Method and apparatus for managing content distribution using content signatures

• US 9,479,522 B1
• Filed: 05/06/2011
• Issued: 10/25/2016
• Est. Priority Date: 05/06/2011
• Status: Active Grant

• Current Assignee: Tellabs Operations Incorporated (Infinera Corp.)
• Original Assignee: Tellabs Incorporated (Infinera Corp.)
• Inventors: Cirkovic, Sasha
• Primary Examiner(s): Gillis, Brian J
• Assistant Examiner(s): Keller, Michael A
• Application Number:
  US13/102,953
• Time in Patent Office: 1,999 Days
• Field of Search: 709230-232, 709/224, 370/252
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A method and apparatus for managing packet flow based on content signatures are disclosed. A process of netflow management, in one embodiment, is able to receive a packet flow traveling through a communications network and obtain a signature from the packet flow. Upon retrieving a predefined signature from storage in accordance with the signature, the signature and the predefined signature are compared. A message of unauthorized distribution associated with the packet flow is issued when bit pattern of the signature matches with bit pattern of the predefined signature.

Claims

1. A method for monitoring network traffic traveling through a router coupled to a communication network, the communication network containing a plurality of network elements capable of transmitting data between network devices, the method comprising:

receiving a predefined first signature from a first subscriber over the communication network and storing the predefined first signature;

detecting a first packet flow traveling through the router to its destination via a content-based monitoring process;

extracting a plurality of bits representing a first signature identifying content of the first packet flow from a predefined location the first packet flow;

retrieving the predefined first signature from a storage in accordance with the first signature;

comparing the first signature with the predefined first signature;

facilitating an issuance of a message indicating unauthorized distribution associated with the first packet flow when bit pattern of the first signature matches with bit pattern of the predefined first signature;

facilitating to prevent the first packet flow from traveling to its destination in accordance with the message of unauthorized distribution; and

generating a report indicating accumulative statistics of data streams traveling through the communications network and providing a market analysis in accordance with recorded data relating packet flows traveling through the communications network.

2. The method of claim 1, further comprising notifying the first subscriber regarding the unauthorized distribution associated with the first packet flow.

3. The method of claim 1, further comprising,

redirecting the first packet flow to a predefined unauthorized distribution handler;

and

recording source address and destination address of the first packet flow.

4. The method of claim 1, wherein detecting a first packet flow traveling through a router to its destination via a communications network includes,

receiving a plurality of predefined signatures from a plurality of subscribers;

and

monitoring network traffic in the communications network in accordance with the plurality of predefined signatures.

5. The method of claim 4, wherein extracting a first signature from a predefined location in a head portion of the first packet flow includes extracting a set of bits from a predefined portion of the first packet flow.

6. The method of claim 5, wherein retrieving the predefined first signature from the storage includes fetching subscriber identification (“

sid”

) of the predefined first signature and content identification (“

cid”

) of the predefined first signature from a local memory storage.

7. The method of claim 6, wherein comparing the first signature with the predefined first signature includes subtracting sid of first signature from the sid of the predefined first signature and subtracting cid of first signature from the cid of the predefined first signature.

8. The method of claim 1, comprising,

receiving a second packet flow traveling through the communications network;

obtaining a second signature from the second packet flow;

retrieving a predefined second signature from the storage in accordance with the second signature;

comparing the second signature with the predefined second signature; and

issuing a second message of unauthorized distribution associated with the second packet flow when bit pattern of the second signature matches with bit pattern of the predefined second signature.

9. A method for monitoring protected content traveling through a router coupled to a communication network, the communication network containing a plurality of network elements capable of transmitting data between network devices, the method comprising:

receiving a plurality of predefined digital signatures identifying content of packets from a plurality of subscribers across the communication network;

identifying the plurality of predefined digital signatures associated with a plurality of protected content;

monitoring network traffic traveling through the router during a content-based monitoring;

detecting a first packet flow passing through the router to its destination and extracting a plurality of bits representing a first digital signature from a content portion of the first packet flow;

identifying a match when the first digital signature matches with one of the plurality of predefined digital signatures;

facilitating to prevent the first packet flow from traveling to its destination in response to the match and reporting the match indicating an access of first protected content to a first subscriber who provides the one of the plurality of predefined digital signatures; and

generating a report indicating accumulative statistics of data streams traveling through the communications network and providing a market analysis in accordance with recorded data relating packet flows traveling through the communications network.

10. The method of claim 9, further comprising:

recording source address and destination address of the first packet flow; and

allowing the first packet flow to be routed.

11. The method of claim 10, further comprising:

issuing an authorized transfer if the source address of the first packet flow matches with a predefined source address; and

issuing an unauthorized transfer if the source address of the first packet flow mismatches with the predefined source address.

12. The method of claim 10,

issuing an authorized transfer if the destination address of the first packet flow matches with a predefined source address;

and

issuing an unauthorized transfer if the destination address of the first packet flow mismatches with the predefined source address.

13. The method of claim 10, wherein receiving a plurality of predefined digital signatures from a plurality of subscribers includes storing a plurality of subscriber identifications (“

sid”

) and content identifications (“

cid”

) in a local memory storage.

14. The method of claim 10, wherein monitoring network traffic traveling through a router includes detecting a plurality of data streams organized in packet format flowing through a communications network.

15. The method of claim 9, wherein detecting a first packet flow passing through the router to its destination and extracting a first digital signature from a head portion of the first packet flow includes,

retrieving a predefined first digital signature from a storage in accordance with the first digital signature;

comparing the first digital signature with the predefined first digital signature.

16. The method of claim 9, comprising:

detecting a second packet flow having a second digital signature that matches with one of the plurality of predefined digital signatures; and

reporting a match of a second protected content to the network element.

17. A method for accumulating content transfer traveling through a router coupled to a communication network, the communication network containing a plurality of network elements capable of transmitting data between network devices, the method comprising:

storing a plurality of predefined signatures identifying contents carried by packet flows from various subscribers situated over the communication network;

associating the plurality of predefined signatures with a plurality of content providers;

monitoring network traffic traveling through the router during a content-based monitoring in accordance with the plurality of the predefined signature;

extracting a plurality of bits representing a first signature from a predefined location of a first packet flow and comparing the first signature with the plurality of the predefined signatures;

facilitating to redirect the first packet flow from traveling through the router to its destination when the bit pattern of the first signature matches with bit pattern of one of the predefined signatures;

recording the first packet flow having one of the plurality of predefined signatures; and

generating a report indicating accumulative statistics of data streams traveling through the communications network and providing a market analysis in accordance with recorded data relating packet flows traveling through the communications network.

18. The method of claim 17, wherein associating the plurality of predefined signatures with a plurality of content providers includes identifying a first unique signature for downloading at least a portion of a book.

19. The method of claim 17, wherein facilitating to redirect the first packet flow from traveling through the router to its destination includes,

identifying transmission authorization if the first signature indicates confidential content in the first packet;

and

rerouting the first packet to an event handler if the transmission authorization is not activated.