Transparent proxy server

• US 20030229809A1
• Filed: 04/24/2003
• Published: 12/11/2003
• Est. Priority Date: 04/15/1999
• Status: Abandoned Application

• Current Assignee: Trustwave Holdings Incorporated (Singapore Telecommunications Limited)
• Original Assignee: Trustwave Holdings Incorporated (Singapore Telecommunications Limited)
• Inventors: Levi, Shaul, Frydman, Ariel, Yaghil, Daniel, Wexler, Asaf
• Application Number:
  US10/422,607
• Publication Number:
  US 20030229809A1
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/163 In-band adaptation of TCP data exchange; In-band control procedures

Abstract

A method of handling packets by a proxy server. The method includes receiving a packet, requesting to establish a connection of a connection based protocol, not carrying an IP address of the proxy server in an IP destination address field of the packet, and establishing a connection between the proxy server and a source of the received packet as listed in the source IP address of the received packet.

Claims

1. A method of handling packets by a proxy server, comprising:

receiving a packet, requesting to establish a connection of a connection based protocol, not carrying an IP address of the proxy server in an IP destination address field of the packet; and

establishing a correction between the proxy server and a source of the received packet, as listed in the source IP address of the received packet.

2. A method according to claim 1, comprising establishing a connection between the proxy server and a destination of the received packet, as listed in the destination IP address of the received packet.

3. A method according to claim 1, comprising receiving one or more additional packets belonging to the same session as the packet requesting establishment of the connection.

4. A method according to claim 3, wherein the received one or more additional packets carry application layer data and comprising altering the application layer data and forwarding the altered data to the destination of the one or more received packets.

5. A method according to claim 4, wherein altering the data comprises leaving at least some of the received application layer data unaltered.

6. A method according to claim 4 or claim 5, wherein altering the data comprises correcting spelling or grammatical errors in the application layer data.

7. A method according to any of claims 4-6, wherein forwarding the altered data to the destination of the one or more packets comprises forwarding in one or more packets carrying at least one different port field value different than in the received one or more additional packets.

8. A method according to any of claims 4-7, wherein forwarding the altered data to the destination of the one or more packets comprises forwarding in one or more packets carrying the same destination IP address as the received packet requesting establishment of the connection.

9. A method according to any of the preceding claims, wherein the proxy server comprises a transparency module and a proxy module and wherein receiving the packet requesting to establish a connection comprises receiving by the transparency module, modifying one or more fields of the packet by the transparency module and providing the modified packet to the proxy module of the proxy server.

10. A method according to claim 9, wherein the transparency module modifies one or more of the IP address fields and port fields of the packet.

11. A method according to claim 10, wherein the transparency module modifies the source port field of the packet.

12. A method according to any of the preceding claims, wherein the request packet is received through a physical port of the proxy server, which does not have a configured IP address which is used as a source IP address for packets transmitted through the physical port.

13. A method of handling packets by a proxy server, comprising:

receiving, by the proxy server, one or more packets of a specific session, not carrying an IP address of the proxy server in their IP destination address field;

altering a portion of the application layer data of the received one or more packets, while leaving at least some of the data intact; and

forwarding the altered application layer data to the destination of the received one or more packets as identified by the IP destination address field of the one or more received packets.

14. A method according to claim 13, wherein forwarding the altered application layer data comprises forwarding in packets carrying the same IP addresses as the received one or more packets.

15. A method according to claim 13 or claim 14, wherein forwarding the altered application layer data comprises forwarding in packets carrying the same time to live (TTL) value as the received one or more packets.

16. A method according to any of claims 13-15, wherein forwarding the altered application layer data comprises forwarding in packets having at least one different port field value different from the value in the respective field in the received one or more packets.

17. A method according to any of claims 13-16, wherein altering the portion of the application layer data comprises replacing an erroneous portion of a Web page by a replacement portion.

18. A method of handling packets by a proxy server, comprising:

receiving, by the proxy server, one or more packets of a specific session, not carrying an IP address of the proxy server in their IP destination address field;

altering at least one of the port fields of the received one or more packets; and

forwarding the altered one or more packets to the destination of the received one or more packets as identified by the IP destination address field of the one or more received packets.

19. A method according to claim 18, wherein forwarding the altered one or more packets comprises forwarding with the same IP addresses as the received one or more packets.

20. A method according to claim 18 or claim 19, wherein forwarding the altered one or more packets comprises forwarding the altered packets with the same time to live (TTL) value as the received one or more packets.

21. A method according to any of claims 18-20, wherein forwarding the altered one or more packets comprises forwarding in accordance with a splicing procedure.

22. A method of converting a mediation tool, located on a network path, into a transparent tool, comprising:

providing a packet transmitted on the path, to a mediation module of the tool;

receiving from the mediation module one or more packets generated in response to the provided packet; and

altering one or more fields of the one or more packets received from the mediation module, so that the altered fields have the same values as the packet provided to the mediation module.

23. A method according to claim 22, comprising receiving the packet from the path, the received packet from the path having a destination IP address not belonging to the mediation tool.

24. A method according to claim 22 or claim 23, comprising altering one or more fields of the packet provided to the mediation module.

25. A method according to claim 24, wherein altering the one or more fields comprises inserting to the packet an identification value which is used in identifying the one or more packets generated by the mediation tool in response to the provided packet.

26. A method according to claim 25, wherein inserting an identification value comprises changing a source port field of the provided packet.

27. A method according to any of claims 24-26, wherein altering the one or more fields comprises altering one or more fields to values expected by the mediation tool, such that the mediation tool operates without being aware of the transparency.

28. A method of handling packets passing along a path by a plurality of mediation tools, comprising:

providing, by each of the plurality of mediation tools, at least some of the packets passing along the path and not carrying an IP address of any of the mediation tools in their IP destination address field, to a layer four or above module of the mediation tool; and

forwarding packets carrying the same destination IP address as the provided packets, responsive to at least some of the provided packets.

29. A method according to claim 28, wherein forwarding packets carrying the same destination IP address as the provided packets comprises forwarding at least one of the packets with the same application layer data as a provided packet.

30. A method according to claim 28 or claim 29, wherein forwarding packets carrying the same destination IP address as the provided packets comprises forwarding at least one of the packets with some application layer data from a provided packet and some application layer data not included in a provided packet of the same session.

31. A method according to any of claims 28-30, wherein forwarding packets carrying the same destination IP address as the provided packets comprises forwarding packets having at least one port value different from the respective provided packet.

32. A method according to any of claims 28-31, wherein providing, by each of the is mediation tools, at least some of the packets to a layer four or above module, comprises receiving all the packets passing on the path by each of the mediation tools and each mediation tool determining which packets to provide to its layer four or above module, responsive to a layer 3 or above content of the packets.

33. A method according to claim 32, wherein determining, by each of the mediation tools, which packets to provide to the layer four or above module comprises determining responsive to the source or destination IP address of the packet.

34. A method according to claim 32, wherein determining, by each of the mediation tools, which packets to provide to the layer four or above module comprises determining responsive to predetermined rules.

35. A method according to any of claims 28-31, wherein providing, by each of the mediation tools, at least some of the packets to a layer four or above module, comprises receiving all the packets passing on the path by a dispatcher, determining by the dispatcher whether the packet requires handling and if required selecting one or more of the mediation tools to perform the handling and forwarding the packet to the selected mediation tool.

36. A method according to claim 35, wherein forwarding the packet to the selected mediation tool comprises forwarding in layer 2.

37. A method according to claim 36, wherein forwarding the packet to the selected mediation tool comprises forwarding with a source MAC address not belonging to the dispatcher.

38. A method according to any of claims 35-37, wherein the dispatcher comprises one of the mediation tools.

39. A method according to claim 38, comprising selecting a mediation tool to operate as the dispatcher using a distributed algorithm.

40. A transparent mediation farm, comprising:

a plurality of mediation tools which provide at least some of the packets they receive to a layer four or above module of the mediation tool for processing and which forward packets carrying the same destination IP address as the provided packets, responsive to at least some of the provided packets; and

communication links which connect the plurality of mediation tools.

41. A farm according to claim 40, wherein at least one of the mediation tools may operate as a dispatcher which receives packets passing on the communication links, determines which of the packets should be forwarded to one or more of the mediation tools and forwards the packets to the respective mediation tools.

42. A farm according to claim 40, wherein at least one of the mediation tools comprises a proxy server.

43. A farm according to claim 40, wherein all the mediation tools perform the same tasks.

44. A farm according to claim 40, wherein at least one of the mediation tools performs at least one different task than one other of the mediation tools.

45. A farm according to claim 40, wherein at least one of the mediation tools generates packets with a source address not belonging to the mediation tool or to any of the packets recently received by the mediation tool.

46. A farm according to claim 40, wherein at least one of the mediation tools is configured with an IP address which is not used in any of the packets forwarded by the mediation tool.

47. A transparent mediation tool, comprising:

a mediation module; and

a transparency module which receives packets from the mediation module, alters one or more IP address fields of the received packets so that the IP addresses of the altered packets do not reveal that the packets were handled by the mediation module and forwards the altered packets on a communication link.

48. A tool according to claim 47, wherein the mediation module comprises a proxy server module.

49. A tool according to claim 47 or claim 48, wherein the mediation module changes at least some of the application layer data of the packets.

50. A tool according to any of claims 47-49, wherein the transparency module receives packets transmitted on the communication link and provides the packets from the link to the mediation tool, and wherein the transparency module alters the IP addresses of packets received from the mediation tool to the IP addresses of packets of the same session provided to the mediation tool.

51. A tool according to claim 50, wherein the transparency module alters at least one of the port fields of at least some of the packets provided to the mediation module.

52. A tool according to any of claims 47-51, wherein the transparency module comprises a software module.

53. A tool according to any of claims 47-51, wherein the transparency module comprises a hardware module.

54. A proxy server, comprising:

an input interface which receives a packet, requesting to establish a connection of a connection based protocol, not carrying an IP address of the proxy server in an IP destination address field of the packet; and

a proxy module which establishes a connection between the proxy server and a source of the received packet, as listed in the source IP address of the received packet.

55. A proxy server according to claim 54, wherein the proxy module establishes a connection between the proxy server and a destination of the received packet, as listed in the destination IP address of the received packet.

56. A proxy server, comprising:

an input interface which receives one or more packets of a specific session, not carrying an IP address of the proxy server in their IP destination address field; and

a proxy module which alters a portion of the application layer data of the received one or more packets, while leaving at least some of the data intact; and

an output interface which forwards the altered application layer data to the destination of the received one or more packets as identified by the IP destination address field of the one or more received packets.

57. A proxy server according to claim 56, wherein the proxy module manages a list of packet sessions which it is interested in receiving and packets received by the proxy module are compared to the list to determine whether they are directed to the proxy module.