Data link layer trust signaling in communication network

• US 10,499,249 B1
• Filed: 07/11/2017
• Issued: 12/03/2019
• Est. Priority Date: 07/11/2017
• Status: Active Grant

• Current Assignee: T-Mobile Innovations LLC (Deutsche Telekom AG)
• Original Assignee: Sprint Communications Company LP (Deutsche Telekom AG)
• Inventors: Marquardt, Ronald R., Paczkowski, Lyle W.
• Primary Examiner(s): Li, Meng
• Application Number:
  US15/646,842
• Time in Patent Office: 875 Days
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/10 Integrity
• CPC Class Codes: H04W 12/106 Packet or message integrity
• CPC Class Codes: H04W 12/66 Trust-dependent, e.g. using trust scores or trust relationships

Abstract

An apparatus comprising a network communication interface to communicatively couple the apparatus to a network, a processor coupled to the network communication interface, and a memory coupled to the processor. The processor is configured to execute instructions to cause the apparatus to determine an indicator of a trusted nature of data for transmission through the network, write the data to a frame of a data stream, write the indicator to an inter-packet gap of the data stream, and transmit the data stream to the network via the network communication interface.

Claims

1. An apparatus, comprising:

a network communication interface to communicatively couple the apparatus to a network;

a processor coupled to the network communication interface; and

a memory coupled to the processor and configured to execute instructions to cause the apparatus to;

determine an indicator of a trusted nature of data for transmission through the network, the indicator including a plurality of serialized portions;

write the data to a frame of a data stream;

write the indicator to a plurality of inter-packet gaps of the data stream, where a first of the plurality of serialized portions of the indicator is written to a first inter-packet gap of the plurality of inter-packet gaps and a second of the plurality of serialized portions of the indicator is written to a second inter-packet gap of the plurality of inter-packet gaps to indicate fidelity of the data stream via an order of sequence of the indicator in the data stream; and

transmit the data stream to the network via the network communication interface.

2. The apparatus of claim 1, wherein the indicator is unique to the apparatus.

3. The apparatus of claim 1, wherein the indicator is unique to a communications service provider controlling the apparatus.

4. The apparatus of claim 1, wherein executing the instructions further causes the apparatus to write a network identifier of a notification destination for transmission of notification of improper handling of the data stream to the inter-packet gap of the data stream.

5. The apparatus of claim 1, wherein the network communication interface, the processor, and the memory are executing at least partially in a trusted security zone.

6. The apparatus of claim 1, wherein executing the instructions further causes the apparatus to write the indicator to a second inter-packet gap of the data stream, wherein the second inter-packet gap of the data stream exists between the frame of the data stream and a second frame of the data stream.

7. The apparatus of claim 1, wherein after receiving a notification of improper handling of the data stream, executing the instructions further causes the apparatus to transmit a second data stream through the network to determine a first location in the network at which the improper handling of the data stream occurs.

8. An apparatus, comprising:

a network communication interface to communicatively couple the apparatus to a network;

a processor coupled to the network communication interface;

a memory coupled to the processor; and

a trusted data monitoring application stored in the memory that when executed, causes the processor to;

monitor the network for existence of a data stream containing an indicator of a trusted nature of data contained in the data stream, the indicator including a plurality of serialized portions;

determine whether the data stream is being properly handled in the network when the data stream contains the indicator of the trusted nature of data contained in the data stream, the determination made at least according to a determination that the plurality of serialized portions occur in contiguous serial order in a plurality of inter-packet gaps of the data stream; and

execute at least one action in the network in response to the data stream not being properly handled in the network.

9. The apparatus of claim 8, wherein the processor monitors the network at a layer of the network lower than the network layer.

10. The apparatus of claim 8, wherein monitoring the network for existence of the data stream containing the indicator of the trusted nature of data contained in the data stream comprising monitoring an inter-packet gap of the data stream for existence of the indicator.

11. The apparatus of claim 8, wherein executing the at least one action in the network in response to the data stream not being properly handled in the network comprises transmitting a notification to a device in the network to inform the device that the data stream is not being properly handled in the network.

12. The apparatus of claim 11, wherein the processor transmits the notification to the device in the network according to a notification address of the device in the network, and wherein the notification address is contained in an inter-packet gap of the data stream.

13. The apparatus of claim 8, wherein executing the at least one action in the network in response to the data stream not being properly handled in the network comprises rerouting the data stream from a first destination to a second destination, and wherein the second destination is a network device designated to receive data streams that are determined as not being properly handled in the network.

14. The apparatus of claim 8, wherein executing the at least one action in the network in response to the data stream not being properly handled in the network comprises rerouting the data stream in the network from an at least partially untrusted portion of the network to a trusted portion of the network.

15. A method executed in a communications network, comprising:

writing, by a first network element, into a plurality of inter-packet gaps of a data stream, an indication of a trusted nature of data included in a frame of the data stream, wherein the indicator includes a plurality of serialized portions having a first of the plurality of serialized portions of the indicator written to a first inter-packet gap of the plurality of inter-packet gaps and a second of the plurality of serialized portions of the indicator written to a second inter-packet gap of the plurality of inter-packet gaps to indicate fidelity of the data stream via an order of sequence of the indicator in the data stream;

transmitting, by the first network element, the data stream through the communications network;

monitoring, by a second network element, the communications network at a data link layer for existence of the indication of the trusted nature of data in the inter-packet gap of the data stream;

determining, by the second network element, that the data stream is being improperly handled in the communications network; and

transmitting, by the second network element, a notification of improper handling of the data stream in the communications network to a notification destination.

16. The method of claim 15, further comprising writing, by the first network element, into the inter-packet gap of the data stream, a notification address of the notification destination in the communications network for transmission of the notification of improper handling of the data stream in the communications network.

17. The method of claim 15, wherein the second network element monitors the communications network at the data link layer by executing a monitoring client at a network layer higher than the data link layer.

18. The method of claim 15, wherein the first network element operates in a trusted security zone while transmitting the data stream through the network.

19. The method of claim 18, further comprising transmitting, by the first network element, a test data stream through the communications network to determine a first location in the communications network at which the improper handling of the data stream occurs.

20. The method of claim 19, further comprising re-transmitting, by the first network element, the data stream through the communications network via a route through the communications network configured to circumvent the first location in the communications network at which the improper handling of the data stream occurs.