Method and system for detecting a communication problem in a computer network

• US 20040064725A1
• Filed: 09/18/2002
• Published: 04/01/2004
• Est. Priority Date: 09/18/2002
• Status: Abandoned Application

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Simon, Daniel R., Padmanabhan, Venkata N.
• Application Number:
  US10/246,156
• Publication Number:
  US 20040064725A1
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32

Abstract

A computer in a network runs a verification procedure in which it sends data packets to another computer in the network. Some or all of the data packets contain, either individually or collectively, a secret piece of information, such as a secret code. The computer then makes a determination regarding the network links between it and the other computer. If, for example, the other computer is able to respond by providing the secret piece of information back, then the computer sending the data packets concludes that the devices along the network links en route to the other computer are properly forwarding data packets.

Claims

1. A method for detecting a communication problem in a computer network, the method comprising:

transmitting a plurality of data packets to a computer over the network link;

indicating to the computer, in a secure communication session, how to identify a subset of the data packets;

receiving, from the computer, information that is based on an analysis of the subset of data packets performed by the computer; and

based on the information, determining whether or not there is a problem with the network link.

2. A computer-readable medium having stored thereon computer-executable instructions for performing the method of claim 1.

3. The method of claim 1, wherein the indicating step comprises:

establishing the secure communication session with the computer; and

transmitting, during the secure communication session, a message that indicates to the computer which data packets of the plurality are to be the subject of the analysis.

4. The method of claim 1, wherein the determining step comprises:

comparing the information with a value, the value representing the correct result that is to be obtained based on the analysis; and

if the information is within an acceptable margin of error of the value, deeming the network link to not have a problem.

5. The method of claim 1, wherein the determining step comprises:

comparing the information with a plurality of acceptable results; and

if the information matches an acceptable result of the plurality, deeming the network link to not have a problem.

6. The method of claim 1, wherein the analysis is a probabilistic analysis.

7. The method of claim 1, wherein the analysis is a statistical analysis.

8. The method of claim 1, wherein the analysis is a cryptographic analysis.

9. The method of claim 1, further comprising:

the computer performing the analysis on the subset of the data packets; and

the computer transmitting the results of the analysis.

10. A method for detecting a communication problem in a computer network, the method comprising:

a first computer transmitting a plurality of data packets to a second computer over the network link, wherein at least a subset of the data packets have a special property that distinguishes them from the rest of the data packets;

the first computer indicating, to the second computer, what the special property is;

the first computer receiving, from the second computer, information that is based on an analysis of those data packets of the subset that are received by the second computer; and

the first computer determining, based on the received information, whether or not there is a problem with the network link.

11. A computer-readable medium having stored thereon computer-executable instructions for performing the method of claim 10.

12. The method of claim 10, wherein the indicating step comprises:

the first computer establishing a secure communication session with the second computer; and

the first computer transmitting, during the secure communication session, a message that indicates to the second computer what the special property is.

13. The method of claim 10, wherein the indicating step comprises:

the first computer establishing a secure communication session with the second computer;

the first computer transmitting, during the secure communication session, a message that indicates to the second computer the location of the next hop for data packets, wherein the message contains an encrypted portion that is formatted to prevent decryption by the second computer, the encrypted portion indicating the location of one or more further hops beyond the next hop; and

the second computer transmitting the encrypted portion to a computer located on the next hop.

14. The method of claim 10, wherein the indicating step comprises:

the first computer establishing a secure communication session with the second computer; and

the first computer transmitting, during the secure communication session, a message that indicates to the second computer an algorithm that the second computer needs to perform using the data packets having the special property.

15. The method of claim 10, wherein the determining step comprises:

receiving from the second computer information that is based on a probabilistic analysis of the subset of data packets;

comparing the information with a predetermined answer; and

if the information is within an acceptable margin of error of the predetermined answer, deeming the network link to not have a problem.

16. The method of claim 10, wherein the determining step comprises:

receiving from the second computer information that is based on a statistical analysis of the subset of data packets;

comparing the information with a predetermined answer; and

if the information is within an acceptable margin of error of the predetermined answer, deeming the network link to not have a problem.

17. The method of claim 10, wherein the determining step comprises:

receiving from the second computer information that is based on a cryptographic analysis of the subset of data packets;

comparing the information with a predetermined answer; and

if the information is within an acceptable margin of error of the predetermined answer, deeming the network link to not have a problem.

18. The method of claim 10, wherein the determining step comprises:

comparing the number of packets of the subset with the number of packets of the subset that the second computer indicates has been received; and

if the number of packets of the subset is within an acceptable margin of error of the number of packets of the subset the second computer indicates has been received, deeming the network link to not have a problem.

19. The method of claim 10, wherein the special property is one or more secret codes contained in each of the subset of packets, and the determining step comprises:

comparing the number of data packets sent with the secret codes to the second computer with the number of data packets having the secret codes that the second computer indicates it has received; and

if the number of data packets sent is with the secret codes is within an acceptable margin of error of the number of data packets having the secret codes the second computer indicates has been received, deeming the network link to not have a problem.

20. The method of claim 10, wherein indicating step comprises:

sending, to the second computer, a list of numbers and a prime number; and

the second computer understanding that it needs to perform an analysis using data packets that include, in a particular field, an equivalent value of one of the numbers on the list modulo the prime number.

21. The method of claim 10, wherein the determining step comprises:

receiving from the second computer information that is based on a cryptographic checksum computed on the concatenation of all of the data packets of the subset;

comparing the information with a predetermined answer; and

if the information is within an acceptable margin of error of the predetermined answer, deeming the network link to not have a problem.

22. A method for detecting a communication problem in a computer network, the method comprising:

receiving, from a computer, information regarding how to identify a secret code;

receiving, from the computer, a plurality of data packets over the network link;

performing an analysis of the data packets of the plurality that have the secret code to obtain a result; and

transmitting, to the computer, the result, thereby verifying that the network link is good.

23. A computer-readable medium having stored thereon computer-executable instructions for performing the method of claim 22.

24. The method of claim 22,

wherein the receiving step comprises:

establishing a secure communication session with the computer; and

receiving, during the communication session, an algorithm;

and wherein the performing step comprises executing the algorithm on the data packets having the secret code.

25. The method of claim 22, wherein the receiving step comprises receiving a shared key from the computer;

using the shared key to establish a secure communication session with the computer; and

receiving, during the communication session, an indication of how to determine which of the plurality of packets contain the secret code.

26. The method of claim 22, wherein the receiving step comprises:

receiving a plurality of numbers from the computer, wherein at least one of the plurality of numbers is prime; and

performing a modulus operation on at least one of the plurality of numbers using the prime number,

wherein the performing step comprises performing an analysis on those data packets that are received from the computer and that contain the result of the modulus operation.

27. A method for verifying one or more network links, wherein one of the network links is bounded by a first computer and a second computer, the network link serving as one of a plurality of hops for network data traffic, the method comprising:

establishing a secret piece of information;

breaking the secret piece of information into parts;

distributing the parts of the secret piece of information among a plurality of data packets;

transmitting the plurality of data packets to the first computer over one or more of the plurality of the routing hops, including the routing hop being served by the network link;

transmitting the plurality of data packets to the second computer over one or more of the plurality of hops, excluding the routing hop being served by the network link; and

determining whether or not the network link has problems based on whether or not the secret piece of information is received from the first computer and whether or not the secret piece of information is received from the second computer.

28. A computer-readable medium having stored thereon computer-executable instructions for performing the method of claim 27.

29. The method of claim 27, wherein the first computer or the second computer can only reconstruct the secret piece of information if it receives a certain percentage of the plurality of data packets.

30. The method of claim 29, wherein the certain percentage is between and inclusive of about 80 and about 90 percent.

31. The method of claim 27, wherein a second of the network links is bounded by the second computer and a third computer, the method further comprising:

transmitting the plurality of data packets to the second computer over one or more of the plurality of the routing hops, including the routing hop being served by the second network link;

transmitting the plurality of data packets to the third computer over one or more of the plurality of hops, excluding the routing hop being served by the second network link; and

determining whether or not the second network link has problems based on whether or not the secret piece of information is received from the second computer and whether or not the secret piece of information is received from the third computer.

32. A method for verifying a network link, the method comprising:

receiving, at a receiving computer, a plurality of data packets from a sending computer over the network link, the network link including at least one other computer, at least some of the plurality of data packets being forwarded by the other computer to the receiving computer;

reconstructing, a secret piece of information using the plurality of received data packets, the secret piece of information being distributed among the plurality of data packets; and

transmitting the secret piece of information back to the sending computer, thereby verifying to the sending computer that the other computer is properly forwarding data packets to the receiving computer.

33. A computer-readable medium having stored thereon computer-executable instructions for performing the method of claim 32.

34. The method of claim 32,

wherein the reconstructing step comprises extracting a parts of secret number from at least some of the plurality of data packets and reconstructing the secret number;

and

wherein the transmitting step comprises transmitting the secret number.

35. The method of claim 34, further comprising receiving an indication from the sending computer regarding how to reconstruct the secret number.

36. The method of claim 35, further comprising establishing a secure communication session with the sending computer, wherein the step of receiving an indication from the sending computer is performed during the secure communication session.

37. A method for verifying a network link, the network link comprising a first, second and third router, the method comprising:

the first router inserting a secret piece of information into one or more data packets;

the first router informing the third router regarding the identity of the secret piece of information;

the first router transmitting the one or more data packets containing the secret piece of information to the third router over the network link via the second router;

the first router receiving, from the third router, an indication regarding whether the third router can identify the secret piece of information based on the data packets; and

the first router determining whether there are problems with the network link between the second router and the third router based on the receiving step.

38. A computer-readable medium having stored thereon computer-executable instructions for performing the method of claim 37.

39. The method of claim 37, wherein the inserting step comprises the first router inserted into a certain number of the packets a secret code.

40. The method of claim 37, wherein the inserting step comprises the first router inserted into a certain number of the packets a secret code, the method further comprising the first router transmitting the secret code to the third router prior to the inserting step.

41. The method of claim 37, wherein the inserting step comprises the first router inserted into a certain number of the packets a secret code, the method further comprising:

the first router establishing a secure communication session with the third router; and

the first router transmitting the secret code to the third router during the secure communication session.

42. A system for verifying a network link between a first router and a second router, the system comprising:

a means for inserting a secret piece of information into one or more data packets;

a means for transmitting the one or more data packets over the network link to the second router via the first router;

a means for analyzing the data packets to identify the secret piece of information; and

a means for responding to the transmitted packets by sending the secret piece of information back over the network link via the first router.

43. The method of claim 42, wherein the means for analyzing is a processing unit on a computer.