The present invention provides a firewall that achieves maximum network security and maximum user convenience. The firewall employs “envoys” that exhibit the security robustness of prior-art proxies and the transparency and ease-of-use of prior-art packet filters, combining the best of both worlds. No traffic can pass through the firewall unless the firewall has established an envoy for that traffic. Both connection-oriented (e.g., TCP) and connectionless (e.g., UDP-based) services may be handled using envoys. Establishment of an envoy may be subjected to a myriad of tests to “qualify” the user, the requested communication, or both. Therefore, a high level of security may be achieved. The usual added burden of prior-art proxy systems is avoided in such a way as to achieve fall transparency-the user can use standard applications and need not even know of the existence of the firewall. To achieve full transparency, the firewall is configured as two or more sets of virtual hosts. The firewall is, therefore, “multi-homed,” each home being independently configurable. One set of hosts responds to addresses on a first network interface of the firewall. Another set of hosts responds to addresses on a second network interface of the firewall. In one aspect, programmable transparency is achieved by establishing DNS mappings between remote hosts to be accessed through one of the network interfaces and respective virtual hosts on that interface. In another aspect, automatic transparency may be achieved using code for dynamically mapping remote hosts to virtual hosts in accordance with a technique referred to herein as dynamic DNS, or DDNS.

Firewall providing enhanced network security and user transparency

A feedback control system for congestion prevention in a cell (packet) switching communication network is described. Congestion control is accomplished by controlling the transmission rate of bursty traffic in the presence of high priority, voice, low speed statistical, high speed deterministic and multicast data. Because bursty traffic is relatively insensitive to delay, adequate buffercapacity can be provided at the network nodes in order to minimize bursty data cell loss. By monitoring the buffer queue lengths at the nodes, a control signal can be generated at each intermediate node indicating the state of congestion. Excess queue length indicates incipient congestion while short queue lengths indicate excess capacity. Queue status is forwarded to the destination node where it is interpreted and sent back to the source node as a feedback rate control signal using a 2-bit code. The source node regulates the rate of bursty data transmission over the cell network in accordance with the feedback control signal thus minimizing congestion and concomitant data loss while efficiently utilizing available network bandwidth.

Congestion control for cell networks

A method and apparatus for dynamically shifting between switching and routing packets efficiently to provide high throughput. The present invention provides a method for transmitting packets betwee an upstream node and a downstream node in a network that utilizes flow classification and labelling to redirect flows. The method includes the steps of establishing default virtual channels between the upstream node and the downstream node (1602), receiving packets at the downstream node, performing flow classification at the downstream node on the packet to determine whether the packet belongs to a specified flow that should be redirected in the upstream node (170), selecting a free label at the downstream node (1668) and informing the upstream node that future packets belonging to the specified flow should be sent with the selected free label attached (1676). Other embodiments of the invention include a basic switching unit (1, 3), a switch gateway unit (21), and a switching agent for use in a system for transmitting packets in a network.

Improved method and apparatus for dynamically shifting between routing and switching packets in a transmission network

Background information on networking and switching is provided, and the various architectures that have been considered for fast packet switches are described. The focus is solely on switches designed to be implemented electronically. A set of definitions and a brief description of the functionality required of fast packet switches are given. Three basic types of packet switches are identified: the shared-memory, shared-medium, and space-division types. Each of these is described, and examples are given. >

Fast packet switch architectures for broadband integrated services digital networks

Presents a new category of optical CDMA systems which work based on spectral encoding. In such systems, that the authors refer to as frequency-encoded CDMA (FE-CDMA) systems, the coding is done in the frequency domain while in the usual CDMA systems the code multiplies the modulation signal in the time domain. They present a new type of FE-CDMA system, based on encoding noncoherent broadband sources. They discuss the advantages of the system compared to other optical CDMA systems and present its performance. They show that very efficient, low-cost, CDMA systems can be obtained with an aggregate throughput of many gigabits per second. Also, for this system, the spreading gain of CDMA is independent of the modulation bandwidth. Hence, the system can accommodate variable bit rates, naturally. >

Optical code-division-multiplexed systems based on spectral encoding of noncoherent sources

The authors propose a shared buffer memory switch in which output buffer memories are shared by all the switch output ports and are alloted to one particular output port as the occasion demands. This switch architecture can further improve the hardware-utilization efficiency of the memory switch by increasing the buffer memory usage rate. A discussion on switch traffic characteristics is provided and indicates that buffer sharing reduced the required memory size to less than 0.14 of that otherwise required for adequate switch size and estimates roughly the buffer size required for the switch. The large scale integration (LSI) count, for example, is about 15 chips for the main part of a 32*32 switch (150 Mb/s for each port) which can be mounted on one printed board. The switch is partitioned into a buffer memory LSI and a control LSI to make them flexible to change in ATM switch specifications. >

A shared buffer memory switch for an ATM exchange

A subscriber line signalling apparatus for use in an asynchronous mode communication system includes a switching circuit having a plurality of input terminals and a plurality of output terminals. The switching circuit selectively communicates fixed length information packets to an adaptation processing unit. The adaptation processing unit reassembles the fixed length packets to signalling frames, and transmits them to a frame processor.

Signalling apparatus for use in an atm switching system

A packet switching equipment housing therein a plurality of pairs of an input line and an output line is provided with a monitor circuit for monitoring a packet congestion state in the packet switching equipment for each output line. When a packet congestion is detected in association with either one of the output lines, a congestion indicator is added to a packet to be delivered to the output line so as to return the packet as a congestion notice packet to an equipment as the transmission source of the packet; furthermore, the input packet is relayed via the output line to the destination equipment.

Packet congestion control method and packet switching equipment

An asynchronous transfer mode (ATM) switch architecture called a shared buffer memory switch whose output cell buffers are shared among all the output ports of the switch is proposed. Experimental measurements and a discussion about the traffic characteristics of the switch architecture are carried out to determine how much buffer memory will be reduced through buffer sharing under various traffic conditions and to roughly estimate how many buffers are needed for the switch to meet certain requirements. The resultant estimate shows that buffer sharing reduces the necessary buffer memory to less than 1/5 of what would otherwise be required, and the required buffer size is about 128 cells/output for a 32*32 switch when considering bursty traffic conditions. LSI implementation is also discussed to show that a 32*32 switch can be composed of about 12 chips mounted on one printed board. >

Shared buffer memory switch for an ATM exchange

In the ATM switching system, an ATM speech path is divided into a plurality of functional blocks (101 - 10n, 120; 130, 110). A routing function for distributing cells (packets) each of a fixed length to address outgoing lines and a logical multiplexing function are imparted to a switch (110), while other functions associated with a line typified by a phase synchronizing function and a flow control function are incorporated en bloc in ATM line terminating units (101, 10n) and functions capable of being processed by hardware in common to the lines are assembled in a line common unit (120, 130). The ATM line terminating unit physically terminates transmission lines and performs the processing relevant to header information of the cells each of a fixed length (ATM terminating processing) and includes a cell phase synchronizing circuit (202) for matching the temporal positions of the cells among the lines and a flow control circuit (205) for avoiding overload exceeding the load declared by subscriber terminal. The line common unit serves for processings of call control signals and the calls and includes a signal processing circuit (120) and a control circuit (130). The switch performs cell multiplexing and switching and is constituted by a self-routing switch.

Shinobu Gohara

Papers

A shared buffer memory switch for an ATM exchange

Signalling apparatus for use in an atm switching system

Packet congestion control method and packet switching equipment

Shared buffer memory switch for an ATM exchange

ATM switching system