Patent ID: 8924705
Filing Date: 2014-12-30
Classification: H04L

Abstract:
1. A detection system for detecting encrypted peer-to-peer (EP2P) sessions associated with a particular EP2P network, embodied in one or more non-transitory computer-readable storage media and executable by one or more processors, comprising: at least one microprocessor a database including: a list of internet protocol (IP) address and port number combinations of known EP2P nodes associated with the particular EP2P network; and a list of known EP2P commands associated with the particular EP2P network; and one or more detection agents, each detection agent including: a filter unit for receiving a plurality of packets on route from a plurality of sources to a plurality of destinations in an IP network, for comparing a destination IP address and port number combination of each of the plurality of packets to the list of IP address and port number combinations of known EP2P nodes associated with the particular EP2P network, and for selecting a particular packet from the plurality of packets on the basis of a predetermined criterion, wherein the predetermined criterion is whether the destination IP address and port number combination of the particular packet is found in the list of IP address and port number combinations of known EP2P nodes associated with the particular EP2P network; a decryption unit for receiving the particular packet from the filter unit if the destination IP address and port number combination of the particular packet is not found in the list of IP address and port number combinations of known EP2P nodes associated with the particular EP2P network, and for performing no-key decryption using only information contained in the particular packet by: extracting seed data associated with the particular EP2P network from the particular packet, obtaining an encryption seed from the extracted seed data, obtaining an encryption key from the obtained encryption seed with a key function associated with the particular EP2P network, initializing a cipher associated with the particular EP2P network with the obtained encryption key, and decrypting a portion or whole of the particular packet with the initialized cipher; an EP2P detection unit for receiving the decrypted portion or whole of the particular packet from the decryption unit, for extracting checksum data associated with the particular EP2P network from the decrypted portion or whole of the particular packet, for obtaining a checksum from the extracted checksum data, for comparing the obtained checksum with a reference checksum associated with the particular EP2P network, for determining that a session including the particular packet is an EP2P session associated with the particular EP2P network if the obtained checksum matches the reference checksum, and for storing the destination IP address and port number combination of the particular packet in the list of IP address and port number combinations of known EP2P nodes associated with the particular EP2P network if the obtained checksum matches the reference checksum and if the IP address and port number combination of the particular packet is not already found in the list of IP address and port number combinations of known EP2P nodes associated with the particular EP2P network; and an extraction unit for receiving the decrypted portion or whole of the particular packet from the EP2P detection unit if the session including the particular packet is determined to be an EP2P session associated with the particular EP2P network, for extracting EP2P commands associated with the particular EP2P network from the decrypted portion or whole of the particular packet, wherein the EP2P commands are bit sequences within the particular packet's payload that carry network-related or user-related information, and for storing the extracted EP2P commands in the list of known EP2P commands associated with the particular EP2P network.