Dropping packets to prevent unauthorized data transfer through multimedia tunnels

A computer security system, comprising:

• an interface configured to receive a stream of media transport protocol packets;
• a processor coupled to the interface and configured to:
• negotiate a packet dropping algorithm between sending and receiving ends of the stream;
• identify a packet to drop from the stream using the negotiated packet dropping algorithm, the negotiated packet dropping algorithm being independent of packet address information, packet port information, protocol type, packet content, traffic flow aggregation, and a network traffic level, the processor further configured to:
• intentionally drop the identified packet from the stream and allow a plurality of other packets comprising the stream to be processed normally in accordance with the media transport protocol, the dropping of the packet to reduce unauthorized use of the stream, wherein the unauthorized use is sensitive to dropping of the identified packet and an authorized use of the stream is not sensitive to dropping of the identified packet, wherein intentionally dropping a packet includes determining whether one or more packets within a prescribed window have been dropped unintentionally and intentionally dropping a packet only if no packet has been dropped unintentionally within the prescribed window.

A computer program product for providing computer security, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

• receiving a stream of media transport protocol packets;
• negotiating a packet dropping algorithm between sending and receiving ends of the stream;
• identifying a packet to drop from the stream using the negotiated packet dropping algorithm, the negotiated packet dropping algorithm being independent of packet address information, packet port information, protocol type, packet content, traffic flow aggregation, and a network traffic level;
• intentionally dropping the identified packet from the stream to reduce unauthorized use of the stream, wherein the unauthorized use is sensitive to dropping of the identified packet and an authorized use of the stream is not sensitive to dropping of the identified packet, wherein intentionally dropping a packet includes determining whether one or more packets within a prescribed window have been dropped unintentionally and intentionally dropping a packet only if no packet has been dropped unintentionally within the prescribed window;
• and
• allowing a plurality of other packets comprising the stream to be processed normally in accordance with the media transport protocol.

A method of providing computer security, comprising:

• receiving a stream of media transport protocol packets;
• negotiating a packet dropping algorithm between sending and receiving ends of the stream;
• identifying a packet to drop from the stream using the negotiated packet dropping algorithm, the negotiated packet dropping algorithm being independent of packet address information, packet port information, protocol type, packet content, traffic flow aggregation, and a network traffic level;
• determining whether one or more packets within a prescribed window have been dropped unintentionally;
• intentionally dropping the identified packet from the stream, in the event that no packet has been dropped unintentionally within the prescribed window, to reduce unauthorized use of the stream, wherein the unauthorized use is sensitive to dropping of the identified packet and an authorized use of the stream is not sensitive to dropping of the identified packet;
• and
• allowing a plurality of other packets comprising the stream to be processed normally in accordance with the media transport protocol.