Nortel Networks Corporation

Alcatel Lucent

Rockstar Consortium US LP

Rockstar Bidco, LP

Avaya Inc.

Donald Fedyk

Peter J Ashwood-Smith

Lakshminath Dondeti

Haixiang He

Hamid Ould-Brahim

Peter Ashwood Smith

Lakshminath Reddy Dondeti

Bilel N Jamoussi

Hong Zhang

Paul Kwok

Ravi Ravindran

Senthil K Sathappan

David Allan

Darek Robert Skalecki

Bruce A Schofield

Sameh Rabie

Indermohan S Monga

Jerzy Miernik

Anoop Ghanwani

Dieter Beller

Ryan M Stark

Marcus D Leech

Keith Clifford Dysart

Ramy M Guirguis

Barry L Hass

Billel Jamoussi

Peter J Ashwood Smith

Keith Dysart

In order to achieve path diversity for dual-homed User-Network Interface clients connected to a Generalized Multiprotocol Label Switching control plane enabled transport network that is operated in an overlay mode, the overlay extension service model is enhanced by adding shared constraint information for path diversity in the optical transport network. In particular, within the provider network, shared constraint information of a first traffic path is determined and a data element indicative of the shared constraint information is returned by a first provider edge node to a customer edge device via a User-Network Interface. When the customer edge device requests a second traffic path through the provider network to be established from a second provider edge node and to be disjoint from said first traffic path, the customer edge device forwards the data element to the second provider edge node to enable path calculation of the second traffic path using the shared constraint information as exclusion list.

Method and related apparatus for establishing link-diverse traffic paths in a telecommunications network

Methods, system and apparatus for determining shortest path bridging (SPB) within a communications network.

Method and apparatus for shortest path bridging of multicast traffic

Domain-wide unique node identifiers and domain-wide unique service identifiers are distributed within a MPLS domain using routing system LSAs. Nodes on the MPLS network compute shortest path trees for each destination and install unicast forwarding state based on the calculated trees. Nodes also install multicast connectivity between nodes advertising common interest in a common service identifier. Rather than distributing labels to be used in connection with unicast and multicast connectivity, the nodes deterministically calculate the labels. Any number of label contexts may be calculated. The labels may either be domain wide unique per unicast path or per multicast, or may be locally unique and deterministically calculated to provide forwarding context for the associated path. Multicast and unicast paths may be congruent, although this is not a requirement.

Service instance applied to MPLS networks

Methods, system and apparatus for determining shortest path bridging (SPB) of multicast frames within a communications network.

A method and apparatus is disclosed which enables detection of undesired packets received at a device in a network, where the device is a member of a group of devices in the network. A registration table stores transform identifiers for each member of a group and controls the forwarding of the transform identifiers to the members of the group as members are added and deleted. A transform identifier indicates a format or transformation of a packet transmitted by an associated member. The transform identifier can therefore be used at a receiving device to distinguish between transmissions by different members of the group, thereby enabling the receiving device to extract sequence information associated with the member from the packet. The sequence information can be compared against an expected sequence number for the member to determine whether the packet is an undesirable or rogue packet.

Method and apparatus for providing replay protection in systems using group security associations

Optical By-Pass (OBP) links may be created by adding wavelengths between nodes on the network. The OBP may extend between any pair of nodes on the network. Intermediate nodes on the OBP are transient nodes and simply forward traffic optically. An OBP extends between a pair of nodes and, unlike express links, is created in such a manner that it does not affect the previous allocation of resources on the network. This enables capacity to be added between pairs of nodes on the network to alleviate congestion at a portion of the network, without changing other traffic patterns on the network. This enables inclusion of an OBP to be deterministic and of linear impact on the network. The OBP links may be statically provisioned or created on demand. Optionally, the OBP links may be crated to coincide with PBB-TE tunnels on the network.

Utilizing optical bypass links in a communication network

CE devices of the present invention are enabled to make more judicious routing decisions in CE-based VPNs. In determining a next-hop in a path from a source CE to a destination subnet, CE-to-CE costs are associated with each next-hop CE in a plurality of next-hop CEs. Each CE-to-CE cost is a cost of a path from the source CE to the associated next-hop CE. CE-to-subnet costs are associated with each of the next-hop CEs. Each CE-to-subnet cost is a cost of a path from the associated next-hop CE to the destination subnet. Total-costs are associated with each of the next-hop CEs. Each total-cost is a sum of a CE-to-CE cost associated with a next-hop CE and a CE-to-subnet cost associated with the same next-hop CE. The next-hop in the path is set to be a next-hop CE associated with an associated total-cost.

QoS-based routing for CE-based VPN

A packet header in a source routed network is augmented to include, with each hop identifier, at least one bit for indicating congestion at the particular hop. As the packet traverses from the source to the destination, when congestion is detected at a hop, a congestion bit associated with the hop is set in the header. At the destination, when another packet is forwarded from the destination to the source on the same path, the congestion bits are reflected back to the source. When the source receives the congestion bits, it has the option of re-routing subsequent communications between the source and destination nodes by generating a new hop list, which routes around one or more of the congested hops.

Method and apparatus for indicating congestion in a source routed network

Described are a method and system for establishing a secure communication session with third-party access at a later time. A first communication subsession is established between two original devices using a first key generated by a two-party key and security association protocol. At least one of the original devices is established as a group key server. A request from a joining device to join the secure communication session is received and a second communication subsession is established between the original devices using a second key generated by the two-party key and security association protocol. The second key is provided to the joining device to enable participation in the second communication subsession.

Key negotiation and management for third party access to a secure communication session

A key selection process is provided which secures traffic between VPN end-points using a combination of SVPN group keys and pair-wise keys. The type of key used is based on the dynamic needs of traffic between the end-points, where the needs may include throughput and quality of service. SVPN group keys allow end-points in a group to initiate data communications while obtaining pair-wise keys in the background. Once pair wise keys are obtained, communications can be transferred using the obtained keys. As the throughput, quality of service, routing and other needs of the channel change, the type of keys used for data transfer may concomitantly change between SVPN group keys and pair-wise keys to appropriately utilize network resources. The key selection idea may be extended to allow communication through a hub using a group key while establishing pair-wise channels for group member communications in the background.

Method of providing secure groups using a combination of group and pair-wise keying

Ethernet provider backbone transport (PBT) paths are controlled utilizing Generalized Multi-protocol Label Switching (GMPLS) signaling protocol. A path between edge nodes is identified by a combination of a VID and destination MAC address in a VID/MAC tuple populated in the forwarding tables of intermediary nodes. To establish the PBT path, a path calculation is performed from the originator node to the terminator node through the network. The originating node then sends a GMPLS label object with a suggested VID/MAC to identify the path to the terminator. The intermediary nodes or bridges forward the object to the terminating node. The terminating node then offers a VID/MAC tuple in a GMPLS label object in response. When the intermediary nodes forward the response from the terminating node to the originator, the appropriate forwarding labels are then installed in the forwarding tables of each node utilizing the associated VID/MAC tuples.

GMPLS control of ethernet

A generalized virtual router is disclosed. A routing and switching apparatus includes a switching fabric and a matrix of switching and routing elements. At least some of the elements are interconnected by the switching fabric. A router control provides control for the switching fabric. The apparatus has both cross-connect and routing functionality.

Generalized virtual router

Source-implemented constraint-based routing with source routing enables traffic engineering to be performed and reservations to be made within a domain without requiring constraint information and reservation information to be disseminated to all nodes in the domain. In one embodiment, a focal node maintains a table containing metrics of links and connection reservations through the domain. When a connection is to be added, the focal node determines a path, given the constraints reflected in the table, and allocates resources on the links forming the path. The table is updated, and the path is used to generate headers for traffic associated with the connection. Traffic from the nodes toward the focal point follow the reverse path. If a node or link fails, connections carried through the failure are identified, reservations on links associated with the connections are released, and new reservations are made taking into account the new network topology.

Source-implemented constraint based routing with source routed protocol data units

Routing information may be provided to VPN sites on demand to allow smaller VPN sites with smaller routing tables to communicate directly with other VPN sites. This allows the meshed VPN architecture to scale to a size larger than where each VPN site is required to store routing information for all other VPN sites. A route server is instantiated on the network, optionally in connection with a Group Controller Key Server, to manage distribution of routes on the network and to provide routes to VPN sites on demand. As routes are learned by the VPN sites they are advertised to the route server, which selectively advertises the routes to other VPN sites depending on the per-site preferences. When a VPN site needs routing information to communicate with another VPN site, the network element will check its routing table for the route, and if the route is not available, will obtain the route on-demand from the route server.

Method and apparatus for obtaining routing information on demand in a virtual private network

Method and apparatus that enable secure transmission of data in a scalable private network are described. Each station that is to be part of a private network registers with a key table. A group security association associated with the private network is forwarded to each trusted ingress and egress point that communicates with each member of the private network. When a member of the private network seeks to communicate with another member, it simply forwards the communication to the trusted ingress point. The trusted ingress point uses the security association associated with the private network to transform the communication and forwards the transformed communication through other intermediate stations in the network until it reaches a trusted egress point. The trusted egress point uses the stored security association to decode the transformed communication and forwards the communication to the appropriate destination. The ingress and egress points may be any points in the network, including customer edge devices, provider edge devices, or some combination thereof.

Growing community of inventors

Groton, MA, United States of America

Donald Fedyk