AT&T Labs Research — Leading Invention, Driving Innovation

A system and method are provided for use in establishing secure end-to-end communication links over a VPN gateway via a network interface unit. Illustrative embodiments include establishing and providing secure communication relationships between users (customers) and companies for e-commerce and other business purposes. Each company's data and linkage to users remaining private and secure from the other participating companies as well as from the general public over the Internet. Login by user with network interface units, addressing, authentication, and other configuration operations achieved using a web page-based GUI are applied in establishing tunnels from LAN clients to desired VPN destinations. Required authentication exchanges and required encryption key exchanges facilitate the secure communications. Financial arrangements regarding the provisioning and use of network interface units are also disclosed.

A method and system allow a subscriber to test emergency 911 telephone services routed from the subscriber's location over a network to a response center. An alternative dialing code ( 911) is provided for testing, and when a call placed by a subscriber to the alternative dialing code is received in the network, the network identifies the response center to which a 911 call placed from the subscriber's location is routed. An answering device is provided with status information with respect to the identified response center, and calls placed by the subscriber to the alternative dialing code are routed to the answering device, whereby when a subscriber places a call to the alternative dialing code, the answering device will supply the subscriber with status information with respect to the identified response center that receives a 911 call from the subscriber's location.

A system has a switch that allows virtual private networks to be created dynamically. The system includes at least one network. The system also includes a computer having an address. The system also includes a plurality of ports for coupling to the computer. The system also includes a switch that assigns one of the plurality of ports to a private network according to the address of the computer. The switch assigns the port by correlating the address with an address list.

A method and system for location determination and guidance using radio frequency identification (RFID) are disclosed. A location of a mobile RFID reader can be determined by detecting stationary RFID tags located at fixed locations. Each RFID tag stores location information associated with its position as well as location information of at least one other RFID tag. The location information stored by each RFID tag can be used to direct a user from one RFID tag to another. Thus, RFID technology is also used to guide mobile RFID reader between the fixed locations of the stationary RFID tags.

A system and method for providing telephony and high-speed data access over a broadband access network, comprising a network interface unit (NIU) coupled to a backup local exchange carrier (LEC) line, the broadband access network coupled to the NIU, an intermediate point-of-presence (IPOP) coupled to the broadband access network, and at least one external access network coupled to the IPOP. The system also provides for a fail-safe mode in which the NIU supports the LEC line for lifeline services.

An identification tag that is vulnerable to ionizing or non-ionizing radiation and system for determining the presence of radiation based on corrupted or altered memory in the tag is disclosed. An identification tag comprises: a transceiver for receiving an RF signal and transmitting a modulated RF signal; first memory containing a first code for generating the modulated RF signal, the first code being associated with an object for identification; and second memory containing a second code corresponding to a unique identifier for the tag for further modulating the received RF signal, the second memory being specifically vulnerable to ionizing or non-ionizing radiation such that the presence of ionizing or non-ionizing radiation alters or corrupts the second code, wherein the detection of the altered or corrupted code can be employed to indicate the presence of radiation.

The preferred embodiments include a method, system or computer-readable storage medium for identifying analog access line impairments in a communications network. The embodiments include determining a ping packet loss count and a ping failure count from digital packet loss data associated with at least one analog access line. The embodiments also include generating a line designation for the at least one analog access line in response to the ping packet loss count exceeding a first threshold and the ping failure count exceeding a second threshold. Also, a plurality of pings can be transmitted during a testing period, the digital packet loss data being generated in response to the plurality of pings. The first threshold can represent at least a three percent ping packet loss. The second threshold can represent the ping failure count being at least ten percent of a total number of the plurality of pings.

The specification describes a new architecture for RFID systems that is adapted to process large numbers of RFID tags and provide information about a large number of items. The system provides for multiple tag readers. The tag readers are active and have both transmit and receive capability. The system includes a gateway tag that receives information about individual items from the multiple readers and thus contains data on the entire inventory of items. This allows each of the multiple readers to conveniently access data for the entire inventory of items.

A network interface unit is provided for use intermediate a LAN and a public or private network, or a combination of both, for establishing secure links to a VPN gateway. Login by a LAN client with the network interface unit, addressing, authentication, and other configuration operations achieved using a web page-based GUI are applied in establishing tunnels from LAN clients to desired VPN destinations. Illustrative network interface units include a DHCP server and provide encryption-decryption and encapsulation-decapsulation of data packets for communication with VPN nodes. Configuration and connection of a client are further enhanced by a built-in DNS server and other functional servers to provide a high degree of autonomy in establishing connections to a desired VPN gateway via an ISP or other public and/or private network links to. The interface unit then performs required authentication exchanges, and required encryption key exchanges.

A network interface unit is provided for use intermediate a LAN and a public or private network, or a combination of both, for establishing secure links to a VPN gateway. Login by a LAN client with the network interface unit, addressing, authentication, and other configuration operations achieved using a web page-based GUI are applied in establishing tunnels from LAN clients to desired VPN destinations. Illustrative network interface units include a DHCP server and provide encryption-decryption and encapsulation-decapsulation of data packets for communication with VPN nodes. Configuration and connection of a client are further enhanced by a built-in DNS server and other functional servers to provide a high degree of autonomy in establishing connections to a desired VPN gateway via an ISP or other public and/or private network links to. The interface unit then performs required authentication exchanges, and required encryption key exchanges.

A method and system for tracking variable conditions using radio frequency identification (RFID) are disclosed. In embodiments of the present invention, an RFID sensor tag is used to measure a condition. The condition can be any measurable condition such as location, temperature, humidity, pressure, time, date, inertial measurements, etc. Variable data representing the measured condition is read from the RFID sensor tag in order to track the measured condition. The variable data can be read from RFID sensor tags in addition to reading tag identification data from RFID tags, so that the variable data can be associated with tag identification data.

A terminal adapter for guaranteeing the quality of service of both voice and data packets is disclosed. Such quality is ensured by inserting gaps between successive data packets in a stream of multiplexed data and/or voice packets. A gap after a particular data packet is proportional to the size of that particular data packet. In this way, bandwidth is preserved for any voice packets that may have arrived during the transfer of the data packet as well as for any voice packets that arrive during the gap. The unconstrained upstream data bandwidth and the bandwidth used by voice calls may each be estimated by taking a plurality of instantaneous measurements of the available bandwidth and/or taking individual direct measurements. The size of data packets may be limited to a maximum size in order to ensure that time-sensitive voice packets experience only an acceptable delay in queue for transmission.

A system has a switch that allows virtual private networks to be created dynamically. The system includes at least one network. The system also includes a computer having an address. The system also includes a plurality of ports for coupling to the computer. The system also includes a switch that assigns one of the plurality of ports to a private network according to the address of the computer. The switch assigns the port by correlating the address with an address list.

In an arrangement where users are connected to an ISP through a bank of modems, a time-out threshold is then selected for the user based on the user's connection pattern. The threshold is varied dynamically in response to access patterns, in an attempt to trade the benefit accrued by using the ISP's modem and phone line for a shorter period of time, against the inconvenience to the user from having to reestablish a connection to the ISP. Specifically, the time interval between the last disconnection by the user and the time of reconnection is evaluated, and when this time interval is shorter than a preselected threshold, then the time-out threshold is increased. When this time interval is longer than the preselected threshold, then the time-out threshold is decreased. Typically, when the time-out threshold is decreased, it is decreased by a significantly smaller amount that the amount by which it is increased, when it is increased.

In an arrangement where users are connected to an ISP through a bank of modems, a time-out threshold is then selected for the user based on the user's connection pattern. The threshold is varied dynamically in response to access patterns, in an attempt to trade the benefit accrued by using the ISP's modem and phone line for a shorter period of time, against the inconvenience to the user from having to reestablish a connection to the ISP. Specifically, the time interval between the last disconnection by the user and the time of reconnection is evaluated, and when this time interval is shorter than a preselected threshold, then the time-out threshold is increased. When this time interval is longer than the preselected threshold, then the time-out threshold is decreased. Typically, when the time-out threshold is decreased, it is decreased by a significantly smaller amount that the amount by which it is increased, when it is increased.

Techniques employed in packet networks for transferring a packet across subnetworks with different namespaces. When a packet enters a given subnetwork and has a destination in a subnetwork with a different namespace, the given subnetwork encapsulates the packet by adding a header which specifies a decapsulator in the namespace. When the packet arrives at the decapsulator, the decapsulator strips the header and provides the packet to a subnetwork with a different namespace. A particular use of the technique is in a network used for broad-band interactive service. The network has two sub-networks. The first subnetwork is a TV channel which functions as a high-bandwidth forward channel and the second subnetwork is a packet network accessible via a public modem pool which functions as a lower-bandwidth return channel. The encapsulator establishes a connection with the public modem pool and receives an address in the second subnetwork which is temporarily associated with the connection. When the encapsulator receives a packet which is produced in response to a packet received from the TV channel and has a destination address in the sub-network of the TV channel, the encapsulator places a header on it which contains the temporary address and the address of the decapsulator. When the packet arrives at the decapsulator, the decapsulator removes the header and provides the packet to the second sub-network.

Techniques employed in packet networks for transferring a packet across subnetworks with different namespaces. When a packet enters a given subnetwork and has a destination in a subnetwork with a different namespace, the given subnetwork encapsulates the packet by adding a header which specifies a decapsulator in the namespace. When the packet arrives at the decapsulator, the decapsulator strips the header and provides the packet to a subnetwork with a different namespace. A particular use of the technique is in a network used for broad-band interactive service. The network has two sub-networks. The first subnetwork is a TV channel which functions as a high-bandwidth forward channel and the second subnetwork is a packet network accessible via a public modem pool which functions as a lower-bandwidth return channel. The encapsulator establishes a connection with the public modem pool and receives an address in the second subnetwork which is temporarily associated with the connection. When the encapsulator receives a packet which is produced in response to a packet received from the TV channel and has a destination address in the sub-network of the TV channel, the encapsulator places a header on it which contains the temporary address and the address of the decapsulator. When the packet arrives at the decapsulator, the decapsulator removes the header and provides the packet to the second sub-network.