Alcatel Lucent

Lucent Technologies Inc.

Alcatel-lucent USA Inc.

At+t Corp.

Eric Henry Grosse

Mark H Kraml

Brenda Sue Baker

Sarvar M Patel

Alexandro Federico Salvarani

David Presotto

Clifford Eric Martin

Francis Xavier Zane, Jr

Philip Douglas MacKenzie

Yuliy Baryshnikov

Andrew C Clark

Michael B Greenwald

Victor Vladimir Boyko

Douglas H Bellows

Victor C Zandy

Dan Romik

David Leo Presotto

Clifford E Martin

Michael Barry Greenwald

Douglas Bellows

Francis X Zane

Methods and apparatus are provided for reliably delivering control messages to a central filter, for example, during a malicious attack, in one or more packet networks without requiring responses or acknowledgements from the central filter to the detector. A detector defends against unwanted traffic by a target victim by determining that unwanted traffic is received by the target victim based on an analysis of packets received from one or more source IP addresses; and transmitting a denunciation message to a central filter associated with a service provider, the denunciation message identifying a source address of at least one source computing device whose transmission of packets to the target victim is to be one or more of limited, dropped or allowed and wherein the denunciation message is transmitted using a Denunciation Protocol that does not require a prompt acknowledgement from the central filter. In addition, the denunciation messages can be sent redundantly to the central filter and are preferably self contained.

Methods and apparatus for delivering control messages during a malicious attack in one or more packet networks

Methods and apparatus are provided for end-to-end security in heterogeneous networks. Hop-by-hop protection techniques ensure that each hop of a signaling path is satisfying one or more predefined security criteria. An end-to-end path is secured at each node by identifying a next hop in the end-to-end path; determining, in response to a received call setup request, if a vendor associated with the next hop in the end-to-end path has satisfied one or more predefined security criteria; and routing the call to the next hop if the vendor has satisfied the one or more predefined criteria. A look-up table can be used to determine whether a vendor has satisfied the one or more predefined security criteria. The look-up table can identify one or more of: (i) vendors that have achieved a predefined security rating; (ii) members in a predefined consortium or business group; and (iii) signatories to a predefined contract or technical specification.

Method and apparatus for end-to-end security in a heterogeneous network

Methods and apparatus are provided for detecting unwanted traffic in one or more packet networks utilizing string analysis. Unwanted traffic received by a target victim, such as a malicious attack, is detected by maintaining a rule base identifying one or more string expressions; analyzing one or more error entries in a log file, the log file comprising one or more requests received by the target victim; determining if the one or more requests include a string that matches one or more of the string expressions in the rule base; and sending a denunciation message to a central filter if the one or more requests include a string that matches one or more of the string expressions in the rule base. The string expressions may comprise, for example, a string or a regular expression and can represent one or more resources that an attacker may attempt to access.

Methods and apparatus for detecting unwanted traffic in one or more packet networks utilizing string analysis

Disclosed is a method and apparatus for filtering received data packets. A hierarchical tree is maintained. The tree includes nodes organized in a plurality of levels. Each level above a root node of the tree has one or more of the nodes, with each of the one or more of the nodes corresponding to a particular value of a segment of an Internet Protocol (IP) address. The segment is the same for each node of a particular level of the tree. Each node at a particular level of the tree stores a number representative of the number of received packets having the same value for the segment of the IP address associated with the particular level. Some of the received data packets are filtered out based on the hierarchical tree.

Method and apparatus for filtering data packets

Methods and apparatus are provided for authenticating a remote service to another service on behalf of a user. A user client authorizes a remote application client to perform one or more actions with a server on behalf of the user client. The user client provides one or more keys to a remote authentication service; receives an identifier of the remote application client, where the remote authentication client is remote from the server; and notifies the remote authentication service that the remote application client is authorized to obtain a response from the remote authentication service regarding a challenge from the server, where the response is based on at least one of the one or more keys stored by the remote authentication service on behalf of the user client. The remote application client provides a challenge that is received from a server that the remote application client is attempting to access for the user client and an identifier of the user client to a remote authentication service and receives a response to the challenge from the remote authentication service, wherein the response is based on one or more keys stored by the remote authentication service on behalf of the user client.

Methods and apparatus for authenticating a remote service to another service on behalf of a user

A system for managing security keys in a wireless network includes a manufacturer certification authority (MCA) for providing a signed digital MCA certificate for installation into a new network element (NE) at the manufacturer's facility prior to the new NE being installed and initialized in the network. The MCA also provides a source of trusted authority for authenticating legacy NEs in the network. The system includes a service provider certification authority for managing certificates and files used by the NEs to communicate securely within the network, a signing server for providing signing services to NEs for authentication, an element manager for providing security key and digital certificate management, and a management agent (MA) for providing proxy functionality of the EM security key services to NEs not directly connected to the EM.

Methods and system for managing security keys within a wireless network

A method and apparatus for defending against a Denial of Service attack wherein a target victim of an attack has recognized the existence of an attack and identified its source. The carrier network which provides service to the victim automatically receives one or more IP (Internet Protocol) source/destination IP address pairs from the victim, and then limits (e.g., blocks) the transmission of packets from the identified source address to the identified destination address. The carrier may implement this filtering capability as a stand-alone box included in the network, or as a line card incorporated into otherwise conventional network elements already present in the network. The source/destination address pairs to be blocked may be advantageously communicated from the victim with use of security signatures and with use of redundant connections from the victim to the carrier network to ensure receipt even under congested network conditions.

Method and apparatus for defending against denial of service attacks in IP networks based on specified source/destination IP address pairs

A method and apparatus for enhanced data storage in peer-to-peer (P2P) networks. Users subscribe to a P2P storage network that allows each user to store files on the storage network by swapping blocks of the user's files with blocks from storage of a peer, or peers, on the network. A user desiring to utilize the storage network for a certain data block must take back an equal, or substantially equal, storage block from another peer on the network thereby insuring no net change, or minimal net change, in total storage across the P2P storage network. In addition, the diffusion of data blocks throughout the storage network is employed whereby individual peers swap data blocks on a random basis thereby further enhancing the security of the swapped blocks from direct attacks.

Method and apparatus for providing data storage in peer-to-peer networks

A wireless communication system () includes a capacity allocation module () that adjusts an allocation of an authorized total capacity among a plurality of base stations (). A disclosed example includes determining a peak capacity requirement for a plurality of base stations at any given time. An authorized capacity corresponds to the peak requirement for the plurality of base stations. The disclosed example includes adjusting an allocation of the authorized total capacity among the plurality of base stations to meet different traffic requirements at each of the base stations at different times.

Capacity allocation in a wireless communication system

Secure communication protocols are disclosed in which two parties generate a shared secret which may be used as a secure session key for communication between the parties. The protocols are based on Diffie-Hellman type key exchange in which a Diffie-Hellman value is combined with a function of at least a password using the group operation such that the Diffie-Hellman value may be extracted by the other party using the inverse group operation and knowledge of the password. In one embodiment, each of the parties explicitly authenticates the other party, while in another embodiment, the parties utilize implicit authentication relying on the generation of an appropriate secret session key to provide the implicit authentication. Typically, the parties will be a client computer and a server computer. In accordance with other embodiments of the invention, in order to protect against a security compromise at the server, the server is not in possession of the password, but instead is provided with, and stores, a so-called password verifier which is a function of the password and where the password itself cannot be determined from the value of the password verifier.

Secure mutual network authentication and key exchange protocol

A technique for determining whether particular clients within a computer network are universally configured in accordance with the desired network security features of the computer network. A probe is randomly inserted within incoming files, e.g., at a firewall in the computer network. The probe is configured as a function of a particular execution task, e.g. a known virus, such that in a properly configured client the probe will not execute and the firewall does not detect a security breach. However, if the client is misconfigured, i.e., not in compliance with the standard network security features, the probe will execute and trigger an alarm in the firewall indicating that the client is vulnerable to a security breach. Advantageously, a network security administrator can take appropriate action to correct those clients which are misconfigured.

Computer security using virus probing

A method and system for displaying names of data files in a collection of data files represented by a corresponding symbol. According to one embodiment of the present invention, a user may display a listing of subroutine library files required to execute a particular subroutine. In such an embodiment, the user may enter the subroutine name as the symbol of interest and the system would display the library file containing that subroutine as well as those data files that contain subroutines called by that subroutine of interest. The present invention uses a transitive closure technique to traverse a data structure generated from a database and retrieve the data file list. The transitive closure technique enables the use of a compact database that contains only the data file names, corresponding symbol names, and symbol names of only data files for each data file that are directly related to that data file.

Database dependency resolution method and system for identifying related

A system and method for selectively controlling database access by providing a system and method that allows a network administrator or manager to restrict specific system users from accessing information from certain public or otherwise uncontrolled databases (i.e., the WWW and the Internet). The invention employs a relational database to determine access rights, and this database may be readily updated and modified by an administrator. Within this relational database specific resource identifiers (i.e., URLs) are classified as being in a particular access group. The relational database is arranged so that for each user of the system a request for a particular resource will only be passed on from the local network to a server providing a link to the public/uncontrolled database if the resource identifier is in an access group for which the user has been assigned specific permissions by an administrator. The invention is implemented as part of a proxy server within the user's local network.

System and method for database access control

A system and method for selectively controlling database access by providing a system and method that allows a network administrator or manager to restrict specific system users from accessing information from certain public or otherwise uncontrolled databases (i.e., the WWW and the Internet). The invention employs a relational database to determine access rights, and this database may be readily updated and modified by an administrator. Within this relational database specific resource identifiers (i.e., URLs) are classified as being in a particular access group. The relational database is arranged so that for each user of the system a request for a particular resource will only be passed on from the local network to a server providing a link to the public/uncontrolled database if the resource identifier is in an access group for which the user has been assigned specific permissions by an administrator. In one preferred embodiment, the invention is implemented as part of a proxy server within the user's local network.

Growing community of inventors

Berkeley Heights, NJ, United States of America

Eric Henry Grosse