Alcatel Lucent

Emanuele Jones

Jean-Marc Robert

Chao Kan

Dmitri Vinokurov

Olivier Le Moigne

Robert W MacIntosh

Thierry Labbe

Pierrick Guingo

Hubert Ogier

Robert W Macintosh

Malicious network activities do not make use of the Domain Name System (DNS) protocol to reach remote targets outside a local network. This DNS-based enforcement system for confinement and detection of network malicious activities requires that every connection toward a resource located outside the local network is blocked by default by the local enforcement box, e.g. a firewall or a proxy. Outbound connections are allowed to leave the local network only when authorized directly by an entity called the DNS Gatekeeper.

DNS based enforcement for confinement and detection of network malicious activities

A system and method are provided for providing multiple aliases and associated policy profiles for a user of a VoIP communication system. The user configures a multitude of aliases by the user wishes to be contacted, and associates with each alias a policy stored at a user terminal. The aliases are stored within the network so as to be associated with contact information for the user terminal. A proxy processes call requests by determining the contact information associated with an alias entered by a caller, and forwards the call request to the user terminal associated with the contact information. The user terminal determines the alias used by the caller, and processes the connection request in accordance with the policy. The invention allows users to add and delete aliases in order to effect temporary and private contact information. Calls can be handled depending on which alias was used by a caller, rather than on an identification of the device used by the caller. The proxy may also store proxy policies in association with the aliases and process call requests accordingly, such as billing a call request to a customer account specified by the proxy policy corresponding to the alias entered by a caller.

Adaptable communication profiles in telephone networks

A system and method of tracing network flows in an autonomous communications system are described. The Autonomous System may be formed of multiple subgroups depending on size and application. Each subgroup contains multiple, interconnected routers which participate in transporting data flow across the Autonomous System (AS). A Director within the AS has a full and complete vision of the network topology. When it is desired to trace a particular flow because of an identified attack, selected routers in key locations&#x2014;through which that particular flow travels&#x2014;mark packets with labels which enable the tracing of the path. These labels permit the source of the attack, at least in so far as it travels through the AS, to be identified. If the number of entry (or key) points to the AS is larger than the number of available labels, the AS will be divided into subgroups, the flow is traced from subgroup to subgroup.

Mechanism for tracing back anonymous network flows in autonomous systems

The Time to Live (TTL) field in an IP header is used as a covert channel in a communication system. More particularly the TTL field can be used to selectively mark packets with unique identifiers as they pass through an upstream station on their way to a downstream station. In this way the source of a traffic flow at least within a particular domain can be absolutely identified. This method of performing a traceback operation doesn't utilize additional resources as it relies on functionality which already exists in the system.

IP Time to Live (TTL) field used as a covert channel

A network monitoring system (). The system comprises storage circuitry () for storing network packet information, wherein the network packet information includes a predicted identifier. The network monitoring system also comprises at least one monitoring circuit () coupled to a network () along which network traffic flows in a form of packets. The at least one monitoring circuit programmed to perform the steps () of receiving a packet communicated along the network and determining whether the received packet is communicated between a source and destination in a first set of network nodes. Each packet in a sequence of communications between the source and the destination comprises a packet identifier that uniquely identifies the packet from all other communications in a flow between the source and the destination. The at least one monitoring circuit programmed to perform the step of, responsive to determining the received packet is communicated between a source and destination in the first set of network nodes, comparing the packet identifier of the received packet to the predicted identifier to determine an identifier deviation between the packet identifier and the predicted identifier for identifying an irregularity in the network traffic.

Growing community of inventors

Ottawa, Canada

Emanuele Jones