Alcatel Lucent

Dmitri Vinokurov

Vinod Choyi

Stanley T Chow

Faud Ahmad Khan

Robert W MacIntosh

Jean-Marc Robert

Scott David D'Souza

Emanuele Jones

Rob MacIntosh

Robert W Macintosh

Caller name is authenticated using authentication certificates issued by a registration authority that registers callers who wish to terminate calls to callers subscribed to the registration authority. In one embodiment, the authentication certificates are sent to a called device or a proxy for the called device via a path that is separate from the call setup path. An indication is conveyed to the called party to indicate whether the caller name was successfully authenticated.

Caller name authentication to prevent caller identity spoofing

A method and apparatus are provided for suppressing display of advertisements within a video over IP stream provided by a content provider. Metadata is prepended to advertisements within the stream. When the stream is received by an access aggregation point, the access aggregation point compares the metadata of an advertisement with preset criteria provided by an enterprise subscriber, and suppresses the advertisement if a comparison of the metadata and the preset criteria indicate that the advertisement is undesirable to the enterprise subscriber. The access aggregation point suppresses the advertisement by switching to a second video channel within the stream for the duration of the advertisement. In this way, the access aggregation point can control display of content provider advertisements without manipulating data within the stream, so as to allow the enterprise subscriber to prevent display of undesirable advertisements to endpoints within the enterprise subscriber site such as set-top boxes within hotel rooms.

Managing undesirable content in IP video broadcast traffic

A system and method are provided for management of access security by user and device. A security policy enforcement point is provided with a user policy module to receive user credentials from an access device of the user and a point for setting device dependent security policy to receive device credentials from the access device. A user policy is retrieved from a user database with use of the user credentials while a device policy is retrieved from a device database with use of the device credentials. The user policy and device policy are combined and used in the SPEP to enforce a user and device based security policy.

System and method of network access security policy management by user and device

A system and method are provided for supporting storage and analysis by law enforcement agency premises equipment of intercepted network traffic. The system and method provide integrity of the intercepted network traffic stored in an archive in accordance with lawful intercept requirements by storing all of the intercepted traffic, both benign and malicious, in the archive in its original form. The system and method furthermore provide for security from any malicious data packets of the archive by separating the malicious packets from the benign packets and forwarding only the benign packets to analysis applications of the law enforcement agency premises equipment.

System and method of securely processing lawfully intercepted network traffic

A soft-denial system for client-server networks is disclosed for translating server authorization denials into responses that are known to be innocuous to the client application. The soft-denial system includes a client-application which originates a service request across a network to a server-application which rejects the request due to lack of authorization and subsequently provides a denial response. A soft-denial application intercepts the denial response, translates the response into a response known to be innocuous to the client-application, and forwards the innocuous response to the client-application. The soft-denial system is particularly useful for overcoming client-application failures due to authorization expectation mismatches.

Soft denial of application actions over the network communications

Transparent caller name authentication is provided to authorized third parties by creating an Public Key Infrastructure (PKI) certificate chain. An owner of a registered caller name can authorize third parties to use the caller name by issuing a PKI sub-certificate to each authorized third party. An authenticated caller name displays the owner's name to the called party. Outsourcing and mobile employment is thereby facilitated, and called party confusion is reduced.

Transparent caller name authentication for authorized third party callers

A system and method are provided for management of access security for access by a multimodal device to a converged fixed/mobile network. An inter-technology change-off monitoring entity (ICME) is provided to monitor an inter-technology change-off of the multimodal device and to notify a policy manager of the inter-technology change-off. The policy manager looks up in a policy database, security policies applicable to the user of the multimodal device and the particular technology being used by the multimodal device. The policy manager conveys to various policy enforcement points throughout the converged fixed/mobile network the applicable security policies which take into account the user's identity and the access technology being used.

System and method of network access security policy management for multimodal device

A system and method are provided for providing multiple aliases and associated policy profiles for a user of a VoIP communication system. The user configures a multitude of aliases by the user wishes to be contacted, and associates with each alias a policy stored at a user terminal. The aliases are stored within the network so as to be associated with contact information for the user terminal. A proxy processes call requests by determining the contact information associated with an alias entered by a caller, and forwards the call request to the user terminal associated with the contact information. The user terminal determines the alias used by the caller, and processes the connection request in accordance with the policy. The invention allows users to add and delete aliases in order to effect temporary and private contact information. Calls can be handled depending on which alias was used by a caller, rather than on an identification of the device used by the caller. The proxy may also store proxy policies in association with the aliases and process call requests accordingly, such as billing a call request to a customer account specified by the proxy policy corresponding to the alias entered by a caller.

Adaptable communication profiles in telephone networks

A method and system for filtering malicious packets received at the edge of a service provider (SP) domain is provided. A protocol aware border element identifies the protocol used by any ingress packet, and then determines which domain-specific information is used in the application payload of the packet to form the source identity. If this packet pretends to come from the SP domain, and no domain entity is allowed to roam, the packet is identified as illegitimate and is subjected to a given security policy. The border element also identifies as legitimate the SP domain entities that are allowed to roam, and legitimate sources outside said SP domain that communicates customary with entities in the SP domain.

Application layer ingress filtering

A method and apparatus directed to detecting DoS (denial of service) attacks against SIP enabled devices. A substantial imbalance between an accounting of SIP INVITE (INV) and SIP 180 Ringing (N) messages indicates a DoS attack. Preferably the number (H) of INVITE messages including credentials (INV) that are sent from a user client in response to a 407 Authentication Required message from a proxy server are removed from the accounting before the balance is tested. If the equation INV+INV&#x2212;H=N(where INVis the number of INVITE messages without credentials) is not true within a small margin of error then the presence of a current DoS attack on the proxy server is indicated by the inequality.

Detection of denial of service attacks against SIP (session initiation protocol) elements

A technique for detecting SPAM calls in VoIP networks and taking responsive actions to such calls is described. Detection is based on recognizing abnormalities in signaling message statistics. For example, a device that persistently sends many more call setup requests then it receives and at the same time constantly receives too many, or too few, call terminations in a statistically determined period of time is assumed to be a spam source. This criteria is based on the principle that a Spammer originates many calls, which are consistently terminated by the Spammer or by the recipient. Responsive actions to the detection of VoIP spam may include displaying a call text warning to the recipient, using special ring tone, automated voice mail answer, rejecting the call, etc. The invention addresses an issue that will become more problematic for VoIP networks and their subscribers in the future, and to which a solution has not been proposed in the prior art.

Growing community of inventors

Ottawa, Canada

Dmitri Vinokurov