US 8,045,564 B2 · Protocol-level filtering

Abstract

Mechanisms are disclosed for detecting protocols independently of the ports used by streams associated with the protocols or applications that may send out such streams. The detecting may entail using a content filter that is hosted on a networking stack, where the content filter may be composed of a stream buffer and handlers for detecting the protocols. The handlers may be further used to modify streams incoming to a port or streams outgoing from an application. The handlers can modify the streams in a variety of ways, including reading, inserting, replacing, deleting, and completing data in the streams according to some policy criteria, such as those set by parental controls. Individual handlers may be selected from a plurality or set of handlers so that they can be matched up to the appropriate streams.

Claims20

Dependent claims

A system for protocol-level filtering of content, the system comprising:

a stream buffer for buffering traffic data, wherein the buffered traffic data has a network protocol that is unknown;
a plurality of handlers configured to:
concurrently connect to the buffered traffic data;
concurrently process the buffered traffic data;
identify the unknown network protocol associated with the buffered traffic data using an identification handler, wherein the identification handler is at least one handler of the plurality of handlers, and wherein identification of the unknown network protocol is performed independent of information regarding a type of port used for the buffered traffic data or an application that generates the buffered traffic data;
remove each handler of the plurality of handlers that is not the identification handler from the buffered traffic data upon identification of the unknown network protocol by the identification handler;
and
place the identification handler in a state to manipulate the buffered traffic data.

5 more elements

A method for filtering content at a protocol-level, comprising acts of:

concurrently attaching a first network protocol identification component and a second network protocol identification component to a stream having a type of network protocol associated therewith which is unknown, wherein the first network protocol identification component and the second network protocol identification component are concurrently attached to the stream regardless of a type of port used by the stream or an application that generates the stream;
concurrently processing the stream by the first network protocol identification component and the second network protocol identification component;
identifying the type of network protocol that is associated with the stream using an identifying network protocol identification component, wherein the identifying network protocol identification component is one of the first network protocol identification component and the second network protocol identification component, and wherein identification of the type of network protocol is performed independent of information regarding the type of port used for the stream or the application that generates the stream;
removing an other of the first network protocol identification component and the second network protocol identification component from the stream upon identification of the type of network protocol associated with the stream, wherein the other of the first network protocol identification component and the second network protocol identification component is not the identifying network protocol identification component;
and
placing the identifying network protocol identification component in a state to modify the stream according to a policy.

3 more elements

Dependencies are inferred from the claim text.

Protocol-level filtering

Life of this patent

Protocol-level filtering

Life of this patent

Abstract

Claims20