Method, system, and logic for in-band exchange of meta-information

Patent metadata

Field	Value
Publication number	US-9479534-B2
Application number	US-201414522064-A
Country	US
Kind code	B2
Filing date	Oct 23, 2014
Priority date	Mar 21, 2014
Publication date	Oct 25, 2016
Grant date	Oct 25, 2016

Abstract

In an embodiment, a method is provided for enabling in-band data exchange between networks. The method can comprise receiving, by a first enveloping proxy located in the first network, at least one regular secure sockets layer (SSL) record for a SSL session established between a client and a server; receiving the data from a network element located in the first network; encoding the data into at least one custom SSL record; and transmitting the at least one regular SSL record and the at least one custom SSL record to an enveloping proxy. In another embodiment, a method can comprise receiving at least one regular secure sockets layer (SSL) record and at least one custom SSL record for a SSL session established between a client and a server; extracting the data from the at least one custom SSL; transmitting the at least one regular SSL record.

First claim

What is claimed is:

1. A method for exchanging data between networks, the method comprising:
receiving, by a first enveloping proxy located in a service provider network, meta-data associated with an encrypted data flow between a client and a server;
transmitting, in-band within the encrypted data flow, the meta-data to a second enveloping proxy located in a content provider network; and
controlling, by the first enveloping proxy using in-band data, a network component located in the service provider network on behalf of the second enveloping proxy located in the content provider network by:
receiving, in-band within the encrypted data flow, a container from the second enveloping proxy located in the content provider network, wherein the container is received encrypted in at least one custom secure sockets layer (SSL) record that is interleaved with at least one regular SSL record, and
controlling the network component located in the service provider network based on the container, at least in part, by transmitting the container to the network component.

2. The method of claim 1 , wherein the controlling the network component located in the service provider network based on the container comprises:
determining, based on the container, a service parameter for the encrypted data flow; and
modifying a routing priority for packets within the encrypted data flow based service parameter.

3. The method of claim 1 , wherein the transmitting the container to the network component comprises transmitting the container over an out-of-band channel between the first enveloping proxy and the network component.

4. The method of claim 1 , wherein the container is received via a network element that translates an address that identifies the data flow from a first value for use by the second enveloping proxy to a second value for use by the first enveloping proxy.

5. The method of claim 1 , wherein the at least one regular SSL record and the at least one custom SSL record are interleaved with one another over a data connection between the first enveloping proxy and the second enveloping proxy, and
wherein the ones of the least one regular SSL record correspond to the encrypted data flow, and wherein ones of the least one custom SSL record correspond to the container.

6. The method of claim 1 , wherein the client is located within the service provider network.

7. The method of claim 1 , wherein the service provider network is to provide clients with access to mobile network services, and wherein the content provider network is to provide the clients with access to multimedia content, and wherein the client is one of the clients.

8. A system for exchanging data between networks, the system comprising:
at least one memory element;
at least one processor on a first enveloping proxy located in a service provider network, the at least one processor being coupled to the at least one memory element and, when executing code, the at least one processor performs operations comprising:
receive meta-data associated with an encrypted data flow between a client and a server;
transmit, in-band within the encrypted data flow, the meta-data to a second enveloping proxy located in a content provider network; and
control a network component located in the service provider network on behalf of the second enveloping proxy located in the content provider network by:
receive, in-band within the encrypted data flow, a container from the second enveloping proxy located in the content provider network, wherein the container is received encrypted in at least one custom secure sockets layer (SSL) record that is interleaved with at least one regular SSL record, and
control the network component located in the service provider network based on the container, at least in part, by transmitting the container to the network component.

9. The system of claim 8 , wherein the controlling the network component located in the service provider network based on the container comprises the at least one processor performing operations comprising:
determine, based on the container, a service parameter for the encrypted data flow; and
modify a routing priority for packets within the encrypted data flow based service parameter.

10. The system of claim 8 , wherein the transmitting the container to the network component comprises the at least one processor performing operations comprising transmit the container over an out-of-band channel between the first enveloping proxy and the network component.

11. The system of claim 8 , wherein the container is received via a network element that translates an address that identifies the data flow from a first value for use by the second enveloping proxy to a second value for use by the first enveloping proxy.

12. The system of claim 8 , wherein the at least one regular SSL record and the at least one custom SSL record are interleaved with one another over a data connection between the first enveloping proxy and the second enveloping proxy, and
wherein the ones of the least one regular SSL record correspond to the encrypted data flow, and wherein ones of the least one custom SSL record correspond to the container.

13. The system of claim 8 , wherein the client is located within the service provider network.

14. The system of claim 8 , wherein the service provider network is to provide clients with access to mobile network services, and wherein the content provider network is to provide the clients with access to multimedia content, and wherein the client is one of the clients.

15. One or more non-transitory tangible media for exchanging data between networks, the one or more non-transitory tangible media including code for execution and when executed by a processor operable to perform operations comprising:
receiving, by a first enveloping proxy located in a service provider network, meta-data associated with an encrypted data flow between a client and a server;
transmitting, in-band within the encrypted data flow, the meta-data to a second enveloping proxy located in a content provider network;
controlling, by the first enveloping proxy using in-band data, a network component located in the service provider network on behalf of the second enveloping proxy located in the content provider network by:
receiving, in-band within the encrypted data flow, a container from the second enveloping proxy located in the content provider network, wherein the container is received encrypted in at least one custom secure sockets layer (SSL) record that is interleaved with at least one regular SSL record, and
controlling the network component located in the service provider network based on the container, at least in part, by transmitting the container to the network component.

16. The one or more non-transitory tangible media of claim 15 , wherein the controlling the network component located in the service provider network based on the container comprises:
determining, based on the container, a service parameter for the encrypted data flow; and
modifying a routing priority for packets within the encrypted data flow based service parameter.

17. The one or more non-transitory tangible media of claim 15 , wherein the transmitting the container to the network component comprises transmitting the container over an out-of-band channel between the first enveloping proxy and the network component.

18. The one or more non-transitory tangible media of claim 15 , wherein the container is received via a network element that translates an address that identifies the data flow fr

Assignees

• Cisco Tech Inc

Inventors

• Duminuco Alessandro
• Bosch Hendrikus G P
• Kumar Surendra M
• La Roche Humberto J
• Napper Jeffrey
• Shatzkamer Kevin D
• Wing Daniel G

Classifications

• H04L63/0435

  wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06) · CPC title

• H04L67/42

  Electricity · mapped topic

• H04L63/168

  above the transport layer · CPC title

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• H04L63/0281

  Proxies · CPC title