British Telecommunications Public Limited Company

British Telecommunications Corporation

Simon A Beddus

Fadi El-Moussa

Claudia Cristina

Gary L Bruce

David Roxburgh

Michael R Hosking

Patrick B Farley

Fenela Wills

Huina Chua

Darren Michael Launders

David Wells

Paul Deans

David Mark Fisher

A computer-implemented method of analysing anomalous network traffic in a telecommunications network, said telecommunications network comprising a plurality of network entities () and a security analyser (-), wherein the method comprises the steps of: receiving at the security analyser a network communication from a first network entity; identifying the first network entity; by means of the security analyser: analysing the network communication and/or a performance of the first network entity thereby to identify the network communication as an anomalous communication (); in response to identifying the network communication as an anomalous communication, communicating an instruction to the identified first network entity to respond with origin information regarding the anomalous communication, wherein the origin information identifies a preceding network entity from which the anomalous communication was directly received by the first network entity (); and commencing with the preceding network entity, iteratively communicating an instruction to a preceding network entity to respond with origin information for identifying another preceding network entity from which the anomalous communication was directly received until a source network entity from which the anomalous communication originated is identified (; and applying a security policy to the identified source network entity ().

Method of analysing anomalous network traffic

A containerisation orchestrator () is controlled by an analysis system () which assesses an application and a device for compatibility to have a candidate application installed on the device using the orchestrator. The analysis includes an assessment of the vulnerability of the installed application to failure or malicious attack, and a risk assessment of the consequences of such an event. The candidate containerised configuration () for the application is also assessed for compatibilities and vulnerabilities.

Vulnerability assessment of containerised installation

Containerised computing processes are generated by an orchestration processor interpreting user commands and user profile data to build a deployment specification specifying functions to be run by a containerised process, using a shell script run on a host virtualisation container. External events such as security threats and computing resource overloads can be used to generate the virtualised process, allowing vulnerability detection, and apply countermeasures such as deployment or migration of containers during attacks to lesser prone infrastructure, and allows the orchestration of non-container tools to provide security and resilience.

Containerised programming

A web server operating in a container has resource and network limits applied to add an extra layer of security to the web server. If a monitor detects that the container's resource usage is approaching one or more of these limits, which may be indicative of a DDoS attack, (step) or identifies traffic sources exhibiting suspicious behaviour, such as frequently repeated requests from the same address, or from a related set of addresses, a restrictor function caps the resources allowed by the original Webserver container to allow it to recover from buffer overflow and protect servers running in other containers from overwhelming any shared resources. A duplicator function starts up replica containers with the same resource limits to take overflow traffic, and a load balancing function then directs incoming traffic to these overflow containers etc. Traffic from suspicious sources is directed by the load balancer to one or more specially-configured attack-assessment container(s) where a 'dummy' web server operates. The behaviour of these sources is analysed by a behaviour monitoring function over some time to determine if they are legitimate or malicious, which can control a firewall to block addresses identified as generating malicious traffic.

Denial of service mitigation

Actuators and sensors in an intelligent system are controlled by setting encryption types and key lengths to individual applications based on the type of device and application being run. A server system () running in a communications gateway, selects an encryption policy for one or more devices under its control. This selection is controlled by an analysis function () using data relating to the type of device (), and the applications to be run on the device (), to generate an appropriate encryption policy () which can be deployed to the device (). Controlling the analysis and deployment in a gateway device allows co-ordination between devices, and reduces processor time in the devices. An agent is sent to the device alongside the encryption policy data, to control the device according to the encryption policy. In response to events detected and analyzed by analysis function (), the server sends triggers () to the agent loaded on the device to modify its encryption type in accordance with the policy previously deployed. Revisions and updates to the deployed policies can also be initiated, in response to dynamic factors such as resource usage (CPU, bandwidth, battery etc.), data sensitivity, external events and notifications of vulnerabilities to device type and applications used, in order to allocate resources more efficiently. Different encryption systems can be applied to different applications or data streams running on the same device, and encryption can be applied actively as and when required, using dynamic analysis of both the device and the application to encrypt data&#x2014;for example to only encrypt if malware is detected.

Dynamic data encryption

An intermediate data transmission device arranges for mutual authentication between itself and a remote terminal to allow data to be exchanged between the remote terminal and a server through the device. The server sends first and second key codes to the intermediate device, the key codes both being derived from a shared secret known to the server and remote terminal but not to the intermediate device. In response to a challenge from the intermediate device the remote terminal uses the shared secret to generate a duplicate of the first key code and transmits the duplicate to the intermediate device. The intermediate device compares the first key code and the duplicate of the first key code received respectively from the server and the remote terminal to verify the authenticity of the remote terminal. The intermediate device then transmits the second key code to the remote terminal, to be compared by the remote terminal with a duplicate of the second key code to verify the authenticity of the intermediate device. This process allows the intermediate device to be used without itself having the shared secret. The codes generated by the server may be encoded with a network identity of the intermediate device using the shared secret, such that the remote terminal can only respond to the same intermediate device that transmitted the codes. This prevents a 'man-in-the middle' attack by another intermediate device, as without the shared secret no intermediate device can modify the codes to include a different network identity.

Authentication of data transmission devices

A method for controlling payment in a communications system including the steps of providing a service accessing a service provider from the or one user device, selecting a product for purchase from the service provider, the service agent receiving a request for payment from the service provider via a payment operator and the service agent issuing a payment authorisation to a payment provider via the payment operator. The service agent is installable in a variety of user devices and provides a uniform interface to the payment system from a plurality of the user devices. The service agent may also provide a uniform interface to an ordering system from a plurality of the user devices.

Communications system

A method of determining the topology of at least part of a network comprising the steps of: monitoring traffic to and/or from a plurality of computers in the network; storing information relating to the monitored traffic for each of the plurality of computers, the information including an identifier of a requested service; selecting a first computer of the plurality of computers; reading the stored information related to the first computer and identifying, using the stored identifier of the requested service, at least one traffic flow to or from the first computer that corresponds to the requested service; using the stored information to identify the destination or origin of the identified traffic flow for the first computer, which traffic flow information includes the identifier of the requested service; using the identified destination or origin to identify one or more computers that are immediately upstream or downstream of the first computer, and determining a topology based on the identified one or more upstream or downstream computers.

Network topology

A client server system uses a client subsystem, a server subsystem and an interconnecting data network. The client subsystem client application initiates a secure connection over the network with the server subsystem which includes a server application cooperating with the client application to complete a secure connection with the client application and which transmits output data over such a connection in response to requests for service by the client application. The server subsystem additionally generates a notification, in response to detecting an event in the absence of a secure connection between the server and the client, and transmits the notification to the notification server which forwards the notification over the interconnecting network to the client application.

Method and apparatus for communicating data between computer devices

A method and system for controlling service requests from a client to a server involves intercepting and controlling the transmission of service requests from the client to the server. The service requests are queued at the client and the transmission of the queued service requests are delayed to smooth the frequency of service requests transmitted to the server.

Controlling service requests transmitted from a client to a server

In a communications network, communications terminals exchange call control capability data which mutually identifies selected call control protocols and network address types. The terminals subsequently set up a call using protocols chosen from those identified. The terminals may continuously monitor for a request for the exchange of such data, allowing other parties to join a session subsequently, after the initial set up.

Communications network

In a telecommunications network short dialling codes for a subscriber terminal are programmed by another party, and the allocation of codes is communicated to the user. An audio announcement played as part of the dial tone may be used to communication the allocation of codes.

Telecommunications network

A computer telephony interface includes both first party and third party call components. A telephony server is arranged to control one or more of plural network nodes and has a control interface having a call model and call components for (a) at least one first party call and (b) at least one third party call. First and third party call components are linked to a single call model.

In a communications network, each of a number of users registers user profile data in a directory. The directory is available to other users. The user profile data includes identifiers for one or more of a plurality of call control protocols. Prior to establishing a call, a user retrieves user profile data for the called party from the directory. The call is then established using a call control protocol which was identified in the relevant user profile.

Communications network and method having accessible directory of user profile data

In a call centre connected via a network to a number of terminals, at least part of a process of automatic call distribution (ACD) is carried out at the terminals.

Growing community of inventors

Ipswich, United Kingdom

Simon A Beddus