Network Traffic Classification via Self-Identification API
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing use of encrypted protocols in wireless, wired, and cellular networks makes it difficult for network operators to enforce service-level policies, such as bandwidth and quality of service, due to obfuscated traffic signals, especially with new encryption standards and dynamic changes in traffic flow patterns.
Innovation Solution
An application programming interface (API) is used by services to self-identify and request access, allowing network operators to classify traffic flows without decrypting the data, enabling policy enforcement and improved network resource management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encrypted protocols are used for network traffic, then security and safety of traffic are improved, but the ability to enforce service-level policies and classify traffic flows deteriorates
Solution Approach 1:
The patent introduces an intermediary mechanism (metadata extraction and classification system) that operates between the encrypted traffic and the policy enforcement point. This intermediary extracts identifiable metadata from encrypted packets without decrypting the payload, enabling policy classification while preserving security. The intermediary translates encrypted traffic characteristics into actionable classification data that network operators can use for policy enforcement.
2Reliability
If new encryption standards are implemented, then security is improved, but the obfuscation of traffic signals increases making classification more difficult
Solution Approach 1:
The patent applies extraction by removing only the necessary identifiable metadata from encrypted traffic flows for classification purposes, while leaving the encrypted payload intact. The system extracts specific signal characteristics (such as packet size patterns, timing intervals, or protocol headers) that can be used for policy enforcement without compromising the encryption's security function. This selective extraction maintains security while providing sufficient information for traffic classification.
3Productivity
If traditional traffic analysis methods are used on encrypted traffic, then some classification may be achieved, but policy enforcement becomes unreliable
Solution Approach 1:
The patent implements feedback mechanisms where the classification system continuously monitors and adjusts its metadata extraction rules based on observed traffic patterns and policy enforcement outcomes. The system receives feedback from policy enforcement points about classification accuracy and refines its extraction algorithms to improve reliability. This closed-loop approach ensures that even with encrypted traffic, the system can adapt and maintain reliable policy enforcement over time.
Data Source
AI summary
Systems and methods for classifying a traffic flow on a network to determine parameters are described herein. The systems and methods use a policy API of a cellular network to allow entities to self-identify when, for example, their traffic flows may be encrypted or the identity of the originating location is obfuscated. The requesting entity accesses the policy API and transmits a self-identification request for a particular set of parameters to be used for subsequent traffic flows from the self-identification requesting entity. The cellular network may use the self-identification requests to allocate resources according to the parameters listed in the self-identification request without requiring the cellular network to decrypt the transmissions or analyze the transmissions to determine parameters.