Avaya Inc.

Sun Microsystems, Inc.

Avaya Technology LLC

Extreme Networks, Inc.

Mahalingam Mani

David Ahrens

Sankar Ramamoorthi

Sachin Garg

Sohrab Modi

Kevin C Fox

Martin Kappes

Hariprasad B Mankude

Tanjore K Srinivas

Mathilde Benveniste

Brian M Oki

Manish Gaur

Saad Abderrazzaq

Joseph Curcio

Methods and systems for routing connections between federated enterprises are provided. More particularly, user location information is stored as part of a first directory accessible to a federation broker. Location information obtained in association with a requested connection is used by the federation broker to access a second directory containing the locations of points of presence within the enterprise that includes the target communication device.

Route lookup resolution

Methods and systems for providing a cache of federated routing information on a dynamic domain name server are provided. More particularly, information obtained from a federation broker can be stored in a dynamic domain name server associated with an enterprise for use in connection with requests for communication links originating from communication endpoints included in the enterprise. By providing this cache of information, requests for federated routing information made to the federation broker can be reduced.

Federation route cache based on dynamic domain name system server

The present invention provides a new network topology. More specifically, a peer-to-peer network is defined on a virtual private network. The peer-to-peer network comprises a set of specified users within a virtual private network that are allowed to communicate according to predetermined rules enforced by the peer-to-peer network itself. This affords secure communication between the specified users of the peer-to-peer network independent of the virtual private network.

Peer-to-peer network over a virtual private network

Methods and systems for facilitating sign-on procedures in connection with a converged system are provided. An authentication plug-in operates to receive authentication credentials in connection with a request to access an application by a client. The authentication plug-in is capable of operating in different contexts in a converged system. After an initial sign-on, subsequent sign-on requests can be fulfilled by accessing authentication credentials stored in a cache.

Single sign-on for applications

The present invention is directed to a virtualization system using a solid-state drive for disaster recovery.

Providing virtual machine high-availability and fault tolerance via solid-state backup drives

A method is provided for authorizing an authenticated user into a teleconference session as a participant that avoids some of the costs and disadvantages of doing so in the prior art. The authorization is a combination of the enterprise user's authentication at work and cryptographic authorization to the teleconference system by the inviter. When a user goes to work and connects with his or her office computer to the network of the user's employer, a secure single sign-on (SSO) access control procedure is executed. In a secure single sign-on (SSO) access control procedure, the user submits authentication information, such as a user name and password, to an identity provider and receives back a credential token when the identity provider determines that the user name/password pair is valid. The credential token is saved on the user's computer and used for further authentication.

High-assurance teleconference authentication

Methods, devices, and systems for automatically controlling the establishment and/or termination of inter-client Data Link Protocol (DLP) communication channels. More specifically, methods, devices, and systems are provided for establishing an inter-client DLP communication channel on demand for communication sessions and terminating the same upon completion of such communication sessions.

DLP-based wireless docking for WiFi-based endpoints with desktop

A method is provided in which a permission for running a system software instance alongside another system software instance is issued on the basis of a first policy rule concerning the operation of a first software application and a second policy rule concerning the execution of second software application.

Policy-based virtualization method involving adaptive enforcement

The present invention is directed to an intrusion detection/prevention system that uses application layer event information to identify potential intrusions and notifies remote trusted peers in other enterprise networks of potential intrusions emanating therefrom.

Method for cooperative intrusion prevention through collaborative inference

An apparatus and methods are disclosed for enabling quality-of-service and call admission control for wireless telecommunications terminals without first submitting a traffic specification. The illustrative embodiment of the present invention is particularly advantageous for IEEE 802.11e networks because the 802.11e standard, which in its currently-drafted form contains provisions for terminals to submit traffic specifications, might not require 802.11e terminals to submit traffic specifications in the finalized 802.11e standard. Proper call admission control and, consequently, quality-of-service for wireless applications therefore might not be universally available to future 802.11e-compliant terminals unless one or more embodiments of the present invention are deployed.

Quality-of-service and call admission control

A method and system for controlling the bandwidths of data traffic over virtual private networks are provided. The method includes classifying the data traffic for the virtual private network into different flows, monitoring a current bandwidth usage by at least one of the flows, comparing the current bandwidth usage with a predetermined threshold for the flow, and performing a bandwidth control operation for the flow if the current bandwidth usage exceeds the predetermined threshold for that flow.

System and method for providing bandwidth management for VPNs

A wireless local area network (LAN), and a method of operating the same, prevents unauthorized users from accessing the wireless LAN. A signal strength of a station attempting to access the wireless LAN is measured. If the signal strength is less than a predetermined threshold value, the system concludes that the station is outside of an authorized geographical area. Such a station attempting to establish a connection is characterized as an unauthorized station, and access to the wireless LAN is denied. The system may also periodically verify that authorized stations remain within the authorized geographical area. A station that has moved outside of the authorized geographical area can be notified or denied further access to the wireless LAN.

Location-based access control for wireless local area networks

A scalable cluster system that provides scalable services for client applications is provided with a forwarding list. The scalable services are transparent to the client application. To facilitate this transparent scalability, the system provides a forwarding list. For various operational reasons, such as tuning the system, an operator may change the work distribution weights between nodes of a scalable cluster system. Such a change in work distribution weights may change how packets are assigned to nodes. Forwarding lists are provided so that if the work distribution weights are changed while there are existing connections the forwarding lists allow packets from existing connections to go to the same node as earlier packets from the same connection.

Method for creating forwarding lists for cluster networking

One embodiment of the present invention provides a system that uses a packet distribution table to distribute packets to server nodes in a cluster of nodes that operate in concert to provide at least one service. The system operates by receiving a packet at an interface node in the cluster of nodes. This packet includes a source address specifying a location of a client that the packet originated from, and a destination address specifying a service provided by the cluster of nodes (and possibly a protocol). The system uses the destination address to lookup a packet distribution table. The system then performs a function that maps the source address to an entry in the packet distribution table, and retrieves an identifier specifying a server node from the entry in the packet distribution table. Next, the system forwards the packet to the server node specified by the identifier so that the server node can perform a service for the client. In this way, packets directed to a service specified by a single destination address are distributed across multiple server nodes in a manner specified by the packet distribution table. In one embodiment of the present invention, the system allows the server node to send return communications directly back to the client without forwarding the communications through the interface node. In one embodiment of the present invention, the function includes a hash function that maps different source addresses to different entries in the packet distribution table in a substantially random manner. Note that this hash function always maps a given source address to the same entry in the packet distribution table.

Growing community of inventors

Cupertino, CA, United States of America

Mahalingam Mani