IMPARTING REAL-TIME PRIORITY-BASED NETWORK COMMUNICATIONS IN AN ENCRYPTED COMMUNICATION SESSION

• US 20100095121A1
• Filed: 10/15/2008
• Published: 04/15/2010
• Est. Priority Date: 10/15/2008
• Status: Active Grant

• Current Assignee: Adobe Inc.
• Original Assignee: Adobe Systems Incorporated (Adobe Inc.)
• Inventors: Chan, Edward, Kaufman, Matthew, Thornburgh, Michael, Shetty, Pritham, Whillock, Asa, Manapragada, Srinivas
• Granted Patent: US 8,051,287 B2
• Time in Patent Office: Days
• US Class Current: 713/170
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 65/60 Network streaming of media packets
• CPC Class Codes: H04L 67/60 Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources admission control or resource allocation H04L47/70
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

This specification describes technologies relating to imparting real-time priority-based network communications in an encrypted session. In general, aspects of the subject matter described can be embodied in methods that include establishing, based on cryptographic information in a reserved, random-data portion of a handshake communication, a session, receiving parameter values relating to a sub media stream, included in a header of a network communication, storing the parameter values, obtaining state information and a data payload included in a second network communication, identifying, from the state information, a purpose of the second network communication, and whether a header of the second network communication includes one or more new values corresponding to one or more of the parameters, updating one or more of the stored values based on the one or more new values, and processing the data payload based on the identified purpose and the stored parameter values.

Claims

1. A method comprising:

establishing, based at least in part on cryptographic information in a pre-defined portion of a handshake network communication, a communication session to communicate a media stream, wherein the pre-defined portion of the handshake network communication is reserved for random data;

receiving through the communication session, as part of the media stream, values of parameters relating to a sub media stream, included in a first header portion of a first real-time, priority-based network communication;

storing the values of the parameters;

obtaining through the communication session, as part of the media stream, state information included in a control portion of a second real-time, priority-based network communication and a data payload included in the second network communication;

identifying, from the state information, a purpose of the second network communication in relation to the media stream, and whether a second header portion of the second network communication includes one or more new values corresponding to one or more of the parameters;

updating, when the second header portion includes the one or more new values, one or more of the stored values based at least in part on the one or more new values; and

processing the data payload based at least in part on the identified purpose and the stored values of the parameters.

2. The method of claim 1, wherein identifying the purpose comprises identifying the purpose from a set of possible purposes including:

beginning a new sub media stream, the second header portion including sub media stream values corresponding to the parameters, and

indicating a new media type, the second header portion including the one or more values corresponding to fewer than all of the parameters.

3. The method of claim 2, wherein identifying the purpose comprises identifying the purpose from the set of possible purposes including:

providing a new time, the second header portion including one new value corresponding to one of the parameters, and

continuing the sub media stream, the second header portion not including the one or more new values.

4. The method of claim 1, wherein establishing the communication session further comprises:

generating, using an incoming data portion from the handshake network communication, a responsive handshake network communication, including an outgoing data portion wherein the outgoing data portion comprises at least one of random data and cryptographic information, and the incoming data portion comprises at least one of random data and cryptographic information in the handshake network communication;

communicating the generated responsive handshake network communication;

receiving a second handshake network communication in response to the communicated responsive handshake network communication; and

authenticating the second handshake network communication based on the outgoing data portion in the communicated responsive handshake network communication.

5. The method of claim 1, wherein establishing the communication session comprises:

establishing a cryptographic key based at least in part on the cryptographic information; and

initiating the communication session as an encrypted communication session based at least in part on the cryptographic key.

6. The method of claim 5, wherein the sub media stream comprises a first sub media stream, the method further comprising:

receiving through the encrypted communication session, as part of the media stream, real-time, priority-based network communications associated with a second sub media stream, wherein the network communications include state information and data payloads;

decrypting the data payloads based at least in part on the cryptographic information;

assembling a playable portion of the second sub media stream based at least in part on state information and the decrypted data payloads; and

playing the assembled portion of the second sub media stream relative to a media type indicated by at least one of the stored values of the parameters.

7. The method of claim 5, further comprising turning on or off a feature of a program operating in relation to the communication session based at least in part on the establishing of the communication session, and wherein establishing the communication session comprises:

retrieving a portion of random data from the pre-defined portion;

determining an index into the pre-defined portion of the handshake network communication based on the retrieved portion of the random data;

locating the cryptographic information based at least in part on the index; and

authenticating the handshake network communication based at least in part on the cryptographic information.

8. A method comprising:

establishing, based at least in part on cryptographic information in a pre-defined portion of a handshake network communication, a communication session to communicate a media stream, wherein the pre-defined portion of the handshake network communication is reserved for random data and the media stream comprises sub media streams;

associating priority values with the sub media streams;

generating a total priority value based on the priority values;

calculating desired transmission proportions corresponding to the sub media streams based on the priority values and the total priority value;

communicating a set of real-time priority based network communications over the sub media streams;

assessing sub media stream counts corresponding to the sub media streams based on the communicated set;

summing a total count based on the sub media stream counts;

determining actual transmission proportions corresponding to the sub media streams based on the sub media stream counts and the total count;

figuring ratios corresponding to the sub media streams based on the desired transmission proportions and the actual transmission proportions; and

storing the figured ratios.

9. The method of claim 8, further comprising:

selecting a low-ratio sub media stream corresponding to a lowest of the stored ratios;

queuing a set of real-time priority based network communications to be communicated over the sub media streams;

picking a low-ratio sub media stream network communication, associated with the low-ratio sub media stream, from the queued set; and

communicating the low-ratio sub media stream network communication over the low-ratio sub media stream.

10. A method comprising:

establishing, based at least in part on cryptographic information in a pre-defined portion of a handshake network communication, a cryptographic key and a communication session to communicate a media stream, wherein the pre-defined portion of the handshake network communication is reserved for random data;

initiating the communication session as an encrypted communication session based at least in part on the cryptographic key;

receiving through the communication session, as part of the media stream, values of parameters relating to a sub media stream, included in a first header portion of a first real-time, priority-based network communication;

storing the values of the parameters;

obtaining through the communication session, as part of the media stream, state information included in a control portion of a second real-time, priority-based network communication and a data payload included in the second network communication;

identifying, from the state information, a purpose of the second network communication in relation to the media stream, and whether a second header portion of the second network communication includes one or more new values corresponding to one or more of the parameters, wherein identifying the purpose comprises identifying the purpose from a set of possible purposes including;

beginning a new sub media stream, the second header portion including sub media stream values corresponding to the parameters,

indicating a new media type, the second header portion including the one or more values corresponding to fewer than all of the parameters,

providing a new time, the second header portion including one new value corresponding to one of the parameters, and

continuing the sub media stream, the second header portion not including the one or more new values;

updating, when the second header portion includes the one or more new values, one or more of the stored values based at least in part on the one or more new values; and

processing the data payload based at least in part on the identified purpose and the stored values of the parameters.

11. The method of claim 10, wherein the sub media stream comprises a first sub media stream, and wherein establishing the communication session comprises:

retrieving a portion of random data from the pre-defined portion;

determining an index into the pre-defined portion of the network communication based on the retrieved portion of the random data;

locating the cryptographic information based at least in part on the index; and

authenticating the handshake network communication based at least in part on the cryptographic information,

and the method further comprising;

turning on or off a feature of a program operating in relation to the communication session based at least in part on the establishing of the communication session;

receiving through the encrypted communication session, as part of the media stream, real-time, priority-based network communications associated with a second sub media stream, wherein the network communications include state information and data payloads;

decrypting the data payloads based at least in part on the cryptographic information;

assembling a playable portion of the second sub media stream based at least in part on state information and the decrypted data payloads; and

playing the assembled portion of the second sub media stream relative to a media type indicated by at least one of the stored values of the parameters.

12. A computer-readable medium having a computer program product encoded therein, the computer program product operable to cause data processing apparatus to perform operations comprising:

establishing, based at least in part on cryptographic information in a pre-defined portion of a handshake network communication, a communication session to communicate a media stream, wherein the pre-defined portion of the handshake network communication is reserved for random data;

receiving through the communication session, as part of the media stream, values of parameters relating to a sub media stream, included in a first header portion of a first real-time, priority-based network communication;

storing the values of the parameters;

obtaining through the communication session, as part of the media stream, state information included in a control portion of a second real-time, priority-based network communication and a data payload included in the second network communication;

identifying, from the state information, a purpose of the second network communication in relation to the media stream, and whether a second header portion of the second network communication includes one or more new values corresponding to one or more of the parameters;

updating, when the second header portion includes the one or more new values, one or more of the stored values based at least in part on the one or more new values; and

processing the data payload based at least in part on the identified purpose and the stored values of the parameters.

13. The computer-readable medium of claim 12, wherein identifying the purpose comprises identifying the purpose from a set of possible purposes including:

beginning a new sub media stream, the second header portion including sub media stream values corresponding to the parameters, and

indicating a new media type, the second header portion including the one or more values corresponding to fewer than all of the parameters.

14. The computer-readable medium of claim 13, wherein identifying the purpose comprises identifying the purpose from the set of possible purposes including:

providing a new time, the second header portion including one new value corresponding to one of the parameters, and

continuing the sub media stream, the second header portion not including the one or more new values.

15. The computer-readable medium of claim 12, wherein establishing the communication session further comprises:

generating, using an incoming data portion from the handshake network communication, a responsive handshake network communication, including an outgoing data portion wherein the outgoing data portion comprises at least one of random data and cryptographic information, and the incoming data portion comprises at least one of random data and cryptographic information in the handshake network communication;

communicating the generated responsive handshake network communication;

receiving a second handshake network communication in response to the communicated responsive handshake network communication; and

authenticating the second handshake network communication based on the outgoing data portion in the communicated responsive handshake network communication.

16. The computer-readable medium of claim 12, wherein establishing the communication session comprises:

establishing a cryptographic key based at least in part on the cryptographic information; and

initiating the communication session as an encrypted communication session based at least in part on the cryptographic key.

17. The computer-readable medium of claim 16, wherein the sub media stream comprises a first sub media stream, and the operations further comprising:

receiving through the encrypted communication session, as part of the media stream, real-time, priority-based network communications associated with a second sub media stream, wherein the network communications include state information and data payloads;

decrypting the data payloads based at least in part on the cryptographic information;

assembling a playable portion of the second sub media stream based at least in part on state information and the decrypted data payloads; and

playing the assembled portion of the second sub media stream relative to a media type indicated by at least one of the stored values of the parameters.

18. The computer-readable medium of claim 16, further comprising turning on or off a feature of a program operating in relation to the communication session based at least in part on the establishing of the communication session, and wherein establishing the communication session comprises:

retrieving a portion of random data from the pre-defined portion;

determining an index into the pre-defined portion of the handshake network communication based on the retrieved portion of the random data;

locating the cryptographic information based at least in part on the index; and

authenticating the handshake network communication based at least in part on the cryptographic information.

19. A computer-readable medium having a computer program product encoded therein, the computer program product operable to cause data processing apparatus to perform operations comprising:

establishing, based at least in part on cryptographic information in a pre-defined portion of a handshake network communication, a communication session to communicate a media stream, wherein the pre-defined portion of the handshake network communication is reserved for random data and the media stream comprises sub media streams;

associating priority values with the sub media streams;

generating a total priority value based on the priority values;

calculating desired transmission proportions corresponding to the sub media streams based on the priority values and the total priority value;

communicating a set of real-time priority based network communications over the sub media streams;

assessing sub media stream counts corresponding to the sub media streams based on the communicated set;

summing a total count based on the sub media stream counts;

determining actual transmission proportions corresponding to the sub media streams based on the sub media stream counts and the total count;

figuring ratios corresponding to the sub media streams based on the desired transmission proportions and the actual transmission proportions; and

storing the figured ratios.

20. The computer-readable medium of claim 19, the operations further comprising:

selecting a low-ratio sub media stream corresponding to a lowest of the stored ratios;

queuing a set of real-time priority based network communications to be communicated over the sub media streams;

picking a low-ratio sub media stream network communication, associated with the low-ratio sub media stream, from the queued set; and

communicating the low-ratio sub media stream network communication over the low-ratio sub media stream.

21. A computer-readable medium having a computer program product encoded therein, the computer program product operable to cause data processing apparatus to perform operations comprising:

establishing, based at least in part on cryptographic information in a pre-defined portion of a handshake network communication, a cryptographic key and a communication session to communicate a media stream, wherein the pre-defined portion of the handshake network communication is reserved for random data;

initiating the communication session as an encrypted communication session based at least in part on the cryptographic key;

receiving through the communication session, as part of the media stream, values of parameters relating to a sub media stream, included in a first header portion of a first real-time, priority-based network communication;

storing the values of the parameters;

obtaining through the communication session, as part of the media stream, state information included in a control portion of a second real-time, priority-based network communication and a data payload included in the second network communication;

identifying, from the state information, a purpose of the second network communication in relation to the media stream, and whether a second header portion of the second network communication includes one or more new values corresponding to one or more of the parameters, wherein identifying the purpose comprises identifying the purpose from a set of possible purposes including;

beginning a new sub media stream, the second header portion including sub media stream values corresponding to the parameters,

indicating a new media type, the second header portion including the one or more values corresponding to fewer than all of the parameters,

providing a new time, the second header portion including one new value corresponding to one of the parameters, and

continuing the sub media stream, the second header portion not including the one or more new values;

updating, when the second header portion includes the one or more new values, one or more of the stored values based at least in part on the one or more new values; and

processing the data payload based at least in part on the identified purpose and the stored values of the parameters.

22. The computer-readable medium of claim 21, wherein the sub media stream comprises a first sub media stream, and wherein establishing the communication session comprises:

retrieving a portion of random data from the pre-defined portion;

determining an index into the pre-defined portion of the network communication based on the retrieved portion of the random data;

locating the cryptographic information based at least in part on the index; and

authenticating the handshake network communication based at least in part on the cryptographic information,

and the operations further comprising;

turning on or off a feature of a program operating in relation to the communication session based at least in part on the establishing of the communication session;

receiving through the encrypted communication session, as part of the media stream, real-time, priority-based network communications associated with a second sub media stream, wherein the network communications include state information and data payloads;

decrypting the data payloads based at least in part on the cryptographic information;

assembling a playable portion of the second sub media stream based at least in part on state information and the decrypted data payloads; and

playing the assembled portion of the second sub media stream relative to a media type indicated by at least one of the stored values of the parameters.

23. A system comprising:

a server computer, programmed to establish encrypted sessions over a network with a client computer using a session startup handshake including a handshake network communication including a pre-defined portion reserved for random data; and

the client computer, programmed to establish encrypted sessions with the server computer using the session startup handshake including cryptographic information in the pre-defined portion of the handshake network communication,

wherein the server computer and the client computer are programmed to perform operations comprising;

establishing, based at least in part on the cryptographic information, an encrypted communication session to communicate a media stream,

receiving through the communication session, as part of the media stream, values of parameters relating to a sub media stream, included in a first header portion of a first real-time, priority-based network communication,

storing the values of the parameters,

obtaining through the communication session, as part of the media stream, state information included in a control portion of a second real-time, priority-based network communication and a data payload included in the second network communication,

identifying, from the state information, a purpose of the second network communication in relation to the media stream, and whether a second header portion of the second network communication includes one or more new values corresponding to one or more of the parameters,

updating, when the second header portion includes the one or more new values, one or more of the stored values based at least in part on the one or more new values, and

processing the data payload based at least in part on the identified purpose and the stored values of the parameters.

24. The system of claim 23, wherein the client computer comprises a mobile device.

25. The system of claim 23, wherein identifying the purpose comprises identifying the purpose from a set of possible purposes including:

beginning a new sub media stream, the second header portion including sub media stream values corresponding to the parameters, and

indicating a new media type, the second header portion including the one or more values corresponding to fewer than all of the parameters.

26. The system of claim 25, wherein identifying the purpose comprises identifying the purpose from the set of possible purposes including:

providing a new time, the second header portion including one new value corresponding to one of the parameters, and

continuing the sub media stream, the second header portion not including the one or more new values.

27. The system of claim 23, wherein establishing the communication session further comprises:

generating, using an incoming data portion from the handshake network communication, a responsive handshake network communication, including an outgoing data portion wherein the outgoing data portion comprises at least one of random data and cryptographic information, and the incoming data portion comprises at least one of random data and cryptographic information in the handshake network communication;

communicating the generated responsive handshake network communication;

receiving a second handshake network communication in response to the communicated responsive handshake network communication; and

authenticating the second handshake network communication based on the outgoing data portion in the communicated responsive handshake network communication.

28. The system of claim 23, wherein establishing the communication session comprises:

establishing a cryptographic key based at least in part on the cryptographic information; and

initiating the communication session as an encrypted communication session based at least in part on the cryptographic key.

29. The system of claim 28, wherein the sub media stream comprises a first sub media stream, the operations further comprising:

receiving through the encrypted communication session, as part of the media stream, real-time, priority-based network communications associated with a second sub media stream, wherein the network communications include state information and data payloads;

decrypting the data payloads based at least in part on the cryptographic information;

assembling a playable portion of the second sub media stream based at least in part on state information and the decrypted data payloads; and

playing the assembled portion of the second sub media stream relative to a media type indicated by at least one of the stored values of the parameters.

30. The system of claim 28, further comprising turning on or off a feature of a program operating in relation to the communication session based at least in part on the establishing of the communication session, and wherein establishing the communication session comprises:

retrieving a portion of random data from the pre-defined portion;

determining an index into the pre-defined portion of the handshake network communication based on the retrieved portion of the random data;

locating the cryptographic information based at least in part on the index; and

authenticating the handshake network communication based at least in part on the cryptographic information.

31. A system comprising:

a server, programmed to establish encrypted sessions over a network with a client using a session startup handshake including a handshake network communication including a pre-defined portion reserved for random data; and

the client, programmed to establish encrypted sessions with the server using the session startup handshake including cryptographic information in the pre-defined portion of the handshake network communication,

wherein the server and the client are programmed to perform operations comprising;

establishing, based at least in part on the cryptographic information, an encrypted communication session to communicate a media stream, wherein the media stream comprises sub media streams,

associating priority values with the sub media streams,

generating a total priority value based on the priority values,

calculating desired transmission proportions corresponding to the sub media streams based on the priority values and the total priority value,

communicating a set of real-time priority based network communications over the sub media streams,

assessing sub media stream counts corresponding to the sub media streams based on the communicated set,

summing a total count based on the sub media stream counts,

determining actual transmission proportions corresponding to the sub media streams based on the sub media stream counts and the total count,

figuring ratios corresponding to the sub media streams based on the desired transmission proportions and the actual transmission proportions, and

storing the figured ratios.

32. The system of claim 31, the operations further comprising:

selecting a low-ratio sub media stream corresponding to a lowest of the stored ratios,

queuing a set of real-time priority based network communications to be communicated over the sub media streams,

picking a low-ratio sub media stream network communication, associated with the low-ratio sub media stream, from the queued set, and

communicating the low-ratio sub media stream network communication over the low-ratio sub media stream.

33. A system comprising:

a server, programmed to establish encrypted sessions over a network with a client using a session startup handshake including a handshake network communication including a pre-defined portion reserved for random data; and

the client, programmed to establish encrypted sessions with the server using the session startup handshake including cryptographic information in the pre-defined portion of the handshake network communication,

wherein the server and the client are programmed to perform operations comprising;

establishing, based at least in part on the cryptographic information, a cryptographic key and a communication session to communicate a media stream, initiating the communication session as an encrypted communication session based at least in part on the cryptographic key, receiving through the communication session, as part of the media stream, values of parameters relating to a sub media stream, included in a first header portion of a first real-time, priority-based network communication, storing the values of the parameters, obtaining through the communication session, as part of the media stream, state information included in a control portion of a second real-time, priority-based network communication and a data payload included in the second network communication, identifying, from the state information, a purpose of the second network communication in relation to the media stream, and whether a second header portion of the second network communication includes one or more new values corresponding to one or more of the parameters, wherein identifying the purpose comprises identifying the purpose from a set of possible purposes including beginning a new sub media stream, the second header portion including sub media stream values corresponding to the parameters, indicating a new media type, the second header portion including the one or more values corresponding to fewer than all of the parameters, providing a new time, the second header portion including one new value corresponding to one of the parameters, and continuing the sub media stream, the second header portion not including the one or more new values, updating, when the second header portion includes the one or more new values, one or more of the stored values based at least in part on the one or more new values, and processing the data payload based at least in part on the identified purpose and the stored values of the parameters.

34. The system of claim 33, wherein the sub media stream comprises a first sub media stream, and wherein establishing the communication session comprises:

retrieving a portion of random data from the pre-defined portion, determining an index into the pre-defined portion of the network communication based on the retrieved portion of the random data, locating the cryptographic information based at least in part on the index, and authenticating the handshake network communication based at least in part on the cryptographic information, and the server and the client are programmed to perform operations further comprising;

turning on or off a feature of a program operating in relation to the communication session based at least in part on the establishing of the communication session, receiving through the encrypted communication session, as part of the media stream, real-time, priority-based network communications associated with a second sub media stream, wherein the network communications include state information and data payloads, decrypting the data payloads based at least in part on the cryptographic information, assembling a playable portion of the second sub media stream based at least in part on state information and the decrypted data payloads, and playing the assembled portion of the second sub media stream relative to a media type indicated by at least one of the stored values of the parameters.