FACILITATING SECURE NETWORK TRAFFIC BY AN APPLICATION DELIVERY CONTROLLER

• US 20140330982A1
• Filed: 05/02/2014
• Published: 11/06/2014
• Est. Priority Date: 05/03/2013
• Status: Active Grant

• Current Assignee: A10 Networks Incorporated
• Original Assignee: A10 Networks Incorporated
• Inventors: Jalan, Rajkumar, Kamat, Gurudeep
• Granted Patent: US 10,038,693 B2
• Time in Patent Office: Days
• US Class Current: 709/229
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/166 at the transport layer

Abstract

Facilitation of secure network traffic by an application delivery controller is provided herein. In some examples, a method includes: (a) receiving a data packet with information from a client indicating that the client is a trusted source; (b) embedding in the data packet a transmission control protocol (TCP) options header, the TCP options header comprising information including at least a sequence number for a protocol connection; and (c) forwarding the embedded data packet to a server.

Claims

1. A method for facilitating a secure network by a network device that comprises a processor and a memory for storing executable instructions, wherein the processor executes the instructions to perform the method, comprising:

receiving a data packet with information from a client indicating that the client is a trusted source;

embedding in the data packet a transmission control protocol (TCP) options header, the TCP options header comprising information including at least a sequence number for a protocol connection; and

forwarding the embedded data packet to a server.

2. The method of claim 1, wherein the data packet received from the client comprises a SYN-cookie received from the network device, wherein the SYN-cookie comprises a sequence number for the network device and an acknowledgement (ACK) that includes a sequence number of the client.

3. The method of claim 2, wherein the network device does not retain information from the data packet until the ACK has been received from the client and a network connection has been established between the server and the client.

4. The method of claim 3, wherein Internet Protocol (IP) is embedded into the ACK, the ACK being forwarded to the server.

5. The method of claim 3, wherein the network device does not retain the TCP options when the network device is operating in a stateless mode.

6. The method of claim 1, wherein the TCP options comprise a maximum segment size, a window scale, and a selective acknowledgement message, wherein the selective acknowledgement message is used for selective retransmission of individual data packets that were not received by the server.

7. The method of claim 1, wherein TCP options are included in the data packet received from the client.

8. The method of claim 1, further comprising authenticating the client by the network device.

9. The method of claim 8, further comprising embedding or stamping any of a server sequence number, a client maximum segment size, a client timestamp, or any other information required for the server to process the embedded data packet, or any combinations thereof.

10. The method of claim 1, wherein the TCP options are embodied in a single message having a predetermined length of bits, wherein the length of bits is separated into segments, each of the segments comprising bits representing one of the TCP options.

11. A method for facilitating secure network by a network device that comprises a processor and a memory for storing executable instructions, wherein the processor executes the instructions to perform the method, comprising:

receiving, at the network device, a data packet with information from a client indicating that the client is a trusted source;

modifying an Internet protocol (IP) header of the data packet with an encoded value from an index table; and

forwarding the data packet with the modified IP header to a server.

12. The method of claim 11, further comprising:

authenticating the client;

computing parameters included in a SYN packet received from the client;

selecting a combination of parameters from the index table based on the computed parameters; and

encoding the combination of parameters into an IP identification field of IP header of the data packet.

13. A method for facilitating a secure network by a network device that comprises a processor and a memory for storing executable instructions, wherein the processor executes the instructions to perform the method, comprising:

receiving a data packet with information from a client indicating that the client is a trusted source;

communicating, in a first channel established between the network device and a server, connection parameters included in a SYN packet received from the client, the connection parameters comprising parameters necessary for efficient data transfer over the secure network; and

forwarding, in a second channel established between the network device and the server, data packets of a data flow from the client.

14. The method of claim 13, wherein the parameters comprise sequence numbers, timestamp, window size, and any other relevant parameter necessary for efficient data transfer over the network.

15. An application delivery controller, comprising:

a processor; and

a memory for storing executable instructions, the processor being configured to execute the instructions to;

receive a data packet with information from a client indicating that the client is a trusted source;

perform either;

(1) an embedding of a transmission control protocol (TCP) options header in the data packet, the TCP options header comprising parameters for a protocol connection or (2) a modification of an Internet protocol (IP) header of the data packet with an encoded value from an index table; and

forward the embedded or modified data packet to a server.

16. The application delivery controller of claim 15, wherein the application delivery controller comprises a module that is configured to place an acknowledgement (ACK) packet in the IP header of the data packet.

17. The application delivery controller of claim 16, wherein the application delivery controller is configured to use IP tunneling to transfer the modified data packet with the modified IP header to the server.

18. The application delivery controller of claim 17, wherein the data included in the TCP header is placed into a tunnel header.

19. The application delivery controller of claim 15, wherein the application delivery controller is configured to determine TCP options that the server is capable of providing.

20. The application delivery controller of claim 19, wherein the application delivery controller is configured to adjust the parameters in the TCP options header with the TCP options that the server is capable of providing.