DYNAMIC FLOW MANAGEMENT AT A FIREWALL BASED ON ERROR MESSAGES

• US 20140173085A1
• Filed: 12/13/2012
• Published: 06/19/2014
• Est. Priority Date: 12/13/2012
• Status: Active Grant

• Current Assignee: Cellco Partnership, Inc. (Verizon Communications Inc.)
• Original Assignee: Cellco Partnership, Inc. (Verizon Communications Inc.)
• Inventors: GUPTA, Praveen
• Granted Patent: US 9,338,098 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 47/266 Stopping or restarting the source, e.g. X-on or X-off
• CPC Class Codes: H04L 61/2575 using address mapping retrieval, e.g. simple traversal of user datagram protocol through session traversal utilities for NAT [STUN]
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04W 4/24 Accounting or billing
• CPC Class Codes: H04W 8/04 Registration at HLR or HSS [Home Subscriber Server]

Abstract

A method and system are provided for blocking data packets that are not desired or capable of being received. One or more data packets are received from a data server. The data packets that are addressed to a wireless device are transmitted via a gateway server. The error messages generated by either the wireless device or the gateway server are forwarded to the data server and their number also counted. When the number of error messages meets a predetermined criterion, additional data packets from the data server that are addressed to the wireless device are blocked, for example, preventing tolling the user account of the wireless device for data packets sent by the data server when the device is not available or the user no longer wants to receive the data.

Claims

1. A method, comprising steps of:

receiving one or more data packets from a data server addressed to a wireless device;

transmitting the data packets addressed to the wireless device to a gateway server for delivery through a mobile traffic network to the wireless device;

counting a number of error messages generated by at least one of (i) the wireless device, or (ii) the gateway server and forwarding the error messages to the data server; and

blocking additional data packets from the data server addressed to the wireless device from transmission to the gateway server, upon determining that the number of error messages meets a predetermined criterion.

2. The method of claim 1, wherein the predetermined criterion includes at least one of:

(i) the number of consecutive error messages exceeding a first threshold within a first predetermined time;

or

(ii) the percentage of error messages to the number data packets from the data server addressed to the wireless device exceeding a predetermined percentage-threshold within a predetermined time.

3. The method of claim 2, further comprising:

resuming transmission of data packets from the data server addressed to the wireless device via the gateway server upon determining that the number of error messages are below a second threshold within a second predetermined time.

4. The method of claim 3, wherein:

the first threshold is equal to the second threshold; and

the first predetermined time is equal to the second predetermined time.

5. The method of claim 2, further comprising:

calculating a time difference between consecutive error messages; and

resetting the error count upon determining that the time difference between consecutive error messages is above a third threshold.

6. The method of claim 1, further comprising:

analyzing the data packets addressed to the wireless device; and

blocking the data packets that match a predetermined rule set based on the analyzing.

7. The method of claim 1, wherein the error messages are Internet Control Message Protocol (ICMP) error messages.

8. A computer system configured as at least one server, the computer system comprising:

a processor;

a network interface coupled to the processor configured to enable communications via a communication network;

at least one storage device accessible by the processor for content and programming;

a program stored in the storage device, wherein execution of the program by the processor configures the computer system to perform functions, including functions to;

receive one or more data packets from a data server addressed to a wireless device;

transmit the data packets addressed to the wireless device to a gateway server for delivery through the communication network to the wireless device;

count a number of error messages generated by at least one of (i) a wireless device, or (ii) the gateway server and forwarding the error messages to the data server; and

block additional data packets from the data server addressed to the wireless device from transmission to the gateway server, upon determining that the number of error messages meets a predetermined criterion.

9. The method of claim 8, wherein the predetermined criterion includes at least one of:

(i) the number of consecutive error messages exceeding a first threshold within a first predetermined time;

or

(ii) the percentage of error messages to the number data packets from the data server addressed to the wireless device exceeding a predetermined percentage-threshold within a predetermined time.

10. The system of claim 9, wherein execution of the program by the processor further configures the computer system to perform the function to:

resume transmission of data packets from the data server addressed to the wireless device via the gateway server upon determining that the number of error messages are below a second threshold within a second predetermined time.

11. The method of claim 10, wherein:

the first threshold is equal to the second threshold; and

the first predetermined time is equal to the second predetermined time.

12. The system of claim 9, wherein execution of the program by the processor further configures the computer system to perform the function to:

calculate a time difference between consecutive error messages; and

reset the error count upon determining that the time difference between consecutive error messages is above a third threshold.

13. The system of claim 8, wherein execution of the program by the processor further configures the computer system to perform the function to:

analyze the data packets addressed to the wireless device; and

block the data packets that match a predetermined rule set based on the analysis.

14. The system of claim 8, wherein the error messages are Internet Control Message Protocol (ICMP) error messages.

15. A system comprising:

a mobile traffic network configured to provide wireless data communication for a wireless device with a data server via a data network;

a gateway server coupled to the mobile traffic network; and

a firewall coupled between the data network and the gateway server;

wherein;

the gateway server is configured to;

communicate the data packets to and from the wireless device through the mobile traffic network;

track an amount of data packets communicated to and from the wireless device; and

transmit error messages received from the wireless device to the firewall; and

the firewall is configured to;

receive one or more data packets from the data server through the data network addressed to the wireless device;

transmit the data packets addressed to the wireless device to the gateway server;

count a number of error messages generated by at least one of (i) the wireless device, or (ii) the gateway server and forward the error messages to the data server;

block additional data packets from the data server addressed to the wireless device from transmission to the gateway server, upon determining that the number of error messages meets a predetermined criterion.

16. The method of claim 15, wherein the predetermined criterion includes at least one of:

(i) a number of consecutive error messages exceeding a first threshold within a first predetermined time;

or

(ii) the percentage of error messages to the number data packets from the data server addressed to the wireless device exceeding a predetermined percentage-threshold within a predetermined time.

17. The system of claim 15, wherein the gateway server is further configured to generate error messages to the firewall when the wireless device is not available.

18. The system of claim 16, wherein the firewall is further configured to transmit data packets from the data server addressed to the wireless device via the gateway server upon determining that the number of error messages are below a second threshold within a second predetermined time.

19. The method of claim 18, wherein:

the first threshold is equal to the second threshold; and

the first predetermined time is equal to the second predetermined time.

20. The system of claim 15, wherein the firewall is further configured to:

calculate a time difference between consecutive error messages; and

reset the error count upon determining that the time difference between consecutive error messages is above a threshold.

21. The system of claim 15, wherein the firewall is further configured to:

analyze the data packets addressed to the wireless device; and

block the data packets that match a predetermined rule set based on the analysis.

22. The system of claim 15, wherein the error messages are Internet Control Message Protocol (ICMP) error messages.