Methods and systems for hairpins in virtual networks

• US 20020053031A1
• Filed: 04/11/2001
• Published: 05/02/2002
• Est. Priority Date: 04/12/2000
• Status: Active Grant

• Current Assignee: Oracle Systems Corporation (Oracle Corporation)
• Original Assignee: Corente, Inc. (Oracle Corporation)
• Inventors: Macey, Christopher, Bendinelli, Samuel, Keane, John
• Granted Patent: US 7,047,424 B2
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: H04L 12/02 Details
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/5012 determining service availability, e.g. which services are available at a certain point in time
• CPC Class Codes: H04L 41/5032 Generating service level reports
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/06 Generation of reports
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/065 related to network devices
• CPC Class Codes: H04L 43/067 using time frame reporting
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/0864 Round trip delays
• CPC Class Codes: H04L 43/0882 Utilisation of link capacity
• CPC Class Codes: H04L 43/0888 Throughput
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/029 : Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/083 : using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/101 : Access control lists [ACL]
• CPC Class Codes: H04L 63/1416 : Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/164 : at the network layer
• CPC Class Codes: H04L 63/166 : at the transport layer
• CPC Class Codes: H04L 63/168 : above the transport layer
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 69/329 : in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 : Network security protocols

Abstract

Methods and systems are provided for enabling communication between a first processor and a second processor using at least one additional processor separate from the first and second processors, wherein one or more firewalls selectively restrict the communication. In one embodiment, the additional processor may determine whether the first and second processors mutually consent to enabling a hairpin between the first and second processors. The first processor may be provided with a first information identifying the hairpin and the second processor may be provided with a second information identifying the hairpin, when the additional processor may determine that the first and second processors mutually consent to the hairpin. Moreover, a first information flow may be established from the first processor to the hairpin based on the provided first information, and a second information flow may be established from the second processor to the hairpin based on the provided second information. The hairpin may forward the first information flow received from the first processor to the second processor such that the communication between the first and second processors is allowed by the firewalls.

Claims

1. A method for enabling communication between a first processor and a second processor using at least one additional processor separate from the first processor and the second processor, wherein one or more firewalls selectively restrict the communication, the method comprising the steps of:

determining, at the least one additional processor, whether the first and second processors mutually consent to enabling a hairpin between the first and second processors;

providing to the first processor a first information identifying the hairpin and to the second processor a second information identifying the hairpin, when the at least one additional processor determines that the first and second processors mutually consent to the hairpin;

establishing a first information flow from the first processor to the hairpin based on the provided first information;

establishing a second information flow from the second processor to the hairpin based on the provided second information; and

forwarding, at the hairpin, the first information flow received from the first processor to the second processor such that the communication between the first and second processors is allowed by the one or more firewalls.

2. The method of claim 1, wherein said step of providing a first information further comprises the step of:

providing an IP address and a first port number at the hairpin.

3. The method of claim 1, wherein said step of establishing a first information flow further comprises the step of:

establishing a first flow of packets from the first processor to a first port at the hairpin based on the provided first information.

4. The method of claim 3, wherein said step of establishing a first flow of packets further comprises the step of:

defining the first port as a TCP port at the hairpin.

5. The method of claim 1, wherein said step of establishing a second information flow further comprises the step of:

establishing a second flow of packets from the second processor to a second port at the hairpin based on the provided second information.

6. The method of claim 1, wherein said step of forwarding at the hairpin further comprises the step of:

forwarding the second information flow from second processor to the first processor such that the communication between the first and second processors is allowed by the one or more firewalls.

7. A method for enabling communication between a first processor and a second processor using at least one additional processor separate from the first and second processors, wherein one or more firewalls selectively restrict the communication between the first and second processors, said method comprising the steps of:

receiving, at the at least one additional processor, a first request from the first processor for a hairpin;

receiving, at the at least one additional processor, a second request from the second processor for the hairpin;

authorizing, at the at least one additional processor, a first port at the hairpin and a second port at the hairpin, when each of the first and second processors consents to enabling the hairpin;

allocating the first port for the first processor and the second port for the second processor; and

forwarding, at the hairpin, one or more packets received at the first port from the first processor to the second port such that the communication between the first and second processors is allowed by one or more firewalls.

8. The method of claim 7, wherein said step of forwarding further comprises the step of:

forwarding the one or more packets received at the first port without decoding one or more payloads included within the one or more packets.

9. The method of claim 7, further comprising the step of:

authorizing, at the at least one additional processor, the first processor to serve as the hairpin.

10. The method of claim 7, further comprising the step of:

authorizing the at least one additional processor to serve as the hairpin.

11. The method of claim 7, further comprising the step of:

authorizing, at the at least one additional processor, a processor to serve as the hairpin, wherein the processor is separate from the first and second processors and the at least one additional processor.

12. The method of claim 7, further comprising the step of:

connecting from the first processor to the first port and from the second processor to the second port.

13. The method of claim 12, wherein said step of connecting further comprises the step of:

connecting from the first processor to the first port and from the second processor to the second port using a transmission control protocol.

14. The method of claim 7, wherein said step of allocating further comprises the step of:

defining each of the first and second ports using a transmission protocol.

15. The method of claim 14, wherein said step of defining further comprises:

defining the transmission protocol as a User Datagram Protocol (UDP).

16. The method of claim 7, further comprising the step of:

determining that the one or more firewalls selectively restrict communication between the first and second processors.

17. The method of claim 16, wherein said step of determining further comprises the step of:

determining, at the at least one additional processor, that the one or more firewalls selectively restrict communication between the first and second processors based on information provided by the first and second processors.

18. The method of claim 16, wherein said step of determining further comprises the step of:

determining, at the at least one additional processor, that the one or more firewalls selectively restrict communication between the first and second processors based on information determined by the at least one additional processor.

19. The method of claim 7, wherein said step of forwarding further comprises:

forwarding, at the hairpin, one or more packets received at the first port from the first processor to the second port.

20. A system for enabling communication between a first processor and a second processor using at least one additional processor separate from the first processor and the second processor, wherein one or more firewalls selectively restrict the communication, the system comprising:

means for determining, at the least one additional processor, whether the first and second processors mutually consent to enabling a hairpin between the first and second processors;

means for providing to the first processor a first information identifying the hairpin and to the second processor a second information identifying the hairpin, when the at least one additional processor determines that the first and second processors mutually consent to the hairpin;

means for establishing a first information flow from the first processor to the hairpin based on the provided first information;

means for establishing a second information flow from the second processor to the hairpin based on the provided second information; and

means for forwarding, at the hairpin, the first information flow received from the first processor to the second processor such that the communication between the first and second processors is allowed by the one or more firewalls.

21. A system for enabling communication between a first processor and a second processor using at least one additional processor separate from the first processor and the second processor, wherein one or more firewalls selectively restrict the communication, the system comprising:

at least one memory comprising

code that determines, at the least one additional processor, whether the first and second processors mutually consent to enabling a hairpin between the first and second processors,

code that provides to the first processor a first information identifying the hairpin and to the second processor a second information identifying the hairpin, when the at least one additional processor determines that the first and second processors mutually consent to the hairpin,

code that establishes a first information flow from the first processor to the hairpin based on the provided first information,

code that establishes a second information flow from the second processor to the hairpin based on the provided second information, and

code that forwards, at the hairpin, the first information flow received from the first processor to the second processor such that the communication between the first and second processors is allowed by the one or more firewalls; and

at least one processor that executes said code.

22. A computer program product for enabling communication between a first processor and a second processor using at least one additional processor separate from the first processor and the second processor, wherein one or more firewalls selectively restrict the communication, the computer program product comprising code that, said code comprising:

code that determines, at the least one additional processor, whether the first and second processors mutually consent to enabling a hairpin between the first and second processors;

code that provides to the first processor a first information identifying the hairpin and to the second processor a second information identifying the hairpin, when the at least one additional processor determines that the first and second processors mutually consent to the hairpin;

code that establishes a first information flow from the first processor to the hairpin based on the provided first information;

code that establishes a second information flow from the second processor to the hairpin based on the provided second information;

code that forwards, at the hairpin, the first information flow received from the first processor to the second processor such that the communication between the first and second processors is allowed by the one or more firewalls.

23. A virtual network comprising:

a first processor;

a second processor; and

at least one additional processor, separate from the first processor and the second processor, that enables communication between the first processor and the second processor, wherein one or more firewalls selectively may restrict the communication, the at least one additional processor further comprising;

means for determining whether the first and second processors mutually consent to enabling a hairpin between the first and second processors,

means for providing to the first processor a first information identifying the hairpin and to the second processor a second information identifying the hairpin, when the at least one additional processor determines that the first and second processors mutually consent to the hairpin,

means for establishing a first information flow from the first processor to the hairpin based on the provided first information,

means for establishing a second information flow from the second processor to the hairpin based on the provided second information, and

means for forwarding, at the hairpin, the first information flow received from the first processor to the second processor such that the communication between the first and second processors is allowed by the one or more firewalls.