Patent application EP20181261A (EP), filed 2020-06-19
Publication number: EP3754947A1
Title: SYSTEM AND METHOD FOR IDENTIFYING OTT APPLICATIONS AND SERVICES
Abstract: [0001]    A computer implemented method for determining the identity of an Over-the Top (OTT) application or service being accessed over the Internet from a HTTP, HTTPS or QUIC connection request received in a network monitoring device. Determine if one or more entries are present in the received connection request have an IP address that matches a known server IP address. A determination is then made as to whether if the received connection request is one of a HTTP, HTTPS or QUIC connection request, and if this cannot be determined than determine if a subject field in the received connection request is available. And determine if a candidate domain name is available from IP cache created from one or more of the above steps if a subject field is not available in the received connection request. Identify and categorize OTT applications associated with the received connection request if it is determined: the connection is either a HTTP, HTTPS or QUIC connection type; a subject field is available; or a candidate domain name is available utilizing a lookup table that is periodically updated with new OTT applications.
IPC codes: H04L  12/    26            A I
H04L  29/    08            A I
H04L  41/   147            A I
H04L  43/   026            A I
H04L  43/   062            A I
H04L  67/    02            A I
Claims: number: 1
text: A computer implemented method for determining the identity of an Over-the Top (OTT) application or service being accessed over the Internet, comprising the steps:
number: 2
text: The computer implemented method of claim 1, wherein receiving a connection request includes determining if a transport layer protocol is TCP and the destination TCP port in the connection request matches known ports to carry HTTP, HTTPS or QUIC requests.
number: 3
text: The computer implemented method of claim 2, wherein receiving a connection request further includes inspecting IP packets in the received connection request and generating a 5-tuple consisting of: IP source and destination addresses; a layer 4 transport protocol (e.g. TCP or UDP), and a transport protocol source and destination ports contained in the received connection request.
number: 4
text: The computer implemented method of claim 3, wherein the generated 5-tuple is compared with entries in a connection table to determine if the received connection request is a new or existing connection request, whereby if there is no existing entry, then a new entry is created matching the generated 5-tuple associated with the received connection request.
number: 5
text: The computer implemented method of claim 1, further including extracting URI and HTTP header fields from the connection request if it is determines the connection request is HTTP connection request.
number: 6
text: The computer implemented method of claim 1, further including detecting an SNI extension in a ClientHello handshake message if it is determined the received connection request is a HTTPS or QUIC connection request.
number: 7
text: The computer implemented method of claim 6, further including extracting the SNI from the ClientHello handshake message.
number: 8
text: The computer implemented method of claim 1 where determining if the subject field is available includes inspecting an "End Entity" X.509 format Server Certificate in the TLS handshake ServerHello message.
number: 9
text: The computer implemented method as recited in claim 1 wherein if determined there is a domain name entry with a matching IP address for the received connection request, the IP address of the destination server of the received connection request is stored as a candidate domain name.
number: 10
text: The computer implemented method as recited in claim 9 wherein if determined the destination IP address associated with the received connection request cannot be directly mapped to a known domain name then, the destination IP address is compared with a list of IP address ranges registered as public IP addresses.
number: 11
text: The computer implemented method as recited in claim 10 wherein the Public IP address ranges are managed and allocated by an International Regional Internet Registry (RIR) whereby each RIR publishes a database listing associated with unique IP addresses ranges on the public internet.
number: 12
text: The computer implemented method as recited in claim 1, further including inspecting Domain Name System (DNS) queries between browsers and their designated DNS servers.
number: 13
text: The computer implemented method as recited in claim 12 wherein a Host field in the received connection request is an IP address or
wherein a Host field in the received connection request is a domain name.
number: 14
text: The computer implemented method as recited in claim 12 further including performing a DNS name-resolution query to obtain an IP address for a target HTTP/HTTPS server whereby a DNS server provides a response containing a domain name being queried and one or more IP addresses associated with the queried domain name.
number: 15
text: The computer implemented method as recited in claim 14 wherein visible DNS name-resolution responses are inspected and utilized to add IP address/domain name mapping pairs to the IP cache.
number: 16
text: The computer implemented method as recited in claim 15 wherein TLS handshake SNI entries are utilized to update the IP cache.
number: 17
text: The computer implemented method as recited in claim 1 when if determined an application is being provided via an HTTP connection request, then one or more of the HTTP Host, Referrer, URI and Content-Type fields is extracted from the HTTP packet header to identify the application.
number: 18
text: The computer implemented method as recited in claim 6 wherein if determined an application is being provided via an HTTPS or QUIC connection request, then the Service Name Identifier (SNI) field in the TLS handshake is utilized as a proxy for the HTTP Host field.
number: 19
text: The computer implemented method and system as recited in claim 18 wherein:
Office action: search_report, dated 2020-12-23
Rejection reasons: inventive_step_epc_56
Prior art cited: ref_id: US2016028607A1
ref_type: patent
severity: background
ref_id: US2017302703A1
ref_type: patent
severity: background
ref_id: US2016028607
ref_type: patent
severity: obviousness
ref_id: US2017302703
ref_type: patent
severity: obviousness
Final disposition: pending (2020-12-23)