Systems and methods for predicting data fields in layered protocols

• US 6,819,681 B1
• Filed: 08/07/2000
• Issued: 11/16/2004
• Est. Priority Date: 08/06/1999
• Status: Expired due to Term

• Current Assignee: Shrikumar Hariharasubrahmanian
• Original Assignee: Shrikumar Hariharasubrahmanian
• Inventors: Hariharasubrahmanian, Shrikumar
• Primary Examiner(s): Yao, Kwang Bin
• Assistant Examiner(s): JONES, PRENELL P
• Application Number:
  US09/632,820
• Time in Patent Office: 1,562 Days
• Field of Search: 370/498, 370/392-394, 370/466-469, 370/455, 370/446-448, 370/412, 370/442, 370/474, 370/399, 370/395, 709/224-236, 375/244, 375/242, 375/240.05, 375/240.24, 375/260, 455/12.1, 455/13.1, 455/500, 708/290, 714/749, 348/419-422
• US Class Current: 370/498
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/166 IP fragmentation; TCP segmentation
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers
• CPC Class Codes: H04L 69/324 in the data link layer [OSI layer 2], e.g. HDLC

Abstract

A system for predicting one or more fields of a packet that includes multiple fields, the packet belonging to a set of packets broken up into one or more packets by the process of fragmentation or segmentation. Each of the fields stores a value. The system receives one or more of the fields of the packet and determines the value of at least one of the received fields. The system predicts a value of at least one other one of the fields of the packet based on the value of the received field before the other field is received. The system then processes the packet based on the received fields and the predicted field(s).

Claims

1. A method for predicting one or more fields of a packet having a plurality of fields, the packet belonging to a set of packets, each of the fields containing data representing a value, the method comprising:

receiving one or more of the fields of the packet;

analyzing a first value of at least one of the received fields;

predicting a second value of at least one other field of the packet not yet received, based on a correlation between the first value and a property of the at least one other field not yet received; and

processing the packet based on the one or more received fields and the predicted at least one other field.

3. The method of claim 1, further comprising:

receiving the at least one other field.

4. The method of claim 3, further comprising:

receiving one or more additional fields of the packet after receiving the at least one other field; and

rechecking the second value using a value in the one or more additional fields.

5. The method of claim 3, wherein the processing includes:

determining whether a received value of the received at least one other field matches the second value of the predicted at least one other field.

6. The method of claim 5, further comprising:

performing corrective measures on the processing of the set of packets when the received value fails to match the second value.

7. The method of claim 5, further comprising:

preventing transmission of reply information corresponding to the packet when the received value fails to match the second value.

8. The method of claim 5, further comprising:

causing a communication context already established to be aborted when the received value fails to match the second value.

9. The method of claim 5, further comprising:

continuing processing of the packet based on the one or more received fields and the received at least one other field when the received value matches the second value.

10. The method of claim 3, wherein the processing includes:

determining whether a received value of the received at least on other field substantially matches the second value.

11. The method of claim 1, wherein at least one received field includes a fragment offset field and the predicted at least one other field includes a protocol data field.

12. The method of claim 1, wherein the at least one received field includes a sequence number field and the predicted at least one other field includes a protocol data field.

13. The method of claim 1, wherein the at least one received field includes a fragment offset field, and the predicted at least one other field includes a flags field and a protocol data field.

14. The method of claim 1, further comprising:

analyzing a third value of at least one additional one of the received fields; and

confirming the second value using the third value of the at least one additional field.

15. The method of claim 14, wherein the confirming includes:

predicting a fourth value of the at least one other field using the third value of the at least one additional field, and

comparing the fourth value and the second value.

2. A method for predicting one or more fields of a packet having a plurality of fields, the packet being broken into one or more packets, each of the fields storing data representing a value, the method comprising:

receiving one or more of the fields of the packet;

analyzing the value of at least one of the received fields;

predicting a value of at least one other field of the packet not yet received, based on the value of the at least one received field;

processing the packet based on the one or more received fields and the predicted at least one other field; and

generating a reply packet based on the one or more received fields and the predicted at least one other field.

16. A system for predicting one or more fields of a packet having a plurality of fields, the packet belonging to a set of packets, each of the fields containing data representing a value, the system comprising:

means for obtaining one of the fields of the packet;

means for determining a first value of the obtained field;

means for predicting a second value of one or more other fields of the packet based on a correlation between the first value and a property of one or more other fields before the one or more other fields are obtained; and

means for processing the packet based on the obtained field and the predicted one or more other fields.

17. A system for predicting one or more fields of a packet having a plurality of fields storing data, such a packet belonging to a set of packets, the system comprising:

a memory configured to store instructions; and

a processor configured to execute the instructions to receive one or more fields of the packet, to determine a first value of at least one of the received fields, to predict a second value of one or more other fields not yet received based on a correlation between the first value, and a property of one or more other fields not yet received and to process the packet based on the one or more received fields and the predicted one or more other fields.

19. The system of claim 17, wherein the processor is further configured to receive the one or more other fields.

20. The system of claim 19, wherein the processor is further configured to receive one or more additional fields of the packet after receiving the one or more other fields and recheck the second value using the one or more additional fields.

21. The system of claim 19, wherein the processor, when processing, is configured to determine whether a third value of the received one or more other fields matches the second value.

22. The system of claim 21, wherein the processor is further configured to take corrective actions according to a protocol when the third value of the received one or more other fields fails to match the second value.

23. The system of claim 21, wherein the processor is further configured to prevent transmission of continued reply information in response to the packet when the third value fails to match the second value.

24. The system of claim 21, wherein the processor is further configured to cause reply information already transmitted in response to the packet to be discarded when the third value fails to match the second value.

25. The system of claim 21, wherein the processor is further configured to continue processing of the packet based on the one or more received fields and the received one or more other fields when the third value of the received one or more other fields matches the second value.

26. The system of claim 19, wherein the processor, when processing, is configured to determine whether a third value of the received one or more other fields substantially matches the second value.

27. The system of claim 17, wherein at least one received field includes a fragment offset and the predicted one or more other fields includes a flags field and a protocol data field.

28. The system of claim 17, wherein the processor is configured to analyze a fourth value of at least one additional one or the received fields and confirm the second value using the fourth value.

29. The system of claim 28, wherein the processor, when confirming, is configured to predict another value of the one or more additional fields using the fourth value of at least one additional field and compare the fourth value and the second value.

18. A system for predicting one or more fields of a packet having a plurality of fields containing data, such a packet belonging to a set of packets, the system comprising:

a memory configured to store instructions; and

a processor configured to execute the instructions to receive one or more fields of the packet, to determine a first value of at least one of the received fields, to predict a second value of one or more other fields not yet received based on a correlation between the first value and a property of one or more other fields not yet received and to process the packet based on the one or more received fields and the predicted one or more other fields wherein the processor, when processing the packet, is configured to generate a reply packet based on the at least one received field and the predicted one or more other fields.

30. A computer-readable medium that stores instructions executable by one or more processors to perform a method for predicting at least one field of a packet, the packet belonging to a set of packets including a plurality of fields, the computer-readable medium comprising:

instructions for obtaining one or more of the fields of the packet;

instructions for predicting at least one other field based on a correlation between at least one of the one or more obtained fields and a property of at least one other field before the at least one other field is received; and

instructions for processing the packet based on the one or more obtained fields and the predicted at least one other field.

39. The computer-readable medium of claim 30, wherein the at least one obtained field includes a fragment offset field and the predicted at least one other field includes a protocol data field.

40. The computer-readable medium of claim 30, wherein the at least one obtained field includes a sequence number field and the predicted at least one other field includes a protocol data field.

41. The computer-readable medium of claim 30, wherein the at least one obtained field includes a total length field and the predicted at least one other field includes a protocol data field and a flags field.

42. The computer-readable medium of claim 30, further comprising:

instructions for analyzing at least one additional one of the obtained fields; and

instructions for confirming the predicted at least one other field using the at least one additional field.

43. The computer-readable medium of claim 42, wherein the instructions for confirming include:

instructions for predicting again the at least one other field using the at least one additional field, and

instructions for comparing the at least one other field predicted using the at least one additional field to the at least one other field predicted based on the at least one obtained field.

31. A computer-readable medium that stores instructions executable by one or more processors to perform a method for predicting at least one field of a packet, the packet being broken up into one or more packets, the packets including a plurality of fields, the computer-readable medium comprising:

instructions for obtaining one or more of the fields of the packet;

instructions for predicting at least one other field based on at least one of the one or more obtained fields before the at least one other field is received; and

instructions for processing the packet based on the one or more obtained fields and the predicted at least one other field; and

instructions for generating a reply packet based on the one or more obtained fields and the predicted at least one other field.

32. The computer-readable medium of claim 31, further comprising:

instructions for obtaining the at least one other field.

33. The computer-readable medium of claim 32, further comprising:

instructions for obtaining one or more additional fields of the packet after obtaining the at least one other field; and

instructions for rechecking the predicted at least one other field using the one or more additional fields.

34. The computer-readable medium of claim 32, wherein the instructions for processing include:

instructions for determining whether the obtained at least one other field matches the predicted at least one other field.

35. The computer-readable medium of claim 34, further comprising:

instructions for correcting a protocol state for processing the packet when the obtained at least one field fails to match the predicted at least one other field.

36. The computer-readable medium of claim 34, further comprising:

instructions for preventing transmission of reply information in response to the packet when the obtained at least one field fails to match the predicted at least one other field.

37. The computer-readable medium of claim 34, further comprising:

instructions for causing reply information already transmitted in response to the packet to be discarded when the obtained at least one field fails to match the predicted at least one other field.

38. The computer-readable medium of claim 34, further comprising:

instructions for continuing processing of the packet based on the one or more obtained fields and the predicted at least one other field when the obtained at least one other field matches the predicted at least one other field.

44. A method for replying to packets that have a plurality of fields, the packets being broken up into one or more packets, before the packets are entirely received, comprising:

receiving one or more of the fields of the packet;

predicting one or more other fields of the packet before the one or more other fields are received;

generating a reply packet based on the one or more received fields and the predicted one or more other fields; and

transmitting the reply packet.

45. The method of claim 44, wherein the predicting includes:

predicting the one or more other fields using at least one of the one or more received fields.

46. The method of claim 44, further comprising:

receiving the one or more other fields; and

determining whether the received one or more other fields match the predicted one or more other fields.

47. The method of claim 46, further comprising:

correcting the continued transmission of subsequent reply packets when the received one or more other fields fail to match the predicted one or more other fields.

48. The method of claim 46, further comprising:

transmitting a packet for causing the state of the communication context at the destination to be corrected when the received one or more other fields fail to match the predicted one or more other fields.

49. A system for replying to packets that have a plurality of fields, the packets being broken up into one or more packets, before the packets are completely received, comprising:

a memory configured to store instructions for obtaining one or more fields of the packet, predicting one or more other fields of the packet before the one or more other fields are obtained, generating a reply packet based on the one or more obtained fields and the predicted one or more other fields, and transmitting the reply packet; and

a processor configured to execute the instructions in the memory.

50. The system of claim 49, wherein the instructions for predicting include:

instructions for predicting the one or more other fields using at least one of the one or more obtained fields.

51. The system of claim 49, wherein the memory is further configured to store instructions for obtaining the one or more other fields and determining whether the obtained one or more other fields substantially match the predicted one or more other fields.

52. The system of claim 51, wherein the memory is further configured to store instructions for preventing further transmission of the reply packets when the obtained one or more other fields fail to substantially match the predicted one or more other fields.

53. The system of claim 51, wherein the memory is further configured to store instructions for causing the transmission of a packet to cause the connection state at the destination to be corrected when the obtained one or more other fields fail to substantially match the predicted one or more other fields.

54. A computer-readable medium that stores instructions executable by one or more processors to perform a method for generating responses to packets having a plurality of fields, the packets being broken into one or more packets, before the packets are entirely received, the method comprising:

receiving one or more fields of the packet;

predicting one or more other fields of the packet before the one or more other fields are received; and

generating a reply packet based on the one or more received fields and the predicted one or more other fields.

55. A method for processing packets having a plurality of fields, the packets being broken into one or more packets, comprising:

receiving one or more of the fields of the packet;

determining a value associated with at least one of the received fields;

predicting a value of one or more other fields of the packet based on the value of the at least one received field before the one or more other fields are received; and

generating a reply packet based on the one or more received fields and the predicted one or more other fields.

56. A method for predicting a protocol data field of a packet, comprising:

receiving a plurality of fields of the packet, the packet being broken into one or more packets, one of the fields including the fragment offset field or sequence number field;

analyzing a value of data stored in the fragment offset field or sequence number field;

predicting a value stored in the protocol data field based on the value of the fragment offset field or a sequence number field before the protocol data field is received; and

processing the packet based on the received fields and the predicted protocol data field.

57. A device that predicts one or more fields of a packet having a plurality of fields, the packet belonging to a set of packets, each of the fields containing data representing a value, the device comprising:

logic configured to receive one or more fields of the packet;

logic configured to determine a first value of at least one of the received fields;

logic configured to predict a second value based on a correlation between the first value and a property of one or more other fields before the one or more other fields are received; and

logic configured to process the packet based on the one or more received fields and the predicted one or more other fields.