Methods, communication networks, and computer program products for storing and/or logging traffic associated with a network element based on whether the network element can be trusted

• US 20070147262A1
• Filed: 12/22/2005
• Published: 06/28/2007
• Est. Priority Date: 12/22/2005
• Status: Abandoned Application

• Current Assignee: Bellsouth Intellectual Property Corporation (AT&T, Inc.)
• Original Assignee: Bellsouth Intellectual Property Corporation (AT&T, Inc.)
• Inventors: Aaron, Jeffrey, Shrum, Edgar
• Application Number:
  US11/315,572
• Publication Number:
  US 20070147262A1
• Time in Patent Office: Days
• US Class Current: 370/250
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281

Abstract

A determination can be made whether a network element is configured in an authorized manner, e.g., whether the network element is configured with authorized firmware, software, and/or data. In this regard, a determination is made whether the network element can be trusted and to what degree the network element can be trusted. Based on this determination of whether the network element can be trusted, the traffic associated with the network element can be stored and/or logged in a desired manner.

Claims

1. A method of operating a communication network, comprising:

determining whether a network element can be trusted; and

storing and/or logging traffic associated with the network element based on whether the network element can be trusted.

2. The method of claim 1, wherein determining whether a network element can be trusted, comprises:

generating a first hash value based on data associated with the network element;

generating a second hash value based on the data associated with the network element; and

comparing the first hash value with the second hash value to determine whether the network element can be trusted.

3. The method of claim 2, wherein comparing the first hash value with the second hash value to determine whether the network element can be trusted comprises comparing the first hash value with the second hash value to determine a degree of trust for the network element.

4. The method of claim 1, wherein storing and/or logging traffic comprises:

selecting traffic for storing and/or logging using rules that are based on network element trust information.

5. The method of claim 4, wherein selecting traffic comprises:

selecting traffic for storing and/or logging based on a protocol associated with the traffic, a source and/or destination address associated with the traffic, an application associated with sending and/or receiving the traffic, and/or payloads associated with the traffic.

6. The method of claim 4, wherein the rules comprise a prioritization of the traffic based on protocol, a prioritization of the traffic based on time to store and/or log the traffic, a prioritization of the traffic based on a source and/or destination address or range, a prioritization of the traffic based on an application associated with sending and/or receiving the traffic, and/or a prioritization of the traffic based on payloads associated with the traffic.

7. The method of claim 6, further comprising:

using context information to adjust at least one prioritization of the traffic.

8. The method of claim 6, further comprising:

using context information to select at least one of the prioritizations of the traffic for use in selecting the traffic for storing and/or logging.

9. The method of claim 6, further comprising:

using degree of trust for the network element to select at least one of the prioritizations of the traffic for use in selecting the traffic for storing and/or logging.

10. The method of claim 4, further comprising:

determining whether to store or log the traffic based on degree of trust for the network element.

11. The method of claim 1, further comprising:

selecting a destination for storing and/or logging the traffic based on network element trust information.

12. The method of claim 1, further comprising:

stopping storing and/or logging of the traffic associated with the network element if it is determined that the network element can be trusted and/or upon elapse of a defined storing and/or logging time; and

retaining the stored and/or logged traffic associated with the network element for a duration that is based on degree of trust for the network element.

13. The method of claim 2, wherein generating the first hash value and generating the second hash value comprise:

generating the first hash value and the second hash value responsive to at least one of an expiration of a timer, a packet count associated with the network element, an event associated with then network element, and/or a hash generation command.

14. The method of claim 1, wherein storing and/or logging traffic comprises:

storing and/or logging traffic associated with at least one of a location, a connection/session, and/or an application.

15. A computer program product for operating a communication network, comprising:

a computer readable storage medium having computer readable program code embodied therein, the computer readable program code being configured to carry out the method of claim 1.

16. A communication network, comprising:

a verification system that is configured to determine whether a network element can be trusted; and

a storing/logging controller that is connected to the verification system and is configured to store and/or log traffic associated with the network element based on whether the network element can be trusted.

17. The communication network of claim 16, wherein the verification system is further configured to generate a first hash value based on data associated with the network element, generate a second hash value based on the data associated with the network element, and compare the first hash value with the second hash value to determine whether the network element can be trusted.

18. The communication network of claim 17, wherein the verification system is further configured to compare the first hash value with the second hash value to determine a degree of trust for the network element.

19. The communication network of claim 18, wherein the storing/logging controller is further configured to select traffic for storing and/or logging using rules that are based on the degree of trust for the network element.

20. The communication network of claim 19, wherein the rules comprise a prioritization of the traffic based on protocol, a prioritization of the traffic based on time to store and/or log the traffic, a prioritization of the traffic based on a source and/or destination address or range, a prioritization of the traffic based on an application associated with sending and/or receiving the traffic, and/or a prioritization of the traffic based on payloads associated with the traffic.