METHOD FOR MAINTAINING DIFFERENTIATED SERVICES DATA FLOW AT A NETWORK DEVICE IMPLEMENTING REDUNDANT PACKET DISCARD SECURITY TECHNIQUES

• US 20100278045A1
• Filed: 05/18/2010
• Published: 11/04/2010
• Est. Priority Date: 06/30/2003
• Status: Active Grant

• Current Assignee: RPX Clearinghouse LLC (RPX Corporation)
• Original Assignee: Rockstar Consortium US LP (Rockstar Consortium Inc.)
• Inventors: Xiang, Jing
• Granted Patent: US 8,755,280 B2
• Time in Patent Office: Days
• US Class Current: 370/235
• CPC Class Codes: H04L 1/08 by repeating transmission, e.g. Verdan system H04L1/1858 and H04L1/189 take precedence
• CPC Class Codes: H04L 47/2408 for supporting different services, e.g. a differentiated services [DiffServ] type of service

Abstract

An improved method is described for providing Differentiated Services (Diffserv) traffic to a node in a network that implements a security method that discards duplicate packets received at the node. The method includes the step of identifying at least two service levels to be provided to received traffic and assigning different size look-back window counts to each of the service levels. The look-back window count indicates a number of packets that have been previously received at the node that should be compared against a received packet to determine whether a duplicate packet has been received. In one embodiment, a service level that has higher priority is assigned a lower look-back window count and thus examines fewer previously received packets than a service level having a lower priority. Such an arrangement reduces the possibility that traffic having higher priority is dropped as a security measure.

Claims

1. A method of determining whether to discard a received packet at a node, the method comprising the steps of:

responsive to a service level associated with the received packet, selecting a number from at least two available numbers, wherein the number identifies a number of previously received packets and wherein the at least two available numbers are different;

comparing a sequence number associated with the received packet against sequence numbers associated with the selected number of previously received packets; and

discarding the received packet in the event of a match between any one of the sequence numbers associated with the selected number of previously received packets and the sequence number associated with the received packet.

2. The method of claim 1, wherein the service level is determined in response to a differentiated services codepoint associated with the packet.

3. The method of claim 1, wherein there are at least two service levels and wherein the number corresponding to a higher priority service level is less than a number corresponding to a lower priority service level.

4. The method according to claim 3, wherein at least one of the service levels corresponds to an Expedited Forwarding (EP) per hop behavior.

5. The method according to claim 3, wherein at least one of the service levels corresponds to an Assured Forwarding (AF) per hop behavior.

6. The method according to claim 3, wherein at least one of the service levels corresponds to a Best Efforts (BE) per hop behavior.

7. The method of claim 1, wherein the step of discarding the received packet in the event of a match is performed in accordance with an Internet Protocol Security (IPsec) anti-replay mechanism.

8. An apparatus for discarding redundant packets received at an input interface, comprising:

a sequence number buffer, for storing sequence numbers associated with packets received at the input interface;

a look-back window table, comprising at least two entries, each entry associated with a service level and storing a number representing a number of previously received packets to be compared in determining whether to discard a received packet.

9. The apparatus of claim 8, wherein one of the entries of the look-back window table is associated with an Expedited Forwarding (EF) service level.

10. The apparatus of claim 8, wherein one of the entries of the look-back window table is associated with an Assured Forwarding (AF) service level.

11. The apparatus of claim 8, wherein one of the entries of the look-back window table is associated with a Best Effort (BE) service level.

12. The apparatus of claim 8, wherein the apparatus operates according to an Internet Protocol Security (IPsec) protocol.

13. An apparatus comprising:

means for comparing a sequence number of a received packet against a set of sequence numbers of previously received packets to determine whether there is a match, wherein a number of sequence numbers included in the set varies according to a service level of the received packet.

14. The apparatus of claim 13, wherein the number decreases as a priority level of the service level increases.