# US 2016/0366108 A1 · Application and data protection tag > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2016/0366108 A1 - Document ID: US20160366108A1 - Status: Published application - Kind: A1 - Application number: 15/181,275 - Filed: 2016-06-13 - Published: 2016-12-15 - Earliest claimed: 2015-06-13 - Assignees: Avocado Systems Inc. - Applicants: Avocado Systems Inc. - Inventors: Keshav Govind Kamble - Web page: https://patentgrep.com/patent/US20160366108A1 ## CPC - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/12: {Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32)} - H04L 63/1433: {Vulnerability analysis} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract According to one embodiment, a system includes a processing circuit and logic integrated with and/or executable by the processing circuit. The logic is configured to cause the processing circuit to generate a multi-context ADPL tag unique to a pair of data socket descriptors on which data is to be received and/or transmitted by a first application instance operating on the system and a second application instance operating on a second host. The logic is also configured to cause the processing circuit to embed the ADPL tag as part of an application payload in response to the first application instance calling an API configured to transmit the application payload out from the system via a sender data socket descriptor. More systems, methods, and computer program products are described in accordance with other embodiments. ## Claims ### Claim 1 A method, comprising: generating a multi-context application and data protection layer (ADPL) tag unique to a pair of data socket descriptors on which data is to be received and/or transmitted by a first application instance operating on a first host and a second application instance operating on a second host; and embedding the ADPL tag as part of an application payload in response to the first application instance calling an application programming interface (API) configured to transmit the application payload out from the first host via a sender data socket descriptor ### Claim 2 (depends on 1) The method as recited in claim 1, wherein the ADPL, tag comprises: a first identification (ID) field configured to store a globally unique identification number that is provided on a per-entity basis; a second ID field configured to store a unique identification number within an entity which is provided the first ID; a security profile field configured to store a security profile value calculated for the first host; and a secure signature field configured to store a uniquely calculated secure source signature for the application payload. ### Claim 3 (depends on 2) The method as recited in claim 2, wherein the secure source signature is based at least in part on attributes of the sender data socket descriptor and a receiver data socket descriptor, the attributes of the sender and receiver data socket descriptors being selected from a group consisting of a server and/or a source internet protocol (IP) interface, a server port number, a maximum number of allowable waiting connections, an application packet buffer size for transmitting and receiving data, a port number of a transport of the sender data socket descriptor, an IP address of a receiver data socket descriptor in the second host, a port number of the transport of the receiver data socket descriptor in all cases of controlled port allocations by the first application instance, bandwidth and flow specific mathematical transforms, and a maximum application packet buffer size usable for transmitting data to and receiving data from the receiver data socket descriptor. ### Claim 4 (depends on 2) The method as recited in claim 2, wherein the ADPL tag further comprises: a buffer length field configured to store a value that represents a buffer length of the application payload prior to modifications due to addition of the ADPL tag to the application payload; and a sequence number ID field configured to store a value that represents a sequence number ID, the sequence number ID being a unique number designating a sequence of the application payload prior to being fragmented into individual packets of data for transmission to the second host. ### Claim 5 (depends on 2) The method as recited in claim 2, wherein the security profile value stored in the security profile field is selected from a group consisting of: all zeros indicating to continue using a security profile in a last received ADPL tag; a non-zero value indicating a new security profile status in response to a change from a previously communicated security profile value; and 0xFFFFFF indicating an unknown security profile for the first host. ### Claim 6 (depends on 1) The method as recited in claim 1, further comprising: sending, by the first application instance, a packet having the application payload and embedded ADPL tag to the second host; and receiving, by the first application instance, a second ADPL tag as part of a second application payload in response to calling an application programming interface (API) configured to receive application payloads via a receiver data socket descriptor. ### Claim 7 (depends on 1) The method as recited in claim 1, wherein the ADPL tag is designated within the application payload at a start of the ADPL tag by a start of frame delimiter (SFD) and at an end of the ADPL tag by an end of frame delimiter (EFD). ### Claim 8 (depends on 7) The method as recited in claim 7, wherein the ADPL tag is stored at a beginning of the application payload, at an end of the application payload, or between the beginning and the end of the application payload using a programmable offset. ### Claim 9 (depends on 7) The method as recited in claim 7, further comprising encrypting at least a portion of the ADPL tag prior to embedding the ADPL tag in the application payload with the proviso that the SFD and the EFD are not encrypted. ### Claim 10 (depends on 9) The method as recited in claim 9, wherein the application payload is not encrypted other than the portion of the ADPL tag that is encrypted. ### Claim 11 A system, comprising: a processing circuit and logic integrated with and/or executable by the processing circuit, the logic being configured to cause the processing circuit to: generate a multi-context application and data protection layer (ADPL) tag unique to a pair of data socket descriptors on which data is to be received and/or transmitted by a first application instance operating on the system and a second application instance operating on a second host; and embed the ADPL tag as part of an application payload in response to the first application instance calling an application programming interface (API) configured to transmit the application payload out from the system via a sender data socket descriptor. ### Claim 12 (depends on 11) The system as recited in claim 11, wherein the ADPL tag comprises: a first identification (ID) field configured to store a globally unique identification number that is provided on a per-entity basis; a second ID field configured to store a unique identification number within an entity which is provided the first ID; a security profile field configured to store a security profile value calculated for the system; a secure signature field configured to store a uniquely calculated secure source signature for the application payload; a buffer length field configured to store a value that represents a buffer length of the application payload prior to modifications due to addition of the ADPL tag to the application payload; and a sequence number ID field configured to store a value that represents a sequence number ID, the sequence number ID being a unique number designating a sequence of the application payload prior to being fragmented individual packets of data for transmission to the second host. ### Claim 13 (depends on 12) The system as recited in claim 12, wherein the secure source signature is based at least in part on attributes of the sender data socket descriptor and a receiver data socket descriptor, the attributes of the sender and receiver data socket descriptors being selected from a group consisting of a server and/or a source internet protocol (IP) interface, a server port number, a maximum number of allowable waiting connections, an application packet buffer size for transmitting and receiving data, a port number of a transport of the sender data socket descriptor, an IP address of a receiver data socket descriptor in the second host, a port number of the transport of the receiver data socket descriptor in all cases of controlled port allocations by the first application instance, bandwidth and flow specific mathematical transforms, and a maximum application packet buffer size usable for transmitting data to and receiving data from the receiver data socket descriptor, and wherein the security profile value stored in the security profile field is selected from a group consisting of: all zeros indicating to continue using a security profile in a last received ADPL tag; a non-zero value indicating a new security profile status in response to a change from a previously communicated security profile value; and 0xFFFFFF indicating an unknown security profile for the system. ### Claim 14 (depends on 11) The system as recited in claim 11, wherein the logic is further configured to cause the processing circuit to: send, by the first application instance, a packet having the application payload and embedded ADPL tag to the second host; and receive, by the first application instance, a second ADPL tag as part of a second application payload in response to calling an application programming interface (API) configured to receive application payloads via a receiver data socket descriptor. ### Claim 15 The system as recited in claim ii, wherein the ADPL tag is designated within the application payload at a start of the ADPL tag by a start of frame delimiter (SFD) and at an end of the ADPL tag by an end of frame delimiter (EFD), and wherein the ADPL tag is stored at a beginning of the application payload, at an end of the application payload, or between the beginning and the end of the application payload using a programmable offset. ### Claim 16 (depends on 15) The system as recited in claim 15, wherein the logic is further configured to cause the processing circuit to encrypt at least a portion of the ADPL tag prior to embedding the ADPL tag in the application payload with the proviso that the SFD and the EFD are not encrypted, wherein the application payload is not encrypted other than the portion of the ADPL tag that is encrypted. ### Claim 17 A computer program product, comprising a computer readable storage medium having program instructions stored thereon, the program instructions being executable by a processing circuit to cause the processing circuit to: generate a multi-context application and data protection layer (ADPL) tag unique to a pair of data socket descriptors on which data is to be received and/or transmitted by a first application instance operating on a first host and a second application instance operating on a second host; and embed the ADPL tag as part of an application payload in response to the first application stan e calling an application programming interface (API) configured to transmit the application payload out from the first host via a sender data socket descriptor. ### Claim 18 (depends on 17) The computer program product as recited in claim 17, wherein the ADPL tag comprises: a first identification (ID) field configured to store a globally unique identification number that is provided on a per-entity basis; a second ID field configured to store a unique identification number within an entity which is provided the first ID; a security profile field configured to store a security profile value calculated for the first host; a secure signature field configured to store a secure source signature uniquely calculated for the application payload; a buffer length field configured to store a value that represents a buffer length of the application payload prior to modifications due to addition of the ADPL tag to the application payload; and a sequence number II) field configured to store a value that represents a sequence number ID, the sequence number ID being a unique number designating a sequence of the application payload prior to being fragmented into individual packets of data for transmission to the second host. ### Claim 19 (depends on 18) The computer program product as recited in claim 18, wherein the secure source signature is based at least in part on attributes of the sender data socket descriptor and a receiver data socket descriptor, the attributes of the sender and receiver data socket descriptors being selected from a group consisting of a server and/or a source internet protocol (IP) interface, a server port number, a maximum number of allowable waiting connections, an application packet buffer size for transmitting and receiving data, a port number of a transport of the sender data socket descriptor, an IP address of a receiver data socket descriptor in the second host, a port number of the transport of the receiver data socket descriptor in all cases of controlled port allocations by the first application instance, bandwidth and flow specific mathematical transforms, and a maximum application packet buffer size usable for transmitting data to and receiving data from the receiver data socket descriptor, and wherein the security profile value stored in the security profile field is selected from a group consisting of: all zeros indicating to continue using a security profile in a last received ADPL tag; a non-zero value indicating a new security profile status in response to a change from a previously communicated security profile value; and 0xFFFFFF indicating an unknown security profile for the first host. ### Claim 20 (depends on 17) The computer program product as recited in claim 17, wherein the ADPL tag is designated within the application payload at a start of the ADPL tag by a start of frame delimiter (SFD) and at an end of the ADPL tag by an end of frame delimiter (EFD), wherein the program instructions are further executable by the processing circuit to cause the processing circuit to encrypt at least a portion of the ADPL tag prior to embedding the ADPL tag in the application payload with the proviso that the SFD and the EFD are not encrypted, wherein the application payload is not encrypted other than the portion of the ADPL tag that is encrypted, and wherein the ADPL tag is stored at a beginning of the application payload, at an end of the application payload, or between the beginning arid the end of the application payload using a programmable offset.