Processing of packet data in a communication system

• US 20060272025A1
• Filed: 05/26/2006
• Published: 11/30/2006
• Est. Priority Date: 05/26/2005
• Status: Abandoned Application

• Current Assignee: Nokia Corporation
• Original Assignee: Nokia Corporation
• Inventors: Mononen, Risto
• Application Number:
  US11/441,122
• Publication Number:
  US 20060272025A1
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: H04L 2463/141 Denial of service attacks against endpoints in a network
• CPC Class Codes: H04L 47/15 in relation to multipoint traffic arrangements for broadcast or multicast in data networks H04L12/18
• CPC Class Codes: H04L 47/24 Traffic characterised by specific attributes, e.g. priority or QoS
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

Processing of packet data in a communication system supporting at least packet data transfer involves the following. Packet data is received from a source. It is determined, based on the received packet data, whether there is anomalous behaviour of the packet data source. Data transmission resources for a communications device are limited in response to determining anomalous behaviour of the source, and transmission of packet data for the communications device is provided using the limited transmission resources. The communications device is either the source or a destination of at least part of the packet data received from the source. In the communication system, access to a set of services from the communications device may furthermore be blocked.

Claims

1. A method for processing packet data in a communication system supporting at least packet data transfer, the method comprising

determining anomalous behaviour of a source of packet data based on the packet data received in a network element;

limiting packet data communication resources provided by the network element for a communications device in response to determining the anomalous behaviour of the source, the communication device being a destination of at least part of the packet data based on which the anomalous behaviour of the source is determined or the communications device being the source; and

providing transmission of the packet data for the communications device in the communications system using the limited packet data communication resources.

2. A method as defined in claim 1, comprising lowering a quality of service of the packet data relating to the communications device.

3. A method as defined in claim 1, comprising lowering a bandwidth for the packet data relating to the communications device.

4. A method as defined in claim 1, comprising increasing a delay for the packet data relating to the communications device.

5. A method as defined in claim 1, comprising sending to the communications device information about limiting a data transmission resource for use by the packet data.

6. A method as defined in claim 1, comprising blocking, in the communication system, access to a set of services from the communications device

7. A method as defined in claim 6, comprising sending to the communications device information about blocking the access to the set of services.

8. A method as defined in claim 1, wherein the step of providing transmission comprises providing transmission in a cellular communication system

9. A method as defined in claim 1, wherein the step of providing transmission comprises providing transmission of the packet data for a terminal of the cellular network.

10. A method as defined in claim 1, wherein the communications system supports circuit-switched data transfer and the circuit-switched data transfer for the communications device is maintained.

11. A method as defined in claim 1, wherein the communications device is capable of transmitting data via a further communications system and data transmission relating to the communications device is maintained in said further communications system.

12. A method as defined in claim 1, where the anomalous behaviour of the source comprises the source being infected with malware or a malfunctioning of the source.

13. A communication system supporting at least packet data transfer, comprising:

means for receiving packet data;

means for determining anomalous behaviour of a source of the packet data based on the packet data received from the source in a network element; and

means for limiting packet data communication resources provided by the network element for a communications device in response to determining anomalous behaviour of the source, the communication device being a destination of at least part of the packet data based on which the anomalous behaviour of the source is determined or the communications device being the source,

wherein the communications system is configured to provide transmission of the packet data for the communications device using the limited packet data communication resources.

14. A communication system as defined in claim 13, comprising means for blocking, in the communications system, access to a set of services from the communications device.

15. A network element for a communication system supporting at least packet data transfer, comprising:

means for determining anomalous behaviour of a source of packet data based on the packet data received from the source in the network element, and

means for deciding to limit packet data transmission resources provided to a communications device by at least the network element in response to determining anomalous behaviour of the source, the communication device being a destination of at least part of the packet data based on which the anomalous behaviour of the source is determined or the communications device being the source.

16. A network element as defined in claim 15, comprising means for deciding to block, in the communications system, access to a set of services from the communications device.

17. A network element for a communication system supporting at least packet data transfer, comprising:

means for determining anomalous behaviour of a source of packet data based on the packet data received from the source in a further network element; and

means for deciding to limit packet data transmission resources provided to a communications device by at least the further network element in response to determining anomalous behaviour of the source, the communication device being a destination of at least part of the packet data based on which the anomalous behaviour of the source is determined or the communications device being the source.

18. A network element as defined in claim 17, comprising means for deciding to block, in the communications system, access to a set of services from the communications device.

19. A computer program, embodied on a computer-readable medium, comprising program instructions for causing a data processing system to perform the steps of:

determining anomalous behaviour of a source of packet data based on the packet data received from the source in a network element; and

deciding to limit packet data transmission resources provided to a communications device by at least the network element in response to determining anomalous behaviour of the source, the communication device being a destination of at least part of the packet data based on which the anomalous behaviour of the source is determined or the communications device being the source.

20. A communication system supporting at least packet data transfer, configured to:

receive packet data from a source;

determine anomalous behaviour of the source based on the packet data received from the source in a network element; and

limit packet data transmission resources for a communications device in response to determining anomalous behaviour of the source, the communication device being a destination of at least part of the packet data based on which the anomalous behaviour of the source is determined or the communications device being the source,

wherein the communications system is configured to provide transmission of packet data for the communications device using the limited transmission resources.

21. A network element for a communication system supporting at least packet data transfer, configured to:

determine anomalous behaviour of a source of packet data based on the packet data received from the source in the network element; and

decide to limit packet data transmission resources provided to a communications device by at least the network element in response to determining anomalous behaviour of the source, the communication device being a destination of at least part of the packet data based on which the anomalous behaviour of the source is determined or the communications device being the source.

22. A network element for a communication system supporting at least packet data transfer, configured to:

determine anomalous behaviour of a source of packet data based on the packet data received from the source in a further network element; and

decide to limit packet data transmission resources provided to a communications device by at least the further network element in response to determining anomalous behaviour of the source, the communication device being a destination of at least part of the packet data based on which the anomalous behaviour of the source is determined or the communications device being the source.

23. A method for processing packet data in a communication system supporting at least packet data transfer, the method comprising:

determining whether a communications device is malfunctioning based on packet data received from the communications device;

limiting data transmission resources for use by the packet data from the communications device in response to determining that the communications device is malfunctioning;

providing transmission of the packet data for the communications device in the communications system using the limited data transmission resources; and

blocking, in the communication system, access to a set of services from the communications device.

24. A communication system supporting at least packet data transfer, comprising:

means for receiving packet data from a communications device;

means for determining whether the communications device is malfunctioning based on the received packet data from the communications device;

means for limiting data transmission resources for use by the packet data from the communications device in response to determining that the communications device is malfunctioning; and

means for blocking, in the communication system, access to a set of services from the communications device,

wherein the communications system is configured to provide transmission of packet data for the communications device using the limited transmission resources.

25. A network element for a communication system supporting at least packet data transfer, comprising:

means for triggering a limiting of data transmission resources for use by packet data from a communications device in response to determining that the communications device is malfunctioning; and

means for triggering in the communications system a blocking of access to a set of services from the communications device in response to determining that the communications device is malfunctioning.

26. A network element as defined in claim 25, comprising means for determining that a communications device is malfunctioning based on the packet data received from the communications device.

27. A computer program, embodied on a computer-readable medium, comprising program instructions for causing a data processing system to perform the steps of:

triggering a limiting of data transmission resources for use by packet data from a communications device in response to determining that the communications device is malfunctioning, and

triggering in a communications system a blocking of access to a set of services from the communications device in response to determining that the communications device is malfunctioning.