Transparently proxying transport protocol connections using an external server

Patent metadata

Field	Value
Publication number	US-9154512-B2
Application number	US-39624906-A
Country	US
Kind code	B2
Filing date	Mar 30, 2006
Priority date	Mar 30, 2006
Publication date	Oct 6, 2015
Grant date	Oct 6, 2015

Abstract

Methods and apparatus are disclosed for processing data packets using a router and a proxy in order to transparently proxy a connection between a client and a server. One method involves mapping a TCP connection to a connection ID and sending a segment from the TCP connection to a proxy, including the connection ID, a direction value and an identifier of an assigned proxy application, such that the segment appears to be from the connection. The method further involves a proxy creating and reading from an IP socket which corresponds to the segment, the connection ID, direction and assigned proxy application and then spoofing the segment using the connection ID, a second direction value, and an identifier of the assigned proxy application.

First claim

What is claimed is:

1. A method of processing data packets using a router and a proxy comprising:
the router receiving, from a client device, a first data segment associated with a transport protocol connection;
wherein the transport protocol connection is a Transmission Control Protocol (TCP) connection;
wherein the first data segment is sent from the client device to a server through the router;
the router determining a connection identifier from a mapping of the TCP connection to the connection identifier and to a plurality of values that identify a source, a destination, and the TCP protocol;
the router sending the first data segment to the proxy in a first message that comprises the connection identifier, a first direction value, and an identifier of a proxy application that is hosted in the proxy;
wherein the first message conforms to a protocol for exchanging messages between the router and the proxy, and wherein the first direction value included in the first message indicates to the proxy a socket to which the first data segment is to be written;
the router receiving from the proxy a second message that comprises a response data segment, wherein the second message further comprises the connection identifier, the first direction value, and the identifier of the proxy application;
wherein the response data segment is generated at the proxy in response to the first data segment based in part by the proxy processing the first data segment using the proxy application;
wherein the first data segment and the response data segment are TCP segments;
wherein the second message conforms to the protocol for exchanging messages between the router and the proxy, and wherein the first direction value included in the second message indicates to the router in which direction on the TCP connection the response data segment is to be forwarded;
based on the first direction value included in the second message, the router determining that the response data segment is to be forwarded to the server in a first direction from the client device to the server;
the router forwarding the response data segment to the server based on the mapping.

2. The method of claim 1 wherein the router sending said first data segment to the proxy further comprises creating a packet having a header and a payload that encapsulates the first data segment, wherein the header includes the connection identifier, the first direction value, and the identifier of the proxy application.

3. The method of claim 1 wherein the mapping further comprises the first direction value and the identifier of the proxy application.

4. The method of claim 1 , further comprising, prior to receiving the first data segment, the router performing the steps of:
receiving from the client device a first connection initialization segment to initialize the TCP connection;
the router creating a connection state data structure and assigning the connection identifier to the connection state data structure;
wherein the connection state data structure further includes the mapping of the TCP connection to the connection identifier and to the plurality of values that identify the source, the destination, and the TCP protocol;
the router forwarding the first connection initialization segment to the proxy in a third message that comprises the connection identifier, the first direction value, and the identifier of the proxy application;
the router receiving from the proxy a fourth message that includes a second connection initialization segment, wherein the fourth message further includes the connection identifier and a second direction value, and wherein the second connection initialization segment comprises an acknowledgment by the proxy of the first connection initialization segment;
wherein the second direction value identifies a second direction from the sever to the client device;
based on the connection identifier and the second direction value included in the fourth message, the router sending the second connection initialization segment on the TCP connection in the second direction to the client device;
the router receiving confirmation of the second connection initialization segment from the client device and forwarding the confirmation to the proxy.

5. The method of claim 4 , wherein the third message encapsulates the first connection initialization segment and wherein the connection identifier, the first direction value, and the identifier of the proxy application are carried in a header of the third message and the first connection initialization segment is carried in a payload of the third message.

6. The method of claim 1 , wherein the proxy application comprises any one of an anti-virus application, a bulk mail detection application, a policy compliance application, a message format conversion or transformation application, and a security posture validation application.

7. An apparatus comprising:
one or more processors;
a computer-readable storage medium coupled to the one or more processors and storing one or more sequences of instructions which, when executed by the one or more processors cause the one or more processors to perform:
receiving, from a client device, a first data segment associated with a transport protocol connection;
wherein the transport protocol connection is a Transmission Control Protocol (TCP) connection;
wherein the first data segment is sent from the client device to a server through the apparatus;
determining a connection identifier from a mapping of the TCP connection to the connection identifier and to a plurality of values that identify a source, a destination, and the TCP protocol of the connection;
sending the first data segment to a proxy in a first message that comprises the connection identifier, a first direction value, and an identifier of a proxy application that is hosted in the proxy;
wherein the first message conforms to a protocol for exchanging messages between the apparatus and the proxy, and wherein the first direction value included in the first message indicates to the proxy a socket to which the first data segment is to be written;
receiving from the proxy a second message that comprises a response data segment, wherein the second message further comprises the connection identifier, the first direction value, and the identifier of the proxy application;
wherein the response data segment is generated at the proxy in response to the first data segment based in part by the proxy processing the first data segment using the proxy application;
wherein the first data segment and the response data segment are TCP segments;
wherein the second message conforms to the protocol for exchanging messages between the apparatus and the proxy, and wherein the first direction value included in the second message indicates to the apparatus in which direction on the TCP connection the response data segment is to be forwarded;
based on the first direction value included in the second message, determining that the response data segment is to be forwarded to the server in a first direction from the client device to the server;
forwarding the response data segment to the server based on the mapping.

8. The apparatus of claim 7 wherein the instructions for sending said first data segment to the proxy further comprise instructions for creating a packet having a header and a payload that encapsulates the first data segment, wherein the header includes the connection identifier, the first direction value, and the identifier of the proxy application.

9. The apparatus of claim 7 wherein the mapping further comprises the first direction value and the identifier of the proxy application.

10. The apparatus of claim 7 , wh

Assignees

• Qu Diheng
• Leavy Nicholas
• Cisco Tech Inc

Inventors

• Qu Diheng
• Leavy Nicholas
• Fox Richard

Classifications

• H04L63/14 Primary

  for detecting or protecting against malicious traffic · CPC title

• H04L61/2567

  for reachability, e.g. inquiring the address of a correspondent behind a NAT server · CPC title

• H04L29/12509

  Electricity · mapped topic

• H04L61/2517

  using port numbers · CPC title

• H04L29/12377

  Electricity · mapped topic