-
公开(公告)号：US06212184B1
公开(公告)日：2001-04-03
申请号：US09115886
申请日：1998-07-15
IPC分类号： H04L1256
CPC分类号： H04L45/745 , H04L45/00 , H04L45/7457 , H04L49/25 , H04L49/3009 , H04L49/602
摘要： Fast, scalable methods and devices are provided for layer four switching in a router as might be found in the Internet. In a first method, a grid of tries, which are binary branching trees, is constructed from the set of routing filters. The grid includes a dest-trie and a number of source tries. To avoid memory blowup, each filter is stored in exactly one trie. The tries are traversed to find the lowest cost routing. Switch pointers are used to improve the search cost. In an extension of this method, hash tables may be constructed that point to grid-of-tries structures. The hash tables may be used to handle combinations of port fields and protocol fields. Another method is based on hashing, in which searches for lowest cost matching filters take place in bit length tuple space. Rectangle searching with precomputation and markers are used to eliminate a whole column of tuple space when a match occurs, and to eliminate the rest of a row when no match is found. Various optimizations of these methods are also provided. A router incorporating memory and processors implementing these methods is capable of rapid, selective switching of data packets on various types of networks, and is particularly suited to switching on Internet Protocol networks.
摘要翻译： 为在互联网中可能找到的路由器中的第四层交换提供了快速，可扩展的方法和设备。 在第一种方法中，从一组路由过滤器构建一个作为二叉分支树的尝试网格。 网格包括一个目标和一些源尝试。 为了避免内存溢出，每个过滤器都存储在正好一个特里。 遍历尝试以找到最低成本的路由。 切换指针用于提高搜索成本。 在该方法的扩展中，可以构造指向尝试结构的哈希表。 哈希表可用于处理端口字段和协议字段的组合。 另一种方法是基于散列，其中最低成本匹配滤波器的搜索发生在位长度元组空间中。 使用预先计算和标记的矩形搜索用于在发生匹配时消除整列元组空间，并且在找不到匹配时消除其余行。 还提供了这些方法的各种优化。 包含实现这些方法的内存和处理器的路由器能够在各种类型的网络上快速，选择性地切换数据分组，并且特别适合于互联网协议网络上的切换。
-
公开(公告)号：US06195751B1
公开(公告)日：2001-02-27
申请号：US09066020
申请日：1998-04-24
申请人： Germano Caronni , Marcel Waldvogel
发明人： Germano Caronni , Marcel Waldvogel
IPC分类号： H04K100
CPC分类号： H04L63/0428 , H04L12/185 , H04L12/1863 , H04L63/062 , H04L63/065 , H04L63/104 , H04L2463/102
摘要： A system for secure multicast including a plurality of participants that can send and receive multicast messages. A traffic distribution component is coupled to the participating entities, where the traffic distribution component supports multiple receiver communication. A participant key management component operates within each participant entity where the participant key management component uses a first key that is shared with all of the other participants, and a second key that is shared with a subgroup of participants. A group key management component is implemented using a flat data structure having a size that is logarithmically proportional to the number of participants.
摘要翻译： 一种用于安全组播的系统，包括可以发送和接收多播消息的多个参与者。 流量分配组件耦合到参与实体，其中业务分配组件支持多个接收机通信。 参与者密钥管理组件在每个参与者实体中操作，其中参与者密钥管理组件使用与所有其他参与者共享的第一密钥，以及与参与者的子组共享的第二密钥。 使用具有与参与者的数量成对数比例的大小的平面数据结构来实现组密钥管理组件。
-
公开(公告)号：US6049878A
公开(公告)日：2000-04-11
申请号：US9475
申请日：1998-01-20
申请人： Germano Caronni , Marcel Waldvogel
发明人： Germano Caronni , Marcel Waldvogel
CPC分类号： H04L9/0891 , H04L63/0428 , H04L63/065 , H04L9/0836
摘要： A system for secure multicast including at least one sending entity operating on a sending computer system, the sending entity with a sending multicast application running on the sending computer system. A number of receiving entities each running on a receiving computer system, the receiving entities having a receiving multicast application running. A traffic distribution component coupled to the sending entity and each of the receiving entities, where the traffic distribution component supports a connectionless datagram protocol. A participant key management component operates within each receiver entity where the participant key management component holds a first key that is shared with the sender and all of the receiving entities, and a second key that is shared with the sender and at least one but less than all of the receiving entities. A group key management component is coupled to the traffic distribution component and includes a data structure for storing all of the participant first and second keys.
摘要翻译： 一种用于安全组播的系统，包括在发送计算机系统上操作的至少一个发送实体，所述发送实体具有在所述发送计算机系统上运行的发送多播应用。 多个在接收计算机系统上运行的接收实体，接收实体具有运行的接收多播应用。 流量分配组件耦合到发送实体和每个接收实体，其中业务分配组件支持无连接数据报协议。 参与者密钥管理组件在每个接收者实体内操作，其中参与者密钥管理组件保持与发送者和所有接收实体共享的第一密钥，以及与发送者共享的第二密钥，以及至少一个但小于 所有接收实体。 组密钥管理组件耦合到流量分配组件，并且包括用于存储所有参与者第一和第二密钥的数据结构。
-
14.发明授权Identifying a distributed denial of service (DDOS) attack within a network and defending against such an attack 失效识别网络中的分布式拒绝服务（DDOS）攻击，并防范此类攻击公开(公告)号：US07921462B2
公开(公告)日：2011-04-05
申请号：US12126976
申请日：2008-05-26
CPC分类号： H04L63/1425 , H04L63/1458 , H04L2463/141
摘要： The invention provides methods, apparatus and systems for detecting distributed denial of service (DDoS) attacks within the Internet by sampling packets at a point or points in Internet backbone connections to determine a packet metric parameter. The packet metric parameter which might comprise the volume of packets received is analyzed over selected time intervals with respect to specified geographical locations in which the hosts transmitting the packets are located. The expected behavior can be employed to identify traffic distortions revealing a DDoS attack. In a complementary aspect, the invention provides a method of authenticating packets at routers in order to elevate the QoS of authenticated packets. This method can be used to block or filter packets and can be used in conjunction with the DDoS attack detection system to defend against DDoS attacks within the Internet in a distributed manner.
摘要翻译： 本发明提供了通过在因特网骨干连接点或点采样分组来检测因特网内的分布式拒绝服务（DDoS）攻击的方法，装置和系统，以确定分组度量参数。 可以根据发送分组的主机所在的指定地理位置的选定时间间隔分析可能包括接收到的分组量的分组度量参数。 可以使用预期的行为来识别暴露DDoS攻击的流量扭曲。 在互补的方面，本发明提供了一种在路由器上认证分组的方法，以便提高认证分组的QoS。 该方法可用于阻止或过滤报文，并可与DDoS攻击检测系统结合使用，以分布式的方式防范互联网内的DDoS攻击。
-
公开(公告)号：US07562293B2
公开(公告)日：2009-07-14
申请号：US11140189
申请日：2005-05-27
CPC分类号： G06F17/2247 , G06F17/2725
摘要： A data processing method comprises receiving an electronically parseable document, scanning the document according to at least one predefined rule to determine if the document is suspicious, and, if the document is determined not to be suspicious, parsing the document with a first parser, and, if the document is determined to be suspicious, parsing the document with a second parser.
摘要翻译： 数据处理方法包括接收电子可解析文档，根据至少一个预定义规则扫描文档以确定文档是否可疑，以及如果文档被确定为不可疑，则用第一解析器解析文档，以及 如果文档被确定为可疑，则使用第二个解析器解析文档。
-
公开(公告)号：US20090055728A1
公开(公告)日：2009-02-26
申请号：US12191652
申请日：2008-08-14
申请人： Marcel Waldvogel , Jan Van Lunteren , Andreas Kind
发明人： Marcel Waldvogel , Jan Van Lunteren , Andreas Kind
IPC分类号： G06F17/00
CPC分类号： G06F17/272 , G06F17/2247 , H03M7/30 , H03M7/3088
摘要： This invention provides methods, apparatus, and systems for decompressing electronic documents. Utility of this invention includes use in validation and parsing of compressed XML documents. An example data processing method comprises receiving a compressed electronic document, decompressing the document and executing an analysis of the document during the decompression. The analysis determines whether the document conforms to defined syntax rules. In one example, a compressed XML document, while it is being decompressed, following receipt, will be parsed and/or validated at the same time.
摘要翻译： 本发明提供了用于解压缩电子文档的方法，装置和系统。 本发明的实用性包括用于验证和解析压缩的XML文档。 示例性数据处理方法包括在解压缩期间接收压缩的电子文档，解压缩文档和执行文档的分析。 分析确定文档是否符合定义的语法规则。 在一个示例中，压缩的XML文档在被解压缩之后，在收到之后将被同时解析和/或验证。
-
17.发明授权System and program storage device for controlling data packet flows by manipulating data packets according to an actual manipulation rate 失效系统和程序存储装置，用于根据实际操纵速率操纵数据包来控制数据包流公开(公告)号：US07869365B2
公开(公告)日：2011-01-11
申请号：US12215007
申请日：2008-06-24
IPC分类号： H04L12/26
CPC分类号： H04L47/10 , H04L47/12 , H04L47/193 , H04L47/283
摘要： A network device and a computer program element are introduced for controlling data packet flows in a network device by manipulating data packets according to an actual manipulation rate. Amongst data packets received by a network device such as a router, data packets are identified that are marked with a pattern according to a congestion notification scheme. A pattern rate of data packets comprising such a pattern is determined, and the actual manipulation rate is determined subject to the pattern rate.
摘要翻译： 引入网络设备和计算机程序元件，以通过根据实际操纵速率操纵数据分组来控制网络设备中的数据分组流。 在由诸如路由器的网络设备接收的数据分组中，根据拥塞通知方案识别出标记有模式的数据分组。 确定包含这种模式的数据分组的模式速率，并根据模式速率确定实际的操纵速率。
-
18.发明授权Controlling data packet flows by manipulating data packets according to an actual manipulation rate 失效通过根据实际操作速率操纵数据包来控制数据包流公开(公告)号：US07468947B2
公开(公告)日：2008-12-23
申请号：US10808995
申请日：2004-03-25
申请人： Soenke Mannal , Roman A. Pletka , Marcel Waldvogel
发明人： Soenke Mannal , Roman A. Pletka , Marcel Waldvogel
IPC分类号： H04L12/26
CPC分类号： H04L47/10 , H04L47/12 , H04L47/193 , H04L47/283
摘要： A method for controlling data packet flows in a network device by manipulating data packets according to an actual manipulation rate. Amongst data packets received by a network device such as a router, data packets are identified that are marked with a pattern according to a congestion notification scheme. A pattern rate of data packets comprising such a pattern is determined, and the actual manipulation rate is determined subject to the pattern rate.
摘要翻译： 一种通过根据实际操作速率操纵数据分组来控制网络设备中的数据分组流的方法。 在由诸如路由器的网络设备接收的数据分组中，根据拥塞通知方案识别出标记有模式的数据分组。 确定包含这种模式的数据分组的模式速率，并根据模式速率确定实际的操纵速率。
-
公开(公告)号：US20080184105A1
公开(公告)日：2008-07-31
申请号：US12059913
申请日：2008-03-31
IPC分类号： G06F17/27
CPC分类号： G06F17/2247 , G06F17/2725
摘要： A data processing method comprises receiving an electronically parseable document, scanning the document according to at least one predefined rule to determine if the document is suspicious, and, if the document is determined not to be suspicious, parsing the document with a first parser, and, if the document is determined to be suspicious, parsing the document with a second parser.
摘要翻译： 数据处理方法包括接收电子可解析文档，根据至少一个预定义规则扫描文档以确定文档是否可疑，以及如果文档被确定为不可疑，则用第一解析器解析文档，以及 如果文档被确定为可疑，则使用第二个解析器解析文档。
-
公开(公告)号：US20060288028A1
公开(公告)日：2006-12-21
申请号：US11443525
申请日：2006-05-30
申请人： Marcel Waldvogel , Jan Lunteren , Andreas Kind
发明人： Marcel Waldvogel , Jan Lunteren , Andreas Kind
CPC分类号： G06F17/272 , G06F17/2247 , H03M7/30 , H03M7/3088
摘要： This invention provides methods, apparatus and systems for decompressing electronic documents. Utility of this invention includes use in validation and parsing of compressed XML documents. An example data processing method comprises receiving a compressed electronic document, decompressing the document and executing an analysis of the document during the decompression. The analysis determines whether the document conforms to defined syntax rules. In one example, a compressed XML document, while it is being decompressed, following receipt, will be parsed and/or validated at the same time.
摘要翻译： 本发明提供用于解压缩电子文档的方法，装置和系统。 本发明的实用性包括用于验证和解析压缩的XML文档。 示例性数据处理方法包括在解压缩期间接收压缩的电子文档，解压缩文档和执行文档的分析。 分析确定文档是否符合定义的语法规则。 在一个示例中，压缩的XML文档在被解压缩之后，在收到之后将被同时解析和/或验证。
-
-
-
-
-
-
-
-
-
搜索结果
30 条记录 (耗时 0.024 秒)
