Detection of encrypted packet streams

• US 20060072464A1
• Filed: 09/17/2004
• Published: 04/06/2006
• Est. Priority Date: 09/17/2004
• Status: Abandoned Application

• Current Assignee: Bellsouth Intellectual Property Corporation (AT&T, Inc.)
• Original Assignee: Bellsouth Intellectual Property Corporation (AT&T, Inc.)
• Inventors: Aaron, Jeffrey A., Shrum, Edgar Vaughan Jr.
• Application Number:
  US10/944,294
• Publication Number:
  US 20060072464A1
• Time in Patent Office: Days
• US Class Current: 370/241
• CPC Class Codes: H04L 63/0457 wherein the sending and receiving network entities apply dynamic encryption, e.g. stream encryption cryptographic mechanisms or cryptographic arrangements for stream encryption H04L9/065
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

Methods, systems, and products are disclosed for detecting encrypted Internet Protocol packet streams. One method selects a subset of observable parameters from a set of observable parameters. The existence of at least one of the observable parameters within the subset is noted within an encrypted stream of packets. The at least one of the observable parameters is observable despite encryption obscuring the contents of the encrypted stream of packets. The type of data within the encrypted stream of packets is inferred using the at least one of the observable parameters.

Claims

1. A method, comprising the steps of:

selecting a subset of observable parameters from a set of observable parameters;

noting at least one of the observable parameters within the subset in an encrypted stream of packets, the at least one of the observable parameters being observable despite encryption obscuring the contents of the encrypted stream of packets; and

inferring the type of data within the encrypted stream of packets using the at least one of the observable parameters.

2. A method according to claim 1, further comprising at least one of the steps of i) varying the selection of the subset of observable parameters and ii) periodically changing the selected subset of observable parameters.

3. A method according to claim 1, wherein the step of inferring the type of data comprises inferring the type of data within the encrypted stream of packets using a combination of the observable parameters within the subset.

4. A method according to claim 1, wherein the step of inferring the type of data comprises using a weighted combination of the observable parameters within the subset.

5. A method according to claim 1, wherein the step of inferring the type of data comprises requiring that more than one of the observable parameters within the subset agree to the type of data within the encrypted stream of packets.

6. A method according to claim 1, wherein the step of inferring the type of data comprises at least one of i) requiring that a majority of the observable parameters within the subset agree to the type of data within the encrypted stream of packets and ii) requiring that all of the observable parameters within the subset agree to the type of data within the encrypted stream of packets.

7. A method according to claim 1, wherein the step of inferring the type of data comprises requiring that some combination of the observable parameters within the subset agree to the type of data within the encrypted stream of packets.

8. A method according to claim 1, wherein the step of inferring the type of data comprises using a mathematical expression, the mathematical expression involving some combination of the observable parameters within the subset.

9. A method according to claim 1, further comprising the step of comparing to a threshold value.

10. A method according to claim 1, wherein the step of inferring the type of data comprises inferring Voice Over Internet Protocol data within the encrypted stream of packets using the at least one of the observable parameters.

11. A system, comprising:

a communications module stored in a memory device, and a processor communicating with the memory device;

the communications module selecting a subset of observable parameters from a set of observable parameters, the communications module noting at least one of the observable parameters within the subset in an encrypted stream of packets, the at least one of the observable parameters being observable despite encryption obscuring the contents of the encrypted stream of packets, and the communications module inferring the type of data within the encrypted stream of packets using the at least one of the observable parameters.

12. A system according to claim 11, wherein the communications module performs at least one of the steps of i) varying the selection of the subset of observable parameters and ii) periodically changing the selected subset of observable parameters.

13. A system according to claim 11, wherein the communications module infers the type of data within the encrypted stream of packets using a combination of the observable parameters within the subset.

14. A system according to claim 11, wherein the communications module infers the type of data comprises using a weighted combination of the observable parameters within the subset.

15. A system according to claim 11, wherein the communications module performs at least one of the steps of i) requiring that more than one of the observable parameters within the subset agree to the type of data within the encrypted stream of packets, ii) requiring that a majority of the observable parameters within the subset agree to the type of data within the encrypted stream of packets and iii) requiring that all of the observable parameters within the subset agree to the type of data within the encrypted stream of packets.

16. A system according to claim 11, wherein the communications module requires that some combination of the observable parameters within the subset agree to the type of data within the encrypted stream of packets.

17. A system according to claim 11, wherein the communications module infers the type of data comprises using a mathematical expression, the mathematical expression involving some combination of the observable parameters within the subset.

18. A system according to claim 11, wherein the communications module compares to a threshold value.

19. A system according to claim 11, wherein the communications module infers Voice Over Internet Protocol data within the encrypted stream of packets using the at least one of the observable parameters.

20. A computer program product comprising a computer readable medium including instructions for performing the steps:

a computer-readable medium; and

a communications module stored on the computer-readable medium, the communications module selecting a subset of observable parameters from a set of observable parameters, the communications module noting at least one of the observable parameters within the subset in an encrypted stream of packets, the at least one of the observable parameters being observable despite encryption obscuring the contents of the encrypted stream of packets, and the communications module inferring the type of data within the encrypted stream of packets using the at least one of the observable parameters.