System and Method for Identifying Encrypted Conference Media Traffic

• US 20090063856A1
• Filed: 08/31/2007
• Published: 03/05/2009
• Est. Priority Date: 08/31/2007
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Zaheer Aziz
• Inventors: Sagy, Ravid, Aziz, Zaheer, Cooke, Jawhny X., Dunn, Chris A.
• Granted Patent: US 8,417,942 B2
• Time in Patent Office: Days
• US Class Current: 713/160
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 65/403 Arrangements for multi-party communication, e.g. for conferences data switching systems for conference H04L12/18; arrangements for connecting several subscribers to a common circuit, i.e. affording conference facilities H04M3/56; television conferencing systems H04N7/15
• CPC Class Codes: H04L 65/75 Media network packet handling
• CPC Class Codes: H04L 65/756 adapting media to device capabilities

Abstract

A method for identifying conference media traffic includes receiving a plurality of dummy packets and matching a series of the plurality of dummy packets to a signature key. The method also includes extracting a first identification from one or more of the plurality of dummy packets in response to matching a series of the plurality of dummy packets to a signature key and determining that a second identification associated with one or more encrypted media packets matches the first identification. The method also includes associating one or more encrypted media packets with a conference in response to determining that the first identification matches the second identification.

Claims

1. A method for identifying conference media traffic comprising:

receiving a plurality of dummy packets;

matching a series of the plurality of dummy packets to a signature key;

extracting a first identification from one or more of the plurality of dummy packets in response to matching a series of the plurality of dummy packets to a signature key;

determining that a second identification associated with one or more encrypted media packets matches the first identification; and

associating one or more encrypted media packets with a conference in response to determining that the first identification matches the second identification.

2. The method of claim 1, further comprising applying one or more policies to the one or more encrypted media packets in response to associating one or more encrypted media packets with a conference.

3. The method of claim 1, wherein the first identification and the second identification each comprise a source identification and a destination identification.

4. The method of claim 3, wherein the source identification and the destination identification are Internet Protocol (IP) addresses.

5. The method of claim 1, further comprising updating the signature key.

6. The method of claim 5, wherein updating the signature key comprises changing the signature key based on the time of day.

7. The method of claim 1, wherein the signature key is associated with the bit size of the series of dummy packets.

8. The method of claim 1, further comprising, in response to extracting a first identification from one or more of the plurality of dummy packets, monitoring a network for one or more encrypted media packets having a second identification that matches the first identification.

9. A network apparatus comprising:

an interface operable to;

receive a plurality of dummy packets; and

receive one or more encrypted media packets; and

a processor coupled to the interface and operable to;

match a series of the plurality of dummy packets to a signature key;

extract a first identification from one or more of the plurality of dummy packets in response to matching a series of the plurality of dummy packets to a signature key;

determine that a second identification associated with one or more of the encrypted media packets matches the first identification; and

associate one or more encrypted media packets with a conference in response to determining that the first identification matches the second identification.

10. The system of claim 9, wherein the processor is further operable to apply one or more policies to the one or more encrypted media packets in response to associating one or more encrypted media packets with a conference.

11. The system of claim 9, wherein the first identification and the second identification each comprise a source identification and a destination identification.

12. The system of claim 9, wherein the source identification and the destination identification are Internet Protocol (IP) addresses.

13. The system of claim 9, wherein the processor is further operable to update the signature key.

14. The system of claim 13, wherein a processor operable to update a signature key comprises a processor operable to change the signature key based on the time of day.

15. The system of claim 9, wherein the signature key is associated with the bit size of the series of dummy packets.

16. The system of claim 9, wherein the processor is further operable to monitor a network for one or more encrypted media packets having a second identification that matches the first identification in response to extracting a first identification from one or more of the plurality of dummy packets

17. A computer readable medium including code for identifying encrypted conference media traffic, the code operable to:

receive a plurality of dummy packets;

match a series of the plurality of dummy packets to a signature key;

extract a first identification from one or more of the plurality of dummy packets in response to matching a series of the plurality of dummy packets to a signature key;

determine that a second identification associated with one or more encrypted media packets matches the first identification; and

associate one or more encrypted media packets with a conference in response to determining that the first identification matches the second identification.

18. The computer readable medium of claim 17, wherein the code is further operable to apply one or more policies to the one or more encrypted media packets in response to associating one or more encrypted media packets with a conference.

19. The computer readable medium of claim 17, wherein the first identification and the second identification each comprise a source identification and a destination identification.

20. The computer readable medium of claim 19, wherein the source identification and the destination identification are Internet Protocol (IP) addresses.

21. The computer readable medium of claim 17, wherein the code is further operable to update the signature key.

22. The computer readable medium of claim 20, wherein code operable to update the signature key comprises code operable to change the signature based on the time of day.

23. The computer readable medium of claim 17, wherein the signature key is associated with the bit size of the series of dummy packets.

24. The computer readable medium of claim 17, wherein the code is further operable to monitor a network for one or more encrypted media packets having a second identification that matches the first identification in response to extracting a first identification from one or more of the plurality of dummy packets.

25. A network apparatus comprising:

means for receiving a plurality of dummy packets;

means for matching a series of the plurality of dummy packets to a signature key;

means for extracting a first identification from one or more of the plurality of dummy packets in response to matching a series of the plurality of dummy packets to a signature key;

means for determining that a second identification associated with one or more encrypted media packets matches the first identification; and

means for associating one or more encrypted media packets with a conference in response to determining that the first identification matches the second identification.