Stateless Transmission Control Protocol Rendezvous Solution For Border Gateway Function

• US 20110113145A1
• Filed: 11/06/2009
• Published: 05/12/2011
• Est. Priority Date: 11/06/2009
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Teplitsky, Yakob, Panattu, Santosh, Kean, Brian
• Granted Patent: US 9,059,968 B2
• Time in Patent Office: Days
• US Class Current: 709/228
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04L 69/163 In-band adaptation of TCP data exchange; In-band control procedures

Abstract

A method and apparatus for brokering a transmission control protocol (TCP) session between two clients that are each situated behind a firewall that blocks incoming TCP session requests is described. Each of the two clients transmits a TCP session request to the other client in order to establish a TCP session between these clients. This brokering allows the two clients to establish the TCP session between the two clients.

Claims

1. A method in a network element of brokering a transmission control protocol (TCP) session without maintaining a full TCP stack for establishing the TCP session by a network element between a first and second clients, wherein the first and second clients each transmits a TCP session request to the other client to establish a TCP session between the first and second clients, the first and second clients are each coupled behind a firewall that blocks incoming TCP session requests, and the brokering allows the first and second clients to establish the TCP session to enable forwarding of TCP data between the two clients, the method comprising the steps of:

receiving a first TCP session request having a first destination descriptor of the network element from the first client, wherein the first destination descriptor includes a first address and a first port of the network element assigned to the first client by a control device to establish the TCP session;

storing information contained in the first TCP session request;

port latching a first source port of the first client;

receiving a second TCP session request having a second destination descriptor of the network element from the second client, wherein the second destination descriptor includes a second address and a second port of the network element assigned to the second client by the control device to establish the TCP session;

storing information contained in the second TCP session request;

port latching a second source port of the second client;

in response to the receiving the second TCP session request, generating, by the network element, a first session response to the second TCP session request using the stored information instead of maintaining a full TCP stack for the TCP session in the network element;

transmitting the first session response to the second client, wherein the first session response is used by the second client to generate an acknowledgment to the first session response to establish the TCP session between the first and second clients; and

translating the second destination descriptor into appropriate address and port in order to forward on TCP data without maintaining a full TCP stack for the TCP session in the network element.

2. The method of claim 1, wherein the method further comprises the steps of:

generating a second session response to the first TCP session request using information from the second TCP session request; and

transmitting the second session response to the first client.

3. The method of claim 1, wherein the stored information contained in the first TCP session request is a TCP header of the first TCP session request.

4. The method of claim 1, wherein the step of storing the information contained in the first TCP session request further includes the step of:

recording flags, a sequence number, and a window parameter of the first session request'"'"'s TCP header.

5. The method of claim 1, wherein the first and second TCP session requests are SYN packets, the first session response is a SYN ACK packet, and the acknowledgment is an ACK packet.

6. The method of claim 1, wherein the network element is a router with a border gateway function.

7. The method of claim 1, wherein the network element is a media gateway.

8. (canceled)

9. A network comprising:

plurality of firewall devices;

a plurality of clients, wherein each of the plurality of clients transmits transmission control protocol (TCP) session requests to another one of the plurality of clients to establish a TCP session with that client and each of the plurality of clients is coupled behind one of the plurality of firewall devices, wherein each of the plurality of firewall devices blocks incoming TCP session requests to a client coupled behind the firewall device;

a network element, coupled to the set of one or more firewall devices, the network element comprising,

a session brokering component to broker a TCP session between different pairs of clients from the plurality of clients, the brokering allows each client pair to establish the TCP session between that client pair, wherein the session brokering component, for each client pair,

receives a first TCP session request having a first destination descriptor of the network element from a first client of that client pair and a second TCP session request having a second destination descriptor of the network element from the second client of that client pair, wherein the TCP session request is a request to establish a TCP session between the first and second clients, the first destination descriptor includes a first address and a first port of the network element assigned to the first client by a control device to establish the TCP session, and the second destination descriptor includes a second address and a second port of the network element assigned to the second client by the control device to establish the TCP session,

stores information contained in the first and second TCP session requests, port latches a first source port of the first client and a second source port of the second client,

in response to the received second TCP session request, generates a first session response to the second TCP session request using the stored information instead of maintaining a full TCP stack for establishing the TCP session, and

transmits the first session response to the second client, wherein the first session response is used by the second client to generate a first acknowledgment to the first session response to establish the TCP session between the first and second clients; and

a forwarding component coupled to the session brokering component, wherein the forwarding component translates destination descriptors into appropriate addresses and ports in order to forward on TCP data without maintaining a full TCP stack for the TCP session in the network element.

10. The network of claim 9, wherein the session brokering component, for each pair of clients, also:

generates a second session response to the first TCP session request using information from the second TCP session request; and

transmits the second session response to the first client.

11. The network of claim 10, wherein the forwarding component also:

forwards the first acknowledgement to the first session response from the second client to the first client and a second acknowledgement to the second session response from the first client to the second client.

12. The network of claim 9, wherein the information stored includes a TCP header of the first TCP session request.

13. The network of claim 9, wherein the information stored includes:

flags, a sequence number, and a window parameter of the first TCP session request'"'"'s TCP header.

14. The network of claim 9, wherein the network element is a router with a border gateway function.

15. The network of claim 9, wherein the network element is a media gateway.

16. A network element adapted to broker transmission control protocol (TCP) sessions without maintaining full TCP stacks for establishing the sessions between different pairs of clients from a plurality of clients, wherein the clients in each client pair are coupled behind different firewalls that block incoming TCP session requests to those clients, the network element comprising:

a session brokering component to, for each of the client pairs,

receive a first TCP session request having a first destination descriptor of the network element from a first client of that client pair and a second TCP session request having a second destination descriptor of the network element from the second client of that client pair, wherein the first destination descriptor includes a first address and a first port of the network element assigned to the first client by a control device to establish the TCP session between the client pair, and the second destination descriptor includes a second address and a second port of the network element assigned to the second client by the control device to establish the TCP session between the client pair,

store information contained in the first and second TCP session requests, port latch source ports of the first and second clients of the client pair,

generate, in response to the received second TCP session request, a first session response to the first TCP session request using the stored information instead of maintaining a full TCP stack for establishing the TCP session between the client pair in the network element, and

transmit the first session response to the second client, wherein the first session response is used by the second client to generate an acknowledgment to the first session response to establish the TCP session between the first and second clients of the client pair; and

a forwarding component coupled to the session brokering component, the forwarding component, for each of the client pairs, to translate destination descriptors into appropriate addresses and ports in order to forward on TCP data without maintaining a full TCP stack for the TCP session between the client pair in the network element.

17. The network element of claim 16, wherein the session brokering component is further, for each of the client pairs, to:

generate a second session response to the first TCP session request using information from the second TCP session request; and

transmit the second session response to the first client.

18. The network element of claim 16, wherein the forwarding component is further, for each of the client pairs, to:

forward the first acknowledgement to the first session response from the second client to the first client and a second acknowledgement to the second session response from the first client to the second client.

19. The network element of claim 16, wherein the information stored includes a TCP header of the first TCP session request.

20. The network element of claim 16, wherein the network element further includes:

a session snooping component coupled to the session brokering component to snoop traffic received for the first and second TCP session requests.

21. The network of claim 16, wherein the network element is a router with a border gateway function.

22. The network of claim 16, wherein the network element is a media gateway