Compression and encryption protocol for controlling data flow in a network

• US 6,704,866 B1
• Filed: 11/05/1998
• Issued: 03/09/2004
• Est. Priority Date: 07/11/1997
• Status: Expired due to Term

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Michel, Patrick, Le Pennec, Jean-Francois, Fieschi, Jacques, Benayoun, Alain
• Primary Examiner(s): Morse, Gregory
• Assistant Examiner(s): CALLAHAN, PAUL E
• Application Number:
  US09/187,097
• Time in Patent Office: 1,951 Days
• Field of Search: 380/37, 380/269, 713/151, 713/200, 713/152, 713/150, 713/153, 713/160
• US Class Current: 713/151
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload

Abstract

Process for controlling frames transporting data from a transmitting Terminal (DTE 1) to at least a receiving Terminal (DTE 2) through a plurality of consecutive nodes including a start access node (NODE 1) connected to said transmitting Terminal and at least an end access node (NODE 6) connected to said receiving Terminal and intermediary nodes (NODE 2 to NODE 5), with each data frame comprising one or several protocol layers respectively associated with one or several communication protocols of controlling the frame flow at each node; such a process consisting in adding to each data frame a Data Manipulation Layer (DML) defining the parameters necessary for managing the manipulation (compression and/or encryption) of each field of the data frame located after the DML, and adding to each data frame a Control message for transporting a control protocol defining new parameters to be used by some ones nodes for managing the communication flow through the consecutive nodes.

Claims

1. Process for controlling frames transporting data from a transmitting Terminal (DTE 1) to at least a receiving Terminal (DTE 2) through a plurality of consecutive nodes including a start access node (NODE 1) connected to said transmitting Terminal, at least an end access node (NODE 6) connected to said receiving Terminal and optional intermediary nodes (NODE 2 to NODE 5), with each data frame comprising one or more protocol layers respectively associated with one or more communication protocols for controlling the frame flow at each node;

said process comprising;

a) adding to each data frame a Data Manipulation Layer (DML) defining the parameters necessary for managing the manipulation (compression and/or encryption) of a plurality of fields of said data frame, the DML providing each of said plurality of fields a manipulated data header (MDH), each MDH associated with a field and defining a manipulation mode for said associated field, such that each of said plurality of fields may be manipulated separately; and

b) adding to each data frame a Control message for transporting a control protocol defining new parameters to be used by some ones of said plurality of nodes for managing the communication flow through said plurality of consecutive nodes.

2. Process according to claim 1 further comprising:

including said Control message as a field of said Data Manipulation Layer (DML).

3. Process according to claim 1 further comprising:

including in said Data Manipulation Layer (DML) a DML frame header defining the contents of said DML after said DML frame header.

4. Process according to claim 3, further comprising:

including in said DML frame header a field defining the length of said Control message.

5. Process according to claim 3, further comprising:

including in said DML frame header a bit indicating whether said DML includes a Control message.

6. Process according to claim 2, further comprising:

including in said DML frame header a bit indicating whether the contents of said data frame following said DML header are compressed and/or encrypted.

7. Process according to claim 1, further comprising:

including in said DML

a Frame supervisor defining the protocol used with the data included in said data frame,

a flow identification (Flow ID), and

a frame sequence number.

8. Process according to claim 7, further comprising:

assigning, by said Control message, functions to each of said plurality of nodes, so that said nodes may have the function of;

Access Node interfacing directly with said transmitting or receiving Terminal, said Access Node generating said DML if it is connected to said transmitting Terminal and removing said DML if it is connected to said receiving Terminal,

Protocol Node for those nodes which may only have access to some manipulated headers but have no access to the data, and

Network node for those nodes which have no access to headers or data but have to route said data frame in the network by using said Flow ID included in said Frame supervisor.

9. Data Manipulation Layer (DML) according to claim 8, wherein said DML frame header further comprises:

a field defining the length of said Control message.

10. Data Manipulation Layer (DML) according to claim 8, wherein said DML frame header contains a bit determining whether the contents of said data frame following said DML are compressed and/or encrypted.

11. A computer readable media, comprising:

said computer readable media having instructions for execution in a computer written thereon for the practice of the process of claim 1.

12. Electromagnetic signals propagating on a computer network, comprising:

said electromagnetic signals containing information having instructions for execution on a computer for the practice of the process of claim 1.

13. A Data Manipulation Layer (DML) added to a data frame transmitted from a transmitting Terminal (DTE 1) to at least a receiving Terminal (DTE 6) through a plurality of consecutive nodes (NODE 2 to NODE 5) of at least a data transmission network (WAN) with said data frame comprising one or more protocol layers respectively associated with one or more communication protocols for controlling the frame flow at each of said nodes;

said DML comprising;

a Frame supervisor defining the protocol to be used with the data included in said data frame, and assigning a flow identification number (Flow ID) and a frame sequence number;

a Control message defining new parameters to be used by some ones of said plurality of consecutive nodes for managing the communication flow in said network;

a DML frame header indicating the presence of a plurality of manipulated (compressed and/or encrypted) data fields in said data frame; and

a plurality of manipulated data headers (MDHs), each MDH associated with a manipulated data field of said plurality of manipulated fields and defining a manipulation mode for said field, such that each of said plurality of manipulated fields may be manipulated separately.

14. A method for controlling frames transporting data from a transmitting terminal (DTE 1) to a receiving terminal (DTE 2), comprising:

adding to each data frame a data manipulation layer (DML) defining the parameters necessary for managing the manipulation (compression and/or encryption) of a plurality of fields of said data frame, the DML providing each of said plurality of fields a manipulated data header (MDH), each MDH associated with a field and defining a manipulation mode for said associated field, such that each of said plurality of fields may be manipulated separately; and

,

adding to each data frame a control message for transporting a control protocol defining new parameters to be used by an intermediate node for managing the communication flow from DTE 1 to DTE 2.

15. The method of claim 14, wherein said managing the manipulation of each field further comprises:

encrypting at least one field of said frame.

16. The method of claim 14, wherein said managing the manipulation of each field further comprises:

compressing at least one field of said frame.

17. The method of claim 14 further comprising:

defining manipulation of a protocol header.

18. The method of claim 14 further comprising:

defining manipulation of data following a protocol header.

19. The method of claim 14 further comprising:

including in said DML a field defining a length of said control message.

20. The method of claim 14 further comprising:

including in said DML a bit determining whether said DML includes a control message.

21. The method of claim 14 further comprising:

including in said DML a bit determining whether a portion of said data frame following said DML is compressed.

22. The method of claim 14 further comprising:

including in said DML a bit determining whether a portion of said data frame following said DML is encrypted.

23. The method of claim 14 further comprising:

including in said DML a bit determining whether a portion of said data frame following said DML is compressed and encrypted.

24. The method of claim 14 further comprising:

including in said DML a Frame Supervisor, said Frame Supervisor defining the protocol to be used with the data included in said data frame, a flow identifier (Flow ID) and a frame sequence number.

25. The method of claim 14 further comprising:

defining said parameters in said control message to enable intermediate nodes between DTE 1 and DTE 2 to respond to said DML and control message with the function of;

Access Node interfacing directly with said transmitting terminal, said Access Node generating said DML if it is connected to said transmitting terminal and removing said DML if it is connected to said receiving terminal,

Protocol Node for those nodes which may only have access to some manipulated headers but have no access to the data, and

Network Node for those nodes which have no access to headers or data but have to route said data frame in the network by using a Flow ID included in a Frame Supervisor.

26. The method of claim 14 further comprising:

transporting said frame by use of a flow identifier (Flow ID);

identifying a protocol header in said frame by a multi-bit field, and manipulating said protocol header to be compressed and/or encrypted.

27. The method of claim 14 further comprising:

identifying an encryption mode with a multi-bit field to identify one of a plurality of encryption types for encrypting a field of said frame.

34. A computer readable media, comprising:

said computer readable media having instructions for execution in a computer for practice of the method of claim 14 or claim 28.

35. Electromagnetic signals propagating on a computer network, comprising:

said electromagnetic signals carrying information, said information having instructions for execution in a computer for practice of the method of claim 14 or claim 28.

28. A method of transferring a data frame from a transmitting data terminal to a receiving data terminal, said data frame including a plurality of fields, comprising:

launching said data frame by said transmitting data terminal to a first access node using a standard protocol;

receiving said data frame by said first access node;

manipulating selected fields of said plurality of fields to compress and/or encrypt clear data in said selected fields, each field compressed or encrypted according to one of a plurality of compression and/or encryption modes;

providing each frame with a data manipulation layer (DML) at said first access node, said DML providing each of said plurality of selected fields a manipulated data header (MDH), each MDH associated with a field and describing said compression and/or encryption mode used for said associated field;

transferring, in response to said Flow ID, said frame to a second access node;

receiving said frame by said second access node;

manipulating said frame in response to said DML, said second access node decrypting and/or decompressing said selected manipulated fields to reproduce said clear data and to create a reproduced frame; and

sending said reproduced frame by said second access node to said receiving data terminal.

29. The method of claim 28 further comprising:

selecting one or more of said selected fields as data fields of said frame.

30. The method of claim 28 further comprising:

selecting one or more of said selected fields as protocol header fields of said frame.

31. The method of claim 28 further comprising:

receiving, in response to said flow ID, said frame by an intermediate node;

obtaining access, in response to said DML, by said intermediate node to a selected field of said frame.

32. An Access Node, comprising:

means for receiving a data frame having clear data, from a first terminal, said data frame including a plurality of fields, each field containing clear data, said data frame addressed to a second terminal;

means for manipulating selected fields of said plurality of fields in said data frame to compress and/or encrypt said clear data in said selected fields, each field compressed and/or encrypted according to one of a plurality of compression and/or encryption modes;

means for adding to said data frame a data manipulation layer (DML), said DML providing each of said plurality of selected fields a manipulated data header (MDH), each MDH associated with a field and describing said compression and/or encryption mode used for said associated field;

means for adding to each data frame a control message for transporting a control protocol defining new parameters to be used by an intermediate node for managing the communication flow from the first to the second terminals;

means for sending through a computer network said frame having manipulated data.

33. An access node as in claim 32, further comprising:

means for receiving a data frame having a DML from said computer network, said data frame including a plurality of fields, selected fields containing manipulated data and each selected field associated with a MDH, said data frame addressed to said first terminal;

means, responsive to said DML of said data frame, for manipulating each of said manipulated fields in accordance said associated MDH to reproduce a clear data frame;

means for sending said clear data frame to said first terminal.

36. A method for controlling frames transporting data from a transmitting terminal to a receiving terminal, each frame having a plurality of fields, comprising:

adding to each data frame a data manipulation layer (DML) header indicating that one or more fields of the frame located after the DML header are manipulated (compressed and/or encrypted);

adding to each of a plurality of selected fields located after the DML header a manipulated data header (MDH), each MDH associated with a field and defining a data manipulation mode for use with the associated field, such that each selected field may be manipulated separately according to a different manipulation mode; and

transmitting said data frame, said data frame having said DML header and said MDHs.