Nortel Networks Corporation

Northern Telecom Limited

Ciena Corporation

Genband US LLC

Rockstar Bidco, LP

Michael C Lee

Lakshminath Dondeti

Frank Horsfall

Lawrence Gerard Dobranski

Neal T Cowan

Jeffrey L Fairless

Roberto Faria

Edmond J Helstab

Jonathan Crone

Robert E Bradley

Edward L Pugh

A mechanism is described that enables encrypted end-point communications in a VoIP network to be accessed by a service provider. The mechanism includes a session information retrieval component which gathers session information such as encryption keys for each session that traverses a network element. The encryption keys may be used to decrypt data to make it available for lawful interception. A media stream monitoring component monitors media streams and verifies that the identified keys for each session are valid, to ensure continuity in compliance with LI regulations. Advantageously a security alert component may be used to controls further session operation for those sessions identified as potential security risks. With such an arrangement, the service provider can satisfy the legal requirement to provide interception, verify that the accuracy of the legal interception support and take appropriate steps to handle security risks.

Method and apparatus for identifying and monitoring VoIP media plane security keys for service provider lawful intercept use

An authentication system is configured to weight multiple available network supplied and user supplied authentication factors to determine whether a user should be provided with access to an Emergency Communication Network (ECN). The multiple factors may include the location of the user, MIN, short PIN, token, biometric information, and other information. The level of access to be provided to the user may be tiered based on the authentication level achieved during the weighting process. Authentication information may be shared between groups of individuals, so that the authentication requirements for group members may be reduced as other members of the group supply authentication information to the ECN. Group authentication may be used to enable group services such as conferencing and push-to-talk to be set up automatically for the group.

Method and apparatus for authenticating users of an emergency communication network

A wireless communication method and wireless gateway device are provided for wireless communication between a wireless mobile station and a remote device. An unsolicited data packet is received from a remote device in which the data packet is addressed to the wireless mobile station. A determination is made as to whether to engage in a communication synchronization handshake with the remote device. The determination is based at least in part on the unsolicited data packet. A communication synchronization handshake with the remote device is performed without transmitting the received data packet to the mobile station upon determining to engage in a communication synchronization handshake with the remote device. A communication session is established with the wireless mobile station when the communication synchronization handshake with the remote device is successful. Data packets are forwarded between the wireless mobile station and the remote device when communication synchronization handshake with the remote device is successful and when communication with the wireless mobile station is established.

Method and apparatus to protect wireless networks from unsolicited packets triggering radio resource consumption

A DWDM optical system in a first embodiment includes a plurality of scramblers on the transmit side and a plurality of corresponding de-scramblers on the receiver side of the DWDM system. Each scrambler includes an input for an encryption key with the corresponding de-scrambler including an input for the same encryption key. In accordance with the pseudorandom encryption key, input data channels are scrambled onto output optical channels to provide data security across the optical path. With a suitable algorithm, this technique can provide very strong data confidentiality. The strength of the technique of the embodiments of the invention resides in the scrambling algorithm that is used to scramble the data over the optical carriers. Preferably the scrambling algorithm is very unpredictable and does not repeat for a very long time.

Method and apparatus for providing data confidentially for very high-speed multiple-wavelength optical data links

Described are a secure communications system and method for transmitting analog signals. The secure communications system includes an analog multiplexer, an analog demultiplexer, a plurality of analog communications channels each at a different wavelength, and a pair of sequence logic modules. Analog signals applied to the analog multiplexer are scrambled onto the multiple communications channels. The demultiplexer descrambles the transmitted scrambled signals to reproduce the original analog signals. The sequence logic modules provide a channel selection signal to implement synchronous pseudorandom switching of the analog signals amongst the analog communication channels. The sequence of the switching between analog communications channels can be pseudorandom in sequence and in time. The channel selection signal is responsive to a key shared between the sequence logic modules. An attacker having access to the analog communications channels cannot retrieve the original analog signals without access to the shared key.

Secure analog communication system using time and wavelength scrambling

Method and system for encrypting streamed data employing fast set-up single use keys and self-synchronization. A transmitting handset produces a bitstream of voice data containing the session key and encrypted by an encryption signal based upon the session key. A receiving handset decrypts the incoming bitstream using the encryption signal and recognizes the session key, thereby establishing synchronization. The session key is derived from a seed by applying a first function to the seed. Following the call, the session key is converted into a new seed by application of a second function and the new seed is stored for use in the next call.

Method and system for encryption of streamed data

A method for preserving security associations between at least two entities includes the steps of maintaining a security association relating to communication between the at least two entities in a table, and periodically storing the security association in non-volatile storage. With such an arrangement, in the event that data within the table become corrupted, it can be retrieved from storage. Because the key data is stored, performance losses due to re-establishing the secure group are minimized. In one embodiment, the security association is advantageously encrypted prior to storage to further secure the security associations for each member.

Security association storage and recovery in group key management

A method and apparatus has been described that permits fast re-establishment of secure communications between endpoints in a network through intelligent re-use of existing security associations.

Fast re-establishment of communications for virtual private network devices

Method and apparatus for protecting processing elements from buffer overflow attacks are provided. The apparatus includes a memory stack for, upon execution of a jump to subroutine, storing a return address in a first location in a stack memory. A second location separate from the stack memory for storing an address of the first location and a third location separate from the stack memory for storing the return address itself are included. A first comparator upon completion of the subroutine, compares the address stored in the second location to the first location in the stack memory and a first interrupt generator provides an interrupt signal if locations are not the same. A second comparator looks at the return address stored in the third location and the return address stored in the first location in the stack memory and has a second interrupt generator for generating an interrupt signal if addresses are not the same. A further method and apparatus for protecting processing elements from buffer overflow attacks includes a memory stack for, upon execution of a jump to subroutine in a first processor, storing a return address in a first location in a stack memory and a second location separate from the stack memory for storing results for the subroutine operation. Also included is a second processor including routines for data manipulation associated with the subroutine, separate from the first processor and for storing any resultant data in the second location, which is readable by the first processor separate from the stack memory.

Method and apparatus for protecting memory stacks

A telephone base unit for use with a mobile telephone handset comprises means for interfacing the handset with the base unit for enabling user definable data entry key settings of the handset to be downloaded and emulated at the base unit such that when interfaced with the base unit, the mobile telephone handset operates to enable the use of the base unit as a wireless desktop interface. The interface means is comprised of means for transferring user definable data entry key settings of the handset to the base unit, means for storing the user definable data entry key settings of the handset at said base unit and controller means to enable a user to use the user definable data entry key settings with the user interface of the base unit to receive incoming and make outgoing calls from the base unit via the mobile telephone handset.

Desktop docking station for use with a wireless telephone handset

An interface unit for interconnecting a telephone central switch to a personal computer. The interface unit receives power and data from the switch over a two wire twisted pair. The data is in a half duplex T.C.M. format and is transformed into standard digital data with the logic '1' and '0' being represented by +5V and 0V respectively. The standard digital data is then arranged into 8 bit words and encoded in either an asynchronous or synchronous manner depending on the type of computer. The interface unit has a line interface circuit which provides the physical interface between the interface unit and the computer. The interface unit has a transmitter circuit which converts the +5V and 0V digital signals to -5V and +5V, respectively. These values are recognized by the computer as logic '1' and '0'. The interface unit also has a receive circuit which takes the computer output signals (between -5 and -12V for logic '1' and between +5 and +12V for logic '0') and converts them back into standard digital format.

Growing community of inventors

Ottawa, Canada

Michael C Lee