Raytheon Bbn Technologies Corp.

Verizon Corporate Services Group Inc.

Bbn Technologies Corporation

Other

Bbnt Solutions Llc.

Stragent, LLC

Gte Internetworking Incorporated

Ericsson Ab

Verizon Corporate Services Group Inc. & Bbn Technologies Corp.

Verizon Corporation Services Group Inc.

Bbn Solutions LLC

Sensor-matic, Inc.

Level 3 Communications, LLC

Walter Clark Milliken

Craig Partridge

Gregory Donald Troxel

William Timothy Strayer

Ravi Sundaram

Stephen Douglas Milligan

David Patrick Mankins

Ronald L Pettyjohn

Gregory Stephen Lauer

Luis Sanchez

Steven Kohalmi

Laura Jane Poplawski Ma

Alden W Jackson

Frank Kastenholtz

Philip P Carvey

Christine Elaine Jones

Robert J Walsh

Andrew V Hoar

Stanley P Sassower

Todd Andrew Snide

Ronald Joseph Watro

Arthur Robert Abbott

Jack Dietz

Alex C Snoeren

Methods and systems for detection and/or prevention of network attacks can include the use of multiple and/or time-dependent addresses coupled with filtering by the directory or naming service. The directory service can respond to requests for the address of a resource by returning an address that can be relocated over time by coordinating the directory service entry with the host and network address configuration data and/or by returning an address specific to the requestor. Thus, the directory service can track and build profiles of matches between requestors and accesses. The methods and systems can use the time dependent addresses and profiles to distinguish legitimate accesses from unauthorized or malicious ones. Requests for non-valid addresses can be misdirected to 'empty' addresses or to detection devices.

Methods and systems for network attack detection and prevention through redirection

Embodiments of the invention reduce the probability of success of a DOS attack on a node receiving packets by decreasing the probability of random collisions of packets sent by a malicious user with those sent by honest users. The probability of random collisions may be reduced in one class of embodiments of the invention by supplementing the identification field of the IP header of each transmitted packet with at least one bit from another field of the header. The probability of random collisions may be reduced in another class of embodiments of the invention by ensuring that packets sent from a transmitting IPsec node to a receiving IPsec node are not fragmented.

Means of mitigating denial of service attacks on IP fragmentation in high performance IPSEC gateways

A method, apparatus and computer program product for non-uniform per-packet priority marking for use with adaptive protocols is presented. A packet is received at a first network device, the packet assigned to a priority band. A priority is determined for the packet between a lowest priority of the priority band and a highest priority of the priority band, the priority for the packet selected based on a target distribution of priorities within the priority band, the target distribution comprising a distribution selected to achieve a desired capacity relationship among groups of packets assigned to different priority bands. The selected priority is assigned to the packet.

Non-uniform per-packet priority marker for use with adaptive protocols

A packet is classified into a class. A priority value is assigned to the packet wherein packets in a flow are assigned priorities according to some probability distribution within some band. A determination is made, at a network device for a highest latency class, whether a sum of queued packet sizes of previously received packets having an equal or smaller latency class than the packet and larger or equal priority than the packet is larger than a threshold value. When the sum is larger, the packet is dropped, otherwise a determination is made whether a latency class of the packet is less than the latency class of the network device. When the latency class is not less, the packet is stored in a queue for the latency class. When the latency class is less, then the process is repeated until the packet is dropped or stored in a queue.

Method and apparatus providing precedence drop quality of service (PDQoS) with class-based latency differentiation

Devices and methods for securely storing data are provided. A device for constructing an encryption key comprising a tamper-protection barrier that encloses one or more memory devices is provided. The memory stores data for constructing the encryption key. The memory may include a single memory device or a plurality of memory devices. The tamper-protection barrier also encloses a security processor configured to combine the data stored in the memory based in part on a function, such as a logical exclusive-or (XOR) function, to construct the encryption key. The stored data in the memory may include partial keys. These partial keys may be created based in part on applying the XOR function to an encryption key.

Device and method for securely storing data

The disclosed technology provides a system and method of synchronizing cryptographic operation between a transmitter and a receiver. A transmitter can communicate encrypted data to a receiver according to a first communications protocol, and communicate a transmitter number and a portion of the encrypted data to the receiver according to a second communications protocol. The receiver can be in communication with a memory space containing locations that are each associated with an encrypted data and that can contain a previous receiver number. The receiver can receive transmitted encrypted data and an associated transmitter number and can search the memory space to find a location wherein the encrypted data associated with the location is entirely, or in part, the same as the transmitted encrypted data. When such a location is found, the receiver can compare the transmitter number with the previous receiver number stored in the location.

Packet-based and pseudo-packet-based cryptographic synchronization systems and methods

A method () and program () for inhibiting attack upon a computer () is provided. The address () of a process () is produced (), and encrypted () to produce an encrypted address (), which is then stored in memory (). When needed, the encrypted address () is retrieved () from memory () and decrypted () to reproduce the original process address (). The reproduced process address () is then verified (). If the process address () is determined () to be valid, i.e., there was no attack, then the process address () is placed () in the program counter (), and a valid process () is executed. If the process address () is determined () to be invalid, i.e., there was an attack, then the address () of a crash and terminate process () is placed () in the program counter () and the computer () crashes. A nonce value () may be generated () and encrypted () and decrypted () in conjunction with the process address (). The nonce value () may then be verified () independently, thereby increasing security.

System and method for thwarting buffer overflow attacks using encrypted process pointers

A data-buffering apparatus () having two buffers () and configured to conserve power is disclosed. When a block of data () having a short block length (') is to be buffered, the block of data () is buffered by a small primary buffer () and a large secondary buffer () is deactivated. When a block of data () having a long block length (&#x2033;) is to be buffered, the large secondary buffer () is activated and the block of data () is buffered by both buffers (). As there are typically many more blocks of data () having short block lengths (&#x2032;) than long block lengths (&#x2033;), the secondary buffer () is activated only a small fraction of the time.

Data-buffering apparatus and method

A network analysis architecture provides a suite of complementary logic operable at different temporal and spatial timescales. The distinct temporal and spatial scales define different tiers, each analyzing network events according to predetermined temporal and spatial scales of progressive magnitude. Particular event detection logic may be operable on an immediate temporal scale, while other logic identifies trends over a longer time period. Similarly, different spatial scales are appropriate to different algorithms, as in logic that examines only headers or length of packets, or inspects an entire payload or transferred file. Deployment of logic that is focused on different timing and scope of data allows timely action in the case of readily apparent deviations, and permits longer term analysis for identifying trends that emerge over time. By selecting a suite of complementary logic directed at different deviant behavior, the focus of a single logic scheme is not charged with producing absolute screening of all traffic.

Multi-tiered scalable network monitoring

A system () detects transmission of potentially malicious packets. The system () receives, or otherwise observes, packets and generates hash values based on variable-sized blocks of the packets. The system () then compares the generated hash values to hash values associated with prior packets. The system () determines that one of the received packets is a potentially malicious packet when one or more of the generated hash values associated with the received packet match one or more of the hash values associated with the prior packets.

Hash-based systems and methods for detecting and preventing transmission of polymorphic network worms and viruses

The disclosed technology provides a system and method of securely communicating data. An encryptor located at a transmitter can provide encrypted data to the transmitter. The transmitter can maintain a packet number indicating a particular packet for carrying the encrypted data and a sub-packet number indicating a position within the packet where the encrypted data is to be stored. The encryptor can produce the encrypted data using an encryptor seed generated based on the packet number and sub-packet number. A receiver can maintain a receiver packet number indicating a number of previously received packets and can compute a receiver sub-packet number. The receiver can receive a packet containing encrypted data and can decrypt the encrypted data using a decryptor seed generated based on the receiver packet number and sub-packet number.

Packet-based and pseudo-packet based cryptographic communications systems and methods

A system () detects transmission of potentially unwanted e-mail messages. The system () may receive e-mail messages and generate hash values based on one or more portions of the e-mail messages. The system () may then determine whether the generated hash values match hash values associated with prior e-mail messages. The system () may determine that one of the e-mail messages is a potentially unwanted e-mail message when one or more of the generated hash values associated with the e-mail message match one or more of the hash values associated with the prior e-mail messages.

Hash-based systems and methods for detecting and preventing transmission of unwanted e-mail

A method, apparatus and computer program product for providing a precedence drop quality of service is presented. A drop precedence value for a packet is determined and inserted into the packet which is then transmitted having the drop precedence value inserted therein. The packet is received and a determination made regarding whether a sum of queued packet sizes of previously received packets having a higher drop precedence value than the packet is larger than a first threshold value. The packet is dropped when the sum of queued packet sizes of the previously received packets having a higher drop precedence value than the packet is larger than the first threshold value.

Method and apparatus providing a precedence drop quality of service (PDQoS)

Method for source-spoofed internet protocol packet traceback. This is an IP packet traceback technique for locating the origin of a malicious packet, even if the packet's IP source address is incorrect (spoofed). This is done by having routers lookup the source address in their routing tables, and mark the relevant entry.

Growing community of inventors

Dover, NH, United States of America

Walter Clark Milliken