8817 results about "Media access control" patented technology

In a system for providing access control management to electronic data, techniques to secure the electronic data and keep the electronic data secured at all times are disclosed. According to one embodiment, a secured file or secured document includes two parts: an attachment, referred to as a header, and an encrypted document or data portion. The header includes security information that points to or includes the access rules and a file key. The access rules facilitate restrictive access to the secured document and essentially determine who/when/how/where the secured document can be accessed. The file key is used to encrypt/decrypt the encrypted data portion. Only those who have the proper access privileges are permitted to retrieve the file key to encrypt/decrypt the encrypted data portion.

For enhanced access control, a client includes a token in each read or write command sent to a block storage device. The block storage device evaluates the token to determine whether or not read or write access is permitted at a specified logical block address. For example, the token is included in the logical block address field of a SCSI read or write command. The client may compute the token as a function of the logical block address of a data block to be accessed, or a metadata server may include the token in each block address of each extent reported to the client in response to a metadata request. For enhanced security, the token also is a function of a client identifier, a logical unit number, and access rights of the client to a particular extent of file system data blocks.

Methods, systems and computer program products are provided for determining if a packet has a spoofed source Internet Protocol (IP) address. A source media access control (MAC) address of the packet and the source IP address are evaluated to determine if the source IP address of the packet has been bound to the source MAC address at a source device of the packet. The packet is determined to have a spoofed source IP address if the evaluation indicates that the source IP address is not bound to the source MAC address. Such an evaluation may be made for packets having a subnet of the source IP address which matches a subnet from which the packet originated.

A protocol, method, and apparatus for managing network communications which are particularly well suited for ATM communications across a wireless medium. Contiguous time slots within a frame are allocated to each node having traffic to send. Each node is assured a nominal bandwidth, and excess bandwidth is distributed by demand. The allocation of excess bandwidth can be dependent upon the size of the buffer at each node, as well as the time-criticality of each message. Nodes communicate their requests for allocation by appending such control information to the first of their transmitted packets. The allocation, of each node's transmit and receive time slots, is transmitted to all the nodes at the beginning of each frame. Thereafter, each node need not participate on the network until their allocated time periods, thereby allowing portable devices to enter inactive states to conserve power. The network is operated in a connection mode; connections are established in a relatively non-interfering manner by the use of periodically occurring beacons. Inactive, unconnected, nodes need only monitor the network during these beacon periods, further allowing for power conservation.

The present invention provides a method, system, and computer program product for enhancing security within a distributed computing network while enabling fine-grained access control for packets traveling through the network. The disclosed techniques enable this fine-grained access control while simultaneously providing broad-brush application-independent and user-independent security for Internet Protocol (IP) packets that are in transit over both secure networks (such as a corporate intranet) and non-secure networks (such as the public Internet). Access control decisions are delegated to an access control engine, and are based upon mutually authenticated identity information (e.g. of a system user and/or application) that is extracted from information exchanged as part of an underlying security service (such as the Internet Key Exchange of the IP Security Protocol).

Display regions for representations of results of transformations applied to access control settings for a resource appear integrated with a familiar representation of the resource, e.g. word processor, or Web browser. A number of functions modify layout and transformations, and those functions are available for invocation, e.g. through mouse gestures or key combinations. Users are graphically represented by displays comprising photographic likenesses. Groups can be shown as individual users. Giving someone access to a resource can be as easy as dragging that person's likeness. Access log information can be shown together with access control settings. Reviewing the subset of resources available to a user is made easier. Overflow indicators replace scroll bars. Macros effect snapshots of volatile sets of users. Sections within documents can be omitted automatically if a user lacks authorization. Access control settings for one resource can be linked to be dependent on settings for other resources.

A Data Link Control protocol for 3G wireless communication system for direct support for network layer protocols, e.g. the Internet Protocol (IP), is provided. The Link Layer disclosed comprises a Link Access Control (LAC) sublayer and a Medium Access Control (MAC) sublayer. At a transmit end of the wireless system, a plurality of Quality of Service (QoS) data planes are created to directly support the IP QoS. Each QoS data plane is optimized to handle QoS requirements for a corresponding Class of Service (CoS). Data packets received at the LAC sublayer are directed to a QoS data plane according to the particular QoS information they contain and processed according to the particular QoS requirement to generate variable size LAC frames. The variable size LAC frames are transmitted to the MAC sublayer for generating radio link protocol data units (RLP PDUs) to be transmitted to a receiving end. A new level of error correction is provided at the LAC sublayer as the size of the LAC PDUs can be dynamically adjusted in response to the conditions of the communication link. A dual mode ARQ is provided at the MAC sublayer to improve the quality of the air transmission for bursty as well as non-bursty traffic conditions.

A method and apparatus for controlling OFDMA cellular networks is described. In one embodiment, the method comprises receiving channel characteristics and noise-plus-interference information measured at spatially distributed subscribers and assigning traffic channels for an orthogonal frequency-division multiple-access (OFDMA) network.

The present invention relates to a wireless communication system, and more particularly, discloses a method and an apparatus for transmitting and receiving duplicate data in a multicarrier wireless communication system. According to one embodiment of the present invention, a method in which a transmitter, which supports carrier aggregation for performing communication using N (N≧2) component carriers, transmits duplicate data, comprises the steps of: generating, in a media access control (MAC) layer of the transmitter, N duplicate data using radio link control (RLC) protocol data units (PDUs) from an RLC layer, and simultaneously transmitting, to a receiver, the respective N duplicate data on the N component carriers through respective N hybrid automatic repeat and request (HARQ) entities.

A data communication having at least one data flow is established over a wireless interface between a radio network and a user equipment node (UE). A medium access control (MAC) layer located in a radio network node receives data units from a higher radio link control (RLC) layer located in another radio network node. Some or all of a header of a RLC data units associated with the one data flow is analyzed at the MAC layer. Based on that analysis, the MAC layer determines a priority of the data unit relative to other data units associated with the one data flow. The MAC layer schedules transmission of higher priority data units associated with the one data flow before lower priority data units associated with the one data flow. The priority determination does not require extra priority flags or signaling.

A hybrid band intelligent backhaul radio (HB-IBR) is disclosed that is a combination of two radios operating in different bands. Embodiments include a dual radio configuration wherein a first radio operates in a non-line of sight (NLOS) radio link configuration and a second ancillary radio operates in a near line of sight or line of sight configuration (n)LOS. For example, the HB-IBR may have an Intelligent Backhaul Radio (IBR) operating in the non-line of sight mode of operation within the 5.8 GHz unlicensed band, and have an ancillary radio link operating in the FCC part 101E band of operation at 60 GHz. A common medium access control (MAC) block may be utilized between the dual radios.

Provider Link State Bridging (PLSB) expands static configuration of Ethernet MAC forwarding tables by the control plane and utilizes direct manipulation of Ethernet forwarding by a link state routing system. At least one media-access-control (MAC) address for unicast forwarding to the bridge and at least one MAC address for multicast forwarding from the bridge are assigned. Bridges exchange state information by a link state bridging protocol so that a synchronized configured view of the network is shared between nodes. Each node can calculate shortest path connective between peer bridging nodes and populated the appropriate forwarding tables. A reverse path forwarding check is performed on incoming packets to provide loop suppression. During times of network instability the loop suppression can be disabled for unicast packets as identified by the destination MAC address to buffer packets and minimize the impact on traffic flow.

A cellular communication system comprises a set of base stations (201,203) which transmit downlink resource exchange discovery messages to remote terminals in resource allocations of a Media Access Control, MAC, frame structure. The discovery messages may indicate that a base station has resource available for reallocation to another base station or that a base station is seeking resource to be allocated from another base station. A remote terminal (205) comprises a receiver (401, 403) which receives a first message of the downlink resource exchange discovery messages from at least a first base station (201). A discovery message transmit processor (407) generates a second message, which is an uplink resource exchange message comprising resource exchange data determined from the first message, and transmits this to a second base station (203). The second base station (203) then initiates a temporary air interface resource reallocation with the first base station in response to receiving the second message.

A fast authentication and access control method of authenticating a network access device to a communications network having an access point communicating with a remote authentication (home AAA) server for the network access device. The method includes the step of receiving an access request having an authentication credential from the network access device at the access point. The authentication credential includes a security certificate having a public key for the network access device and an expiration time. The security certificate is signed with a private key for the remote authentication server. The access point locally validates the authentication credential by accessing the public key of the remote authentication server from a local database, and checking the signature and expiration time of the security certificate. If the authentication credential is validated at the access point, the access point grants the network access device conditional access to the network by sending an access granted message to the network access device. The access granted message includes a session key encrypted with a public key for the network access device. The session key is stored in a database associated with the access point. The access point contacts the remote authentication server to check a revocation status of the security certificate for the network access device. If the access point receives a message from the remote authentication server that the authentication credential for the network access device has been revoked, it suspends network access for the network access device.

A system is provided in which a person may use a Cellular (Mobile) Telephone, a PDA or any other handheld computer to make a purchase. This is an example only. The process may entail any type of transaction which requires authentication, such as any financial transaction, any access control (to account information, etc.), and any physical access scenario such as doubling for a passport or an access key to a restricted area (office, vault, etc.). It may also be used to conduct remote transactions such as those conducted on the Internet (E-Commerce, account access, etc.). In the process, a multifactor authentication is used.

A wireless communication system is provided that has at least three nodes arranged in a multi-hop ultra wide band (UWB) communication network such that communications from a first node destined for a third node pass through a second node. Each of the devices in the system includes a radio and a media access control (“MAC”) module that is configured to establish multi-hop UWB wireless communications between the three or more wireless communication devices that enables high bandwidth applications such as Voice Over Internet Protocol (“VoIP”); multiplayer gaming; Wireless High Definition Television; and Internet Protocol Television (“IPTV”) among others. The MAC module is configured to avoid bandwidth reservation conflicts so that network performance does not degrade as the number of hops or the number of nodes in the wireless communication system increases. The MAC also facilitates utilization of multiple channels to maximize the available spectrum and is further configured to dynamically switch between channels to maximize throughput and meet or exceed quality of service (“QoS”) requirements such that QoS is guaranteed and network resources are efficiently utilized.

A method and apparatus for implementing location-based identification in a communication network. The method comprises establishing a network connection between a host and a network, transmitting network data packets from the host through a connection port, transmitting data packets from the host through a location-specific connection port and identifying the port at an access concentrator in the form of a port identifier. The port identifier is then communicated to a network device, typically a gateway device, and stored in a database in communication with the network device. The method may include tagging the network packets at the access concentrator with a port identifier that corresponds to a media access control (MAC) address. The access concentrator and the network device will tag and communicate port numbers by assigning VLAN (Virtual Local Area Network) identifiers to the ports.

A device and method for allocating the same Internet protocol (IP) address to all information terminals or hosts connected to a specific local network, which allows the hosts in the local network to gain access to the Internet while the hosts share a single IP address. The device includes a dynamic host configuration protocol (DHCP) client, a local access point, and a DHCP server spoofer. The DHCP client is allocated an IP address through a DHCP message communication with an Internet service provider. The Internet service provider includes a DHCP server for allocating IP addresses to the hosts and an Internet access gateway. The local access point includes a hardware address port translation (HAPT) module and a local IP address translation (LIAT) module. The HAPT module modifies a source medium access control (MAC) II address and port number of a frame received from each host, stores the modified result in a HAPT table, and recovers a destination MAC address and port number of a frame received from the Internet service provider, referring to the HAPT table. The LIAT module prevents a collision occurring because the hosts have the same public IP address. The DHCP server spoofer implements a DHCP server function to allocate an IP address to each host.

A method aggregates frames to be transmitted over a channel in a wireless network into a single frame. Multiple MSDU frames having identical destination addresses and identical traffic classes, received in the media access control layer from the logical link layer in a transmitting station are aggregated into a single aggregate MPDU frame, which can be transmitted on the channel to a receiving station. In addition, aggregate MSDU frames with different destination addresses and different traffic classes received from the media access control layer can be further aggregated into a single aggregate PPDU frame before transmission.

A method of operation for a node of an Ethernet access network includes issuing a multicast message on the Ethernet access network by a maintenance end point (MEP) of the node. The multicast message contains a name of a target MEP. The node is further operable to receive a unicast reply message from the target MEP, the unicast message reply containing a MEP identifier (MEP-ID) and a MEP Media Access Control (MAC) address of the target MEP. It is emphasized that this abstract is provided to comply with the rules requiring an abstract that will allow a searcher or other reader to quickly ascertain the subject matter of the technical disclosure. It is submitted with the understanding that it will not be used to interpret or limit the scope or meaning of the claims.

A cloud computing environment can be configured to allow third party, user-controlled resources to be included in the pool of resources available in the cloud. The user-controlled resources can include a cloud application to communicate with a cloud management system to coordinate access to the user-controlled resources. The cloud application allows the user to specify the specific set of resources that the cloud can access, such as specific hardware and software resources.

An energy efficient MAC protocol for a sensor network that extends the battery life of remotely located wireless nodes by employing MAC operations involving transmission of a wake-up signal with more processing gain, dynamic adjustment of a transmission rate of synchronization messages for fast time synchronization and an energy efficient neighboring node discovery technique.

Apparatus and methods are described for accessing redacted material based on user roles. An author designates portions of content as to-be-redacted. The author establishes various users roles able to access it and defines attributes or time constraints affecting the viewing/using. Upon electronically saving the content, the to-be-redacted portion is encrypted. An intermediary, such as a keytable service, mediates access between later users and the content. Upon identification of a role of a user attempting to interact with the content, and matching the role to one of the author-established roles, the encrypted redacted portion is decrypted. In this manner, users gain access to content based only on their role. The surrounding events are also loggable, traceable, and verifiable. A monitored connection between the user and the content, as well as various user interface options, are other noteworthy features. Computer program products and computing network interaction are also defined.