Detection of encrypted packet streams using feedback probing

• US 8,379,534 B2
• Filed: 05/13/2010
• Issued: 02/19/2013
• Est. Priority Date: 09/17/2004
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Aaron, Jeffrey A., Shrum, Edgar Vaughan Jr.
• Primary Examiner(s): JAIN, RAJ K
• Application Number:
  US12/779,647
• Publication Number:
  US 20100232313A1
• Time in Patent Office: 1,013 Days
• Field of Search: None
• US Class Current: 370/252
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload

Abstract

Methods, systems, and devices are disclosed for detecting encrypted Internet Protocol packet streams. A probe stream having a known observable parameter is generated. The observable parameter exhibits a known characteristic of a known type of data encrypted within a stream of packets. The probe stream is communicated to a network element via a communications network. When the probe stream is received by the network element, the network element can compare the known observable parameter to an actual value. Any difference between the known observable parameter and the actual value can be used to correct for network-induced variation and other effects, thus ensuring accurate detection and identification of data types within encrypted streams of packets.

Claims

1. A method comprising:

measuring variation in a time interval between probe stream adjacent packets using an inserted known observable parameter as part of a probe stream transmitted via a communications network to determine a network-induced time variation; and

changing a time interval inserted between subsequent actual data packets transmitted via the communications network based on the network-induced time variation.

2. A method according to claim 1, further comprising:

periodically generating the probe stream corresponding to a zone within the communications network.

3. A method according to claim 1, further comprising:

periodically transmitting respective probe streams from different respective zones within the communications network to other zones within the communications network to determine respective zone network-induced time variations.

4. A method according to claim 3 wherein the respective zone network-induced time variations comprise respective zone network-induced time variations corresponding to transmissions from ones of the different respective zones to ones of the other zones.

5. A method according to claim 4 further comprising:

changing the time interval inserted between subsequent actual data packets transmitted based on the respective zone network-induced time variations corresponding to the transmissions from ones of the different respective zones to ones of the other zones.

6. A system comprising:

a communications module stored in a memory device, and a processor communicatively coupled to the memory device;

the communications module to measure variation in a time interval between probe stream adjacent packets using an inserted known observable parameter as part of a probe stream transmitted via a communications network to determine a network-induced time variation; and

the communications module to change a time interval inserted between subsequent actual data packets transmitted via the communications network based on the network-induced time variation.

7. A system according to claim 6, wherein the communications module is further to generate the probe stream corresponding to a zone within the communications network.

8. A system according to claim 6, wherein the communications module is further to transmit respective probe streams from different respective zones within the communications network to other zones within the communications network to determine respective zone network-induced time variations.

9. A system according to claim 8 wherein the respective zone network-induced time variations comprise respective zone network-induced time variations corresponding to transmissions from ones of the different respective zones to ones of the other zones.

10. A system according to claim 9 wherein the communications module is further to change the time interval inserted between subsequent actual data packets transmitted based on the respective zone network-induced time variations corresponding to the transmissions from ones of the different respective zones to ones of the other zones.