Sonus Networks, Inc.

Motorola Corporation

Ribbon Communications Operating Company, Inc.

Shiping Li

Shaun Jaikarran Bharrat

John A Perreault

Mark Duffy

Kevin Pilotte

Jian Yang

Tolga Asveren

James A Pasco-Anderson

Ronald V Grippo

Gregory Paul Khederian

Toru Mike Yamanishi

Xiang Yu

Prashant Motagi

Subhransu S Nayak

Mark Smith

Keith M Conger

Gary Robert McCarthy

Methods and apparatus for detecting and minimizing the effects of Denial Of Service (DOS) attacks in high-speed networks in which packet processing is carried out by multiple processing cores. In one embodiment of the invention a communications method and apparatus detects and deletes denial of service attack packets in a multi-core distributed packet processing system using a lightweight DOS attack packet detection and deletion process.

Methods and apparatus for detecting and/or dealing with denial of service attacks

Methods and apparatus for supporting secure packet communications, e.g., SRTP, which use implicit index numbers for synchronization and sequencing of received packets. The secure communications methods and apparatus having an adaptive index learning mode of operation and a non-adaptive index learning mode of operation. The adaptive index learning mode of operation being used to determine a correct estimated sequence number roll over counter number and the implicit index number for one of a plurality of secure packets received when an adaptive index learning process condition is satisfied.

Methods and apparatus for synchronizing decryption state with remote encryption state

Methods and apparatus for supporting secure packet communications, e.g., sRTP/sRTCP, which are resistant to denial of service attacks are described. A received packet is identified to correspond to a particular stream being received, the stream having a current expected set of packet sequence numbers, e.g., a current window including a next expected packet sequence number and at least one packet sequence number in the expected packet window on each side of the expected packet sequence number. Unencrypted information from the received packet, e.g., a received packet sequence number, is used to determine at least one of: to drop the received packet, or to assign the packet to one of a plurality of policing levels. If the packet passes policing at its assigned policing level, the packet may undergo authentication and decryption to determine if it is a valid packet.

Methods and apparatus for denial of service resistant policing of packets

Methods and apparatus for sharing bandwidth over a link in a packet-oriented telecommunications system or network that supports multiple types of traffic including, e.g., real time packet flows, opportunistic rate packet flows, control and signaling traffic, are described. In one exemplary embodiment the method includes the steps of receiving a bandwidth allocation request requesting allocation of a required amount of bandwidth for a new real time packet flow, allocating the requested bandwidth from bandwidth reserved for newly-allocated real time packet flows, updating the measure of the total amount of bandwidth allocated to real time packet flows to reflect the allocation of the bandwidth to the new real time packet flow, and generating new bandwidth allocations for existing opportunistic rate packet flows based on a measure of the total amount of bandwidth allocated to real time packet flows. Some embodiments of the invention include methods to enforce the dynamic bandwidth allocations.

Methods and apparatus for bandwidth management in a telecommunications system

The invention features a computer-implemented method for playing back an announcement message to a user device. The method includes initiating, by a computing device, an announcement session in response to a user device establishing communication with the computing device and determining, by the computing device, the announcement message to be played back to the user device. The method includes loading, by the computing device, into a queue associated with the announcement session, a descriptor referencing a memory buffer on the computing device. The memory buffer includes a plurality of memory partitions, each memory partition storing at least one portion of the announcement message encoded at a different rate. The method includes the computing device scheduling play back of the announcement message, playing the announcement message to the user device at a first rate and receiving a request from the user device for playback at a second rate.

Systems and methods for playing recorded announcements

A computer-implemented method for inserting an out-of-band signaling packet into a real-time protocol (RTP) stream is provided. The method includes receiving the out-of-band signaling packet intended for transmission to a user device and forming a synthesized packet based on payload information from the out-of-band signaling packet and header information stored in a data structure describing the RTP stream. The method also includes inserting the synthesized packet into the RTP stream. The method further includes receiving an RTP packet intended for transmission to the user device via the RTP stream, analyzing an insertion sequence number and an insertion flag maintained in the data structure, and discarding or forwarding the RTP packet via the RTP stream based on the analyzing.

Inserting out-of-band data into in-band data streams

Described are computer-based methods and apparatuses, including computer program products, for identifying attackers on a network. A data packet is filtered by a multi-tiered filtering and transmission system. Data packets matching the first tier filter are discarded. Data packets matching the second tier filter are transmitted to an output module based on a criterion. Data packets in the third tier filter are hashed into bins and data packets matching an entry in the bin are transmitted to the output module based on a criterion for the bin. Data packets in the fourth tier transmission system are transmitted to the output module based on a criterion. Data packets that do not meet the criterion for transmission to the output module are transmitted to an attack identification module which analyzes the data packets to identify attacks.

Identifying attackers on a network

Described are computer-based methods and apparatuses, including computer program products, for scalable filtering and policing mechanism for protecting user traffic in a network. A data packet is filtered by a multi-tiered filtering and transmission system. Data packets matching the first tier filter are discarded. Data packets matching the second tier filter are transmitted to an output module based on a criterion. Data packets in the third tier filter are hashed into bins and data packets matching an entry in the bin are transmitted to the output module based on a criterion for the bin. Data packets in the fourth tier transmission system are transmitted to the output module based on a criterion. Data packets that do not meet the criterion for transmission to the output module are transmitted to an attack identification module which analyzes the data packets to identify attacks.

Scalable filtering and policing mechanism for protecting user traffic in a network

Described are computer-based methods and apparatuses, including computer program products, for filtering and policing for defending against denial of service attacks on a network. A data packet is filtered by a multi-tiered filtering and transmission system. Data packets matching the first tier filter are discarded. Data packets matching the second tier filter are transmitted to an output module based on a criterion. Data packets in the third tier filter are hashed into bins and data packets matching an entry in the bin are transmitted to the output module based on a criterion for the bin. Data packets in the fourth tier transmission system are transmitted to the output module based on a criterion. Data packets that do not meet the criterion for transmission to the output module are transmitted to an attack identification module which analyzes the data packets to identify attacks.

Filtering and policing for defending against denial of service attacks on a network

A gateway apparatus includes multiple network server cards which are synchronized with each other to allow time slot switching of synchronous data across an asynchronous medium between source and destination server cards. The gateway includes synchronization logic and a data adaptation layer which implements a protocol for formatting of synchronous serial data. The data undergoes serial to parallel conversion and is formed into per time slot subpackets which are further packetized along with context and synchronization data. The packet is transmitted through an asynchronous switch after which the packet is disassembled into its constituent subpackets and queued into play-out buffers according to each subpackets' associated context and synchronization data. The apparatus allows synchronous data to be switched from a source time slot to a destination time slot across the asynchronous switch with a known, fixed delay. The gateway apparatus requires only a single asynchronous switch to transmit data between and among both the synchronous and asynchronous domains.

Data adaptation protocol

A parallel CRC remainder coefficient generator (100) and method (1100) are described for providing efficient error detection in a digital data communication system. This method calculates a K-bit CRC remainder m data bits at a time, where m can be less than, equal to, or greater than K, and where the processing of each of the m bits requires a total of j, K-bit table look-ups into a total of j tables of 2.sup.b entries each, where m=jb. It also requires one m-bit exclusive-or operation, a total of (j-1) K-bit exclusive-or operations, and one (K-m)-bit exclusive-or operation if m&lt;K. An implementation of a 16-bit CRC using the new method (700) in a 16-bit DSP processor with m=16, j=2 and b=8 reduces processor loading by 43% relative to the fastest prior art method which uses m=8, j=1, and b=8. An implementation of a 32-bit CRC using the novel method (600) in a 16-bit DSP processor with m=6, j=2, and b=8 reduces the processor loading by 41% relative to the fastest prior art method which uses m=8, j=1, and b=8. Hardware implementation of the new method provides similar benefits with respect to throughput and area.

Growing community of inventors

Acton, MA, United States of America

Shiping Li