources

Tailored application or service may be delivered via a communication device to a number of subscribers in a manner that avoids having to store individual copies of a service profile on the device for each subscriber receiving the application or service. Specifically, a packet is received requesting delivery of the application or service from the subscriber at a communication device. In response, the communication device retrieves a subscriber context, which references policies that describe each of the applications and services available to the subscriber. The application or service requested by the packet is compared with the policies referenced by the subscriber context to identify any matching policies. Subsequently, the requested application or service is delivered to the subscriber via the communication device according to the matching policies as described by a service profile. This service profile is accessible for describing the application or service when requested by other subscribers. In addition, in some cases each application or service is described by a single set of polices in the service profile. In these instances, each request for the application or service is fulfilled according to that single set of policies.

Directory-enabled intelligent broadband service switch

Distributed connection-oriented services for switched communications networks

Growing community of inventors

Salem, NH, United States of America

David Ruffen