Compression of data packets while maintaining endpoint-to-endpoint authentication

• US 8,416,788 B2
• Filed: 04/26/2007
• Issued: 04/09/2013
• Est. Priority Date: 04/26/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Colville, Scott, Boldo, Dan, Stepin, Maxim, Pinkerton, James
• Primary Examiner(s): Nawaz, Asad
• Assistant Examiner(s): HARLEY, JASON A
• Application Number:
  US11/796,078
• Publication Number:
  US 20080267217A1
• Time in Patent Office: 2,175 Days
• Field of Search: 709/223, 370/474
• US Class Current: 370/398
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/38 by adapting coding or compression rate
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 69/04 Protocols for data compression, e.g. ROHC
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

Contiguous data packets of a single communication session between endpoints are gathered for compression, and at least the payloads are compressed collectively via a single compressible buffer. The original headers, which may or may not be compressed, and the compressed payloads are transmitted from a sending packet compression device to a receiving packet compression device that performs decompression to the compressed payload and may also decompress headers if they have been compressed at the sending end. The original contiguous data packets including headers and payload may be reconstructed at the receiving packet compression device by matching the headers to the corresponding payloads. The reconstructed data packets are injected back into the single communication session, and the presence of the original headers in the reconstructed data packets may thereby maintain the endpoint-to-endpoint authentication protocols.

Claims

1. At a packet processing device, the packet processing device including a processor and system memory, the packet processing device connected to one or more computer systems on a local network, the packet processing device also connected to a wide area network, a method of compressing data packets for transmission in a communication session method comprising:

receiving a plurality of data packets sent from a computer system, the computer system selected from among the one or more computer systems, the plurality of data packets included in an established communication session between the computer system and an endpoint location on the wide area network, each of the plurality of packets addressed to the endpoint location on the wide area network, each of the plurality of packets including a header and a payload;

identifying a set of contiguous data packets from among the plurality of received data packets, the set of contiguous data packets being less than all of the plurality of received packets such that the plurality of received data packets includes other remaining data packets;

for the set of contiguous data packets, separating the headers from the payloads to form a set of headers and a set of payloads;

compressing the set of payloads into a compressed payload data set;

concatenating the set of headers with the compressed payload data set to form a concatenated data set;

packetizing the concatenated data set into a further set of data packets, the further set of data packets for transmission to a complementary packet processing device via another different communication session, the complementary packet processing device connected to the wide area network and connected to the endpoint location; and

transmitting the further set of data packets via the other communication session to the complementary packet processing device.

2. The method of claim 1, further comprising:

transmitting at least some of the other remaining packets to the endpoint location via the established communication session between the computer system and the endpoint location.

3. The method of claim 1, wherein identifying a set of contiguous data packets from among the plurality of received data packets comprises identifying a set of contiguous data packets that are eligible for compression based on a protocol associated with the set of contiguous data packets.

4. The method of claim 1, further comprising grouping the set of payloads into the single compressible buffer prior to compressing the set of payloads.

5. The method of claim 1, further comprising compressing the concatenated data set, including the set of headers and the compressed payload data set, into a compressed data set prior to packetizing;

and

wherein packetizing the concatenated data set comprises packetizing the compressed data set.

6. The method of claim 3, wherein identifying a set of contiguous data packets that are eligible for compression based on a protocol associated with the set of contiguous data packets comprises:

determining whether any data packets of the established communication session include a security header;

if a data packet of the established communication session includes a security header, then determining whether the data packet with the security header is an encrypted data packet or an authenticated data packet; and

if the data packet is determined to be an authenticated data packet, then including the data packet in the first set and if the data packet is determined to be an encrypted data packet, then forwarding the data packet through the first communication session between endpoints without compressing.

7. The method of claim 6, wherein determining whether any of the received data packets includes a security header comprises detecting whether the packet is an IPSec ESP packet and when the packet is an IPSec ESP packet, then determining whether the IPSec ESP packet is an encrypted packet or an authenticated packet by attempting to validate the packet using an assumed IPSec ESP signature size.

8. The method of claim 1, wherein concatenating the set of headers with the compressed payload data set to form a concatenated data set comprises concatenating metadata and the set of headers with the compressed payload data set to from the concatenated data set, the metadata specifying the lengths and order of each of the headers and payloads.

9. The method of claim 1, further comprising:

accessing a Quality-of-Service (QoS) marking from a header corresponding to one of the set of contiguous data packets, the Quality-of-Service (QoS) marking indicating a Quality-of-Service (QoS) priority for the established communication session; and

transferring Quality-of-Service (QoS) priority for established communication session to the other different communication session by marking the further set of packets with the Quality-of-Service (QoS) marking to specifying that the other different communication session also has the Quality-of-Service (QoS) priority indicated for the established communication session.

10. At a packet processing device, the packet processing device including a processor and system memory, the packet processing device connected to one or more computer systems on a local network, the packet processing device also connected to a wide area network, a method for decompressing packets received for a communication session, the method comprising:

receiving a set of data packets via a communication session with a complementary packet processing device, the complementary packet processing device connected to the wide area network, the set of data packets encapsulating a concatenated compressed data set including a set of headers concatenated with a compressed payload data set, the compressed payload data set including payloads corresponding to the set of headers, the payloads having been separated from the set of headers for compression at the complementary packet processing device, the set of headers and corresponding payloads for a computer system selected from among the one or more computer systems, the set of headers and corresponding payloads representing a set of contiguous data packets sent from an endpoint location on the wide area network to the computer system via another different established communication session between the computer system and the endpoint location;

depacketizing the received set of data packets into the compressed concatenated data set including the set of headers and the compressed payload data;

decompressing the compressed payload data set to reveal the corresponding payloads;

reconstructing the set of contiguous data packets by matching headers from the set of headers with corresponding payloads; and

injecting the reconstructed set of contiguous data packets into a plurality of other data packets being sent to the computer system via the other different communication session, the set of contiguous data packets injected in an appropriate order so that the set of contiguous data packets is appropriately streamed along with the plurality of other packets to the computer system.

11. The method of claim 10, further comprising prior to decompressing the compressed payload data set decompressing the compressed concatenated data set to reveal the set of headers and the compressed payload data set.

12. The method of claim 10, wherein receiving a set of data packets comprises receiving a set of data packets including metadata and the set of headers concatenated with the compressed payload data set, the metadata specifying a sequential ordering within the plurality of other data packets being sent via the other different communication session and wherein reconstructing the set of contiguous data packets comprises obtaining headers and payloads in accordance with the metadata.

13. The method of claim 10, wherein injecting the reconstructed set of contiguous data packets into a plurality of other data packets comprises injecting the reconstructed set of contiguous data packets into the plurality of other data packets in accordance with the sequential ordering specified in the metadata.

14. A device for processing data packets, comprising:

one or more processors;

system memory;

at least one network connector;

one or more computer storage devices having stored there on computer-executable instructions representing a gather engine, a compression engine, and a transmission engine, the gather engine executed by a processor configured to;

receive a plurality of data packets sent from a computer system, the computer system selected from among one or more computer systems on a local area network with the device, the plurality of data packets included in an established communication session between the computer system and an endpoint location on a wide area network, each of the plurality of packets addressed to the endpoint location on the wide area network, each of the plurality of packets including a header and a payload;

identify a set of contiguous data packets from among the plurality of received data packets, the set of contiguous data packets being less than all of the plurality of received packets such that the plurality of received data packets includes other remaining data packets;

for the set of contiguous data packets, separate the headers from the payloads to form a set of headers and a set of payloads;

are

the compression engine executed by a processor configured to;

compress the set of payloads to create a compressed a load data set; and

concatenate the set of headers with the compressed payload data set to form a concatenated data set; and

the transmission engine executed by a processor configured to;

packetize the concatenated data set into a further set of data packets, the further set of data packets for transmission to a complementary packet processing device via another different communication session, the complementary packet processing device connected to the wide area network and connected to the endpoint location; and

transmit the further set of data packets via the other communication session to the complementary packet processing device.

15. The device of claim 14, further comprising:

the one or more computer storage devices having further stored there on computer-executable instructions representing a receiver engine, a decompression engine, and a scatter engine, the receiver engine executed by a processor configured to;

receive a set of data packets via a further communication session with another complementary packet processing device, the other complementary packet processing device connected to the wide area network, the set of data packets encapsulating a concatenated compressed data set including a set of headers concatenated with a compressed payload data set, the compressed payload data set including payloads corresponding to the set of headers, the payloads having been separated from the set of headers for compression at the other complementary packet processing device, the set of headers and corresponding payloads for another computer system connected to the local area network, the set of headers and corresponding payloads representing a set of contiguous data packets sent from another endpoint location on the wide area network to the computer system via an additional different established communication session between the computer system and the other endpoint location; and

depacketize the received set of data packets into the compressed concatenated data set including the set of headers the compressed payload data; and

the decompression engine executed by a processor configured to decompress the compressed payload data set to reveal the corresponding payloads; and

the scatter engine executed by a processor configured to;

reconstruct the set of contiguous data packets by matching headers from the set of headers with corresponding payloads; and

inject the reconstructed set of contiguous data packets into a plurality of other data packets being sent to the computer system via the additional different communication session, the set of contiguous data packets injected in an appropriate order so that the set of contiguous data packets is appropriately streamed along with the plurality of other packets to the computer system.

16. The device of claim 14, wherein the gather engine executed by a processor is configured to identify a set of contiguous data packets from among the plurality of received data packets by be configured to:

determine whether any of the plurality of packets include a security header;

if an incoming data packet includes a security header, then determine whether the incoming data packet with the security header is an encrypted packet or an authenticated packet; and

include authenticated data packets in the set of contiguous packets while passing through without compressing the encrypted data packets.

17. The device of claim 16, wherein the gather engine executed by a processor being configured to determine whether any of the incoming data packets include a security header comprises the gather engine being configured to detect whether a packet is an IPSec ESP packet and when the packet is an IPSec ESP packet, then the gather engine determines whether the IPSec ESP packet is an encrypted packet or an authenticated packet by attempting to validate the packet using an assumed IPSec ESP signature size.

18. The device of claim 14, wherein the gather engine executed by a processor being configured to identify a set of contiguous packets comprises the gather engine being configured to gather incoming data packets into the f4r-st-set of contiguous data packets by analyzing each data packet to detect whether the packet is a transmission control protocol packet.

19. The device of claim 14, wherein the gather engine executed by a processor is further configured to:

access a Quality-of-Service (QoS) marking from a header corresponding to one of the set of contiguous data packets, the Quality-of-Service (QoS) marking indicating a Quality-of-Service (QoS) priority for the established communication session; and

transfer Quality-of-Service (QoS) priority for established communication session to the other different communication session by marking the further set of packets with the Quality-of-Service (QoS) marking to specify that the other communication session has the Quality-of-Service (QoS) priority indicated for the established communication session.