An integrated system includes a system user interface (SUI) that provides an iconic, at-a-glance representation of integrated security system status. The SUI is for use across all client devices including mobile or cellular telephones, a mobile portal, a web portal, and a touchscreen device. The SUI includes a number of display elements presented across all types of client devices for monitoring status of the integrated security system. The display elements of the SUI include an orb icon, text summary, security button, device warnings, system warnings, interesting sensors, and quiet sensors. The SUI thus provides system status summary information agnostically across all clients. Additionally, the SUI provides consistent iconography, terminology, and display rules across all clients as well as consistent sensor and system detail across clients.

Cross-client sensor user interface in an integrated security network

A novel method for logically routing a packet between a source machine that is in a first logical domain and a destination machine that is in a second logical domain is described. The method configures a managed switching element as a second-level managed switching element. The method configures a router in a host that includes the second-level managed switching element. The method communicatively couples the second-level managed switching element with the router. The method causes the router to route a packet when the router receives a packet from the first logical domain that is addressed to the second logical domain.

Distributed logical l3 routing

In general, the present invention relates to a virtual platform in which one or more distributed virtual switches can be created for use in virtual networking. According to some aspects, the distributed virtual switch according to the invention provides the ability for virtual and physical machines to more readily, securely, and efficiently communicate with each other even if they are not located on the same physical host and/or in the same subnet or VLAN. According other aspects, the distributed virtual switches of the invention can support integration with traditional IP networks and support sophisticated IP technologies including NAT functionality, stateful firewalling, and notifying the IP network of workload migration. According to further aspects, the virtual platform of the invention creates one or more distributed virtual switches which may be allocated to a tenant, application, or other entity requiring isolation and/or independent configuration state. According to still further aspects, the virtual platform of the invention manages and/or uses VLAN or tunnels (e.g, GRE) to create a distributed virtual switch for a network while working with existing switches and routers in the network. The present invention finds utility in both enterprise networks, datacenters and other facilities.

Method and apparatus for implementing and managing virtual switches

Systems and methods for managing a network are described. A view of current state of the network is maintained where the current state of the network characterizes network topology and network constituents, including network entities and network elements residing in or on the network. Events are announced that correspond to changes in the state of the network and one or more network elements can be configured accordingly. Methods for managing network traffic are described that ensure forwarding and other actions taken by network elements implement globally declared network policy and refer to high-level names, independently of network topology and the location of network constituents. Methods for discovering network constituents are described, whereby are automatically configured. Routing may be performed using ACL and packets can be intercepted to permit host to continue in sleep mode. The methods are applicable to virtual environments.

Network operating system for managing and securing networks

The authors describe a novel approach to scalable group re-keying for secure multicast. Our approach, which we call Kronos, is based upon the idea of periodic group re-keying. We first motivate our approach by showing that if a group is re-keyed on each membership change, as the size of the group increases and/or the rate at which members leave and join the group increases, the frequency of rekeying becomes the primary bottle neck for scalable group re-keying. In contrast, Kronos can scale to handle large and dynamic groups because the frequency of re-keying is independent of the size and membership dynamics of the group. Next, we describe how Kronos can be used in conjunction with distributed key management frameworks such as IGKMP (T. Hardjono et al., 1998) that use a single group-wide session key for encrypting communications between members of the group. Using a detailed simulation, we compare the performance tradeoffs between Kronos and other key management protocols.

/pdf/kronos-a-scalable-group-re-keying-approach-for-secure-gl3ril0tk3.pdf

Kronos: a scalable group re-keying approach for secure multicast

A system, device, and method for expediting control flow in a communication system involves establishing a separate control channel for high priority control messages between two network nodes and exchanging high priority control messages over the control channel. The control channel may be a physical or virtual channel. Within a particular network node, a separate high priority queue is used for transferring high priority control messages between a control plane and a forwarding plane.

System, device and method for expediting control flow in a communication system

Using alternate routes for fail-over in a communication network involves maintaining a preferred route and an alternate route in a routing table and routing protocol messages according to the alternate route when the preferred route is unavailable. A node obtains multiple routes for a destination, prioritizes the routes, and installs multiple routes in the routing table, including at least the preferred route and the alternate route. When the node receives a protocol message, the node searches the routing table for a highest priority route that is available for routing the protocol message, and routes the protocol message according to the highest priority route that is available for routing the protocol message. When a route becomes unavailable, the node updates the routing table to indicate that the route is unavailable, and may compute new routes and/or re-prioritize existing routes.

Using alternate routes for fail-over in a communication network

A system, device, and method for receiver access control in a multicast communication network uses a policy service to determine whether a subscriber device can be admitted to a multicast group. The subscriber device accesses the multicast communication network via an access device. The access device uses a policy service to obtain a policy decision from a policy server, where the policy decision indicates whether or not the subscriber device can be admitted to the multicast group. The access device enforces the policy decision by admitting the subscriber device to the multicast group if and only if the policy decision indicates that the subscriber device can be admitted to the multicast group.

System, device, and method for receiver access control in a multicast communication system

Internet Drafts are draft documents valid for a maximum of six months. Internet Drafts may be updated, replaced, or obsoleted by other documents at any time. It is not appropriate to use Internet Drafts as reference material or to cite them other than as a "working draft" or "work in progress." To view the entire list of current Internet-Drafts, please check the "1id-abstracts.txt" listing contained in the Internet-Drafts Shadow Directories on ftp.is.co.za (Africa), ftp.nordu.net (Northern Europe), ftp.nis.garr.it (Southern Europe), munnari.oz.au (Pacific Rim), ftp.ietf.org (US East Coast), or ftp.isi.edu (US West Coast). Abstract This document provides a framework for group key management for multicast security, motivated by three main considerations, namely the multicast application, scalability and trust-relationships among entities. It introduces two planes corresponding to the network entities and functions important to multicasting and to security. The key management plane consists of two hierarchy-levels in the form of a single 'trunk region' (inter-region) and one or more 'leaf regions' (intra-region). These regions are defined to have unique group keys and are open to differing (inter-region or intra-region) group key management protocols. The advantages of the framework among others are that it is scalable, it has reduced complexity and allows the independence in regions of group key management.

A Framework for Group Key Management for Multicast Security

This document describes a protocol for intra-domain group key
management for IP multicast security, based on the framework of
[HCD99]. In order to support multicast groups, the domain is divided
into a number of administratively-scoped "areas". A host-member of a
multicast group is defined to reside within one (and only one) of
these areas. The purpose of placing host-members in areas is to
achieve flexible and efficient key management, particularly in the
face of the problem of changes (joining, leaving, ejections) in the
membership of a multicast group. A separate administratively-scoped
area control-group is defined for each (data) multicast group, for the
express purpose of key management and other control-message delivery.

Bradley Cain

Papers

System, device and method for expediting control flow in a communication system

Using alternate routes for fail-over in a communication network

System, device, and method for receiver access control in a multicast communication system

A Framework for Group Key Management for Multicast Security

Intra-Domain Group Key Management Protocol