System and method for early cut through of encrypted and unencrypted voice streams
VoIP systems often use multiple ciphers for different components. The present invention includes a system and method for early detection of encrypted signals in packet networks that may be encrypted using any of a multitude of ciphers.
1. A method of providing in-band early encryption detection within a packet data network, the method comprising the following steps:
i) transmitting, at a transmitter device of said packet data network, a plurality of data packets;
ii) receiving, at a receiver device of said packet data network, said plurality of data packets;
iii) determining, at said receiver, whether at least one of said data packets includes a predetermined pattern inserted into said packet at said transmitter of said packet data network, and upon finding said predetermined pattern in said at least one of said data packets, determining that said data packets are unencrypted, and otherwise:
iv) decrypting said packet with one of a plurality of pre-configured ciphers, further determining whether said decrypted packet includes said predetermined pattern, and upon finding said predetermined pattern in said decrypted packet, determining that said data packets are encrypted and that the pre-configured cipher at the receiver matches a cipher at the transmitter, and decrypting subsequent packets with said pre-configured cipher prior to delivering said decrypted data packets; and
v) in the event the predetermined pattern is not found performing step iv) for each remaining one of said plurality of pre-configured ciphers until no pre-configured ciphers remain whereupon said packet is discarded and security negotiations ensue between the transmitter and the receiver.
2. The method of claim 1 wherein step v) is performed sequentially for each of said pre-configured ciphers.
3. The method of claim 1 wherein step v) is performed simultaneously for each of said pre-configured ciphers.
4. The method of claim 1 wherein said predetermined pattern is a series of zeros.
5. The method of claim 1 , further including a step iiia) prior to step iii), wherein step iiia) comprises examining the length of said at least one of said data packets for presence of authorization information and if said examination indicates the presence of authentication information then decrypting the pre-configured cipher.
6. The method of claim 1 , wherein step v) is performed according to a decision tree.
7. The method of claim 1 , wherein said data packets are voice packets.
8. The method of claim 1 , wherein said at least one of said data packets is a first one of said plurality of data packets.
9. The method of claim 1 , wherein said least one of said data packets comprises successive ones of said plurality of data packets for each performance of step v).
10. A communication system for providing in-band early encryption detection within a packet data network, comprising:
i) a transmitter in said packet data network for transmitting a plurality of data packets;
ii) a receiver in said packet data network for
a) receiving said plurality of data packets;
b) determining whether at least one of said data packets includes a predetermined pattern inserted into said packet at said transmitter, and upon finding said predetermined pattern in said at least one of said data packets, determining that said data packets are unencrypted, and otherwise
c) decrypting said packet with one of a plurality of pre-configured ciphers, further determining whether said decrypted packet includes said predetermined pattern, and upon finding said predetermined pattern in said decrypted packet, determining that said data packets are encrypted and that the pre-configured cipher matches a cipher at the transmitter, and decrypting subsequent packets with said pre-configured cipher prior to delivering said decrypted data packets; and
d) in the event the predetermined pattern is not found performing step c) for each remaining one of said plurality of pre-configured ciphers until no pre-configured ciphers remain whereupon said packet is discarded and security negotiations ensue between the transmitter and the receiver.
11. The communication system of claim 10 , wherein said receiver performs step d) sequentially for each of said pre-configured ciphers.
12. The communication system of claim 10 wherein said receiver performs step d) simultaneously for each of said pre-configured ciphers.
13. The communication system of claim 10 , wherein said predetermined pattern is a series of zeros.
14. The communication system of claim 10 , wherein said receiver examines the length of said at least one of said data packets for presence of authorization information prior to step c), and if said examination indicates the presence of authentication information then decrypting the pre-configured cipher.
15. The communication system of claim 10 , wherein step d) is performed according to a decision tree.
16. The communication system of claim 10 , wherein said data packets are voice packets.
17. The communication system of claim 10 , wherein said at least one of said data packets is a first one of said plurality of data packets.
18. The communication system of claim 10 , wherein said at least one of said data packets comprises successive ones of said plurality of data packets for each performance of step d).