公开(公告)号：US07395549B1

公开(公告)日：2008-07-01

申请号：US09691278

申请日：2000-10-17

申请人： Radia J. Perlman ,  Stephen R. Hanna

发明人： Radia J. Perlman ,  Stephen R. Hanna

IPC分类号： H04L9/00

CPC分类号： H04L9/083 ,  H04L9/0825 ,  H04L9/3213 ,  H04L9/3265

摘要： One embodiment of the present invention provides a system for operating a key distribution center (KDC) that provides keys to facilitate secure communications between clients and servers across a computer network, wherein the system operates without having to store long-term server secrets. The system operates by receiving a communication from a server at the KDC. This communication includes an identifier for the server, as well as a temporary secret key to be used in communications between a client and the server for a limited time period. In response the communication, the system attempts to authenticate the server. If the server is successfully authenticated, the system stores the temporary secret key at the KDC, so that the temporary secret key can be subsequently used to facilitate communications with the server. Upon subsequently receiving a request at the KDC from a client that desires to communicate with the server, the system produces a session key to be used in communications between the client and server, and then creates a ticket to the server by encrypting an identifier for the client and the session key with the temporary secret key for the server. Next, the system assembles a message that includes the identifier for the server, the session key and the ticket to the server, and sends the message to the client in a secure manner. The system subsequently allows the client to forward the ticket to the server in order to initiate communications between the client and the server.

摘要翻译： 本发明的一个实施例提供了一种用于操作密钥分发中心（KDC）的系统，其提供密钥以促进跨越计算机网络的客户端和服务器之间的安全通信，其中系统在不必存储长期服务器秘密的情况下操作。 系统通过从KDC的服务器接收通信来进行操作。 该通信包括用于服务器的标识符，以及在有限时间段内在客户端和服务器之间的通信中使用的临时秘密密钥。 为响应通信，系统尝试对服务器进行身份验证。 如果服务器成功认证，则系统将临时密钥存储在KDC，以便随后可以使用临时密钥来促进与服务器的通信。 在随后从客户端收到希望与服务器进行通信的客户端的请求时，系统产生用于客户端与服务器之间的通信中的会话密钥，然后通过加密用于 客户端和会话密钥与服务器的临时秘密密钥。 接下来，系统组装包括服务器的标识符，会话密钥和到服务器的故障单的消息，并以安全的方式将消息发送给客户端。 系统随后允许客户机将票转发到服务器，以便启动客户端和服务器之间的通信。

公开(公告)号：US07339900B2

公开(公告)日：2008-03-04

申请号：US10671643

申请日：2003-09-26

申请人： Radia J. Perlman

发明人： Radia J. Perlman

IPC分类号： H04L12/28

CPC分类号： H04L45/28 ,  H04L12/4625 ,  H04L45/18 ,  H04L45/48

摘要： One embodiment of the present invention provides a system that prevents loops from occurring when spanning tree configuration messages are lost while executing a spanning tree protocol on bridges in a network. During operation, the system executes the spanning tree protocol on a bridge. This spanning tree protocol configures each port coupled to the bridge into either a forwarding state, in which messages are forwarded to and from the port, or a backup state, in which messages are not forwarded to or from the port. The system also monitors ports coupled to the bridge to determine when messages are lost by the ports. If one or more messages are lost on a port, the system refrains from forwarding messages to or from the port until no messages are lost by the port for an amount of time.

摘要翻译： 本发明的一个实施例提供了一种在网络中的桥上执行生成树协议时防止生成树配置消息丢失时发生环路的系统。 在运行过程中，系统在桥上执行生成树协议。 该生成树协议将耦合到网桥的每个端口配置为转发状态，其中消息被转发到端口或从端口转发，或者备份状态，其中消息不被转发到端口或从端口转发。 系统还监视耦合到网桥的端口，以确定端口何时丢失消息。 如果端口上有一个或多个消息丢失，则系统将禁止向端口转发消息，直到端口丢失一段消息。

公开(公告)号：US07016499B2

公开(公告)日：2006-03-21

申请号：US09880470

申请日：2001-06-13

申请人： Radia J. Perlman

发明人： Radia J. Perlman

IPC分类号： H04L9/00

CPC分类号： H04L9/083 ,  H04L9/088

摘要： A method and apparatus for securely communicating ephemeral information from a first node to a second node. In a first embodiment, the first node encodes and transmits an ephemeral message encrypted at least in part with an ephemeral key, from the first node to the second node. Only the second node has available to it the information that is needed to achieve decryption by an ephemeral key server of a decryption key that is needed to decrypt certain encrypted payload information contained within the message communicated from the first node to the second node. In a second embodiment the first node transmits to the second node an ephemeral message that is encrypted at least in part with an ephemeral key. The ephemeral message includes enough information to permit the second node to communicate at least a portion of the message to an ephemeral key server and for the ephemeral key server to verify that the second node is an authorized decryption agent for the message. After verifying that the second node is an authorized decryption agent for the message, the ephemeral key server returns to the second node an encrypted decryption key that is needed to decrypt the encrypted message. The ephemeral message may comprise an encrypted decryption key that may be used after decryption of the decryption key to decrypt other encrypted information communicated to the second node.

公开(公告)号：US06801998B1

公开(公告)日：2004-10-05

申请号：US09439246

申请日：1999-11-12

申请人： Stephen R. Hanna ,  Anne H. Anderson ,  Yassir K. Elley ,  Radia J. Perlman ,  Sean J. Mullan

发明人： Stephen R. Hanna ,  Anne H. Anderson ,  Yassir K. Elley ,  Radia J. Perlman ,  Sean J. Mullan

IPC分类号： H04L900

CPC分类号： H04L63/045 ,  H04L63/065 ,  H04L63/105

摘要： A method and system for granting an applicant associated with a client computer in a client-server system access to a requested service without providing the applicant with intelligible information regarding group membership. The applicant transmits a request for service to an application server over a computer network. In response, the application server prepares an encrypted message which includes the identification of the group or groups having access privileges and transmits the encrypted message to the client along with a request that the client prove membership in at least one of the groups. The message is encrypted with an encryption key which can be decrypted by a group membership server.

摘要翻译： 一种方法和系统，用于在客户机 - 服务器系统中授予与客户端计算机相关联的申请人访问所请求的服务，而不向申请人提供关于组成员身份的可理解信息。 申请人通过计算机网络向应用服务器发送服务请求。 作为响应，应用服务器准备加密的消息，其包括具有访问权限的组或组的标识，并且将客户端证明成员资格的请求与客户端一起发送给客户端。 消息使用加密密钥进行加密，加密密钥可以由组成员服务器进行解密。

公开(公告)号：US06590895B1

公开(公告)日：2003-07-08

申请号：US09173228

申请日：1998-10-15

申请人： Amit Gupta ,  Radia J. Perlman

发明人： Amit Gupta ,  Radia J. Perlman

IPC分类号： H04L1256

CPC分类号： H04L1/1614 ,  H04L1/1809 ,  H04L2001/0095

摘要： Protocols that provide more efficient operation in dynamic and heterogeneous networking environments are defined. The protocols present a range of levels of error control and sequence order control. Traffic in a link between neighboring network devices is segregated into flows. Each flow is managed in accordance with a selected protocol. It is possible to simultaneously employ different protocols for respective flows within the link.

摘要翻译： 定义了在动态和异构网络环境中提供更高效运行的协议。 协议提供了一系列的错误控制和序列顺序控制。 在相邻网络设备之间的链路中的流量被隔离成流。 每个流程根据选定的协议进行管理。 可以同时为链路内的各个流使用不同的协议。

公开(公告)号：US06580722B1

公开(公告)日：2003-06-17

申请号：US09138586

申请日：1998-08-21

申请人： Radia J. Perlman

发明人： Radia J. Perlman

IPC分类号： H04J326

CPC分类号： H04L12/1836 ,  H04L12/185 ,  H04L12/1886

摘要： Data units are tunneled through topological restrictions that reside in a path between a first network device and a second network device. For example, a remote network device that resides outside of the domain of a multicast group obtains access to the multicast group by tunneling through the boundary of the domain. A proxy device within the domain functions as a member of the multicast group on behalf of the remote network device. Data units that are transmitted from the remote network device to the proxy device are tunneled to the multicast group via the proxy device. Data units that are transmitted from the multicast group to the proxy device are tunneled to the remote network device via the proxy device.

摘要翻译： 数据单元通过驻留在第一网络设备和第二网络设备之间的路径中的拓扑限制进行隧道传送。 例如，驻留在组播组域之外的远程网络设备通过隧道通过域的边界获得对多播组的访问。 域内的代理设备作为组播组的成员，代表远程网络设备。 从远程网络设备传输到代理设备的数据单元通过代理设备被隧道传输到组播组。 从组播组发送到代理设备的数据单元通过代理设备被隧道传输到远程网络设备。

公开(公告)号：US06473431B1

公开(公告)日：2002-10-29

申请号：US09346801

申请日：1999-07-02

申请人： Radia J. Perlman ,  Stephen R. Hanna

发明人： Radia J. Perlman ,  Stephen R. Hanna

IPC分类号： H04L1256

CPC分类号： H04L45/00 ,  H04L45/20

摘要： A network includes routers which route message packets among devices, thereby to facilitate transfer of information thereamong. Each router node makes use of routing information that identifies, inter alia, addresses and address ranges for which other router nodes are responsible, that the respective router node uses in routing a message packet that it receives. Each router node, through a negotiation operation with other router nodes, attempts to aggregate addresses for which it is responsible into one or more address ranges which do not overlap with addresses for which the other router nodes are responsible, and provides the address range(s), along with addresses for which it is responsible which could not be so aggregated, to the other router nodes for use as their routing information. Several methodologies are described for use in connection with the negotiation operations.

摘要翻译： 网络包括在设备之间路由消息分组的路由器，从而便于传输信息。 每个路由器节点利用路由信息，该路由信息特别地标识其他路由器节点负责的地址和地址范围，各路由器节点在路由接收到的消息分组时使用路由信息。 每个路由器节点通过与其他路由器节点的协商操作，尝试将其负责的地址聚合到与其他路由器节点负责的地址不重叠的一个或多个地址范围内，并提供地址范围 ）以及其不负责的地址不能如此聚合到其他路由器节点以用作其路由信息。 描述了与讨论操作有关的几种方法。

公开(公告)号：US06263434B1

公开(公告)日：2001-07-17

申请号：US09399899

申请日：1999-09-21

申请人： Stephen R. Hanna ,  Anne H. Anderson ,  Yassir K. Elley ,  Radia J. Perlman ,  Sean J. Mullan

发明人： Stephen R. Hanna ,  Anne H. Anderson ,  Yassir K. Elley ,  Radia J. Perlman ,  Sean J. Mullan

IPC分类号： A61F238

CPC分类号： H04L9/3247 ,  G06Q20/3821 ,  H04L2209/60

摘要： A method and apparatus for identifying an applicant as a member of a group without explicitly listing all possible applicants. A test is defined which specifies the criteria for group membership. The test definition and an optional group identifier code are supplied to a criterion generator. The criterion generator generates an authenticated message based, at least in part, upon said test definition. The authenticated message is delivered to one or more criterion evaluators that verify the authenticated message. In one embodiment, once the authenticated message has been verified, the applicant for access to a resource presents a credential to the criterion evaluator. If the credential satisfies the test definition, the applicant is granted access to the specified resource and denied access if the credential does not satisfy the test definition. In another embodiment, upon presentation of a suitable credential to the criterion evaluator, the criterion evaluator produces a group membership credential that may be presented to an actuator that is not in communication with the criterion evaluator. If the actuator determines that the group membership credential is authentic, the applicant is granted access to the resource.

摘要翻译： 用于将申请人识别为组的成员而不明确列出所有可能的申请人的方法和装置。 定义了一个测试，该测试指定了组成员资格的标准。 测试定义和可选组标识符代码被提供给标准生成器。 标准生成器至少部分地基于所述测试定义生成认证消息。 已验证的消息被传递给验证已验证消息的一个或多个标准评估器。 在一个实施例中，一旦经过认证的消息已被验证，对资源的访问的申请人向标准评估者呈现凭证。 如果凭证满足测试定义，则授予申请人访问指定的资源，如果凭证不符合测试定义，则拒绝访问。 在另一个实施例中，在向标准评估器呈现合适的凭证之后，标准评估器产生可以呈现给不与标准评估器通信的致动器的组成员凭证。 如果执行器确定组成员凭证是真实的，则授予申请人对该资源的访问权限。

公开(公告)号：US6055316A

公开(公告)日：2000-04-25

申请号：US998520

申请日：1997-12-26

申请人： Radia J. Perlman ,  Stephen R. Hanna

发明人： Radia J. Perlman ,  Stephen R. Hanna

IPC分类号： G09C1/00 ,  H04L9/12 ,  H04L9/00

CPC分类号： H04L9/0637 ,  H04L9/0643

摘要： A secure communications arrangement is disclosed including a source device and a destination device interconnected by a network. The source device generates message packets for transfer to the destination device, each message packet including information in ciphertext form. The source device generates the ciphertext from plaintext in accordance with the cipher block chaining mode, using an initialization vector that is generated using a hash function selected so that small changes in an input result in large changes in the initialization vector. As a result values such as sequence numbers or time stamps can be used in generating the initialization vector, while still providing for cryptographic security for the ciphertext as against cryptanalytic attack. The destination device receives the message packet and decrypts the ciphertext to generate plaintext in accordance with the cipher block chaining mode, using an initialization vector that is generated using the corresponding hash function. Although the secure communications arrangement is described in connection with the cipher block chaining mode, other modes, such as the cipher-feedback mode, output-feedback mode and other encryption modes which make use of initialization vectors, could also be used.

摘要翻译： 公开了一种安全通信装置，其包括由网络互连的源设备和目的设备。 源设备生成用于传送到目的设备的消息分组，每个消息分组包括密文形式的信息。 源设备根据密码块链接模式，使用使用选择的散列函数生成的初始化向量，从明文生成密文，使得输入中的小变化导致初始化向量的大的变化。 因此，可以使用诸如序列号或时间戳的值来生成初始化向量，同时仍然为密文提供加密安全性以防止密码分析攻击。 目的设备使用使用相应散列函数生成的初始化向量，接收消息分组并解密密文以根据密码块链接模式生成明文。 虽然结合密码块链接模式描述了安全通信布置，但是也可以使用诸如密码反馈模式，输出反馈模式和利用初始化向量的其他加密模式的其他模式。

公开(公告)号：US5781534A

公开(公告)日：1998-07-14

申请号：US550981

申请日：1995-10-31

申请人： Radia J. Perlman ,  Neal D. Castagnoli

发明人： Radia J. Perlman ,  Neal D. Castagnoli

IPC分类号： H04L12/56

CPC分类号： H04L45/00 ,  H04L45/26

摘要： An information gathering mechanism efficiently acquires information about a path interconnecting a source node and a destination node in a computer network. The mechanism comprises a novel packet configuration for soliciting parameters pertaining to network characteristics from routers coupled to the path. This novel probe packet preferably has a flexible format so that it may be processed not only by routers configured to interpret this type of packet, but also those that are incapable of either supplying some of the parameters or, further, deciphering any of the contents of the packet.

摘要翻译： 信息收集机制有效地获取关于在计算机网络中互连源节点和目的地节点的路径的信息。 该机制包括用于从与路径相连的路由器请求与网络特性有关的参数的新颖分组配置。 这种新颖的探测分组优选地具有灵活的格式，使得它不仅可以被配置为解释这种类型的分组的路由器被处理，而且还可以被处理不能提供一些参数的那些，或者进一步解密 包。