Detection of encrypted packet streams using a timer

• US 20060064747A1
• Filed: 09/17/2004
• Published: 03/23/2006
• Est. Priority Date: 09/17/2004
• Status: Active Grant

• Current Assignee: Bellsouth Intellectual Property Corporation (AT&T, Inc.)
• Original Assignee: Bellsouth Intellectual Property Corporation (AT&T, Inc.)
• Inventors: Aaron, Jeffrey A., Shrum, Edgar Vaughan Jr.
• Granted Patent: US 8,332,938 B2
• Time in Patent Office: Days
• US Class Current: 726/13
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload

Abstract

Methods, systems, and devices are disclosed for detecting encrypted Internet Protocol packet streams. The type of data within an encrypted stream of packets is inferred using an observable parameter. The observable parameter is observable despite encryption obscuring the contents of the encrypted stream of packets. A timer is established that maintains settings despite changes in the type of inferred data.

Claims

1. A method, comprising the steps of:

inferring a type of data within an encrypted stream of packets using an observable parameter, the observable parameter being observable despite encryption obscuring the contents of the encrypted stream of packets; and

establishing at least one of a timer and a timer value.

2. A method according to claim 1, further comprising at least one of the steps of i) maintaining the type of inferred data until expiration of the timer and ii) processing the encrypted stream of packets until expiration of the timer.

3. A method according to claim 1, further comprising at least one of the steps of i) processing the encrypted stream of packets until expiration of the timer, despite a change in the type of inferred data, ii) maintaining the type of inferred data until expiration of the timer, despite a change in the observable parameter, and iii) applying quality of service processing until expiration of the timer, despite a change in the observable parameter.

4. A method according to claim 1, further comprising the step of comparing the observable parameter to a threshold value.

5. A method according to claim 4, wherein if the comparison is unfavorable, maintaining the type of inferred data until expiration of the timer.

6. A method according to claim 1, further comprising at least one of the steps of i) varying a value of the timer according to a schedule, ii) varying a value of the timer according to performance, iii) varying a value of the timer according to congestion, and iv) varying a value of the timer according to delay.

7. A method according to claim 1, further comprising at least one of the steps of i) varying a value of the timer according to packet loss, ii) varying a value of the timer according to equipment, iii) varying a value of the timer according to a protocol, and iv) varying a value of the timer according to a software application.

8. A method according to claim 1, further comprising:

inferring Voice Over Internet Protocol data within the encrypted stream of packets using the observable parameter; and

continue inferring the Voice Over Internet Protocol data until expiration of the timer.

9. A system, comprising:

a communications module stored in a memory device, and a processor communicating with the memory device;

the communications module inferring a type of data within an encrypted stream of packets using an observable parameter, the observable parameter being observable despite encryption obscuring the contents of the encrypted stream of packets; and

the communications module establishing a timer.

10. A system according to claim 9, wherein the communications module at least one of i) maintains the type of inferred data until expiration of the timer and ii) processes the encrypted stream of packets until expiration of the timer.

11. A system according to claim 9, wherein the communications module at least one of i) processes the encrypted stream of packets until expiration of the timer, despite a change in the type of inferred data, ii) maintains the type of inferred data until expiration of the timer, despite a change in the observable parameter, and iii) applies quality of service processing until expiration of the timer, despite a change in the observable parameter.

12. A system according to claim 9, wherein the communications module compares the observable parameter to a threshold value.

13. A system according to claim 12, wherein if the comparison is unfavorable, the communications module maintains the type of inferred data until expiration of the timer.

14. A system according to claim 9, wherein the communications module at least one of i) varies a value of the timer according to a schedule, ii) varies a value of the timer according to performance of a communications network, iii) varies a value of the timer according to congestion within the communications network, and iv) varies a value of the timer according to delay within the communications network.

15. A system according to claim 9, wherein the communications module at least one of i) varies a value of the timer according to packet loss within a communications network, ii) varies a value of the timer according to vendor equipment, iii) varies a value of the timer according to a protocol, and iv) varies a value of the timer according to a software application.

16. A system according to claim 9, wherein the communications module i) infers Voice Over Internet Protocol data within the encrypted stream of packets using the observable parameter, and ii) continues inferring the Voice Over Internet Protocol data until expiration of the timer.

17. A computer program product comprising a computer readable medium including instructions for performing the steps:

inferring a type of data within an encrypted stream of packets using an observable parameter, the observable parameter being observable despite encryption obscuring the contents of the encrypted stream of packets; and

establishing a timer.

18. A computer program product according to claim 17, further performing at least one of the steps of i) maintaining the type of inferred data until expiration of the timer and ii) processing the encrypted stream of packets until expiration of the timer.

19. A computer program product according to claim 17, further performing at least one of the steps of i) processing the encrypted stream of packets until expiration of the timer, despite a change in the type of inferred data, ii) maintaining the type of inferred data until expiration of the timer, despite a change in the observable parameter, and iii) applying quality of service processing until expiration of the timer, despite a change in the observable parameter.

20. A computer program product according to claim 17, further performing the steps:

inferring Voice Over Internet Protocol data within the encrypted stream of packets using the observable parameter; and

continue inferring the Voice Over Internet Protocol data until expiration of the timer.