Unisys Corporation

Sarah K Inforzato

Robert A Johnson

Ted W Hinaman

Charles Austin Parker

Mark Steven Brandt

Lois Bridgham Coyne

Susan Mary Jennion

Kathleen Wild

Robert Frank Inforzato

Eugene J Gretter

Michael C Leap

Anthony Narisi

Michael J Saunders

Michael T Kain

James J Leigh

Diane E Schaefer

Robert Buckwalter

Christopher John Harrer

Jared Poetter

Frances Ann Laukagalis

George Karian

David S Dodgson

Dwayne E Ebersole

Gregory J Small

Matthew Mohr

William H Gunn

Jeffrey John Wilson

Vinh Ha Le

Jonathan Skilton

Steven J Rajcan

Margaret Ann Magnotta

Michelle Marie Salvado

A network model includes nodes, node property sets, authorization groups and authorization servers. The node property sets define how the nodes operate and authenticate. The nodes are member of the node property sets. The authorization groups are associated with the node property set. And, authorization servers are member of the authorization groups. In addition, a network model in a secure network environment has at least one community of interest. The network model includes at least one node being a member of a node property set that defines how the node operates and authenticates.

Network model utilizing property sets

A method of creating secure endpoints on a network includes registering by a node using a random selection algorithm to choose which server to register to; receiving by the node a property set ID of a property set that the node is a member of; and authorizing by the node using the property set ID to look up its authorization details in the property set. A method of creating secure endpoints on a secure network having at least one community of interest, includes registering by a node using a random selection algorithm to choose which server to register to; receiving by the node a property set ID of a property set that the node is a member of; and authorizing by the node through an authorization server using the property set ID to look up its authorization details in the property set; wherein the node and the authorization server are a member of the at least one community of interest.

Method of creating secure endpoints on a network

Methods of communicatively connecting first and second endpoints are disclosed. One method includes transmitting from a first endpoint to a second endpoint a connection request, the connection request including an IP address of the second endpoint. The method further includes, based at least in part on the IP address of the second endpoint, selecting IPsec from among a plurality of available security protocols to first attempt to use in forming a tunnel between the first and second endpoints, and forming the tunnel between the first and second endpoints based on the connection request.

Negotiation of security protocols and protocol attributes in secure communications environment

Methods and systems for securing communications with an enterprise from a remote computing system are disclosed. One method includes initiating a secured connection with a VPN appliance associated with an enterprise using service credentials maintained in a secure applet installed on a remote computing device, and initiating communication with an authentication server within an enterprise via the secured connection. The method also includes receiving specific credentials from the authentication server, terminating the secured connection with the VPN appliance, and initiating a second secured connection with the VPN appliance using the specific credentials, the specific credentials providing access to one or more computing devices within the enterprise being within a same community of interest as the remote computing device and obfuscating one or more other computing systems within the enterprise excluded from the community of interest. The method also includes initiating communications with at least one of the one or more computing devices included in the community of interest.

Secure remote access for secured enterprise communications

A method of managing secure communications states in an endpoint within a secure network is disclosed. The method includes, in a disconnected state, transmitting from a first endpoint to a second endpoint a first message including an authorization token. The method further includes, in the pending state, receiving from the second endpoint a second message including a second authorization token at the first endpoint. The method includes, based on the receipt of the second message, entering an open state and initializing a tunnel between the first and second endpoints using an IPsec-based secured connection. The method also includes, upon termination of the tunnel due to a termination or timeout message issued by at least one of the first and second endpoints, entering a closed state.

Secured networks and endpoints applying internet protocol security

A secure communications arrangement including an endpoint is disclosed. The endpoint includes a computing system. The computing system includes a user level services component and a kernel level callout driver interfaced to the user level services component and configured to establish an IPsec tunnel with a remote endpoint. The computing system also includes a filter engine storing one or more filters defining endpoints authorized to communicate with the endpoint via the IPsec tunnel. The computing system also includes a second kernel level driver configured to establish a secure tunnel using a second security protocol different from IPsec.

Secured communications arrangement applying internet protocol security

A method and system for establishing secure communications between endpoints includes transmitting a first message including a token having one or more entries each corresponding to a community of interest associated with a user of the first endpoint and including an encryption key and a validation key associated with the first endpoint. The method includes receiving a second message including a second authorization token including one or more entries, each entry corresponding to a community of interest associated with a second user and including an encryption key and a validation key associated with the second endpoint. The method includes, for each community of interest associated with both users, decrypting an associated entry in the second authorization token to obtain the encryption key and validation key associated with the second endpoint. The method also includes generating a shared secret based on the key pair, transmitting a third message including the created key pair to the second endpoint, and initializing tunnel using the shared secret to derive encryption keys used for IPsec-secured communications between the endpoints.

Community of interest-based secured communications over IPsec

An endpoint, method, and authorization server are disclosed which can be used to allow concurrent secure and clear text communication. An endpoint includes a computing system including a programmable circuit operatively connected to a memory and a communication interface, the communication interface configured to send and receive data packets via a data communications network. The endpoint also includes a filter defined in the memory of the computing system, the filter configured to define one or more access lists, each access list defining a group of access permissions for a community of interest. The community of interest includes one or more users, and an access list from among the one or more access lists defines a set of clear text access permissions associated with a community of interest. The endpoint also includes a driver executable by the programmable circuit, the driver configured to cooperate with the communication interface to send and receive data packets via the data communications network. The driver is also configured to selectively split and encrypt data into a plurality of data packets to be transmitted via the data communications network based at least in part upon the contents of the one or more access lists.

Methods and systems for managing concurrent unsecured and cryptographically secure communications across unsecured networks

A distributed computer system comprises an enterprise server and a network server. The distributed computer system utilizes a distributed transmission control protocol (TCP) to establish an off-loaded dialog through the network server. If the off-loaded dialog is interrupted by, e.g., failure of the hosting network server, dialog recovery is performed to move the off-loaded dialog.

Dialog recovery in a distributed computer system

Intelligent NIC optimizations includes system and methods for Token Table Posting, use of a Master Completion Queue, Notification Request Area (NRA) associated with completion queues, preferably in the Network Interface Card (NIC) for providing notification of request completions, and what we call Lazy Memory Deregistration which allows non-critical memory deregistration processing to occur during non-busy times. These intelligent NIC optimizations which can be applied outside the scope of VIA (e.g. iWARP and the like), but also support VIA.

Intelligent network interface card (NIC) optimizations

A high speed data communications method and system is provided whereby multiple groups of software interfaces are used to link a Distributed Systems Services Unit to a Network Provider which connects to an Input/Output Interface Module which relates to external interfaces of a Network. The interfaces permit the capability of buffer sharing and lock pool sharing, in addition to improved Connection Library Element Interfaces which reduce the overhead that was previously required and further enables faster data transfer operations with reduced latency.

Multiple interface data communication system and method utilizing

An improved high-speed data communications system is provided having software functions which permit a Network Data Path Interface to work in conjunction with a Distributed System Service application and a Network Provider application for enhancing data transfers to a Input/Output module and Network Processor. The improved Network Data Path Interface functions involve transmitting data outward to Channel Adapters via the use of shared buffers which can be re-used after utilization, and also receiving data by the sharing of buffers between a Distributed System Service application software unit, a Network Provider unit, and the Network Data Path Interface, enabling data to be received by the Network Provider for transferral to the Distributed System Service application unit.

Network data path interface method and system for enhanced data

An Output Interface function for a Cooperative Service Interface which allows export of data from a Distributed System Services unit (DSS) to a Network Provider unit (NP) whereby lock pools are shared as well as buffer pools in each unit. Copying of exported data from said DSS to said NP is eliminated by use of an image buffer pool in said Network Provider (NP) (Which holds pointers to data in memory) and which can export the data to an external I/O port.

Output interface method and system for enhanced data transfers via

An Input Interface functions for a Cooperative Service Interface unit and enables data from a network to be placed in a designated input buffer of a Network Provider (NP) which can convey pointers to a Distributed System Service (DSS) unit's image buffer pool for access of the data by said DSS from memory. Sharing of buffer pools and lock pools lessen the overhead and latency which would normally burden such data transfers.

Cooperative service interface with buffer and lock pool sharing, for

An interface which enables a LAN connected workstation to concurrently communicate with a plurality of computer platforms having respective network architectures over the same physical connection. The interface receives data from a LAN connection, examines the data and identifies the format being used. Based on the identified format, the interface determines the appropriate destination for the data and sends the data to that destination. Additionally, the interface enables a workstation running XNS software to run terminal emulation programs at the increased speed available from a LAN connection by enhancing the XNS protocol with (1) message segmentation and reassembly, (2) maximum packet size negotiation and (3) LAN address discovery.

Growing community of inventors

Malvern, PA, United States of America

Sarah K Inforzato