Nortel Networks Corporation

Avaya Inc.

Rockstar Consortium US LP

Haixiang He

Donald Fedyk

Lakshminath Dondeti

Darwin A Engwer

Xiangrong Cai

A method and apparatus for authorizing forwarding states in a Layer 2 device of a multicast system includes a forwarding table for use in forwarding communications to group members over interfaces of the Layer 2 device. According to one aspect of the invention, associated with the forwarding state is an authorization flag. The authorization flag signals whether or not the forwarding state is an authorized forwarding state over which multicast communications may be transferred. The Layer 2 device snoops authorization communications between a host and a layer 3 device, and updates the forwarding table authorization flags in response to these communications.

Method and apparatus for authorizing multicast forwarding states

A method and apparatus is disclosed which enables detection of undesired packets received at a device in a network, where the device is a member of a group of devices in the network. A registration table stores transform identifiers for each member of a group and controls the forwarding of the transform identifiers to the members of the group as members are added and deleted. A transform identifier indicates a format or transformation of a packet transmitted by an associated member. The transform identifier can therefore be used at a receiving device to distinguish between transmissions by different members of the group, thereby enabling the receiving device to extract sequence information associated with the member from the packet. The sequence information can be compared against an expected sequence number for the member to determine whether the packet is an undesirable or rogue packet.

Method and apparatus for providing replay protection in systems using group security associations

According to one embodiment, a method involves receiving an incoming media access control (MAC) frame that includes a header, a frame body and an error detection field. Thereafter, an information element within the frame body is analyzed to determine whether to alter a mobility tunnel between a plurality of networking devices.

Method and apparatus to facilitate the closure of mobility tunnels

According to one embodiment, a method involves determining whether a wireless connection between a first access point and a wireless station has failed. If so, a partial scanning process is conducted only on a subset of communication channels over which data is transmitted by access points neighboring the first access point. The subset of communication channels, inclusive of zero, is determined by analysis of a scanning history database.

Method and apparatus to intelligently perform scanning and assist scanning by profiling scanning history

Described is a method for statically or dynamically enabling a DVMRP router in a DVMRP domain to perform a reverse path forwarding check for an external source. A route report is generated for each known external source and injected into the DVMRP domain. Each route report includes routing information for a respective one of the known external sources. In one embodiment, the route report is generated for each network listed in a unicast routing table maintained on a DVMRP multicast border router and each route report includes unicast routing information for each of the networks and an indicator designating that the routing information is derived from unicast routing information. In another embodiment, if it is determined that routing information for an external source of multicast traffic received at a DVMRP border router is not available, the route report is generated at that time and includes a predetermined metric value.

DVMRP border router for reverse path forwarding validation with external sources

Fast transitions between access points (APs) in a wireless network may be accomplished when a mobile unit (MU) moves between the APs, by causing a first tunnel to be established between the APs, and causing a second tunnel to be established between the new AP and the MU. A data path having established security and quality of service parameters between the MU and the old AP may be extended through the tunnels, so that communication with the MU is not disrupted while transitioning between APs. Transition processing thus may be decoupled from movement of the MU, so that the MU may continue to receive access to data over the data path. Optionally, once the data path has been so extended, the MU and new AP may engage in authentication and other messaging to formally affect a handover of the data path to the new AP. The APs and MU may be configured to communicate according to the 802.11 protocol.

Method and apparatus for extending a mobile unit data path between access points

Method and apparatus that enable secure transmission of data in a scalable private network are described. Each station that is to be part of a private network registers with a key table. A group security association associated with the private network is forwarded to each trusted ingress and egress point that communicates with each member of the private network. When a member of the private network seeks to communicate with another member, it simply forwards the communication to the trusted ingress point. The trusted ingress point uses the security association associated with the private network to transform the communication and forwards the transformed communication through other intermediate stations in the network until it reaches a trusted egress point. The trusted egress point uses the stored security association to decode the transformed communication and forwards the communication to the appropriate destination. The ingress and egress points may be any points in the network, including customer edge devices, provider edge devices, or some combination thereof.

Method an apparatus for providing a scalable and secure network without point to point associations

Each member of a group registers with the Security/Routing (S/R) deviceand receives a Group Security Association (GSA) associated with the group. The member may register as part of a group by identifying the group and the other members. Alternatively, Routing Functionality auto-discovers the other members of the group. AS members are identified, Routing functionality reflects the routes of all members in the group to all other members of the group. The forwarding of the routes to the respective group members may be secured via the GSA associated with the group. Each member can forward communication directly to the group members, securing the communication using the group SA and standard tunneling techniques (such as IPsec, GRE, MPLS, etc.). Thus the S/R provides a mechanism for private networks to be built on top of an existing network without modification of any existing network components and much more scalable in operation and configuration than individual IP sec tunnels.

Self-configuring method and apparatus for providing secure communication between members of a group

Scalable, distributed method and apparatus for transforming packets to enable secure communication between two stations

Scalable method and apparatus for transforming packets to enable secure communication between two stations

A method and apparatus for producing a multicast tree in a network traces such tree based upon information retrieved from a multicast database that is protocol independent. More particularly, the network includes a plurality of network devices. A set of the plurality of network devices each includes the prior noted protocol independent multicast database. After the multicast database in each of the set of network devices is located, the multicast information in such databases is retrieved. After being retrieved, the multicast information is traced across the plurality of network devices to form the multicast tree.

Method and apparatus for producing a multicast tree

VPN tunnels may be established from a wireless user through a wireless network without requiring the wireless user to have a relationship with the wireless network. Instead, the wireless user interfaces with an authentication, authorization, and accounting service on a VPN host network. This allows the wireless user to sign on once to gain admittance to both the wireless network and the VPN host network. The VPN host network is able to establish accounts on various wireless network providers to alleviate the need for wireless users to have individual accounts with the wireless providers. Additionally, a wireless access point on the wireless network serves as a VPN gateway to interface between an encrypted session on the wireless network and a VPN tunnel formed between the wireless access point and the VPN host network. This allows the wireless access device to participate in a VPN tunnel without instantiating a VPN client.

Method and apparatus for establishing virtual private network tunnels in a wireless network

A technique for distributing receiver membership reports containing receiver information for a plurality of multicast source systems in a multicast source notification of interest protocol is disclosed. In one embodiment, the technique is realized by collecting receiver information for a plurality of multicast source systems; aggregating receiver information for each multicast source system into a respective record; indexing each respective record using an IP address of each multicast source system; aggregating the plurality of respective records into a single message; and multicasting the single message to a group address.

Growing community of inventors

Woburn, MA, United States of America

Haixiang He