An apparatus and method for enhancing the infrastructure of a network such as the Internet is disclosed. A packet interceptor/processor apparatus is coupled with the network so as to be able to intercept and process packets flowing over the network. Further, the apparatus provides external connectivity to other devices that wish to intercept packets as well. The apparatus applies one or more rules to the intercepted packets which execute one or more functions on a dynamically specified portion of the packet and take one or more actions with the packets. The apparatus is capable of analyzing any portion of the packet including the header and payload. Actions include releasing the packet unmodified, deleting the packet, modifying the packet, logging/storing information about the packet or forwarding the packet to an external device for subsequent processing. Further, the rules may be dynamically modified by the external devices.

Transparent provisioning of network access to an application

In general, one embodiment of the invention is a air monitor adapted to a wireless network. The air monitor enforces policies followed by the wireless network even though it is not involved in the exchange of data between wireless devices of the wireless network such as access points and wireless stations.

System and method for monitoring and enforcing policy within a wireless network

A system and method of allocating a resource to a service request. Servers are virtually assigned through a hierarchy including groups of servers and super groups of the groups of servers. Each service request type is associated with a service index that determines both a super group and a load balancing policy for that service request type. A load balancing policy may be applied to select a group of servers among several server groups associated with the super group. Another load balancing policy is applied to the selected group of servers to select a server to handle the service request. The hierarchical data structure allows servers to be configured into overlappable, arbitrary subsets that can address service requests matching configured content rules. Load balancing policies can be selected by service request type.

Method of and system for allocating resources to resource requests

An access control system including a network device having a plurality of network interfaces for receiving and transmitting packets of data, the network device including a forwarding element to apply filter rules to the packets, and a filter rule constructor engine associated with said forwarding element to receive access control rules and decryption information for a security protocol, derive from the access control rules and security information a set of filter rules to be applied to packet headers encrypted with the security protocol, and transmit the set of filter rules to the at least one forwarding element.

Security enabled network access control

An exemplary system and method for using a network access system, such as a virtual private network (VPN), are provided. A user device may have a user session with a home agent. Additionally, an initiating security gateway may be in communication with the home agent, and a terminating security gateway may be in communication with the initiating security gateway via a tunnel (e.g., Internet Protocol in Internet Protocol (IP-in-IP) or Internet Protocol security (IPsec) tunnel). Further, a virtual local area network (VLAN) tag associated with the user session may map to a selector operable in a security policy database. The selector may be used to find a security policy defining an IPsec procedure, and the security policy may be applied to the tunnel. Also, the initiating security gateway may also include a Quality of Service (QoS) module that determines QoS markings for a packet traveling along the tunnel.

System and method for using virtual local area network tags with a private network

A hardware function performed in the data link control layer first determines if a received frame is an IP frame requiring IPSec processing, and if it is, places the IPSec frame on a separate receive queue for subsequent inbound processing. The hardware function further determines if a frame to be transmitted is an IP frame requiring IPSec outbound processing, and if it is, places the IPSec frame on a separate transmit queue for subsequent outbound processing. To determine if an IP frame is an IPSec frame, the hardware function examines both the type field in the Medium Access Control (MAC) header and the protocol field in the IP header, both at the data link control layer. Once IPSec and non-IPSec traffic are separated at the data link layer into different receive or transmit queues, a hardware assist component processes the IPSec data frames in parallel with the processing of non-IPSec data frames by the processor in the network device. The hardware assist component performs the IPSec functions of encryption and decryption, security association management, and key exchange.

IpSec performance enhancement using a hardware-based parallel process

A converged service frame format is defined to support any-to-any connections between Ethernet and Token Ring LANs. The converged service frame format is a superset of standard Ethernet frame formats defined in IEEE 802.3 specifications. Where the frame source is an Ethernet LAN, an 802.1Q tag is added. Where the frame source is a Token Ring LAN, other operations are performed, including mapping of Token Ring priority bits into an appropriate field in the converged service frame. The operations required to map either an Ethernet or a Token Ring frame into the converged service frame are performed at an edge device at a point of ingress into an intervening network. The inverse operations required to restore the Ethernet or Token Ring frame are similarly performed in an edge device at a point of egress from the network.

Converged service for interconnected local area networks

A programmable multispeed communication apparatus includes a plurality of identical media access control (MAC) units for use with a programmable data processing system. The MAC units when multiplexed and connected to a communication media achieve a transmission speed n·s where n is the number of MAC units and s is the speed of the individual MACs. If one or more but not all of the MAC units fail, the apparatus will operate in degraded mode with the remaining active MAC units. User frames are sequentially numbered, partitioned into sequentially numbered partitions which are assigned to one or more MAC's. Each of the partitions includes a prefix which includes the sequential frame number, the sequential partition number and an indicator for distinguishing the last partition of a frame from the other partitions of that frame.

Apparatus including a scalable multiprotocol communications adapter using modular components and a method for transmitting data frames via scalable multiprotocol communication adapters

Vehicles such as airliners or trains can be equipped with a local area network in which individual network connections are made available at individual passenger seats using standard network connectors. Passengers having computers can connect to the network using their own conventional network connection cables. Wireless communications technology is used to link the vehicle network to external ground stations or satellite systems. To meet the DC power requirements of mobile computer users, the vehicle includes a DC power source. A normally unused wire-pair in the network connectors brings the DC power to each workstation. A slightly modified connector is used to transfer the DC power to the computer's DC power subsystem. The technology is adaptable to networks provided at more conventional, non-mobile, workstations.

Network powered computer system and components

Vehicles such as airliners or trains can be equipped with a form of local area network in which individual network connections are made to individual passenger seats using standard telephony connectors. Passengers having computers can connect to the network using their own conventional telephone cables. Wireless communications technology is used to link the vehicle network to external ground stations or satellite systems. To meet the DC power requirements of mobile computer users, the vehicle includes a DC power source. A normally unused wire-pair in the telephony connectors brings the DC power to each seatback. A slightly modified connector is used to transfer the DC power to the computer's DC power subsystem.

William Woollcott Ellington

Papers

IpSec performance enhancement using a hardware-based parallel process

Converged service for interconnected local area networks

Apparatus including a scalable multiprotocol communications adapter using modular components and a method for transmitting data frames via scalable multiprotocol communication adapters

Network powered computer system and components

System including an alternate power source for a modem-capable computer