Patent Application
20100135287
1. Field of Invention
The present invention relates to a process for securing control and user data in communication systems and, in particular, to a process wherein encrypted priority information is included in the transmission of the data through the communication system.
2. Description of Related Art
Streaming video communications over packet-based networks are becoming more common within communications systems. Currently, many of these networks are Internet Protocol (IP) networks. The use of these networks for communications takes advantage of resources already in place. Further, entities with Internet systems also may implement streaming video communications using their existing network systems. Further, in addition to streaming video, the presence of a packetbased network allows for various services to be offered based on the packetbased technologies, such as, for example, providing e-mail messages, ISR video, chat and documents across the same terminal device. A packet-based network system used for streaming video is the fact that IP networks, such as the Internet, consists of multiple routers (i.e. edge and core), which are linked together. These routers store the data and forward them to the most appropriate output links.
IP is a datagram-based approach and offers no guarantee of quality of service. For example, network delays may be variable depending on the traffic within the network. In an IP network, packets are self-routed and dependant on the IP address. As a result, packets may take different routes depending on how busy each router is within a network. In contrast, with a fixed circuit, the delay is fixed and deterministic. A further problem with IP networks is that depending on the traffic within a network, packets may be dropped. As a result, the packets retransmitted are delayed more than other packets taking the same route, which have not been dropped. This retransmission mechanism is appropriate for applications, which are insensitive to delays. These mechanisms are commonly used in applications, such as, for example, Web browsers and e-mail programs.
Conversely with delay sensitive applications, variable delays and dropping of packets are undesirable. When the delay sensitive application includes transmitting streaming video data, variable delay or dropping of packets is unacceptable to maintain an appropriate quality of service for a call. Another instance in which the unpredictable delay or dropping of packets is unacceptable occurs as with user data messages used to set up, manage, and terminate a session for a call. Currently, no mechanism is present for handling control and user data messages over a packet-based network to guarantee delivery of these messages where these packets are secure via encryption or other cryptographical methods, where data is obscure. Therefore, it would be valuable to have an improved method, apparatus, and system for handling control and user data messages in an IP communications system, where the data is secure by means of cryptography. The proposed ToS/QoS mechanism affords a guaranteed service in the reception of the higher priority messages 99 percent of the time using cryptographic security protocols.
U.S. Pat. No. 7,106,718 describes a signaling bearer quality of service profile is pre-established and configured in various nodes in an access network. This is a new quality of service class designed to meet the needs of signaling bearers in multimedia sessions.
U.S. Pat. No. 7,027,457, Method And Apparatus For Providing Differentiated Quality-of-Service Guarantees In Scalable Packet Switches by F. M. Chiussi, et al. describes an invention comprises a method and apparatus for providing differentiated Quality-of-Service (QoS) guarantees in scalable packet switches. The invention advantageously uses a decentralized scheduling hierarchy to regulate the distribution of bandwidth and buffering resources at multiple contention points in the switch, in accordance with the specified QoS requirements of the configured traffic flows.
U.S. Pat. No. 6,970,470 Packet Communication System with QOS Control Function by T. Yuzaki, et al. describes a packet communication system of the present invention has first mode, second mode and third mode to apply to input packets. U.S. Pat. No. 6,865,153 Stage-implemented QOS Shaping for Data Communication Switch by R. Hill, et al. describes a stage-implemented QoS shaping scheme is provided for a data communication switch. U.S. Pat. No. 6,850,540 Packet Scheduling in A communication System by J. J. Pelsa, et al. describes methods, systems, and arrangements enable packet scheduling in accordance with quality of service (QoS) constraints for data flows. U.S. Pat. No. 6,640,248 Application-Aware Quality of Service (QOS) Sensitive, Media Access Control (MAC) Layer by J. W I Jorgensen describes an application aware, quality of service (QoS) sensitive, media access control (MAC) layer includes an application-aware resource allocator, where the resource allocator allocates bandwidth resource to an application based on an application type. U.S. Pat. No. 7,123,598 Efficient QOS Signaling for Mobile IP using RSVP Frame Work by H. M Chaskar describes a system and method for efficient QoS signaling for mobile IP using RSVP framework in which mobile nodes are connected to correspondent nodes via plurality of intermediate nodes.
Thus, it is a primary purpose of the invention to provide a process in a communication system wherein the priority of the data is securely transmitted. This priority is taking place in various layers of the protocols from source host (i.e. computer, PDA, electronic device, etc) to the destination host along the edge and core routers.
It is another primary purpose of the invention to provide a process in a communication system wherein the priority of the data transmission is encrypted, wherein a priority indicator is provided by a signaling protocol.
The present invention provides a process in a communication system for control and user data for a session in a packet-based network within the communications system where the data is encrypted. An encrypted priority indicator is placed or derived from other sources in a user data message handling a session within the communications system through the packet-based network via a signaling protocol. Applications handling user data messages in the packet-based network will provide priority or preferential handling of the secure user data messages. The main advantage of this invention is to guarantee that higher priority data will be received at the other end (destination host) before lower priority data at least 99 percent of the time in a secure manner.
In detail, the process for prioritizing messages from a first computer system having at least one computer connected to a first edge router to be sent to a second computer system having at least one computer connected to a second edge router, the process includes the steps of:
The novel features which are believed to be characteristic of the invention, both as to its organization and method of operation, together with further objects and advantages thereof, will be better understood from the following description in connection with the accompanying drawings in which the presently preferred embodiment of the invention is illustrated by way of example. It is to be expressly understood, however, that the drawings are for purposes of illustration and description only and are not intended as a definition of the limits of the invention.
Following is a list of acronyms used, which are used throughout the description of the preferred embodiment:
Referring to
For example the core routing provides the following services to the packets.
Control and user data flow through packet-based routers is depicted in accordance with a preferred embodiment of the present invention. In some cases, control and user data messages may be routed through nodes (i.e. IP or other router, wireless nodes), which do not contain applications to control the flow of messages. For example, within an IP network, messages may be placed into IP packets for routing from a source to a destination through a number of different nodes, such as routers. These routers do not examine the user data messages themselves, but route the data based on the headers in the IP packets. In this example, IP layer generates IP packets containing data for user data messages and sends them to IP layer. These IP layers may be located in a same LAN and/or a separate LAN.
In this case, the path between these computers 10A, 10B, 11A, and 11B passes through routers (preferably HAIPE type) 12A, 12B, 13A, 13B, 13C, and 13D. These routers, do not examine the user data messages, but process the IP packets based on the information in the headers of the IP packets along with the QoS information received via signaling protocol such as RMD for DiffServ. IP layer is instructed through a call or some other mechanism to set an indicator to provide priority handling of the IP packets. When an IP packet is received by routers 12A, 12B, 13A, 13B, 13C, and 13D, the header of the IP packet is examined. In addition to identifying where to send the IP packet, a determination is made as to whether an indicator is set in the header of the IP packet to identify whether the IP packet is to be given priority in processing. If an indicator is set in the header, then that IP packet is processed prior to other IP packets without the indicator. For example, an IP packet containing the indicator will be placed in a processing queue prior to other packets without an indicator. In this manner, priority handling of packets containing user data messages may be obtained even in nodes, which do not contain applications that examine the user data messages themselves.
Referring to
The mechanism of the present invention is implemented in application layer 20A, and 20B; network layer 22A, 22B, 22C, and 22D; and the data link layer 23A, 23B, 23C, and 23D. An application program, i.e. streaming Video in application layer 20A, and 20B may generate or receive user data messages. When generating a user data message, the application includes an indicator to provide priority processing by an application receiving the user data message. Further, the application in the node generating the message may send a call or command to network layer to provide for priority or precedence handling of IP packets containing the user data message. Further, the network layer in the node generating the message may send a call or command to link layer to provide for priority or precedence handling of IP packets containing the user data packet. In this example, network layer includes an IP protocol. In response to receiving a request to provide priority or precedence handling for a user data message being transported using one or more IP packets, the headers of these IP packets will include an indicator used by other network layers located in nodes routing IP packets to provide priority or precedence in the processing of these IP packets.
In this manner, when user data messages are routed by nodes that do not examine the user data messages in routing the messages, priority in the handling of these messages is insured between a host and an edge router. Between one edge router to another edge router, RMD for differential server is used to sending priority information in an encrypted manner.
From
When an external QoS Request arrives at the ingress node 31A, the PDR protocol, after classifying it into the appropriate PHB, will calculate the requested resource unit and create the PDR state. The PDR state will be associated with a flow specification ID. If the request is satisfied locally, then the ingress node will generate the PHR Resource Request and the PDR Reservation Request signaling message, which will be encapsulated in the PHR Resource Request signaling message. This PDR signaling message may contain information such as the IP address, session info the ingress node etc. This message will be decapsulated and processed by the egress node 31B only. The node reserves the requested resources by adding the requested amount to the total amount of reserved resources for that Diffserv class PHB. The egress node 31B, after processing the PHR Resource Request message, decapsulates the PDR signaling message and creates/identifies the flow specification ID and the state associated with it. In order to report the successful reservation to the ingress node 31A, the egress node 31B will send the PDR reservation report back to the ingress node 31A. After receiving this report message, the ingress node 31A will inform the external source of the successful reservation, which will in turn send traffic (user data).
Within a LAN 30A and 30B QoS flags such as ToS, TC, or DS is used for priority packet processing using multi-level priority queues. For QoS service beyond a LAN, 30A sends a quality specification message to interior edge router 31A using a signaling protocol such as NSIS. There are shared encryption keys among edge routers 31A and 31B and core routers 32A and 32B. Intranet side (left side) of the edge router 31A uses signaling protocol (i.e. NSIS) and builds control data; which has a Internet source IP Address, destination IP Address, session ID (optional), and priority Information. Note that this extra step is not required for user data. Both control and user data are based on IP protocols, except control data which also adds signaling protocol and is sent once per session. Once a core router 32A or 32B receives control message, it decrypts the message and adds the tuple with Internet source IP Address, destination IP Address, session ID (optional), and priority information in the access control list (ACL). Note, that core routers are trusted and secured. Once user data passes through core routers 32A or 32B, the core router compares Internet source, destination and optionally Session ID to the ACL list to provide the relevant QoS accordingly.
Referring to
A process used to process user data is depicted in accordance with a preferred embodiment of the present invention. This process may be implemented in an application, network, and/or link layer. The process begins by receiving a data message to the input processor 40 and ends to the output processor 47. This data message is received after IP packets have received by a lower layer in the protocol and placed into a form for use by the application. The data message is parsed. A determination is made as whether a priority 41 is present within the data message. If a priority is present, then the data message is processed based on the priority indicated with the process termination thereafter. If a priority is absent in the user data message, and then the user data message is processed normally with the process terminating thereafter.
Priority in processing may be achieved by placing the user data message or the data from the user data message higher up in a queue or buffer for processing with respect to other user data messages in which priority is absent or in which priority is lower than that of the current user data message. A similar process is followed by the router at various protocol layers. Upon receiving an IP packet, the router examines the header to see whether an indicator is present or set for priority handling of the IP packet.
Referring now to
Consider a queuing system in which there are three classes of packets classified by classified message/packet/frame classifier 51. The messages have high, med, or low priority, which arrive admission control 52 under independent Poisson distribution. No lower-priority packet enters to be serviced is low priority queue empty 55 with respect to medium priority queue empty 53 with respect to is high priority queue empty 53 when any higher-priority packets are present 54 with respect to 53; and 53 with respect to 54 and 55. If a lower-priority for example [58] packet is in service, its service will be interrupted at once if a higher-priority 53 or 54 packet arrives, and will not be resumed until the system is again clear of higher-priority packets. PQ-WFQ, LLQ or any other priority based queue theory may be applied instead of MPQ depending on the need.
Referring to
Referring to
The Type of Service/Traffic Class provides an indication of the abstract parameters of the quality of service desired. These parameters are to be used to guide the selection of the actual service parameters when transmitting a datagram through a particular network. Several networks offer service precedence, which somehow treats high precedence traffic as more important than other traffic. The major choice is a three way tradeoff between low-delay, high-reliability, and high-throughput. The use of the delay, throughput, and reliability indications may increase the cost of the service. In many networks better performance for one of these parameters is coupled with degraded performance on another. Except for very unusual cases at most two of these three indications should be set. The type of service is used to specify the treatment of the datagram during its transmission through the internet system.
The network control precedence designation is intended to be used within a network only. The actual use and control of that designation is up to each network. The Internet-work control designation is intended for use by gateway control originators only. If the actual use of these precedence designations is of concern to a particular network, it is the responsibility of that network to control the access to, and use of, those precedence designations.
Referring to
A diagram of an IP packet (see
Referring back to
User data may be, for example, a message to set up a session, a message to terminate a session, and a message to authenticate/authorize a user. User data includes a header and a payload in these examples, user data messages is placed into a queue for processing by an application. Application layer identifies time sensitive user data and a priority is generated. Additionally, a call is made to an IP layer in the protocol to set the priority indicator. The priority indicator set in response to this call is a priority indicator in a header of the packet used to transport the user data message. In the depicted examples, this priority indicator is a DS field 100. This call is used to provide priority handling of packets used to transport user data messages. The setting of this indicator allows for priority handling of the packet in nodes, which do not examine user data messages. In this manner, best efforts handling in the transport of the user data message from a source to a destination is ensured even when the message is being transported through nodes, which do not look at the contents of the packets themselves. The user data message is then sent for transport with the process terminating thereafter. This step involves sending the user data message to the next layer in the protocol stack, such as a transport layer. The setting of an indicator in the header of an IP packet and the use of a mechanism to reserve bandwidth for processing selected packets is intended as examples of mechanisms used to provide best efforts processing of user data. Ethernet layer can process similar priority as needed.
In
Referring to
Referring to
Referring to
Referring to
A node (i.e. router, host, server, etc) in which the present invention may be implemented is depicted in accordance with a preferred embodiment of the present invention. In this example, a node contains a bus providing communication between processor unit, memory, communications adapter, and storage. The processor unit, in this example, executes instructions, which may be located in memory or storage. Communications adapter is used to send and received data, such as user data messages. Node may be used to implement different components of the present invention. For example, a node may be a host or a router used to route IP packets or communications unit used to route or handle user data messages within a packet-based network, such as IP network.
This present invention provides a priority based mechanism used to control and user data within a packet-based network. Control and user data contain time sensitive information that is sensitive to delays in delivery. The mechanism of the present invention allows for these types of control and user data messages to be appropriately handled when received via different nodes. The priority handling is provided through the setting of various indicators within the messages and packets by the various protocol layers. The processing of messages and IP networks can be handled securely and quickly to avoid delays in delivering data to delay sensitive applications.
This description of the present invention has been presented for purposes of illustration and description and is not intended to be exhaustive or limited to the invention in the form disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art. For example, although the depicted examples use user data messages, the processes of the present invention may be implemented for other types of data other than user data including control and user data.
This invention has applicability to the computer network operation, cyber security, and information assurance industry.
