Patent Grant
7574597
1. Field of the Invention
The present invention relates generally to communication networks, and more specifically, to the monitoring of data transmitted over such networks.
2. Description of Related Art
Communication networks typically include a number of interconnected communication devices. Connections among the devices in some communication networks are accomplished through physical wires or optical links. Such networks may be referred to as “wired” networks. Connections among the devices in other communication networks are accomplished through radio, infrared, or other wireless links. Such networks may be referred to as “wireless” networks.
Communication messages (e.g., data packets) sent across communication networks may be intercepted. Intercepted messages may yield valuable information, and the process of intercepting and analyzing messages may be referred to as “traffic analysis.” In general, traffic analysis seeks to understand something about the message traffic by observing the traffic and analyzing that traffic to extract information. To guard against unwanted traffic analysis, messages are typically encrypted. For example, both the content and the destination of a message could be obscured through encryption.
In some situations, however, it may still be desirable to monitor traffic flow over communication networks. Accordingly, there is a need to monitor traffic flow even when identifying information associated with the messages is encrypted.
Methods and systems consistent with the present invention address this and other needs by detecting chunks of data, determining characteristics of the detected chunks, and encoding the characteristics into one or more signals that are amenable to further processing.
In accordance with one purpose of the invention as embodied and broadly described herein, a method of acquiring information about communication among nodes in a network may include intercepting chunks of data in the network by a tap located among the nodes in the network. Characteristic information about the intercepted chunks of data may be obtained. The characteristic information may include times of arrival of the chunks of data at the tap and identifiers of source nodes that sent the chunks of data. At least one signal may be constructed to represent the characteristic information over time.
In another implementation consistent with the present invention, a method of acquiring information about communication among nodes in a network may include intercepting chunks of data in the network by a tap located among the nodes in the network. Characteristic information about the intercepted chunks of data may be obtained. The characteristic information may include times of arrival of the chunks of data at the tap and durations of the chunks of data. At least one signal may be constructed to represent the characteristic information over time.
In a further implementation consistent with the present invention, a method of acquiring information about communication among nodes in a network may include intercepting chunks of data in the network by a tap located among the nodes in the network. Characteristic information about the intercepted chunks of data may be obtained. The characteristic information may include times of arrival of the chunks of data at the tap, durations of the chunks of data, and identifiers of source nodes that sent the chunks of data. At least one signal may be constructed to represent the characteristic information over time.
In yet another implementation consistent with the present invention, a computer-readable medium that stores instructions executable by one or more processors to perform a method for acquiring information about communication in a network may include instructions for detecting chunks of data in the network by a tap located among the nodes in the network. The medium may also include instructions for obtaining times of arrival of the chunks of data at the tap. The instructions may further cause identifiers of source nodes that sent the chunks of data to be obtained. Other instructions may cause at least one signal that represents the times of arrival of the chunks of data and the identifiers of source nodes over time to be constructed.
The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate an embodiment of the invention and, together with the description, explain the invention. In the drawings,
The following detailed description of the invention refers to the accompanying drawings. The same reference numbers in different drawings may identify the same or similar elements. Also, the following detailed description does not limit the invention. Instead, the scope of the invention is defined by the appended claims and equivalents.
Data encryption may hide the contents of packets (i.e., discrete units of data), but it does not obscure basic protocol mechanisms and dynamics. Some examples of these basic mechanisms may include the packet's source, destination, and the interpacket gaps caused by certain applications.
Methods and systems consistent with the principles of the invention detect chunks of data and determine characteristics of the detected chunks. The characteristics may be encoded into one or more signals that are amenable to further processing.
Network nodes 110 may be configured to send and receive information according to a communication protocol, such as TCP/IP. Although not specifically shown, some nodes 110 may be configured to provide a route for information to a specified destination. Other nodes 110 may be configured to send the information according to a previously-determined route. The network nodes 110 may communicate via discrete “chunks” of data (i.e., separate pieces of data that extend over a period of time) that are transmitted by “senders” 110. A chunk may be individually detectable or distinguishable (i.e., a listening device, such as tap 120, may determine when a chunk starts and ends). A chunk of data need not exactly correspond to a packet of data. A chunk may represent part of a packet (e.g., a fragment or an ATM cell of an AAL5 PDU), or multiple packets (e.g., two packets concatenated).
Chunks of data may be transmitted by “senders” 110. A sender 110 may be the most recent node 110 to transmit a particular chunk (e.g., node n3 in
Network links 115 may include electronic links (e.g., wires or coaxial cables) and optical links (e.g., fiber optic cables). These links 115 may provide a connection between two nodes 110 (e.g., nodes n1 and n3). It may be possible to physically tap into these links 115 to observe the information carried on them.
Network tap 120 is a device that may intercept chunk transmissions on the network 100. The tap 120 may include a physical connection to a corresponding link 115 and circuitry to detect chunks of data on the link 115. The tap 120 may intercept chunks at a physical layer, a link layer, a network layer, or at higher layers of the network 100 being monitored. The layer at which interceptions occur is within the abilities of those skilled in the art, and may be chosen based on knowledge of, and access to, the network links 115. The tap 120 may include, for example, a transceiver for sensing the chunks of data and may also include other circuitry (e.g., clock circuitry) for determining times of arrival and duration of the chunks. The tap 120 may include a processor for computing any other information associated with the chunks, such as information contained within a header of the chunk of data (e.g., identity of a sending node and/or receiving node).
In the example of
The tracefile may contain a minimum amount of information for each observed chunk. For example, the information may include the time the chunk was seen and the identity of the sender 110 of the chunk. The identity of the sender 110 may include, for example, the IP address of an IPsec gateway, the upstream or downstream transmitter on the point-to-point link 115, or “the same sender 110 as the one that also sent these other chunks.” If available, the tracefile may also include additional information about the length or duration of the chunk, the destination node 110, or any insight into the contents of the chunk. Other information that may be available is the location of the tap 120 along the link 115 relative to the nodes 110 at either end of the link 115.
Tap 120 may not capture all traffic on the link 115. For example, tap 120 may occasionally make an error and mistakenly believe it has seen a chunk when no chunk was sent (e.g., due to bit errors on wired network 100). If transmissions are missed, false transmissions are detected, or if a sender 110 is misclassified, these events may be viewed as adding noise to the signals generated by the tap 120. Other sources of noise in the signal generated by the tap 120 may include interference from other signals (e.g., packets belonging to another flow, or jitter in timing due to sharing of a bottleneck among multiple flows).
Tap 120 may listen passively and may not participate in the monitored network 100 at the MAC (or higher) layers. In some cases, for example with 802.3 LANs, it is possible for the tap 120 to snoop at the MAC layer and extract some information about higher layer protocols. In the case of SONET networks, however, little or no information may be available about the MAC or higher layer protocols. Such passive listening may also be referred to as covert information collection.
Although a single tap 120 is shown in
A tap 120 (or a network of taps 120) should store the transmissions that it detects for a sufficient amount of time. For example, the round-trip time of a transport layer flow cannot be determined if the history that may be stored at tap 120 is less than one roundtrip time. The total volume of data that is stored depends on the capacity of the link 115 and the maximum round-trip time of flows seen on the link 115. Taps 120 may assign a unique identifier to each sender 110, for example, based on the address of the IPsec gateway. Taps 120 in the network 100 may assign the same unique identifier to any given sender 110.
Although six nodes 210 and one tap 220 are shown in
Wireless nodes 210 may communicate via chunks of data that are transmitted by wireless senders 210. Senders 210 may transmit using various types of wireless physical layers, such as terrestrial RF, satellite bands, and free space optical. Wireless nodes 210 may be, for example, radio routers or client radios in the wireless network 200.
Wireless tap 220 is a device that may intercept wireless transmissions on the network 200. Unlike tap 120, which may detect chunks of data only on a certain link 115, wireless tap 220 may observe some (potentially very large) fraction of the wireless spectrum, and thus may see transmissions from a wide range of wireless senders 220. As shown in
Wireless tap 220 also may record information about all the chunks that it observes in a tracefile. The tracefile may contain a minimum amount of information for each observed chunk. For example, the information may include the time the chunk was seen and the identity of the wireless sender 210 of the chunk. The identity of the wireless sender 210 may include, for example, an RF signature, the location of a radio transmitter 210, or “the same wireless sender 210 as the one that also sent these other chunks.” If available, the tracefile may also include additional information about the length or duration of the chunk, the destination node 210, or any insight into the contents of the chunk. Other information that may be available is the geographic location of the tap 220, as determined by, for example, a global positioning system (GPS) receiver.
Tap 220 may not capture all traffic within its range 225. For example, reception on the wireless network 200 may be variable due to environment, noise, transmission power, or jamming such that a tap is unable to observe some transmissions. Furthermore, tap 220 may occasionally make an error and mistakenly believe it has seen a chunk when no chunk was sent (again due to noise on a wireless network). If transmissions are missed, false transmissions are detected, or if a wireless sender 210 is misclassified, these events may be viewed as adding noise to the signals generated by the wireless tap 220. Other sources of noise in the signal generated by the tap 220 may include interference from other signals (e.g., packets belonging to another flow or jitter in timing due to sharing of a bottleneck among multiple flows).
Tap 220 may listen passively and may not participate in the monitored network 200 at the MAC (or higher) layers. In some cases, for example with 802.11b LANs, it is possible for the tap 220 to snoop at the MAC layer and extract some information about higher layer protocols. In the case of tactical ad hoc networks, however, little or no information may be available about the MAC or higher layer protocols. Such passive listening may also be referred to as covert information collection.
Although a single tap 220 is shown in
In the presence of mobile nodes 210 (for example, in ad hoc wireless networks or Mobile IP), taps 220 may, but need not, be mobile. Taps 220 may be placed randomly over a specified geographic area, or in a pattern. Alternately, taps 220 may be placed near respective senders 210. Wireless senders 210 can move into or out of range of one or more taps 220. Senders 210 typically may dwell in the range of one or more taps 220 long enough for transmissions to be observed, and the sources identified and recorded. Taps 220 may assign a unique identifier to each wireless sender 210, for example, based on their RF signature. Taps 220 in the network 200 may assign the same unique identifier to any given sender 210.
Either the tap 120/220 or an associated (possibly central) processor (not shown) may perform processing on the signal produced by the tap 120/220 to produce results [act 320]. Such signal processing may produce identifiable signal traffic features, and may be computationally intensive. Those skilled in the art will appreciate, based on processing and networking requirements, whether to perform the signal processing at each tap 120/220 or other location(s).
The signal processing results may be further processed to analyze and classify the traffic on the network 100/200 [act 330]. Again, such traffic analysis processing may be performed by the tap 120/220 or another processor. Acts 310-330 may be broadly characterized as “signal generation,” “signal processing,” and “traffic analysis,” respectively. These acts will be described in greater detail for certain implementations below.
Tracefile:
Once a tap 120/220 has generated a tracefile of tapped data, a signal may be generated (e.g., as in act 310) from the tracefile for further traffic analysis. A tracefile may represent discrete events, namely a sequence of events associated with different times. The tracefile may include other information (e.g., sender or recipient information) associated with the events.
The time of arrival 410 may be based on when the tap 120/220 sensed the leading edge of a chunk of data. Although its information content may be limited, a signal may be encoded using solely time of arrival information 410. The presence of additional information (e.g., 420-450) may allow the generation of additional signals and/or signals with more robust information content.
One additional piece of information that the tap 120/220 may obtain is the size/duration 450 of a chunk of data. The tap may measure a length of time (i.e., duration) when data is present after it first sees the chunk. This duration 450 may be converted into a size (e.g., a certain number of bytes) by observing segmentation in the chunk of data. Alternately, the tap 120/220 may estimate the size 450 of a chunk of data by measuring a clock-time duration of when the chunk is present and by multiplying the duration by a bandwidth of the wired or wireless link over which the chunk travels.
Another piece of information that the tap 120/220 may obtain is identification of the source node 420 which sent the chunk of data. The identity (or address) of the source node 420 may be obtained, for example, even if the chunk of data is otherwise encrypted. A wireless tap 220 may obtain, for example, data including the time of arrival 410, the source node 420, and the size/duration 450 of chunks of data.
A further piece of information that the tap 120/220 may obtain is the identity (or address) of the destination node 430 to which the chunk of data is addressed. The identity of the destination node 430 may be obtained, for example, even if the chunk of data is otherwise encrypted. A wired tap 120 may obtain, for example, data including the time of arrival 410, the size/duration 450, the source node 420, and the destination node 430 of chunks of data. The wired tap 120 may obtain the latter two pieces of information, because it may know between which two nodes it is located.
Although designated as nodes “1” and “2” in
Yet another piece of information that the tap 120/220 may obtain is the type 440 of the chunk of data. The type 440 (e.g., a TCP packet, an ACK message, a CBR packet, etc.) of chunk may be determined by examining the chunk itself. For example, unencrypted formatting data within the chunk may make the type 440 of chunk apparent. Alternately, the type 440 of chunk may be inferred from other information, such as the source node 420 or the size/duration 450 of the chunk.
The tap 120/220 may, if available, obtain other information from intercepted chunks of data, such as any field from an IP header associated with the chunk of data. Even if the body of the chunk is encrypted, the tap 120/220 may be able to determine a location of, and read information from, the header of the chunk. Similarly, the tap 120/220 may determine an IP security association value of the chunk. In a wireless network (e.g., 200), the tap 220 may also determine a signal strength of a chunk of data. Those skilled in the art will appreciate additional information in addition to the above examples may be directly or indirectly obtained by tap 120/220.
Signal Formation:
Signals may be formed from tracefiles (e.g., tracefile 400) by various techniques, which will be discussed below. In general, signals may be discrete-event data streams or files, and multiple items of information (e.g., 410-450) may be encoded within a single signal. In other implementations consistent with the principles of the invention, multiple signals may be generated from the same tracefile (e.g., one signal for arrivals from one node and another signal for arrivals from another node). Discrete-event data signals may facilitate later processing of those signals by a digital signal processor or general purpose computer. In still other implementations consistent with the principles of the invention, continuous signals may be constructed (e.g., by a digital-to-analog converter, digital logic combination, or similar device) to facilitate further signal filtering, truncation, or transformation that is performed in a non-discrete manner (e.g., by analog or digital electrical signal manipulation).
Approaches to signal generation may be generally grouped in non-uniform and uniformly-spaced methods. Under the former scheme, a non-uniform signal may be represented as a non-uniformly-spaced sequence of data. Data may include, for example, arrival times 410 and little other information. Non-arrivals need not be explicitly listed in such a signal, allowing for compact representation and storage.
Each chunk arrival time 410 may indicate the leading edge of the discrete events in the tap's tracefile, where time is quantized to the desired resolution. Only a limited number of signal processing algorithms, however, have been derived for non-uniform data (i.e., data that does not have a uniform sampling). One example of such a signal processing algorithm is a Lomb Periodogram, which can process non-uniformly sampled data sets.
Another approach to producing a signal representing time of arrival of chunks is to pick an appropriate time quantization, to bin time into increments at that quantization, and to place a marker in the bins where a chunk was detected. This process may be termed “re-sampling,” and it produces a uniformly sampled signal. Various schemes are available for determining into which time bin a given event will fall. These include a ceiling function (i.e., the bin below), a floor function (i.e., the bin above), a random function (e.g., a random or pseudo-random one of the adjacent bins), etc. Those skilled in the art will also appreciate various schemes for handling multiple arrival events that fall within the same time bin. One such scheme would be to uniquely spread the arrivals among a number of empty adjacent bins (not shown) to keep the multiple arrivals from being obscured. Due to errors introduced by the re-sampling, some information in the tracefile may be lost, but characteristic frequency and similarity information in the tracefile(s) may be maintained by re-sampling.
Both
Those skilled in the art will appreciate other ways of encoding source node information after reading this disclosure. For example, in one implementation consistent with the principles of the invention, the source node information 420 may be used to create different signals, each corresponding to a particular source node. With reference to
If, for example, the duration 450 of each chunk is also known, several schemes may be used to encode this additional information in the signal.
Further, multiple chunks may be in transit and received by the tap 120/220 at substantially the same time (e.g., within the same sample time quantization period or “bin”). For ease of explanation, arrivals 410 that fall within the same sample bin will be referred to herein as “simultaneous,” even though they may not, in fact, arrive at exactly the same time. In other words, the “simultaneous” times of arrival 410 may be very closely spaced. Several techniques are available for handling such chunk arrivals 410.
Returning to
Another approach to simultaneous arrivals 410 may be to generate distinct tracefiles for each sender. Multiple tracefiles may refine later traffic flow analysis by focusing on traffic from each sender separately.
In general, the pulses 570-590 may encode, in addition to their start time, at least two pieces of information in their 1) height and 2) width. For example, time-related information (e.g., transmit time or packet duration 450) may be encoded as the pulse width.
Further, the pulses 570-590 need not be rectangular as shown in
Other Signal Formation Schemes:
Other encoding schemes will be apparent to those skilled in the art, depending on the amount of available information in the tracefiles and the ability of later signal processing schemes to use the available information. Information in addition to time of arrival 410 may be encoded into signals from tracefiles 400. It should be noted that such additional information is not limited to items 420-450, but may include other data directly obtainable by taps 120/220. Further, the additional data may include data that is indirectly obtained (e.g., derived or calculated) from data directly obtained by taps 120/220. One example of such indirectly obtained data is inter-arrival time, which may be calculated from adjacent arrivals in the time of arrival data 410. Those skilled in the art will appreciate other directly and indirectly obtainable items of data from taps 120/220 after reading the disclosure herein.
Exemplary schemes may include binary, sign, real weighted, absolute value weighted, complex weighted, and multi-dimensional weighted schemes. Binary, sign, real weighted, and absolute value weighted methods may be referred to, collectively, as “single-valued” functions. By contrast, complex weighted and multi-dimensional weighted methods may be referred to as “multi-valued” functions.
An encoding function of a parameter x may be referred to in shorthand as f(x). The single-valued functions listed above will now be described in greater detail. For a binary scheme, f(x)=0 if x<c, where c is an arbitrary constant. Otherwise, f(x)=1. For a sign encoding scheme, f(x)=sgn(x). This sign technique may retain polarity information, but may eliminate the actual value of the parameter x. In a real weighted scheme, f(x)=cx, where c is a constant that may be helpful in scaling the data. In an absolute value weighted scheme, f(x)=c abs(x), where c is a constant.
The multi-valued functions listed above will now be described in greater detail. For a complex weighted function, f(x,y)=ax+jby for constants a and b. Many signal processing techniques use complex arithmetic to preserve phase information. This complex weighted technique may preserve such phase information. For a multi-dimensional weighted technique, f(x)=c*x, where x is a vector formed by a number of data values at a given time t, and where c is a vector of weighting constants.
In addition to one-dimensional signal encoding, tracefile data 400 may also be encoded as two-dimensional signals. Data encoded as a two-dimensional signal may be processed with any of a rich arsenal of algorithms used for signal processing. Examples of two-dimensional signal processing algorithms may include, but are not limited to, periodogram processing, spectrum processing, cepstrum processing, coherence processing, wavelet processing, fractal processing, etc.
One way of generating a two-dimensional signal may be to process a time of arrival signal over periodic intervals to obtain a series of results (e.g., spectra, periodograms, cepstra, etc.). These results may be combined over time into a two-dimensional signal.
Another way of generating a two-dimensional signal may be to plot inter-arrival time vs. arrival time. For example, horizontal positions in an image x(k) may equal (tk−tk-1), the inter-arrival times. Vertical positions in the image y(k) may equal tk, the arrival times. The intensity of points within the image z(k) may equal f(xk), a magnitude assigned to the arrival time impulse or pulse by one of the above-described schemes.
The above methods of generating signals from data collected by taps 120/220 are exemplary, and should not limit other methods of generating signals which may be implemented by those skilled in the art without undue experimentation.
Exemplary Signal Processing
Processing of signals (e.g., as in act 320) may be performed by techniques that are generally understood by those skilled in the signal processing arts. Various techniques may be used to extract, for example, periodic features of a signal. For non-uniformly sampled signals, Lomb periodograms may be used. For uniformly-sampled signals, Fourier-transform techniques or Cepstrum processing may be used to generate spectra or cepstra, respectively. These spectra or cepstra may be combined over time to form periodograms or cepstrograms.
Other techniques may compute the power spectral density of a signal. Fractal and wavelet-based techniques may also be employed. Moreover, for pairs of signals, cross spectral density or coherence techniques may be used to compute the “sameness” of the two signals.
Exemplary Flow Classification Processing
Classification of signatures (e.g., as in act 330) is generally understood by those skilled in the signal processing arts. Various techniques are known to classify a certain signature into one or more different classes. Generally, these techniques involve training or otherwise developing a number of known signatures, against which a candidate signature will be compared. Candidate signatures may be compared against a set of known signatures, and probabilities or other measures of “sameness” with various known signatures may be generated. Alternately, binary decisions may be made (i.e., matches or does not) based on a boundary between different signatures in a particular signature-space.
Using a periodogram, a signal generated from a tap 120/220 may be used to determine a number of data flows on a wired or wireless network. From the periodicity information in such periodograms, a type of data flow (e.g., FTP, CBR, etc.) may be hypothesized. Such classification of flows may be aided by other knowledge, such as typical transmission periods of different types of flows.
Periodograms may exhibit the dominant frequencies/periods in a signal. One type of such a dominant period is the round-trip time of a signal flow (e.g., in a TCP flow, the time between sending a packet and receiving an acknowledgment of the packet from the destination node). Another type of dominant period may be the latency associated with a data flow. Certain types of data flows (i.e., applications) may have “characteristic” periods/frequencies associated with them (e.g., voice over IP, video data, sensor data, etc.). These characteristic periods may be inherent in the type of data flow (e.g., a continuous stream of data). To the extent that these characteristic periods/frequencies identify certain applications or types of data flows, these periods may be used as “signatures” of the applications for classification processing. Applications that are not directly observed may still be characterized, because of their influence on other data flows that are observed. Hence, using a minimal amount of information, such as the arrival times of chunks at a tap 120/220, different flows at the tap 120/220 may be detected and classified.
Methods and systems consistent with the principles of the invention may detect chunks of data and determine characteristics of the detected chunks. The characteristics may be encoded into one or more signals that are amenable to further processing.
The foregoing description of preferred embodiments of the invention provides illustration and description, but is not intended to be exhaustive or to limit the invention to the precise form disclosed. Modifications and variations will be apparent to those skilled in the art in light of the above teachings or may be acquired from practice of the invention.
For example, other types and permutations of signal encoding not specifically illustrated in
Moreover, the acts in
No element, act, or instruction used in the description of the present application should be construed as critical or essential to the invention unless explicitly described as such. Also, as used herein, the article “a” is intended to include one or more items. Where only one item is intended, the term “one” or similar language is used. The scope of the invention is defined by the claims and their equivalents.
This application claims the benefit of priority under 35 U.S.C. § 119(e) of provisional applications, Ser. Nos. 60/339,288, 60/340,780, and 60/355,573, filed Oct. 26, 2001, Oct. 30, 2001, and Feb. 5, 2002 respectively, the entire contents of which are incorporated herein by reference. This application is also a continuation-in-part (CIP) under 37 C.F.R. § 1.53(b) of application Ser. No. 10/167,620, filed Oct. 19, 2001, the entire contents of which are incorporated herein by reference.
The invention described herein was made with government support. The U.S. Government may have certain rights in the invention, as provided by the terms of contract No. MDA972-01-C-0080, awarded by the Defense Advanced Research Projects Agency (DARPA).
| Number | Name | Date | Kind |
|---|---|---|---|
| 4625081 | Lolito et al. | Nov 1986 | A |
| 5025486 | Klughart | Jun 1991 | A |
| 5140585 | Tomikawa | Aug 1992 | A |
| 5426513 | Scorse et al. | Jun 1995 | A |
| 5477547 | Sugiyama | Dec 1995 | A |
| 5539737 | Lo et al. | Jul 1996 | A |
| 5596719 | Ramakrishnan et al. | Jan 1997 | A |
| 5610905 | Murthy et al. | Mar 1997 | A |
| 5649108 | Spiegel et al. | Jul 1997 | A |
| 5687095 | Haskell et al. | Nov 1997 | A |
| 5737525 | Picazo et al. | Apr 1998 | A |
| 5751967 | Raab et al. | May 1998 | A |
| 5793762 | Penners et al. | Aug 1998 | A |
| 5838919 | Schwaller et al. | Nov 1998 | A |
| 5859979 | Tung et al. | Jan 1999 | A |
| 5881237 | Schwaller et al. | Mar 1999 | A |
| 5946308 | Dobbins et al. | Aug 1999 | A |
| 5959995 | Wicki et al. | Sep 1999 | A |
| 5999563 | Polley et al. | Dec 1999 | A |
| 6014087 | Krishnakumar et al. | Jan 2000 | A |
| 6021158 | Schurr et al. | Feb 2000 | A |
| 6023563 | Shani | Feb 2000 | A |
| 6092039 | Zingher | Jul 2000 | A |
| 6104696 | Kadambi et al. | Aug 2000 | A |
| 6151390 | Volftsun et al. | Nov 2000 | A |
| 6154844 | Touboul et al. | Nov 2000 | A |
| 6195622 | Altschuler et al. | Feb 2001 | B1 |
| 6219788 | Flavin et al. | Apr 2001 | B1 |
| 6233242 | Mayer et al. | May 2001 | B1 |
| 6237007 | Brown | May 2001 | B1 |
| 6243361 | McMillen et al. | Jun 2001 | B1 |
| 6246684 | Chapman et al. | Jun 2001 | B1 |
| 6256306 | Bellenger | Jul 2001 | B1 |
| 6269330 | Cidon et al. | Jul 2001 | B1 |
| 6279113 | Vaidya | Aug 2001 | B1 |
| 6308218 | Vasa | Oct 2001 | B1 |
| 6308220 | Mathur | Oct 2001 | B1 |
| 6321338 | Porras et al. | Nov 2001 | B1 |
| 6434624 | Gai et al. | Aug 2002 | B1 |
| 6442139 | Hosein | Aug 2002 | B1 |
| 6446131 | Khansari et al. | Sep 2002 | B1 |
| 6449255 | Waclawsky | Sep 2002 | B1 |
| 6453345 | Trcka et al. | Sep 2002 | B2 |
| 6473858 | Shimomura et al. | Oct 2002 | B1 |
| 6484203 | Porras et al. | Nov 2002 | B1 |
| 6510154 | Mayes et al. | Jan 2003 | B1 |
| 6519703 | Joyce | Feb 2003 | B1 |
| 6522656 | Gridley | Feb 2003 | B1 |
| 6535489 | Merchant et al. | Mar 2003 | B1 |
| 6546017 | Khaunte | Apr 2003 | B1 |
| 6546834 | Benuzzi | Apr 2003 | B1 |
| 6574669 | Weaver | Jun 2003 | B1 |
| 6584101 | Hagglund et al. | Jun 2003 | B2 |
| 6597660 | Rueda et al. | Jul 2003 | B1 |
| 6597661 | Bonn | Jul 2003 | B1 |
| 6601208 | Wu | Jul 2003 | B2 |
| 6621796 | Miklos | Sep 2003 | B1 |
| 6662223 | Zhang et al. | Dec 2003 | B1 |
| 6665317 | Scott | Dec 2003 | B1 |
| 6665733 | Witkowski et al. | Dec 2003 | B1 |
| 6674718 | Heddes et al. | Jan 2004 | B1 |
| 6681029 | Rhoads | Jan 2004 | B1 |
| 6700895 | Kroll | Mar 2004 | B1 |
| 6711623 | Furukawa et al. | Mar 2004 | B1 |
| 6718395 | Ziegler | Apr 2004 | B1 |
| 6721355 | McClennon et al. | Apr 2004 | B1 |
| 6731596 | Chiang et al. | May 2004 | B1 |
| 6735702 | Yavatkar et al. | May 2004 | B1 |
| 6741556 | Seddigh et al. | May 2004 | B1 |
| 6760701 | Sharma et al. | Jul 2004 | B2 |
| 6775392 | Rhoads | Aug 2004 | B1 |
| 6839754 | Nowak et al. | Jan 2005 | B2 |
| 6850989 | Lavian et al. | Feb 2005 | B1 |
| 6944127 | Burchfiel et al. | Sep 2005 | B1 |
| 6950404 | Pearl | Sep 2005 | B2 |
| 6958977 | Mitrani et al. | Oct 2005 | B1 |
| 6977942 | Raisanen | Dec 2005 | B2 |
| 6981055 | Ahuja et al. | Dec 2005 | B1 |
| 6981158 | Sanchez | Dec 2005 | B1 |
| 6985722 | Snelgrove et al. | Jan 2006 | B1 |
| 7012893 | Bahadiroglu | Mar 2006 | B2 |
| 7065482 | Shorey et al. | Jun 2006 | B2 |
| 7089428 | Farley et al. | Aug 2006 | B2 |
| 7095753 | Milliken et al. | Aug 2006 | B1 |
| 7127396 | Chu et al. | Oct 2006 | B2 |
| 7170860 | Partridge et al. | Jan 2007 | B2 |
| 7180908 | Valavi et al. | Feb 2007 | B2 |
| 7200105 | Milliken et al. | Apr 2007 | B1 |
| 7200656 | Cousins | Apr 2007 | B1 |
| 7218736 | Nishimura et al. | May 2007 | B1 |
| 7263479 | Cousins | Aug 2007 | B2 |
| 7283475 | Fortin et al. | Oct 2007 | B2 |
| 7318105 | Bongiovanni et al. | Jan 2008 | B1 |
| 20020032871 | Malan et al. | Mar 2002 | A1 |
| 20020039371 | Hedayat et al. | Apr 2002 | A1 |
| 20020049985 | Olshansky et al. | Apr 2002 | A1 |
| 20020080967 | Abdo et al. | Jun 2002 | A1 |
| 20020095289 | Chu et al. | Jul 2002 | A1 |
| 20020112060 | Kato | Aug 2002 | A1 |
| 20020136183 | Chen et al. | Sep 2002 | A1 |
| 20020150102 | Janko et al. | Oct 2002 | A1 |
| 20030008622 | Fernandez-Corbaton et al. | Jan 2003 | A1 |
| 20030023918 | Wu | Jan 2003 | A1 |
| 20030028662 | Rowley et al. | Feb 2003 | A1 |
| 20030041165 | Spencer et al. | Feb 2003 | A1 |
| 20030097439 | Strayer et al. | May 2003 | A1 |
| 20030097595 | Partridge et al. | May 2003 | A1 |
| 20030145110 | Ohnishi et al. | Jul 2003 | A1 |
| 20030182431 | Sturniolo et al. | Sep 2003 | A1 |
| 20040037561 | Guild et al. | Feb 2004 | A1 |
| 20040057376 | Sasvari et al. | Mar 2004 | A1 |
| 20040203383 | Kelton et al. | Oct 2004 | A1 |
| 20040203764 | Hrastar et al. | Oct 2004 | A1 |
| 20050198504 | Smith | Sep 2005 | A1 |
| 20050246165 | Pettinelli et al. | Nov 2005 | A1 |
| 20050286414 | Young et al. | Dec 2005 | A1 |
| 20060067245 | Pearl | Mar 2006 | A1 |
| Number | Date | Country | |
|---|---|---|---|
| 60339288 | Oct 2001 | US | |
| 60340780 | Oct 2001 | US | |
| 60355573 | Feb 2002 | US |
| Number | Date | Country | |
|---|---|---|---|
| Parent | 10167620 | Oct 2001 | US |
| Child | 10212324 | US |
