Transparent middlebox graceful entry and exit

Patent metadata

Field	Value
Publication number	US-10284669-B2
Application number	US-201614987481-A
Country	US
Kind code	B2
Filing date	Jan 4, 2016
Priority date	Jul 31, 2012
Publication date	May 7, 2019
Grant date	May 7, 2019

Abstract

Middleboxes include a processor configured to determine that a network connection between a client device and a server device is idle. A connection table is configured to create a first connection entry at the middlebox for the client device and a second connection entry at the middlebox for the server device. The first and second connection entries are initialized after determining that the network connection between the client device and the server device is idle. A network control module is configured to activate redirection of the network connection between the client device and the server device to the middlebox after determining that the network connection between the client device and the server device is idle.

First claim

What is claimed is:

1. A middlebox, comprising:
a processor configured to determine that a network connection between a client device and a server device is idle;
a connection table configured to create a first connection entry at the middlebox for the client device and a second connection entry at the middlebox for the server device, where the first and second connection entries are initialized after determining that the network connection between the client device and the server device is idle; and
a network control module configured to activate redirection of the network connection between the client device and the server device to the middlebox based on the determination that the network connection between the client device and the server device is idle.

2. The middlebox of claim 1 , further comprising a network monitoring module configured to receive network information at the middlebox from a hardware tap to monitor network state information.

3. The middlebox of claim 2 , wherein the state information includes one or more of an IP address, port numbers, transport control protocol (TCP) sequence numbers, TCP options, and a congestion window.

4. The middlebox of claim 1 , further comprising a network monitoring module configured to receive network information at the middlebox from a separate network monitoring device to monitor network state information.

5. The middlebox of claim 1 , wherein the middlebox is in-band with the network connection between the client device and the server device.

6. The middlebox of claim 5 , wherein the network control module is further configured to change rules at the middlebox from routing to redirection to activate redirection.

7. The middlebox of claim 1 , wherein the middlebox is out-of-band with the network connection between the client device and the server device.

8. The middlebox of claim 7 , wherein the network control module is further configured to direct a router device to redirect the network connection between the client device and the server device through the middlebox to activate redirection.

9. The middlebox of claim 1 , wherein the processor is further configured to determine that no information has been sent between the client device and the server device for at least a predetermined period of time to determining that the connection is idle.

10. The middlebox of claim 1 , wherein the processor is further configured to determine whether the network connection between the client device and the server device would benefit from the middlebox's intercession based on monitored packet loss and round-trip times and to trigger the idle determination, the connection entry creation, and the redirection activation based on said determination.

11. A non-transitory computer readable storage medium comprising a computer readable program for adding a middlebox to an existing network connection, wherein the computer readable program when executed on a computer causes the computer to perform the steps of:
determining that a network connection between the client device and the server device is idle with a processor;
creating a first connection entry at a middlebox for the client device and a second connection entry at the middlebox for the server device, where the first and second connection entries are initialized after determining that the network connection between the client device and the server device is idle; and
activating redirection of the network connection between the client device and the server device to the middlebox based on the determination that the network connection between the client device and the server device is idle.

Assignees

• IBM

Inventors

• Agrawal Dakshi
• Le Thai V
• Nahum Erich M
• Pappas Vasileios

Classifications

• H04L41/34

  Signalling channels for network management communication · CPC title

• H04L41/344

  Out-of-band transfers · CPC title

• H04L41/12

  Discovery or management of network topologies · CPC title

• H04L69/16 Primary

  Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP] · CPC title

• H04L47/193

  at the transport layer, e.g. TCP related · CPC title