Providing Information of Data Streams

• US 20160112488A1
• Filed: 10/20/2014
• Published: 04/21/2016
• Est. Priority Date: 10/20/2014
• Status: Abandoned Application

• Current Assignee: SSH Communications Security Oyj
• Original Assignee: SSH Communications Security Oyj
• Inventors: Oksanen, Kenneth
• Application Number:
  US14/517,992
• Publication Number:
  US 20160112488A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 2101/622 Layer-2 addresses, e.g. medium access control [MAC] addresses
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 65/70 Media network packetisation

Abstract

Methods and apparatuses for processing information of data streams in a data network are provided. In accordance with a method comprising at least one first stream of data is determined in accordance with a first protocol. A second stream of data is then generated in accordance with a second protocol, wherein the second protocol is a lower layer protocol than the first protocol. The generating comprises including at least a portion of the determined at least one first stream of data in the second stream of data and encoding into a predefined control information field of the second stream of data information associated with the at least one first stream of data for use in processing the at least one first stream of data. The recipient can then use the encoding in processing the at least one data stream.

Claims

1. A method for communicating information in a data network, the method comprising

determining at least one first stream of data in accordance with a first protocol, and

generating a second stream of data in accordance with a second protocol, wherein the second protocol is a lower layer protocol than the first protocol and the generating comprises

including at least a portion of the determined at least one first stream of data in the second stream of data, and

encoding into a predefined control information field of the second stream of data information associated with the at least one first stream of data for use in processing the at least one first stream of data.

2. The method according to claim 1, comprising determining at least two first streams of data multiplexed in a data flow in accordance with the first protocol, and encoding information for distinguishing the determined at least two first streams of data into the predefined control information field of the second data stream.

3. The method according to claim 2, wherein the first data streams are included in respective channels of the data flow, the method comprising encoding channel identity information into the predefined control information field for use in demultiplexing the first data streams from the generated second data stream.

4. The method according to claim 1, wherein the predefined field comprises at least one of a destination address field, a source address field, an options field, and a port number field in accordance with the lower layer protocol.

5. The method according to claim 1, wherein the predefined field comprises one of a media access control (MAC) destination address field and a media access control (MAC) source address field.

6. The method according to claim 1, wherein the determining comprises capturing by an intermediate entity at least one first stream of encrypted data and the generating comprises decrypting the captured encrypt data for sending in plaintext form in the second data stream to a data analyser entity.

7. The method according to claim 1, comprising

capturing by an intermediate entity the at least one first stream of data,

sending the generated second data stream to a data analyser entity with information identifying the at least one first data stream being encoded in the predefined control information field,

storing information in a database for the at least one first data stream,

receiving information identifying the at least one first data stream from the data analyser entity, and

fetching the stored information based on the received information identifying the at least one first data stream.

8. The method according to claim 1, comprising encoding an indication of a virtual local area network into the predefined field.

9. The method according to claim 1, wherein the first protocol is based on a security protocol and the second protocol is based on Transport Control Protocol/Internet Protocol (TCP/IP).

10. A method for receiving information regarding at least one first stream of data according to a first protocol, the method comprising

receiving a second stream of data in accordance with a second protocol and including at least a portion of the least one first stream of data, wherein the second protocol is a lower layer protocol than the first protocol and the second stream of data includes an encoding of information associated with the at least one first stream of data in a predefined control information field, and

processing the at least one first stream of data based on said information in the predefined control information field of the second stream of data.

11. The method according to claim 10, comprising distinguishing at least two first streams of data multiplexed in a data flow in accordance with the first protocol based on the encoding of information in the predefined control information field of the second data stream.

12. The method according to claim 11, wherein the first data streams are included in respective channels of the data flow, the method comprising demultiplexing the first data streams based on encoding of channel identity information in the predefined control information field.

13. The method according to claim 10, wherein the predefined field comprises one of a destination address field, a source address field, an options field, and a port number field in accordance with the lower layer protocol.

14. The method according to claim 10, wherein the predefined field comprises one of a media access control (MAC) destination address field and a media access control (MAC) source address field.

15. The method according to claim 10, comprising detecting that an address field of a received packet comprises information associated with a multiplexed data flow.

16. The method according to claim 10, comprising

receiving the second stream of data from an intermediate data capture entity at a data analyser entity,

determining irregularity in at least one first stream of data included in the second stream of data identified based on information in the predefined control information field, and

sending the information identifying the determined at least one first data stream for use in fetching information stored in a database for the determined at least one first data stream.

17. An apparatus for providing information associated with data streams, the apparatus comprising at least one processor, and at least one memory including computer program code, wherein the at least one memory and the computer program code are configured, with the at least one processor, to cause the apparatus to

determine at least one first stream of data in accordance with a first protocol, and

generate a second stream of data in accordance with a second protocol, wherein the second protocol is a lower layer protocol than the first protocol and the apparatus includes at least a portion of the determined at least one first stream of data in the second stream of data and encodes into a predefined control information field of the second stream of data information associated with the at least one first stream of data for use in processing the at least one first stream of data.

18. The apparatus according to claim 17, configured to determine at least two first streams of data multiplexed in a data flow in accordance with the first protocol and encode information for distinguishing the determined at least two first streams of data into the predefined control information field of the second data stream.

19. The apparatus according to claim 18, wherein the first data streams are associated with respective channels of the data flow, the apparatus being configured to encode channel identity information into the predefined control information field for use in demultiplexing of the first data streams from the second data stream.

20. The apparatus according to claim 17, wherein the predefined field comprises at least one of a destination address field, a source address field, an options field, and a port number field in accordance with the lower layer protocol.

21. The apparatus according to claim 17, wherein the predefined field comprises one of a media access control (MAC) destination address field and a media access control (MAC) source address field.

22. The apparatus according to claim 17, comprising an intermediate entity configured further to capture encrypted data and decrypt the captured encrypt data for sending in plaintext form in the second data stream to a data analyser entity.

23. The apparatus according to claim 17, comprising an intermediate entity configured to

capture the at least one first stream of data,

communicate the generated second data stream to a data analyser entity with information identifying the at least one first data stream,

store information in a database for the at least one first data stream,

receive information identifying the at least one first data stream from the data analyser entity, and

fetch the stored information from the database based on the received information identifying the at least one first data stream.

24. An apparatus for processing at least one first stream of data according to a first protocol, the apparatus comprising at least one processor, and at least one memory including computer program code, wherein the at least one memory and the computer program code are configured, with the at least one processor, to cause the apparatus to

receive a second stream of data in accordance with a second protocol including at least a portion of the least one first stream of data, wherein the second protocol is a lower layer protocol than the first protocol and the second stream of data includes in a predefined control information field an encoding of information associated with the at least one first stream of data, and

process the at least one first stream of data based on said information in the predefined control information field of the second stream of data.

25. The apparatus according to claim 24, configured to distinguish at least two first streams of data multiplexed in a data flow in accordance with the first protocol based on encoding of information in the predefined control information field of the second data stream.

26. The apparatus according to claim 25, wherein the first data streams associate with respective channels of the data flow, the apparatus being configured to demultiplex the first data streams based on the encoding of channel identity information.

27. The apparatus according to claim 24, wherein the predefined field comprises one of a media access control (MAC) destination address field and a media access control (MAC) source address field.

28. The apparatus according to claim 24, configured to detect whether an address field of a received packet comprises information associated with a multiplexed data flow.

29. The apparatus according to claim 24, comprising a data an analyser entity configured to

receive the second stream of data from an intermediate data capture entity,

determine irregularity in at least one first stream of data included in the second stream of data and identified based on information in the predefined control information field, and

send the information identifying the determined at least one first data stream for use in fetching information stored in a database for the determined at least one first data stream.