Alcatel Lucent

Olivier Le Moigne

Bertrand Marquet

Bashar Said Bou-Diab

Jean-Marc Robert

Christophe Gustave

Scott David D'Souza

Frederic Gariador

Emanuele Jones

John Coulter

Christopher Hawley

The present invention permits translation of SM addresses (*, G) and (*, G) to configurable SSM addresses (S, G). IGMPv2 group membership queries from the receiver subnet are translated to IGMPv3 membership queries for processing in a SSM network. In the preferred embodiment, packets travel via a connection to the multicast router (mrouter). The mrouter queries an IGMPv2 receiver. The IGMPv2 receiver generates a membership report and sends it back to the mrouter. The mrouter translates the membership report into a (S, G) as specified in a multicast address translation table and stores the translation in the Multicast Forward Information Base (MFIB) located in the mrouter. Multicast payload addressed (S, G) flowing towards the IGMPv2 receiver can be translated to (S, G). When media data is addressed to (S, G), the mrouter consults the MFIB for forwarding and can also translate the destination address to (S, G).

Method and tool for IP multicast network address translation (MNAT)

This invention provides a tool for generating ACLs in an environment where a set of network elements or servers (e.g. web servers, IPTV servers, application servers . . . ) need to be secure. The tool also performs ACL validation to ensure that the filtering rules are correct before they are deployed in a network. The system enables a central view of the security configuration concerning the filtering rules in the network. Furthermore, it allows end-to-end configuration of the ACL rules, from the definition of the flows between the servers to the deployment of the rules on the network elements.

Access control list generation and validation tool

Systems and methods of providing secure signaling for voice communications over a public switched voice network (PSTN) are described. The call signaling is received at a first secure voice signaling gateway (SVSG) in which it is encrypted utilizing a security key. The encrypted payload is tunneled from the first SVSG to a second SVSG at a destination network element. The destination SVSG decrypts the payload and passes it on to the destination. According to the invention the communication can be either masqueraded in which the address of the first SVSG is given as the origin or non-masqueraded in which the actual original of the voice communication is retained.

Secure voice signaling gateway

A distributed authentication framework is presented. The framework includes an authentication stack that is created by an authentication server. The server receives an authentication request from an end-user, the request including an authentication domain ID that distinguishes the end-user. The authentication stack has entries that trigger local or remote specific authentication actions providing respective results. When the results are consolidated the authentication status of the end-user is determined.

Distributed authentication framework stack

The present invention provides adequate service virtualization and compartmentalization in Network Management Systems for heterogeneous Network Elements to provide interoperability. It introduces a generic mediation layer that can be added to each Network Element that does not provide a network compartmentalization model that is compatible with the one used by the Network Management System. The mediation layer acts as a reverse proxy for the Network Management System to provide an operator with transparent access to an appropriate Management Service. The present invention is also instrumental in providing a high level of security in such hybrid networks.

Labeling gateway for compartmented multi-operator network elements over a heterogeneous network

The Time to Live (TTL) field in an IP header is used as a covert channel in a communication system. More particularly the TTL field can be used to selectively mark packets with unique identifiers as they pass through an upstream station on their way to a downstream station. In this way the source of a traffic flow at least within a particular domain can be absolutely identified. This method of performing a traceback operation doesn't utilize additional resources as it relies on functionality which already exists in the system.

Growing community of inventors

Ottawa, Canada

Olivier Le Moigne