Two-stage TCP handshake

Patent metadata

Field	Value
Publication number	US-9602330-B1
Application number	US-201313901367-A
Country	US
Kind code	B1
Filing date	May 23, 2013
Priority date	May 23, 2013
Publication date	Mar 21, 2017
Grant date	Mar 21, 2017

Abstract

Techniques are disclosed for dividing a TCP handshake into multiple parts, in a system comprising an edge device, an intermediary computing node, and a destination computing node. A client sends a TCP SYN packet to the edge device, to establish a TCP connection with the destination computing node. The edge device performs the handshake, and then forwards an ACK packet to the intermediary computing node. The intermediary computing node uses that ACK packet to generate a second SYN packet, and uses that SYN packet to perform a TCP handshake with the destination computing node. Then, TCP sequence numbers are converted between what is expected by the client and destination in packets sent between the two.

First claim

What is claimed is:

1. A Transmission Control Protocol (TCP) connection system comprising:
a first intermediary computing node bearing in a non-transitory medium instructions that, upon execution on a processor, cause the first intermediary node to at least:
receive a first TCP SYN packet from a source computing node directed to a destination computing node;
send a first TCP SYN-ACK packet, generated by the first intermediary computing node, to the source computing node in response to receiving the first TCP SYN packet; and
send, in response to receiving a first TCP ACK packet from the source computing node, an indication to a second intermediary computing node; and

the second intermediary computing node, the second intermediary computing node bearing instructions that, upon execution, cause the second intermediary computing node to:
send a second TCP SYN packet, generated by the second intermediary computing node and containing a source address corresponding to the source computing node, to the destination computing node, in response to receiving the indication from the first intermediary computing node;
receive a second TCP SYN-ACK packet from the destination computing node;
send a second TCP ACK packet to the destination computing node in response to receiving the second TCP SYN-ACK packet;
determine a first sequence number from the indication of the first TCP ACK packet, the first sequence number indicating a TCP sequence numbering scheme used by the source computing node;
determine a second sequence number from the second TCP SYN-ACK packet, the second sequence number indicating a TCP sequence numbering scheme used by the destination computing node;
receive a packet originated from the source computing node and destined for the destination computing node;
convert a TCP sequence number in a packet originated from the source computing node to the TCP sequence numbering scheme used by the destination computing node based at least in part on the first sequence number and the second sequence number; and
send the converted packet to the destination computing node.

2. The system of claim 1 , wherein the second intermediary computing node further bears instructions that, upon execution, cause the second intermediary computing node to at least to: determine the first sequence number from the TCP ACK packet;
determine the second sequence number from the second TCP SYN packet;
receive, from the first intermediary computing node, the packet originated from the destination computing node and destined for the source computing node;
convert the packet to the TCP sequence numbering scheme used by the source computing node based at least in part on the first sequence number and the second sequence number; and
send the converted packet to the source computing node.

3. The system of claim 1 , wherein the first intermediary computing node comprises an edge device, wherein the second intermediary computing node comprises a host computing device, and wherein the destination computing node comprises a virtual machine instantiated on the host computing device.

4. A computer-implemented method, comprising:
receiving, by a first intermediary computing node, an ACK packet as part of a Transmission Control Protocol (TCP) handshake with a computing node;
sending, by the first intermediary computing node, in response to receiving the ACK packet, an indication to a second intermediary computing node;
sending, by the second intermediary computing node, a SYN packet to a second computing node in response to receiving the indication, a source address of the SYN packet being based at least in part on a source address of at least one packet received as part of the TCP handshake;
receiving, by the second intermediary computing node, a SYN-ACK packet from the second computing node after sending the SYN packet to the second computing node;
sending, by the second intermediary computing node, a second ACK packet to the second computing node in response to receiving the SYN-ACK packet;
receiving, by the second intermediary computing node, a packet originated from the computing node and destined for the second computing node;
converting, by the second intermediary computing node, a sequence number in the packet from a numbering scheme used by the computing node to a numbering scheme used by the second computing node; and
sending the converted packet to the second computing node.

5. The method of claim 4 , further comprising:
determining the numbering scheme used by the computing node based at least in part on the ACK packet; and
determining the numbering scheme used by the second computing node based at least in part on the SYN-ACK packet.

6. The method of claim 4 , further comprising:
receiving a packet originated from the second computing node and destined for the computing node;
converting a sequence number in the packet from a numbering scheme used by the second computing node to a numbering scheme used by the computing node; and
sending the converted packet to the computing node.

7. The method of claim 4 , wherein sending the second ACK packet to the second computing node comprises:
receiving, by the first intermediary computing node, a second SYN packet, the second SYN packet indicating a TCP option;
encapsulating the second ACK packet with an indication of the TCP option; and
sending the encapsulated second ACK packet to the second computing node.

8. The method of claim 4 , wherein sending the second ACK packet to the second computing node comprises:
receiving, by the first intermediary computing node, a second SYN packet, the second SYN packet indicating a TCP option; and
adding an IP header to the second ACK packet before sending the second ACK packet to the second computing node, the IP header comprising an indication of the TCP option.

9. The method of claim 4 , wherein sending the second ACK packet to the second computing node comprises:
receiving, by the first intermediary computing node, a second SYN packet, the second SYN packet indicating a TCP option; and
modifying an address of the second ACK packet to contain an indication of the TCP option before sending the second ACK packet to the second computing node, the second ACK packet being in an Internet Protocol version 6 (IPv6) format.

10. The method of claim 4 , wherein sending the second ACK packet to the second computing node comprises:
receiving, by the first intermediary computing node, a second SYN packet, the second SYN packet indicating a TCP option; and
adding metadata to the second ACK packet to contain an indication of the TCP option before sending the second ACK packet to the second computing node.

11. A non-transitory computer-readable medium, bearing computer-readable instructions that, when executed on at least one computing node, cause the at least one computing node to perform operations comprising:
receiving, by a first intermediary computing node, an ACK packet as part of a Transmission Control Protocol (TCP) handshake with a computing node;
sending, by the first intermediary computing node, in response to receiving the ACK packet, an indication to a second intermediary computing node;
sending, by the second intermediary computing node, a SYN packet to a second computing node in response to receiving the indication, a source address of the SYN packet being based at least in part on a source address of at least one packet received as part of the TCP handshake;
receiving, by the second intermediary computing node, a SYN-ACK packet from the second computing node after sending the SYN packet to the second computing node;
sending, by the second intermediary computing node, a second ACK packet

Assignees

• Amazon Tech Inc

Inventors

• Dickinson Andrew Bruce
• Petersen Kirk Arlo

Classifications

• H04L69/16

  Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP] · CPC title

• H04L67/14

  Session management (for real-time applications in data packet communications networks H04L65/1066) · CPC title

• H04L29/06095 Primary

  Electricity · mapped topic

• H04L63/1458

  Denial of Service · CPC title

• H04L69/163 Primary

  In-band adaptation of TCP data exchange; In-band control procedures · CPC title