US20140269316A1 - Method for maintaining differentiated services data flow at a network device implementing redundant packet discard security techniques - Google Patents

Method for maintaining differentiated services data flow at a network device implementing redundant packet discard security techniques Download PDF

Info

Publication number
US20140269316A1
US20140269316A1 US14/293,201 US201414293201A US2014269316A1 US 20140269316 A1 US20140269316 A1 US 20140269316A1 US 201414293201 A US201414293201 A US 201414293201A US 2014269316 A1 US2014269316 A1 US 2014269316A1
Authority
US
United States
Prior art keywords
packet
node
packets
sequence
received
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Abandoned
Application number
US14/293,201
Inventor
Jing Xiang
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
RPX Clearinghouse LLC
Original Assignee
Rockstar Consortium US LP
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority to US10/611,392 priority Critical patent/US7746781B1/en
Priority to US12/781,908 priority patent/US8755280B2/en
Application filed by Rockstar Consortium US LP filed Critical Rockstar Consortium US LP
Priority to US14/293,201 priority patent/US20140269316A1/en
Publication of US20140269316A1 publication Critical patent/US20140269316A1/en
Assigned to RPX CLEARINGHOUSE LLC reassignment RPX CLEARINGHOUSE LLC ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: BOCKSTAR TECHNOLOGIES LLC, CONSTELLATION TECHNOLOGIES LLC, MOBILESTAR TECHNOLOGIES LLC, NETSTAR TECHNOLOGIES LLC, ROCKSTAR CONSORTIUM LLC, ROCKSTAR CONSORTIUM US LP
Abandoned legal-status Critical Current

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00Traffic regulation in packet switching networks
    • H04L47/10Flow control or congestion control
    • H04L47/24Flow control or congestion control depending on the type of traffic, e.g. priority or quality of service [QoS]
    • H04L47/2408Different services, e.g. type of service [ToS]
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L1/00Arrangements for detecting or preventing errors in the information received
    • H04L1/08Arrangements for detecting or preventing errors in the information received by repeating transmission, e.g. Verdan system

Abstract

An improved method is described for providing Differentiated Services (Diffserv) traffic to a node in a network that implements a security method that discards duplicate packets received at the node. The method includes the step of identifying at least two service levels to be provided to received traffic and assigning different size look-back window counts to each of the service levels. The look-back window count indicates a number of packets that have been previously received at the node that should be compared against a received packet to determine whether a duplicate packet has been received. In one embodiment, a service level that has higher priority is assigned a lower look-back window count and thus examines fewer previously received packets than a service level having a lower priority. Such an arrangement reduces the possibility that traffic having higher priority is dropped as a security measure.

Description

    FIELD OF THE INVENTION
  • This invention relates generally to the field of networking and, more specifically, to the method for supporting quality of service issues in a secure network environment.
  • BACKGROUND OF THE INVENTION
  • As is known in the art, data is transferred between nodes over the Internet in the form of packets or datagrams. A packet typically consists of a header portion and a data portion. The data portion comprises a number of bytes or octets of data. There may be any minimum number of bytes in the data portion of the packet, but typical protocols also ensure that there is a maximum number of bytes of data that are transferred between each packet header. Because packets may be transmitted through different routes in the network to a destination node, they may reach the destination node out of order. Under the Transmission Control Protocol (TCP)/IP protocol and other protocols a sequence number is assigned to each packet to enable the destination node to restore the order of packets in the data transmission.
  • Referring now to FIG. 1, an exemplary definition of fields of an Internet Protocol (IP) packet header includes a number of fields that control how the data associated with the header is to be treated at a source and destination node. Exemplary fields include the source address 12 j and the destination address 12 k, which include the IP addresses of the communicating nodes. In addition, the IP header includes a version field 12 a which identifies which version of the IP protocol should be used when parsing the IP header, and a protocol field 12 h which identifies what other protocols are layered on top of the IP protocol. For example, certain protocols such as Transmission Control Protocol (TCP) include their own header, and the encoding of the TCP protocol in the protocol field alerts the destination node to interpret a portion of the data as a TCP header.
  • Another field in the IP header is the Type Of Service (TOS) field 12 m. In the IP protocol, the TOS identifies the quality of service that should be afforded a given transmission between the identified source and destination nodes. For example, the field may be encoded to indicate a relative priority of the transmission; high priority transmissions would be given precedence over low priority transmissions at each of the source and destination nodes.
  • In version IPv4 and IPv6 of the IP protocol a replacement header field, called the Differentiated Services Code (DSC) field 13, is defined, which supersedes the definition of the IP TOS octet. Differentiated Services (generally referred to as Diffsery by the art), enables different Per Hop Behaviors (PHBs) to be experienced at different nodes for different types of traffic. Traffic having a certain type of per hop behavior are said to belong to a particular behavior aggregate. Diffsery thus allows a network subscriber to control the quality of service (QOS) that is associated with their traffic by entering into a service level agreement to obtain the desired behavior of traffic at certain nodes. Generally speaking, there is a correlation between the value in the DSC field and the per hop behavior desired for the data encapsulated in the data field of the corresponding packet, and the per hop behavior is the means by which a node allocates resources to the behavior aggregate. There can be a variety of different types of traffic between a common source and destination, each of which may have different per hop behaviors and therefore each of which has different access rights to the resources (buffers, etc.) of the destination node.
  • While there are many possible per hop behaviors, certain per hop behaviors have been defined in the art. These per hop behaviors include Best Effort Forwarding (BE), Assured Forwarding (AF) and Expedited Forwarding (EF).
  • Best Effort (BE) per hop behavior is the default per hop behavior of Diffserv. BE behavior aggregate packets may be sent into a network without adhering to any particular rules and the network will deliver as many of these packets as possible and as soon as possible, subject to other resource policy constraints. The reasonable implementation of this per hop behavior would be to forward packets in this aggregate whenever the output link is not required to satisfy another per hop behavior. A reasonable policy for constructing services ensures that the behavior aggregate was not starved by allowing some accesses to the resources.
  • Traffic that is forwarded as part of the Assured Forwarding (AF) behavior aggregate is forwarded with a high probability that it will reach the destination node as long as the aggregate traffic from each site does not exceed a subscribed threshold. For example, in a typical application, a company uses the Internet to interconnect its geographically distributed sites and wants an assurance that IP packets within this intranet are forwarded with high probability as long as the aggregate traffic from each site does not exceed the subscribed information rate (profile). Different levels of Assured Forwarding (AF) PHB group behavior may be offered by a service provider to meet the required bandwidth and cost associated with the customer.
  • Expedited Forwarding provides the highest priority per hop behavior. The intent of the Expedited Forwarding PHB is to provide a building block for low loss, low jitter and low delay services. The dominant causes of delay in packet network are set propagation delays in wide area links and tuning delay in switching and routers. Since propagation delays are a set property of the topology, delay can be minimized when queuing delays are minimized. The intent of the expedited forwarding per hop behavior is to provide a behavior in which suitably marked packets usually encounter short or empty queues. If queues remain short relative to buffer space available, packet loss is also kept to a minimum. An additional characteristic that may be EF or AF PHBs requirement is that the data packets often must be received in the order that they are transmitted.
  • A protocol that may be layered on top of the IP protocol is the Internet Protocol Security (IPsec) protocol. Internet Protocol Security (IPsec) is a security protocol that provides security services at the IP layer by enabling a system to select required security protocols, determine the algorithm(s) to use for services, and put in place any cryptographic keys required to provide the requested services. IPsec can be used to protect one or more paths between a pair of hosts, between a pair of secure gateways, or between a security gateway and a host. The set of security services that IPsec can provide include access control, connectionless integrity, data origin authentication, limited traffic flow confidentiality, and the rejection of replayed packets (a form of partial sequence integrity).
  • One element of the IPsec protocol is the use of the Authentication Header (AH) 14. as shown in FIG. 2. The IP Authentication Header is used to provide connectionless integrity and data origin authentication for IP datagrams, and to provide protection against replays. AH offers an anti-replay (partial sequence integrity) service at the discretion of the receiver, to help counter denial of service (DoS) attacks. A DoS attack is a type of attack on a network that is designed to bring the network to its knees by flooding it with useless traffic. Many DoS attacks, such as the Ping of Death and Teardrop attacks, exploit limitations in the TCP/IP protocols. The anti-replay mechanism seeks to overcome DoS attacks by assigning examining sequence number 15 d of received packets, and dropping any packets having duplicate sequence numbers within a predefined window of time. As shown in FIG. 2, the sequence number 15 d comprises 32 bits, and is used as a counter for the data packets associated with the secure transmission. Typical implementations do not allow duplicate sequence numbers to appear within a thirty two bit window, and therefore use five bits of the counter, before resetting to provide a new sequence number. In order to prevent DoS attacks, the anti-replay mechanism deletes packets having duplicate sequence numbers within the thirty-two packet window.
  • Referring now to FIG. 3, an exemplary Diffsery data flow is shown, wherein the IP packets may have layered thereon an Authentication Header for IPsec purposes, including sequence numbers. A first traffic stream is shown to include packets A1, A2 and A3, and a second traffic stream is shown to include packets B1, B2, B3. Source node 20 transmits both traffic streams to destination node 30. In the example of FIG. 3, assume that data transmission A, comprising packets A1, A2 and A3 are packets comprising the BE PHB aggregate, and transmission B, comprising packets B1, B2 and B3 are packets comprising an EF PHB aggregate. Source node 20 initiates the transmission of traffic stream A over the Internet 25 by forwarding packets A1 and A2 to destination node 30. As the packets are transmitted, they are assigned sequence numbers 1 and 2 respectively. Subsequent to the transmission of packets A1 and A2, data traffic belonging to the Expedited Forwarding per hop behavior aggregate is received at the source node 20. To implement the EF PHB for traffic stream B, the source node immediately substitutes the traffic stream B in its transmissions to destination node 30. Packet B1 is assigned sequence number 1, packet B2 is assigned sequence number 2, and packet B3 is assigned sequence number 3, and all packets are forwarded to the destination node. Following the transmission of packet B3 to the destination node, the final packet A3 of the first transmission can be forwarded to the destination node. Within a four packet transmission period, two packets have identical sequence numbers (packet A1 and B1 have matching sequence number 1, and packets A2 and B2 have matching sequence number 2). Typically the destination node will look to other characteristics of the packet, such as protocol, the DSC fields, and other identifying elements to arrange the appropriate packets with the appropriate transmission streams.
  • A problem arises, however, at the destination node due to the anti-replay mechanism of the IPsec protocol, because when packet B1 having the sequence number of 1 is received at the destination node it will be dropped since the duplicate sequence number potentially indicates a DoS attack. Thus, the contracted EF PHB for traffic stream B is not achieved. It would be desirable to determine a method of implementing Diffsery in networks having nodes operating using the IPsec protocol.
  • SUMMARY OF THE INVENTION
  • An improved method is described for providing Differentiated Services (Diffserv) traffic to a node in a network that implements a security method that discards duplicate packets received at the node. The method includes the step of identifying at least two service levels to be provided to received traffic and assigning different size look-back window counts to each of the service levels. The look-back window count indicates a number of packets that have been previously received at the node that should be compared against a received packet to determine whether a duplicate packet has been received. In one embodiment, a service level that has higher priority is assigned a lower look-back window count and thus examines fewer previously received packets than a service level having a lower priority. Such an arrangement reduces the possibility that traffic having higher priority is dropped as a security measure.
  • BRIEF DESCRIPTION OF THE DRAWINGS
  • Figure is a diagram illustrating various fields of a header according to the Internet Protocol;
  • FIG. 2 is a diagram illustrating various fields that are included in an Authentication Header (AH) in the Internet Protocol Security (IPsec) protocol;
  • FIG. 3 is a packet flow diagram for illustrating how packets that are part of Diffsery traffic are frequently dropped at nodes operating using the anti-replay mechanism of the IPsec protocol;
  • FIG. 4 is a conceptual block diagram of certain components that may be included in hardware or software at a host node operating according to the present invention;
  • FIG. 5 is a packet flow diagram for illustrating how offering differing size windows according to the present invention reduces the instances of discard of Diffsery packets in systems operating under the IPsec protocol; and
  • FIG. 6 is a block diagram of a sequence number buffer illustrating various window sizes that are assigned to various service levels according to the present invention.
  • DESCRIPTION OF THE PREFERRED EMBODIMENT
  • A method and apparatus for supporting differentiated services (Diffserv) traffic at nodes that implement redundant packet discard security measures to prevent Denial Of Service (DoS) attacks will be described with reference to the attached Figures and below specification.
  • Referring now to FIG. 4, some basic components of a networked node 50 are shown to include a packet processor 56, a parser 52 and a packet buffer 54. Although the components are shown as functional blocks, it should be understood that the functionality described with regard to each of the components may be implemented in either software, hardware, or a combination thereof, and the present invention is not limited to any specific implementation.
  • In general, the networked node receives incoming packets on line 53, and forwards the packets for temporary storage in the packet buffer 54. The packet processor 56, among other things, determines whether the packet stored in the buffer should be forwarded to memory (not shown) for further processing or to an output path (not shown) of the node. In addition, the packet processor sends signals to the packet buffer if it is determined that the packet should be discarded. The focus of the present invention will be specifically on the redundant packet discard security measure that is often performed to minimize DoS attacks at a node. One example of a redundant packet discard security measure is the anti-replay mechanism of the Internet Protocol Security (IPsec) protocol. It should be understood that although the present invention is described with regard to certain elements of the IPsec protocol, the present invention is not limited to operation under any specific protocol.
  • According to one aspect of the present invention, a table of look-back window sizes 58 is provided. Each look-back window size is associated with a defined per hop behavior aggregate, such as Best Effort (BE), one of a set of Assured Forwarding (AF) per hop behaviors, Expedited Forwarding (EF) or the like. When an input packet is received at the node, the DSC field is parsed from the IP header and forwarded to the Diffsery codepoint (DSC) table 57 to determine the contracted level of service associated with the traffic stream. There is a correlation between the DSC and the per hop behavior, although it may not be a one-to-one mapping, and other considerations, such as the type of packet as indicated in the identifier field 12 d of the IP header, the IP addresses of the source and destination nodes, the protocol associated with the specific packet (as identified in field 12 h), and other factors may be used to map the packet to one of a set of per hop behavior (PHB) aggregates. The present invention recognizes that there may be many PHBs defined from many input fields of the packet, and the present invention should not be limited to any specific PHBs or methods for determining PHB aggregates. The alternative term of ‘service level’ will be used interchangeably hereinafter with the term per hop behavior aggregate.
  • Logic at the node 50 operates generally as follows. When a packet is received at the node, the parser 52 strips the DSC field and the sequence number from the respective IP and Authentication headers. The DSC field is used to obtain a portion of the per hop behavior mapping information, which is forwarded to the packet processor 56. The packet processor retrieves the look-back window size for the PHB from the replay window table 58. The packet processor uses the window size to determine how many previous sequence numbers should be compared with the current sequence number to find a match. If a match is found within this window, the current packet is discarded because it is a potential DoS attack. If no match is found, the packet is processed in accordance with the remaining fields of the IP header.
  • For example, referring now to FIG. 5, assume that a node is implementing a security protocol that drops duplicate packets, but that the traffic that flows through the network is Diffsery traffic having a variety of service levels. Using known Diffsery terminology, assume that the traffic includes packets having Expedited Forwarding (EF) service levels, one Assured Forwarding (AF) service level, and a default Best Effort (BE) service level. Data traffic having EF service level has a look-back window size of eight sequence numbers/packets, while data having AF service level has a look-back window of twelve sequence numbers/packets, and data having BE service level has a look-back window of thirty two packets/sequence numbers.
  • In FIG. 5, source node 60 is transmitting a series of traffic streams A, B and C to destination node 70. Individual packets will be referred to hereinafter by their respective stream designations in combination with their sequence numbers (for example, as shown in FIG. 5 packet B1 is forwarded at time T16, packet A12 is forwarded at time T12, etc.) In FIG. 5, traffic stream A has a contracted Best Effort service level, traffic stream B has an Assured Forwarding service level, and traffic stream C has an Expedited Forwarding service level.
  • At time T1, packet A1 is transferred to destination node 70. The transmission of traffic stream A continues until time T16, when the source node receives a higher priority traffic stream B. When the destination node receives packet B1, the packet processor examines the DSC field and other information in the IP header to determine the service level/PHB of the packet. As mentioned above, the service level of traffic stream B is AF. Once the service level/PHB has been identified, the associated look-back window size is selected from the window table 58. When the look-back size is determined the node examines the sequence numbers that are associated with packet in the predefined window to determine whether a match is made. Referring briefly to FIG. 6, in one embodiment the sequence numbers of accepted packets are stored in the sequence number buffer 55, which is a first in first out (FIFO) buffer. When examining the FIFO 55, only those sequence numbers within the window are examined for the match. For example, in FIG. 6 only those sequence numbers in window 61 are examined for higher priority traffic, only the sequence number in window 63 are examined for mid-priority traffic, and all sequence numbers are examined for default priority traffic. Any known method of quickly determining whether or not there is a match between the numbers can be used. As new sequence numbers are received, remaining sequence numbers are pushed down the buffer until eventually they are overwritten, or fall out of the buffer. The length of the sequence number buffer should correspond to the maximum look-back window size.
  • Referring back to FIG. 5, when packet B1 is received, the sequence numbers of the previous twelve packets are examined for a match. In the example of FIG. 5, there is no match, and the packet is not discarded. The transmission of stream B continues until at time T25 the source node 60 starts to forward a third traffic stream C. In the example of FIG. 5, traffic stream C is high priority EF service level traffic, and thus has a look-back window of only eight packets. The sequence numbers of packets B2-B9 are compared against the sequence number of packet C1, and as there is no match, the packet is not discarded.
  • Thus, a method and apparatus has been shown and described wherein different size windows are associated with different priority traffic to ensure that the packets are not discarded due to redundant packet dropping security levels. Although certain sizes have been disclosed above, it should be noted that the present invention is not limited to any specific look-back window size. Various considerations have to be made by a user when making the decision for sizing, such as the type of traffic generally seen at the node, the service levels offered by the service provider, loading considerations at the node, and a variety of other considerations (Jing, can you give me any general statements here about what data you might look to in determining appropriate window size>?)
  • Although the present invention has been particularly described with reference to the preferred embodiments thereof, it should be readily apparent to those of ordinary skill in the art that changes and modifications in the form and details may be made without departing from the spirit and scope of the invention. It is intended that the appended claims include such changes and modifications.

Claims (12)

What is claimed is:
1. A node for a packet communication network, the node comprising:
a communication interface configured to receive packets from the communication network; and
a packet processor coupled to the communication interface, the packet processor being configured:
to compare a sequence number associated with a received packet against sequence numbers associated with a number of previously received packets, the number of previously received packets having been determined responsive to a service level associated with the received packet; and
to discard the received packet in the event of a match between the respective sequence number associated with any one of the number of previously received packets and the sequence number associated with the received packet.
2. The node of claim 1, wherein the packet processor is configured to determine the service level associated with the received packet in response to a differentiated services codepoint associated with the received packet.
3. The node of claim 1, wherein the packet processor is configured to be responsive to at least two service levels wherein the number of previously received packets determined for a higher priority service level is less than a number of previously received packets determine for a lower priority service level.
4. The node of claim 3, wherein at least one of the service levels corresponds to an Expedited Forwarding (EF) per hop behavior.
5. The node of claim 3, wherein at least one of the service levels corresponds to an Assured Forwarding (AF) per hop behavior.
6. The node of claim 3, wherein at least one of the service levels corresponds to a Best Efforts (BE) per hop behavior.
7. The node of claim 1, wherein the packet processor is configured to discard the received packet in the event of a match in accordance with an Internet Protocol Security (IPsec) anti-replay mechanism.
8. The node of claim 1, wherein the communication interface comprises a packet buffer configured to buffer received packets.
9. The node of claim 1, wherein the communication interface comprises a packet parser configured to determine a respective sequence number associated with each received packet.
10. The node of claim 1, comprising a differentiated services code table configured to determine a respective level of service associated with each received packet.
11. The node of claim 1, comprising a table of look back window sizes configured to associate a respective look back window size with each level of service.
12. The node of claim 1, comprising a sequence number buffer configured to buffer sequence numbers associated with previously received packets.
US14/293,201 2003-06-30 2014-06-02 Method for maintaining differentiated services data flow at a network device implementing redundant packet discard security techniques Abandoned US20140269316A1 (en)

Priority Applications (3)

Application Number Priority Date Filing Date Title
US10/611,392 US7746781B1 (en) 2003-06-30 2003-06-30 Method and apparatus for preserving data in a system implementing Diffserv and IPsec protocol
US12/781,908 US8755280B2 (en) 2003-06-30 2010-05-18 Method for maintaining differentiated services data flow at a network device implementing redundant packet discard security techniques
US14/293,201 US20140269316A1 (en) 2003-06-30 2014-06-02 Method for maintaining differentiated services data flow at a network device implementing redundant packet discard security techniques

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
US14/293,201 US20140269316A1 (en) 2003-06-30 2014-06-02 Method for maintaining differentiated services data flow at a network device implementing redundant packet discard security techniques

Related Parent Applications (1)

Application Number Title Priority Date Filing Date
US12/781,908 Continuation US8755280B2 (en) 2003-06-30 2010-05-18 Method for maintaining differentiated services data flow at a network device implementing redundant packet discard security techniques

Publications (1)

Publication Number Publication Date
US20140269316A1 true US20140269316A1 (en) 2014-09-18

Family

ID=42271234

Family Applications (3)

Application Number Title Priority Date Filing Date
US10/611,392 Active 2026-07-05 US7746781B1 (en) 2003-06-30 2003-06-30 Method and apparatus for preserving data in a system implementing Diffserv and IPsec protocol
US12/781,908 Expired - Fee Related US8755280B2 (en) 2003-06-30 2010-05-18 Method for maintaining differentiated services data flow at a network device implementing redundant packet discard security techniques
US14/293,201 Abandoned US20140269316A1 (en) 2003-06-30 2014-06-02 Method for maintaining differentiated services data flow at a network device implementing redundant packet discard security techniques

Family Applications Before (2)

Application Number Title Priority Date Filing Date
US10/611,392 Active 2026-07-05 US7746781B1 (en) 2003-06-30 2003-06-30 Method and apparatus for preserving data in a system implementing Diffserv and IPsec protocol
US12/781,908 Expired - Fee Related US8755280B2 (en) 2003-06-30 2010-05-18 Method for maintaining differentiated services data flow at a network device implementing redundant packet discard security techniques

Country Status (1)

Country Link
US (3) US7746781B1 (en)

Families Citing this family (36)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8370583B2 (en) * 2005-08-12 2013-02-05 Silver Peak Systems, Inc. Network memory architecture for providing data based on local accessibility
US8929402B1 (en) 2005-09-29 2015-01-06 Silver Peak Systems, Inc. Systems and methods for compressing packet data by predicting subsequent data
US8392684B2 (en) 2005-08-12 2013-03-05 Silver Peak Systems, Inc. Data encryption in a network memory architecture for providing data based on local accessibility
US20070115812A1 (en) * 2005-11-22 2007-05-24 Silver Peak Systems, Inc. Sequence numbers for multiple quality of service levels
US8072982B2 (en) * 2006-01-25 2011-12-06 Telefonaktiebolaget Lm Ericsson (Publ) Gateway entity for distinguishing between different messages without full knowledge of underlying protocol
FR2901436B1 (en) * 2006-05-19 2008-07-04 Airbus France Sas Device for receiving messages, in particular in relation to secure data exchanges, aircraft and associated methods
US8755381B2 (en) * 2006-08-02 2014-06-17 Silver Peak Systems, Inc. Data matching using flow based packet data storage
US8885632B2 (en) 2006-08-02 2014-11-11 Silver Peak Systems, Inc. Communications scheduler
WO2009000331A1 (en) * 2007-06-28 2008-12-31 Telefonaktiebolaget Lm Ericsson (Publ) Method and apparatus for data transfer in a peer-to-peer network
US8171238B1 (en) 2007-07-05 2012-05-01 Silver Peak Systems, Inc. Identification of data stored in memory
US8095774B1 (en) 2007-07-05 2012-01-10 Silver Peak Systems, Inc. Pre-fetching data into a memory
KR100849888B1 (en) * 2007-11-22 2008-08-04 한국정보보호진흥원 Device, system and method for dropping attack multimedia packets
US8307115B1 (en) 2007-11-30 2012-11-06 Silver Peak Systems, Inc. Network memory mirroring
US8489562B1 (en) 2007-11-30 2013-07-16 Silver Peak Systems, Inc. Deferred data storage
US8442052B1 (en) 2008-02-20 2013-05-14 Silver Peak Systems, Inc. Forward packet recovery
US8743683B1 (en) 2008-07-03 2014-06-03 Silver Peak Systems, Inc. Quality of service using multiple flows
US9717021B2 (en) 2008-07-03 2017-07-25 Silver Peak Systems, Inc. Virtual network overlay
US8811431B2 (en) * 2008-11-20 2014-08-19 Silver Peak Systems, Inc. Systems and methods for compressing packet data
EP2609721A4 (en) * 2010-08-25 2014-04-30 Ericsson Telefon Ab L M Methods and arrangements for secure communication over an ip network
US8856213B2 (en) * 2011-08-11 2014-10-07 Verizon Patent And Licensing Inc. Provisioning a moderated data service using a syndicated radio access network (RAN)
US9246876B1 (en) * 2011-10-13 2016-01-26 Juniper Networks, Inc. Anti-replay mechanism for group virtual private networks
US9130991B2 (en) 2011-10-14 2015-09-08 Silver Peak Systems, Inc. Processing data packets in performance enhancing proxy (PEP) environment
US9626224B2 (en) 2011-11-03 2017-04-18 Silver Peak Systems, Inc. Optimizing available computing resources within a virtual environment
DK2792112T3 (en) * 2011-12-15 2018-11-26 Ericsson Telefon Ab L M Technology-conscious DIFFSERV marking
US9438483B2 (en) 2012-10-15 2016-09-06 At&T Intellectual Property I, L.P. System and method of implementing quality of service over a packet-based Network
CA2938904A1 (en) * 2014-02-06 2015-08-13 Brett Shellhammer System, methods, and devices for addressed data communications
US9154460B1 (en) * 2014-02-12 2015-10-06 Sonus Networks, Inc. Methods and apparatus for denial of service resistant policing of packets
US9948496B1 (en) 2014-07-30 2018-04-17 Silver Peak Systems, Inc. Determining a transit appliance for data traffic to a software service
US9875344B1 (en) 2014-09-05 2018-01-23 Silver Peak Systems, Inc. Dynamic monitoring and authorization of an optimization device
EP3248360B1 (en) 2015-01-19 2020-05-06 Inauth, Inc. Systems and methods for trusted path secure communication
US9667650B2 (en) * 2015-05-15 2017-05-30 Cisco Technology, Inc. Anti-replay checking with multiple sequence number spaces
US10164861B2 (en) 2015-12-28 2018-12-25 Silver Peak Systems, Inc. Dynamic monitoring and visualization for network health characteristics
US10432484B2 (en) 2016-06-13 2019-10-01 Silver Peak Systems, Inc. Aggregating select network traffic statistics
US9967056B1 (en) 2016-08-19 2018-05-08 Silver Peak Systems, Inc. Forward packet recovery with constrained overhead
US10257082B2 (en) 2017-02-06 2019-04-09 Silver Peak Systems, Inc. Multi-level learning for classifying traffic flows
US10637721B2 (en) 2018-03-12 2020-04-28 Silver Peak Systems, Inc. Detecting path break conditions while minimizing network overhead

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5151899A (en) * 1991-02-11 1992-09-29 Digital Equipment Corporation Tracking sequence numbers in packet data communication system
US20030072261A1 (en) * 2001-10-17 2003-04-17 Keiko Shinagawa Packet distributing device
US6978384B1 (en) * 2000-09-19 2005-12-20 Verizon Corp. Services Group, Inc. Method and apparatus for sequence number checking
US7020143B2 (en) * 2001-06-18 2006-03-28 Ericsson Inc. System for and method of differentiated queuing in a routing system
US7191231B2 (en) * 2003-02-12 2007-03-13 Cisco Technology, Inc. System and method for consistent forwarding of packets across wireless and wireline networks

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6321093B1 (en) * 1998-08-07 2001-11-20 Samsung Electronics Co., Ltd. System and method for controlling priority calls in a wireless network
US6498787B1 (en) * 1998-12-30 2002-12-24 Motorola, Inc. Method and apparatus for sending and receiving service utilization messages
US7000120B1 (en) * 1999-12-23 2006-02-14 Nokia Corporation Scheme for determining transport level information in the presence of IP security encryption
US7099327B1 (en) * 2000-10-12 2006-08-29 Lucent Technologies Inc. Data communications networks with high performance and reliability
CA2394711C (en) * 2000-10-19 2009-09-22 Samsung Electronics Co., Ltd. Device and method for transmitting multimedia data in mobile communication system
US6839327B1 (en) * 2000-12-01 2005-01-04 Cisco Technology, Inc. Method and apparatus for maintaining consistent per-hop forwarding behavior in a network using network-wide per-hop behavior definitions
US7017175B2 (en) * 2001-02-02 2006-03-21 Opentv, Inc. Digital television application protocol for interactive television
US7237262B2 (en) * 2002-07-09 2007-06-26 Itt Manufacturing Enterprises, Inc. System and method for anti-replay processing of a data packet
US7260392B2 (en) * 2002-09-25 2007-08-21 Intel Corporation Seamless teardown of direct link communication in a wireless LAN

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5151899A (en) * 1991-02-11 1992-09-29 Digital Equipment Corporation Tracking sequence numbers in packet data communication system
US6978384B1 (en) * 2000-09-19 2005-12-20 Verizon Corp. Services Group, Inc. Method and apparatus for sequence number checking
US7020143B2 (en) * 2001-06-18 2006-03-28 Ericsson Inc. System for and method of differentiated queuing in a routing system
US20030072261A1 (en) * 2001-10-17 2003-04-17 Keiko Shinagawa Packet distributing device
US7191231B2 (en) * 2003-02-12 2007-03-13 Cisco Technology, Inc. System and method for consistent forwarding of packets across wireless and wireline networks

Also Published As

Publication number Publication date
US7746781B1 (en) 2010-06-29
US20100278045A1 (en) 2010-11-04
US8755280B2 (en) 2014-06-17

Similar Documents

Publication Publication Date Title
US10164886B2 (en) Route optimization using measured congestion
US9350653B2 (en) Label switching in fibre channel networks
US9258323B1 (en) Distributed filtering for networks
US9667555B2 (en) Quality of service in packet networks
US9813339B2 (en) Filtering and route lookup in a switching device
US20180041470A1 (en) Applications and integrated firewall design in an adaptive private network (apn)
US8848718B2 (en) Hierarchical metering in a virtual router-based network switch
Badishi et al. Keeping denial-of-service attackers in the dark
US8125911B2 (en) First-hop domain reliability measurement and load balancing in a computer network
JP4705115B2 (en) Network monitoring
EP1920557B1 (en) Method for updating best path based on real-time congestion feedback
US7778176B2 (en) Methods, apparatuses and systems facilitating concurrent classification and control of tunneled and non-tunneled network traffic
US7426634B2 (en) Method and apparatus for rate based denial of service attack detection and prevention
US7010611B1 (en) Bandwidth management system with multiple processing engines
US8077606B1 (en) Multimedia data flow dropping with notification
US7873065B1 (en) Selectively enabling network packet concatenation based on metrics
US7626940B2 (en) System and method for integrated header, state, rate and content anomaly prevention for domain name service
EP1017203B1 (en) Monitoring of Internet differentiated services for transactional applications
EP1457008B1 (en) Methods and apparatus for network congestion control
EP1851920B1 (en) Congestion notification in 3g radio access
US7188189B2 (en) System and method to improve the resiliency and performance of enterprise networks by utilizing in-built network redundancy
EP1769611B1 (en) Method of operating a network with test packets
US6415313B1 (en) Communication quality control system
Zhang et al. Low-Rate TCP-Targeted DoS Attack Disrupts Internet Routing.
US7940757B2 (en) Systems and methods for access port ICMP analysis

Legal Events

Date Code Title Description
AS Assignment

Owner name: RPX CLEARINGHOUSE LLC, CALIFORNIA

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:ROCKSTAR CONSORTIUM US LP;ROCKSTAR CONSORTIUM LLC;BOCKSTAR TECHNOLOGIES LLC;AND OTHERS;REEL/FRAME:034924/0779

Effective date: 20150128

STCB Information on status: application discontinuation

Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION