Smarter policy decisions based on metadata in data flows

Patent metadata

Field	Value
Publication number	US-9282040-B2
Application number	US-201414255701-A
Country	US
Kind code	B2
Filing date	Apr 17, 2014
Priority date	Feb 28, 2014
Publication date	Mar 8, 2016
Grant date	Mar 8, 2016

Abstract

Modern day user applications leverages new communication technologies such as WebRTC, WebEx, and Jabber allow devices to connect and exchange media content including audio streams, video streams, and data stream/channels. The present disclosure describes mechanisms for a Port Control Protocol (PCP) server to provide feedback to PCP clients to enforce certain policies on the transport of such media content for a network. A policy may include a traffic handling policy for enforcing differentiated quality of service characteristics for different types of media streams. Another policy may include a security policy ensuring a data files being transmitted over a data channel from one endpoint travels to a security application via a relay element before the packets reaches another endpoint. The mechanisms are transparent to the endpoints, and advantageously preserve the user experience for these user applications.

First claim

What is claimed is:

1. A method for communicating feedback to enforce security policies on transport of content, comprising:
receiving, from a Port Control Protocol (PCP) client of a first device at a PCP server of a network, a PCP Map request comprising a query whether the PCP client can bundle a plurality of streams into a flow according to a 5-tuple comprising source Internet Protocol (IP) address, destination IP address, protocol, source port number, and destination port number;
determining, by the PCP server using a policy application, whether at least one of the plurality of streams is to be provided to a security application through a relay element;
in response to determining the PCP client must transmit at least one of the plurality of streams separately from the rest of the plurality of streams, transmitting, from the PCP server to the PCP client, a first PCP Option response indicating to the PCP client that bundling is not allowed for the at least one of the plurality of streams and the at least one of the plurality of streams is to be provided to the security application through a relay element;
determining, by the PCP server using the policy application, whether the PCP client is allowed to bundle the rest of the plurality of streams into the flow and the network is configured to classify traffic on a per-packet basis; and
in response to determining the PCP client is allowed to bundle the rest of the plurality of streams into the flow and the network is configured to classify traffic on a per-packet basis, transmitting, from the PCP server to the PCP client, a second PCP Option response to the query indicating to the PCP client that bundling for the rest of the plurality of streams is allowed.

2. The method of claim 1 , wherein the second PCP Option response comprises a success code.

3. The method of claim 1 , wherein the PCP Map request comprises a PCP option having:
a first identifier for identifying packets associated with a first stream of the plurality of streams and one or more quality of service characteristics associated with the first stream; and
a second identifier for identifying packets associated with a second stream of the plurality of streams and one or more quality of service characteristics associated with the second stream.

4. A method for receiving feedback to enforce security policies on transport of content, comprising:
transmitting, from a Port Control Protocol (PCP) client of a first device to a PCP server of a network, a PCP Map request comprising a query whether the PCP client can bundle a plurality of streams into a flow according to a 5-tuple comprising source Internet Protocol (IP) address, destination IP address, protocol, source port number, and destination port number;
if a first PCP Option response is received from the PCP server at the PCP client indicating to the PCP client that bundling is not allowed for the at least one of the plurality of streams and the at least one of the plurality of streams is to be transmitted separately from the rest of the plurality of streams and is to be provided to the relay element and the security application:
determining, by an connection agent at first device, an address for the relay element; and
signaling, by the connection agent at the first device, to the relay element to obtain the relay element for transmitting the at least one of the plurality of streams to a second device via the relay element; and

if a second PCP Option response is received from the PCP server at the PCP client indicating the PCP client is allowed to bundle the plurality of streams into the flow and the network is configured to classify traffic on a per-packet basis:
signaling, by the connection agent at the first device, to an application server with a session setup message indicating that the plurality of streams are bundled in the flow.

5. The method of claim 4 , further comprising:
if the first PCP Option response is received, enabling, by a connection agent at the first device, transmission of the at least one of the plurality of streams via the relay element by signaling an application server, with a session setup message indicating the address of the relay element as a relay candidate for the at least one of the plurality of streams.

6. The method of claim 4 , further comprising:
if the first PCP Option response is received, transmitting the at least one of plurality of streams to the second device over a data channel via the relay element and separately from the rest of the plurality of streams.

7. The method of claim 4 , wherein the at least one of the plurality of streams comprises data file(s) being transmitted from the first client towards a second client.

8. The method of claim 4 , wherein the security application performs deep packet inspection on packets in the at least one of the plurality of streams sent via the relay element to detect malicious content and/or proprietary content.

9. The method of claim 4 , further comprising
if a first PCP Option response is received, transmitting a further PCP Map request comprising a PCP option having:
a first identifier for identifying packets associated with a first stream of the rest of the plurality of streams and one or more quality of service characteristics associated with the first stream; and
a second identifier for identifying packets associated with a second stream of the rest of the plurality of streams and one or more quality of service characteristics associated with the second stream.

10. The method of claim 9 , further comprising:
receiving a response to the further PCP Map request indicating that bundling for the rest of the plurality of streams is allowed;
enabling, by an connection agent at the first device, bundling of the rest of the plurality of streams into the flow by signaling an application server, with a session setup message, indicating that the rest of the plurality of streams are bundled in the flow; and
transmitting the rest of the plurality of streams as part of the flow over the network from the first device to a second device, wherein the flow is identified by the 5-tuple.

11. A Port Control Protocol (PCP) server for communicating feedback to enforce security policies on transport of content, the PCP server comprising:
one or more processors;
one or more memory elements coupled to the processor;
a PCP server application that when executed by the at least one processor is configured to:
receive, from a PCP client of a first device, a PCP Map request comprising a query whether the PCP client can bundle a plurality of streams into a flow according to a 5-tuple comprising source Internet Protocol (IP) address, destination IP address, protocol, source port number, and destination port number;
determine, by the PCP server using a policy application, whether at least one of the plurality of streams is to be provided to a security application through a relay element;
in response to determining the PCP client must transmit at least one of the plurality of streams separately from the rest of the plurality of streams, transmit, from the PCP server to the PCP client, a first PCP Option response indicating to the PCP client that bundling is not allowed for the at least one of the plurality of streams and the at least one of the plurality of streams is to be provided to the security application through a relay element;
determine, by the PCP server using the policy application, whether the PCP client is allowed to bundle the rest of the plurality of streams into the flow and the network is configured to classify traffic on a per-packet basis; and
in response to determining the PCP client is allowed to bundle the rest of the plurality of st

Assignees

• Cisco Tech Inc

Inventors

• Reddy K Tirumaleswar
• Ravindranath Ram Mohan
• Perumal Muthu Arul Mozhi
• Wing Daniel G
• Versteeg William C

Classifications

• H04L65/60

  Network streaming of media packets · CPC title

• H04L63/0263

  Rule management · CPC title

• H04L65/80

  Responding to QoS · CPC title

• H04L63/10

  for controlling access to devices or network resources · CPC title

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title