Alcatel Lucent

Alcatel

Xylan Corporation

Alcatel Internetworking, Inc.

Alcatel Interworking, Inc.

John W Bailey

Geoffrey C Stone

Michael E See

Charles L Panza

Yuri Pikover

Anees Narsinh

John Daniel Wallner

Christopher Leo Hoogenboom

Michael Jon Nishimura

Michael K Wilson

Bryan J Dietz

Rex Hill

Robert Leon Sangroniz

Michele Wright Goodwin

Todd Khacherian

Todd L Khacherian

Shekar G Nair

A user authentication service for a communication network authenticates local users before granting them access to personalized sets of network resources. Authentication agents on intelligent edge devices present users of associated end systems with log-in challenges. Information supplied by the users is forwarded to an authentication server for verification. If successfully verified, the authentication server returns to the agents authorized connectivity information and time restrictions for the particular authenticated users. The agents use the information to establish rules for filtering and forwarding network traffic originating from or destined for particular authenticated users during authorized time periods. An enhanced authentication server may be engaged if additional security is desired. The authorized connectivity information preferably includes identifiers of one or more virtual local area networks active in the network. Log-in attempts are recorded so that the identity and whereabouts of network users may be monitored from a network management station.

Deterministic user authentication service for communication network

The present invention features a data link layer processor for performing VLAN tagging operations, policing, shaping, and statistics acquisition integrally with one or more media access controllers (MACs). When a plurality of data link layer processors are operated in parallel in a switching device, the computational burden carried by the route engine is significantly reduced. Moreover, the data link layer processor in its several embodiments may be used to introduce various forms of pre-processing and post-processing into network switching systems that employ route engines that do not posses such functionality.

Parallel data link layer controllers in a network switching device

The present invention features a data link layer processor for performing VLAN tagging operations, policing, shaping, and statistics acquisition integrally with one or more media access controllers (MACs). When a plurality of data link layer processors are operated in parallel in a switching device, the computational burden carried by the route engine is significantly reduced. Moreover, the data link layer processor in its several embodiments may be used to introduce various forms of pre-processing and post-processing into network switching systems that employ route engines that do not possess such functionality.

Lookup scheme in which a tuple representing a plurality of flow properties is parsed into multiple subtuples for application in recursive lookups. A first subtuple including a first subset of bits from the tuple is applied to the flow information database and returns a result including a nickname having a smaller bit count than the first subtuple. A second subtuple including a second subset of bits from the tuple and the nickname are combined and applied to the flow information database. The lookups continue until a result indicates that no recursion is required. The final lookup result includes flow information applicable to one or more of modifying, enqueuing or forwarding the packet. A truncated lookup capability enables common processing across a group of distinct flows having common flow properties.

Tuple-based lookup scheme for packet switching node

A method and apparatus for accomplishing source learning in a data switch of the type having a plurality of switching modules where each supports one or more external network devices and a backplane interconnecting the switching modules. Each switching module has logic resident thereon for performing distributed source learning, including configuring unknown source addresses 'seen' in inbound packets and for notifying the other switching modules that such source addresses were 'seen' on a port thereof. Address-port associations are thereby configured on the switch using distributed logic, i.e. without intervention by a centralized management entity. In regard to configuring destination addresses&#x2014;when a destination address is unknown, packets are delivered over a multicast queue until the destination address is found. Once the destination address is found, a method of flow integrity is used to avoid out of order packet delivery when the device transitions from using a multicast flood queue to a unicast queue.

Distributed source learning for data communication switch

The present invention, generally speaking, uses input buffering and output control to provide a high-speed, high-performance digital traffic switch. This approach solves all of the problems noted above with respect to the prior art (input buffering/input control, output buffering/output control). Dropped discrete information units (cells) are dropped at the input port, and so will not be transmitted across the switch fabric. This reduces the traffic load on the switch fabric during congested periods, and makes the switch fabric easier to design and expand. Input buffering/output control allows for the use of smaller buffers than output buffered/output control architectures for the same level of &ldquo;discrete information unit (cell) drop&rdquo; performance, and scales well to larger systems. Input buffering/output control provides all the information necessary to the output (data flow) controller necessary to implement very precise control algorithms. These algorithms can then administer switch fabric admission polices and contract enforcement fairly across all input ports.

Input buffering/output control for a digital traffic switch

A service for providing seamless communication between stations over an ATM network. Seamless communication services are distributed among intelligent &ldquo;peer&rdquo; members. A single service member is selected as a &ldquo;master&rdquo; member for purposes of service configuration. The master member advertises the addresses of all members to every other member so that every member can configure virtual circuits to every other member. In the provision of services, each member constructs a member table which associates other members with a point-to-point virtual circuit and a learning table which associates globally recognized representations of addresses of stations behind other peer members with a point-to-point virtual circuit. The service supports multiple LAN media and multiple virtual local area networks (VLANs).

Seamless communication service with intelligent edge devices

The present invention, generally speaking, uses input buffering and output control to provide a high-speed, high-performance digital traffic switch. Dropped discrete information units (cells) are dropped at the input port, and so will not be transmitted across the switch fabric. This reduces the traffic load on the switch fabric during congested periods, and makes the switch fabric easier to design and expand. Input buffering/output control allows for the use of smaller buffers than output buffered/output control architectures for the same level of 'discrete information unit (cell) drop' performance, and scales well to larger systems. Input buffering/output control provides all the information necessary to the output (data flow) controller necessary to implement very precise control algorithms. These algorithms can then administer switch fabric admission polices and contract enforcement fairly across all input ports.

Growing community of inventors

Agoura Hills, CA, United States of America

John W Bailey