Detection of encrypted packet streams using feedback probing

• US 20060064749A1
• Filed: 09/17/2004
• Published: 03/23/2006
• Est. Priority Date: 09/17/2004
• Status: Active Grant

• Current Assignee: Bellsouth Intellectual Property Corporation (AT&T, Inc.)
• Original Assignee: Bellsouth Intellectual Property Corporation (AT&T, Inc.)
• Inventors: Aaron, Jeffrey A., Shrum, Edgar Vaughan Jr.
• Granted Patent: US 7,730,519 B2
• Time in Patent Office: Days
• US Class Current: 726/13
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload

Abstract

Methods, systems, and devices are disclosed for detecting encrypted Internet Protocol packet streams. A probe stream having a known observable parameter is generated. The observable parameter exhibits a known characteristic of a known type of data encrypted within a stream of packets. The probe stream is communicated to a network element via a communications network. When the probe stream is received by the network element, the network element can compare the known observable parameter to an actual value. Any difference between the known observable parameter and the actual value can be used to correct for network-induced variation and other effects, thus ensuring accurate detection and identification of data types within encrypted streams of packets.

Claims

1. A method, comprising the steps of:

generating a probe stream having a known observable parameter, the observable parameter exhibiting a known characteristic associated with a known type of data encrypted within a stream of packets; and

communicating the probe stream via a communications network.

2. A method according to claim 1, wherein the step of generating the probe stream comprises periodically generating the probe stream corresponding to a zone within the communications network.

3. A method according to claim 1, further comprising the step of encrypting the probe stream.

4. A method according to claim 1, wherein the probe stream comprises cleartext data.

5. A method according to claim 1, further comprising the step of identifying the probe stream with an identification number, the identification number corresponding to the known observable parameter.

6. A method according to claim 1, wherein the probe stream is generated having a set of known observable parameters, the set of known observable parameters exhibiting known characteristics associated with the known type of data.

7. A method according to claim 6, wherein the set of observable parameters is identified with an identification number, the identification number corresponding to the set of observable parameters.

8. A method according to claim 1, wherein the observable parameter exhibits a characteristic of Voice over Internet Protocol data encrypted within the stream of packets.

9. A method, comprising the steps of:

receiving a probe stream having a known observable parameter;

comparing the known observable parameter to an actual value in the probe stream; and

compensating for variation between the known observable parameter and the actual value when inferring a type of data encrypted within a stream of packets.

10. A method according to claim 9, further comprising the step of summarizing the variation between the known observable parameter and the actual value and communicating the summary via a communications network.

11. A method according to claim 9, further comprising the steps of relating the probe stream to a zone and applying the compensation to a subsequent stream of packets having the same zonal relationship.

12. A system, comprising:

a communications module stored in a memory device, and a processor communicating with the memory device;

the communications module generating a probe stream having a known observable parameter, the observable parameter exhibiting a known characteristic associated with a known type of data encrypted within streams of packets, and the communications module communicating the probe stream via a communications network.

13. A system according to claim 12, wherein the communications module periodically generates the probe stream corresponding to a zone within the communications network.

14. A system according to claim 12, wherein the communications module encrypts the probe stream.

15. A system according to claim 12, wherein the probe stream is cleartext.

16. A system according to claim 12, wherein the communications module identifies the probe stream with an identification number, the identification number corresponding to the known observable parameter.

17. A system according to claim 12, wherein the communications module generates the probe stream having a set of known observable parameters, the set of known observable parameters exhibiting known characteristics associated with the known type of data.

18. A system according to claim 12, wherein the observable parameter exhibits a characteristic of a Voice over Internet Protocol data encrypted within a stream of packets.

19. A computer program product comprising a computer readable medium including instructions for performing the steps:

generating a probe stream having a known observable parameter, the observable parameter exhibiting a known characteristic associated with a known type of data encrypted within a stream of packets; and

communicating the probe stream via a communications network.

20. A computer program product according to claim 19, further performing at least one step of i) encrypting the probe stream and ii) generating the probe stream as text data.

21. A computer program product according to claim 19, wherein the observable parameter exhibits a characteristic of Voice over Internet Protocol data encrypted within a stream of packets.