TCP isolation with semantic processor TCP state machine

• US 20070027991A1
• Filed: 07/14/2005
• Published: 02/01/2007
• Est. Priority Date: 07/14/2005
• Status: Abandoned Application

• Current Assignee: GigaFin Networks, Inc. (Infinity Security Solutions, Inc.)
• Original Assignee: Mistletoe Technologies, Inc.
• Inventors: Sikdar, Somsubhra, Rowett, Kevin, Jalali, Caveh, Rallapalli, Prasad
• Application Number:
  US11/181,528
• Publication Number:
  US 20070027991A1
• Time in Patent Office: Days
• US Class Current: 709/227
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 67/289 Intermediate processing functionally located close to the data consumer application, e.g. in same machine, in same home or in same sub-network
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 67/565 Conversion or adaptation of application format or content adding application control or application functional data H04L67/561
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/163 In-band adaptation of TCP data exchange; In-band control procedures

Abstract

A system and method for isolating TCP comprises a proxy configured to manage a plurality of sessions including at least one transmission control protocol session, wherein the proxy translates data between the transmission control protocol session and a local session.

Claims

1. A system comprising:

a proxy configured to manage a plurality of sessions including at least one transmission control protocol (TCP) session, wherein the proxy translates data between the transmission control protocol session and a local session.

2. The system of claim 1 wherein the proxy operates:

a device-interface proxy configured to manage the local session with a networking device; and

a network-interface proxy configured to manage the transmission control protocol session over a public network, wherein the network-interface proxy depacketizes and sequences the data received over the transmission control protocol session prior to providing it to the device-interface proxy.

3. The system of claim 1 wherein the proxy includes at least one semantic processor having a direct execution parser to identify the transmission control protocol sessions according to a stored grammar.

4. The system of claim 3 wherein the semantic processor implements a transmission control protocol state machine to manage the transmission control protocol sessions by switching contexts within the stored grammar.

5. The system of claim 1 wherein the proxy sequences the data received out-of-order from one of the sessions during the translation.

6. The system of claim 1 wherein the proxy reassembles fragmented data from one of the sessions during the translation.

7. The system of claim 1 wherein the proxy performs cryptography operations including encryption, decryption, or authentication on the data during the translation.

8. The system of claim 1 wherein the transmission control protocol session has an endpoint signature corresponding to the proxy.

9. The system of claim 1 wherein the proxy provides the data to the networking device in the local session at a controlled rate.

10. The system of claim 9 wherein the local session is a transmission control protocol session.

11. The system of claim 1 including a plurality of networking devices each configured to process data from the network, wherein the proxy is coupled between the network and the network devices and configured to manage at least one local session with each networking device and to translate data between each local session and the corresponding transmission control protocol session.

12. The system of claim 1 wherein the proxy determines a change in the network during one of the transmission control protocol sessions and applies the network change to all of the transmission control protocol sessions over the network.

13. A method comprising:

establishing a public transmission control protocol (TCP) session for exchanging packetized data over a network;

establishing a local TCP session for exchanging data with a networking device; and

translating between the public transmission control protocol session and the local TCP session.

14. The method of claim 13 includes depacketizing the data received over the transmission control protocol session during the translating.

15. The method of claim 14 wherein depacketizing includes reassembly of fragmented data during transmission over the network.

16. The method of claim 14 wherein depacketizing includes performance of cryptography operations, including encryption, decryption, or authentication, during transmission over the network.

17. The method of claim 13 includes sequencing the data received over the transmission control protocol session during the translating.

18. A system comprising:

a first semantic processor configured to manage one or more transmission control protocol sessions over a public network; and

a second semantic processor coupled to the first semantic processor and configured to manage one or more local sessions, wherein the first and second semantic processors translate data between the transmission control protocol sessions and the local sessions.

19. The system of claim 18 wherein the first semantic processor depacketizes and sequences data received over the transmission control protocol sessions prior to providing it to the second semantic processor for transmission over corresponding local sessions.

20. The system of claim 19 wherein the first semantic processor sequences the data received out-of-order from one of the transmission protocol sessions.

21. The system of claim 19 wherein the first semantic processor reassembles fragmented data from one of the transmission protocol sessions.

22. The system of claim 19 wherein the first semantic processor performs cryptography operations including encryption, decryption, or authentication on the data from one of the transmission protocol sessions.

23. The system of claim 18 wherein the transmission control protocol sessions have an endpoint signature corresponding to the first semantic processor.

24. The system of claim 18 where the first and second semantic processors each include:

a session interface to exchange data in one or more sessions;

a semantic processor interface to exchange data with other semantic processors;

a direct execution parser to parse data received at either interface according to a stored grammar; and

at least one semantic processing unit to perform data operations when prompted by the direct execution parser.

25. The system of claim 24 wherein the first semantic processor manages the transmission control protocol sessions by switching contexts within the stored grammar.

26. The system of claim 24

wherein the local sessions are transmission control protocol sessions;

and

wherein the second semantic processor manages the local sessions by switching contexts within the stored grammar.

27. The system of claim 18 wherein the first semantic processor determines a change in the network during one of the transmission control protocol sessions and applies the network change to all of the transmission control protocol sessions over the network.