Method and System for Providing Connection Resiliency

• US 20090132714A1
• Filed: 11/20/2007
• Published: 05/21/2009
• Est. Priority Date: 11/20/2007
• Status: Active Grant

• Current Assignee: Radware Limited
• Original Assignee: Radware Limited
• Inventors: Blander, Emanuel, Peles, Amir
• Granted Patent: US 9,112,901 B2
• Time in Patent Office: Days
• US Class Current: 709/227
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/165 Combined use of TCP and UDP protocols; selection criteria therefor
• CPC Class Codes: H04L 69/40 for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection management of faults, events, alarms or notifications in data switching networks H04L41/06

Abstract

A system, method and device for providing connection resiliency. The method including maintaining, by a first proxy, a TCP connection with a TCP client and a TCP connection with a TCP server through one or more TCP networks; maintaining information of both TCP connections by a forwarding component between the TCP networks and the first proxy; establishing, by the forwarding component, a new TCP connection with a second proxy for each of the TCP connections maintained by the first proxy; and forwarding data, to and from both the client and the server, to and from the second proxy without disconnection of the TCP connections of the TCP client and TCP server.

Claims

1. A connection resilient proxy system communicating with at least one client and one server through at least one transmission control protocol (TCP) network external to the proxy system, the proxy system comprising:

at least one active proxy managing a separate TCP connection with each of the client and the server and determining a destination for received data, wherein the destination includes one of the client and the server;

at least one backup proxy for determining the destination for received data in an event of predetermined conditions; and

at least one active forwarding component for routing data between the at least one TCP network and the active proxy, wherein the active forwarding component maintains information of the TCP connections between the TCP networks and the active proxy, and wherein

in the event of a predetermined condition, said active forwarding component modifying received data according to said maintained information and forwarding said received data to said backup proxy or said TCP network, thereby forwarding data, to and from both the client and the server, to and from the backup proxy without disconnection of the TCP connections of the client and server.

2. The system of claim 1, wherein said predetermined conditions include failure or overload of the active proxy, and said system further comprising a backup forwarding component for routing data packets between the TCP network and one of the active proxy and the backup proxy if the active forwarding component fails or is in an overload condition.

3. The system of claim 2 wherein the backup forwarding component is enabled by a virtual router redundancy protocol to takeover the functions of the active forwarding component.

4. The system of claim 1 wherein the active forwarding component performs at least one of network address translation and network address port translation.

5. The system of claim 1 wherein, for each TCP connection, the information includes at least one of highest data sequence number, highest data acknowledgement number, a source IP address, a destination IP address, a TCP source port number, a TCP destination port number, a sequence number delta, an acknowledgement number delta, and internal connection information.

6. The system of claim 1 wherein the active forwarding component monitors the active proxy for said predetermined conditions.

7. The system of claim 6 wherein the active forwarding component establishes a new TCP connection with the backup proxy for a corresponding TCP connection with the active proxy based on the monitoring of the active proxy.

8. The system of claim 5 wherein the active forwarding component modifies a TCP sequence number of data received from the TCP network according to a sequence number delta calculated as the difference between said highest data sequence number and the TCP acknowledgement number received by the active forwarding component from the backup proxy component during TCP connection establishment.

9. The system of claim 5 wherein the active forwarding component modifies a TCP acknowledgement number of data received from the TCP network according to an acknowledgement number delta calculated as the difference between said highest data acknowledgement number and the TCP acknowledgement number sent by the active forwarding component to the backup proxy component during TCP connection establishment.

10. The system of claim 1 wherein the active proxy performs at least one of data caching, data filtering, data blocking, data encryption and decryption, data compression and decompression, data authentication, data securing, data formatting, TCP splitting, TCP multiplexing, and data modification.

11. The system of claim 1 wherein the active proxy performs at least one of TCP splitting, and TCP multiplexing.

12. A proxy system communicating with at least one client and one server through one or more transmission control protocol (TCP) networks external to the proxy system, the proxy system comprising:

at least one first proxy component managing a separate TCP connection with each of the client and the server and determining a destination of received data, wherein the destination includes one of the client and the server;

at least one second proxy for determining the destination for a received data packet upon the occurrence of a condition; and

at least one forwarding component for routing data packets between the one or more TCP networks and the first proxy, and maintaining information of the TCP connections between the TCP network and the first proxy, wherein

in the event of the occurrence of the condition, the forwarding component establishes a new TCP connection between the forwarding component and the second proxy for each of the client and the server TCP connections, the TCP connections corresponding to the TCP connections with the first proxy component, and wherein

the active forwarding component modifies a data packet TCP sequence number and a data packet TCP acknowledgement number using the maintained information while routing the data packets between the one or more TCP networks and the second proxy, thereby forwarding data, to and from both the client and the server, to and from the second proxy without disconnection of the TCP connections of the client and server.

13. The system of claim 12 wherein the predetermined condition includes failure or an overload condition of the first proxy, and wherein

the first proxy performs at least one of data caching, data filtering, data blocking, data encryption and decryption, data compression and decompression, data authentication, data securing, data formatting, TCP splitting, TCP multiplexing, and data modification.

14. A method for providing connection resiliency, the method comprising:

maintaining, by a first proxy, a TCP connection with a TCP client and a TCP connection with a TCP server through one or more TCP networks;

maintaining information of both TCP connections by a forwarding component between the TCP networks and the first proxy;

monitoring the first proxy;

based upon the monitoring, establishing, by the forwarding component, a new TCP connection with a second proxy for each of the TCP connections maintained by the first proxy; and

forwarding data, to and from both the client and the server, to and from the second proxy without disconnection of the TCP connections of the TCP client and TCP server.

15. The method of claim 14 further comprising:

modifying, prior to forwarding, a sequence number and acknowledgement number of the data based upon the maintained information.

16. The method of claim 14 wherein, for each TCP connection, the information comprises at least one of highest sequence number, highest acknowledgement number, a source IP address, a destination IP address, a TCP source port number, a TCP destination port number, a sequence number delta, an acknowledgement number delta, and internal connection information.

17. The method of claim 16 wherein the sequence number is modified according to said sequence number delta calculated as the difference between said highest data sequence number and the data packet acknowledgement number received by the active forwarding component from the backup proxy component during said new TCP connection

18. The method of claim 14 further comprising backing up the forwarding component by a backup forwarding component using virtual router redundancy protocol.

19. The method of claim 14 further comprising mirroring the maintained information on a backup forwarding component.

20. The method of claim 14 further comprising querying one of the first proxy and the second proxy to determine the connection information when the backup forwarding component takes over.

21. The method of claim 14 further comprising reestablishing the connections with the first proxy, based upon the monitoring of the first proxy.

22. The method of claim 14 further comprising switching back to the forwarding component, once the active forwarding component is functional.

23. A proxy system comprising:

an active forwarding component in communication with external transmission control protocol (TCP) networks, wherein the active forwarding component resides on a first network proxy server;

at least one active proxy in communication with the active forwarding component, wherein the active proxy resides on a second network proxy server, wherein the second network proxy server is separate from the first network proxy server;

a backup forwarding component in communication with the external transmission control protocol network if the active forwarding component fails, wherein the backup forwarding component resides on the second network proxy server; and

at least one backup proxy in communication with one of the active forwarding component and the backup forwarding component, wherein the backup proxy resides on the first network proxy server.

24. The system of claim 23, wherein the active forwarding component maintains the information of the TCP connections flowing through the active forwarding component between a TCP network and one of the active proxy and the backup proxy, and wherein

the forwarding component establishing a new TCP connection with the backup proxy for each of the TCP connections maintained by the active proxy, and forwarding data, to and from both the client and the server, to and from the backup proxy without disconnection of the TCP connections of the client and server.

25. A forwarding device routing data packets between transmission control protocol (TCP) networks and a first proxy, comprising:

a processing unit for maintaining information of TCP connections between the TCP networks and the first proxy, and in the event of a predetermined condition, modifying received data according to said maintained information and forwarding said received data to a second proxy or said TCP network, thereby forwarding data, to and from both a client and a server, to and from the second proxy without disconnection of TCP connections of the client and server maintained by the first proxy prior to said predetermined condition event.

26. The forwarding device of claim 25, wherein the processing unit, establishing a new TCP connection with the second proxy for each of the TCP connections maintained by the first proxy.