Pin-hole firewall for communicating data packets on a packet network

Patent metadata

Field	Value
Publication number	US-9621361-B2
Application number	US-201113196482-A
Country	US
Kind code	B2
Filing date	Aug 2, 2011
Priority date	Aug 22, 2006
Publication date	Apr 11, 2017
Grant date	Apr 11, 2017

Abstract

A pin-hole firewall network communications device that includes a first port configured to communicate data packets over a packet network and a first counter module in communication with the first port. A pin-hole firewall module may be in communication with the first counter module. A call control module may be in communication with the first counter module and the pin-hole firewall function. The call control module is configured to communicate with the pin-hole firewall module to alter the communication of data packets through a firewall pin-hole. A second counter module may be in communication with the pin-hole firewall function and the call control module. A second port may in communication with the second counter module and the packet network and be configured to communicate data packets over a second node segment of the packet network.

First claim

We claim:

1. A pin-hole firewall network communications device, comprising:
a first port configured to communicate data packets over a packet network;
a first counter module in communication with said first port, the first counter module configured to count real-time data packets, packets provided special bandwidth treatment, marked packets, and total data packets communicated through the first port,
wherein marked packets are counted based on specifics within each packet including any of type of service level markings, specific packets in an Ethernet virtual channel, P-bit markings in 802.1Q tags, and a differentiated services field,
wherein packets provided special bandwidth treatment include any of specific packets in hardware-specific high priority schedules, and packets being treated by a QoS engine;

a pin-hole firewall module in communication with said first counter module;
a call control module in communication with said first counter module and said pin-hole firewall module, the call control module configured to communicate with the pin-hole firewall module to alter the communication of data packets through a firewall pin-hole based at least in part on the count of real-time data packets and total data packets communicated through the first port;
a second port in communication with the packet network and configured to communicate data packets over a second node segment of the packet network;
a second counter module in communication with said pin-hole firewall module and said call control module, the second counter module configured to count real-time data packets and total data packets communicated through the second port, wherein the real-time data packets and total data packets are counted when a CODEC stack is in use or reserved for use; and
wherein each of the first and second counter modules keeps both a real-time data packet count and total data packet count.

2. The device according to claim 1 , wherein said first and second counter modules each include a counter to count total data packets communicated with said pin-hole firewall module via said first and second ports, respectively.

3. The device according to claim 2 , wherein said first and second counter modules each further include a second counter to count data packets including real-time content communicated with said pin-hole firewall module via said first and second ports, respectively.

4. The device according to claim 3 , wherein said first and second counter modules each further include a computation module to compute bandwidth of data packets including real-time content.

5. The device according to claim 1 , wherein said first and second ports are Ethernet ports.

6. The device according to claim 5 , further comprising Ethernet virtual circuits in communication with said respective first and second ports.

7. The device according to claim 1 , wherein said call control module is configured to read values of said first and second counters and communicate the values over the packet network.

8. The device according to claim 7 , wherein the values include total bandwidth and bandwidth of data packets including real-time content.

9. The device according to claim 1 , further comprising a processing unit on which said first and second counter modules, said call control module, and said pin-hole firewall module execute.

10. The device according to claim 1 , wherein said call control module is configured to alter communications of said pin-hole firewall module.

11. A method for providing communications over a packet network, comprising:
receiving data packet communications at a pin-hole firewall from a packet network via a first port;
counting, with a first counter, real-time data packets, packets provided special bandwidth treatment, marked packets, and total data packets received via the first port,
wherein marked packets are counted based on specifics within each packet including any of type of service level markings, specific packets in an Ethernet virtual channel, P-bit markings in 802.1Q tags, and a differentiated services field,
wherein packets provided special bandwidth treatment include any of specific packets in hardware-specific high priority schedules, and packets being treated by a QoS engine;

receiving data packet communications at the pin-hole firewall from the packet network via a second port;
counting, with a second counter, real-time data packets and total data packets received via the second port, wherein the real-time data packets and total data packets are counted when a CODEC stack is in use or reserved for use; and
altering the communication of data packets through the pin-hole firewall based on a data packet count received via the first port and a second data packet count received via the second port;
wherein each of the first and second counter modules keeps both a real-time data packet count and total data packet count.

12. The method according to claim 11 , wherein counting data packets received via the first and second ports include counting total data packets received via the first and second ports, respectively.

13. The method according to claim 12 , further comprising counting data packets including real-time content communicated with said pin-hole firewall via said first and second ports, respectively.

14. The method according to claim 13 , further comprising computing bandwidth of data packets including real-time content.

15. The method according to claim 11 , further comprising communicating the data packets over Ethernet networks via the first and second ports.

16. The method according to claim 15 , further comprising establishing Ethernet virtual circuits via the first and second ports.

17. The method according to claim 11 , further comprising:
reading values from the first and second counters; and
communicating the values over the packet network.

18. The method according to claim 17 , wherein reading the values includes reading total bandwidth and bandwidth of data packets including real-time content.

19. The method according to claim 11 , further comprising altering communications of the pin-hole firewall includes halting communication of non-real-time content to increase communication of real-time content.

20. The method according to claim 11 , wherein altering communications of the pin-hole firewall includes slowing down data packet communications with the packet networks.

Assignees

• Bugenhagen Michael K
• Wiley William L
• Centurylink Ip Llc

Inventors

• Bugenhagen Michael K
• Wiley William L

Classifications

• H04L45/00

  Routing or path finding of packets in data switching networks (routing or path finding in wireless networks H04W40/00) · CPC title

• H04L43/08

  Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters · CPC title

• H04L41/0677

  Localisation of faults · CPC title

• H04L41/0681

  Configuration of triggering conditions · CPC title

• H04L41/5051

  Service on demand, e.g. definition and deployment of services in real time · CPC title