Packet filtering by session setup association in a wireless communication system
View Patent ↗Embodiments disclosed herein provide systems and methods for packet filtering in a wireless communication network. In a particular embodiment, a wireless network receives from a requesting device a request for a plurality of data packets to be transferred by a source for delivery to the requesting device. The network then generates session information associating the source of the data packets with the requesting device. Additionally, the network receives a first subset of the data packets from the source for delivery to a destination identified by the data packets. After receiving the packets, the network identifies a destination device based on the destination identified by the packets. The network processes the session information to determine whether the destination device is associated with the source of the packets. If the destination device is associated with the source, the network transfers the packets for delivery to the destination device.
1. A method of operating a communication system comprising:
receiving from a requesting device a request for a plurality of data packets to be transferred by a source for delivery to the requesting device;
generating session information associating the source of the plurality of data packets with the requesting device;
receiving a first subset of the plurality of data packets from the source for delivery to a destination identified by the first subset of the plurality of data packets;
identifying a destination device based on the destination identified by the first subset of the plurality of data packets;
processing the session information to determine whether the destination device is associated with the source of the first subset of the plurality of data packets;
transferring the first subset of the plurality of data packets for delivery to the destination device if the destination device is associated with the source;
receiving a second subset of the plurality of data packets from the source for delivery to a second destination identified by the second subset of the plurality of data packets;
identifying a second destination device based on the second destination identified by the second subset of the plurality of data packets;
processing the session information to determine whether the second destination device is associated with the source of the second subset of the plurality of data packets; and
transferring the second subset of the plurality of data packets for delivery to the second destination device if the destination device is associated with the source.
2. The method of claim 1 further comprising discarding the first subset of the plurality of data packets if the destination device is not associated with the source.
3. The method of claim 2 wherein the destination device is associated with the source if the destination device is the same device as the requesting device.
4. The method of claim 3 wherein the destination device is not associated with the source if the destination device is not the same device as the requesting device.
5. The method of claim 4 wherein the destination device is the same device as the requesting device if the devices have the same network access identifier.
6. The method of claim 1 wherein the destination identified by the first subset of the plurality of data packets is an IP address.
7. The method of claim 6 wherein the destination device is associated with the source if the IP address has not been reassigned to another device at a time after receiving the request for the first subset of the plurality of data packets.
8. A communication system comprising:
a requesting device configured to transfer a request for a plurality of data packets from a source; and,
a control system in communication with the requesting device and configured to:
receive the request for the plurality of data packets to be transferred by the source for delivery to the requesting device;
generate session information associating the source of the plurality of data packets with the requesting device;
receive a first subset of the plurality of data packets from the source for delivery to a destination identified by the first subset of the plurality of data packets;
identify a destination device based on the destination identified by the first subset of the plurality of data packets;
process the session information to determine whether the destination device is associated with the source of the first subset of the plurality of data packets;
transfer the first subset of the plurality of data packets for delivery to the destination device if the destination device is associated with the source;
receive a second subset of the plurality of data packets from the source for delivery to a second destination identified by the second subset of plurality of data packets;
identify a second destination device based on the second destination identified by the second subset of the plurality of data packets;
process the session information to determine whether the second destination device is associated with the source of the second subset of the plurality of data packets; and
transfer the second subset of the plurality of data packets for delivery to the second destination device if the second destination device is associated with the source.
9. The communication system of claim 8 wherein the control system is further configured to discard the plurality of data packets if the destination device is not associated with the source.
10. The communication system of claim 9 wherein the destination device is associated with the source if the destination device is the same device as the requesting device.
11. The communication system of claim 10 wherein the destination device is not associated with the source if the destination device is not the same device as the requesting device.
12. The communication system of claim 10 wherein the destination device is the same device as the requesting device if the devices have the same network access identifier.
13. The communication system of claim 8 wherein the destination identified by the first subset of the plurality of data packets is an IP address.
14. The communication system of claim 13 wherein the destination device is associated with the source if the IP address has not been reassigned to another device at a time after receiving the request for the plurality of data packets.
15. A communication control system comprising:
an interface configured to receive from a requesting device a request for a plurality of data packets to be transferred by a source for delivery to the requesting device, receive a first subset of the plurality of data packets from the source for delivery to a destination identified by the first subset of the plurality of data packets, and transfer the first subset of the plurality of data packets for delivery to a destination device if the destination device is associated with the source;
a processing system configured to generate session information associating the source of the plurality of data packets with the requesting device, identify the destination device based on the destination identified by the first subset of the plurality of data packets, and process the session information to determine whether the destination device is associated with the source of the first subset of the plurality of data packets;
the interface further configured to receive a second subset of the plurality of data packets from the source for delivery to a second destination identified by the second subset of the plurality of data packets, and transfer the second subset of the plurality of data packets for delivery to a second destination device if the second destination device is associated with the source; and
the processing system configured to identify the second destination device based on the second destination identified by the second subset of the plurality of data packets, and process the session information to determine whether the second destination device is associated with the source of the second subset of the plurality of data packets.
16. The communication control system of claim 15 wherein the processing system is further configured to discard the plurality of data packets if the destination device is not associated with the source.
17. The communication control system of claim 16 wherein the destination device is associated with the source if the destination device is the same device as the requesting device.