Method and apparatus for transparently proxying a connection

• US 6,473,406 B1
• Filed: 07/31/1997
• Issued: 10/29/2002
• Est. Priority Date: 07/31/1997
• Status: Expired due to Term

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Coile, Brantley W., Howes, Richard A., LeBlanc, William M.
• Primary Examiner(s): Chin, Wellington
• Assistant Examiner(s): PHAN, MAN U
• Application Number:
  US08/903,718
• Time in Patent Office: 1,916 Days
• Field of Search: 370/401, 370/403, 370/94.1, 370/355, 370/88, 370/402, 370/404, 370/405, 395/187.01, 395/188.01, 395/188.02, 395/200, 709/227, 709/203, 709/230, 709/219, 709/224, 709/228
• US Class Current: 370/248
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 67/568 Storing data temporarily at an intermediate stage, e.g. caching
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04L 69/163 In-band adaptation of TCP data exchange; In-band control procedures
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A system and method are disclosed for transparently proxying a connection to a protected machine. The method includes monitoring a communication packet on a network at a proxy machine. The communication packet has a communication packet source address, a communication packet source port number, a communication packet destination address, and a communication packet destination port number. The proxy determines whether to intercept the communication packet based on whether the communication packet destination address and the communication packet destination port number correspond to a protected destination address and a protected destination port number stored in a proxy list. The proxy then determines whether to proxy a proxied connection associated with the communication packet based on the communication packet source address and the communication packet source port number. A protected connection is terminated from the proxy machine to a protected machine. The protected machine corresponds to the communication packet destination address and the communication packet destination port number. A response is formed to the communication packet under a network protocol by sending a responsive packet from the proxy machine. The responsive packet has a header having a responsive packet source address and a responsive packet source port number such that the responsive packet source address and the responsive packet source port number are the same as to the communication packet destination source address and the communication packet destination port number.

Claims

1. A method of transparently proxying a connection to a protected machine comprising:

monitoring communication packets directed to the protected machine on a network at a proxy machine, the communication packet having a communication packet source address, a communication packet source port number, a communication packet destination address, and a communication packet destination port number, the proxy machine being located within a communication path of the protected machine for monitoring all packets routed to the protected machine, the communications packet not being addressed to the proxy machine by the originator of the communication packet under any network communication protocol;

determining to intercept the communication packet at the proxy machine based on whether the communication packet destination address and the communication packet destination port number correspond to a protected destination address and a protected destination port number stored in a proxy list;

determining to proxy a proxied connection associated with the communication packet based on the communication packet source address and the communication packet source port number;

terminating a protected connection from the proxy machine to a protected machine, the protected machine corresponding to the communication packet destination address and the communication packet destination port number, each communication sent from the proxy machine to the protected machine having a header in which the source address and the source port number are the same as the communication packet source address and the communication packet source port number; and

forming a response to the communication packet under a network protocol by sending a responsive packet from the proxy machine wherein the responsive packet has a header having a responsive packet source address and a responsive packet source port number wherein the responsive packet source address and the responsive packet source port number are the same as to the communication packet destination source address and the communication packet destination port number;

whereby the proxy machine terminates a protected connection to the protected machine and the proxy machine responds to the communication packet acting on behalf of the protected machine and the proxy machine appears to be the protected machine.

2. A method of transparently proxying a connection to a protected machine as recited in claim 1 wherein the protected machine has a protected machine IP address and the protected machine IP address is the same address as the communication packet destination address.

3. A method of transparently proxying a connection to a protected machine as recited in claim 1 wherein the communication packet is a SYN packet.

4. A method of transparently proxying a connection to a protected machine as recited in claim 1 wherein the proxy machine terminates an outside connection with an outside machine, the outside machine being the sender of the communication packet.

5. A method of transparently proxying a connection to a protected machine as recited in claim 4 wherein the proxy machine pretends to be the protected machine on the outside connection.

6. A method of transparently proxying a connection to a protected machine as recited in claim 5 wherein the proxy machine includes the protected machine IP address as the source address in packets that are sent from the proxy machine to the outside machine.

7. A method of transparently proxying a connection to a protected machine as recited in claim 4 further including receiving on the outside connection an outside data packet containing outside data from the outside machine, reading the outside data at the proxy machine, and relaying the outside data to the protected machine via a socket corresponding to the protected connection.

8. A method of transparently proxying a connection to a protected machine as recited in claim 7 further including modifying the outside data at the proxy machine.

9. A method of transparently proxying a connection to a protected machine as recited in claim 1 further including receiving on the protected connection an protected data packet containing protected data from the protected machine, reading the protected data at the proxy machine, and relaying the protected data to the outside machine via a socket corresponding to the protected connection.

10. A method of transparently proxying a connection to a protected machine as recited in claim 9 further including modifying the protected data at the proxy machine.

11. A method of transparently proxying a connection to a protected machine as recited in claim 7 further including receiving on the protected connection an protected data packet containing protected data from the protected machine, reading the protected data at the proxy machine, and relaying the protected data to the outside machine via a socket corresponding to the protected connection.

12. A method of transparently proxying a connection to a protected machine as recited in claim 7 wherein the outside data is used to authenticate the outside machine to the protected machine.

13. A method of transparently proxying a connection to a protected machine as recited in claim 9 wherein the protected data includes an authentication request.

14. A method of transparently proxying a connection to a protected machine as recited in claim 7 further including requesting and obtaining data from the protected machine that is responsive to the outside data.

15. A method of transparently proxying a connection to a protected machine as recited in claim 1 wherein the proxy machine is a web server.

16. A method of transparently proxying a connection to a protected machine as recited in claim 1 wherein the proxy machine is a PIX.

17. A method of transparently proxying a connection to a protected machine as recited in claim 1 wherein the proxy machine is a firewall.

18. A method of transparently proxying a connection to a protected machine as recited in claim 1 wherein an intercepting controller determines whether to direct the communication packet to a local application or a proxy application or to drop the communication packet based on a proxy quad list.

19. A method of transparently proxying a connection to a protected machine as recited in claim 1 wherein the network protocol is TCP.

22. A method of transparently proxying a connection to a protected machine as recited in claim 1 wherein the communication packet is not encapsulated with a device address of the proxy machine.

23. A method of transparently proxying a connection to a protected machine as recited in claim 1 wherein determining to intercept the communication packet at the proxy machine comprises intercepting the communication packet only if the communication packet destination address and the communication packet destination port number correspond to a protected destination address and a protected destination port number stored in the proxy list or a destination address and a destination port number of the proxy machine.

20. A method of transparently proxying a connection to a protected machine comprising:

monitoring a communication packet on a network at a proxy machine, the communication packet having a communication packet source address, a communication packet source port number, a communication packet destination address, and a communication packet destination port number, the communications packet not being addressed to the proxy machine by the originator of the communication packet under any network communication protocol;

determining to intercept the communication packet at the proxy machine based on whether the communication packet destination address and the communication packet destination port number correspond to a protected destination address and a protected destination port number stored in a proxy list;

determining to proxy a proxied connection associated with the communication packet based on the communication packet source address and the communication packet source port number;

terminating a protected connection from the proxy machine to a protected machine, the protected machine corresponding to the communication packet destination address and the communication packet destination port number, each communication sent from the proxy machine to the protected machine having a header in which the source address and the source port number are the same as the communication packet source address and the communication packet source port number;

forming a response to the communication packet under a network protocol by sending a responsive packet from the proxy machine wherein the responsive packet has a header having a responsive packet source address and a responsive packet source port number wherein the responsive packet source address and the responsive packet source port number are the same as to the communication packet destination source address and the communication packet destination port number;

receiving on an outside connection an outside data packet containing outside data from an outside machine, the outside machine being the sender of the communication packet, reading the outside data at the proxy machine, and relaying the outside data to the protected machine via a socket corresponding to the protected connection; and

acknowledging the receipt of the outside data packet at the proxy machine after a protected machine acknowledges receipt of data contained in the outside data packet;

whereby the proxy machine terminates a protected connection to the protected machine and the proxy machine responds to the communication packet acting on behalf of the protected machine and the proxy machine appears to be the protected machine.

21. A proxy system for proxying a connection from an outside machine to a protected machine comprising:

an outside connection stack, the outside connection stack being operative to establish an outside connection to an outside party;

a proxy quad list, the proxy quad list containing a list of proxied connections;

an intercepting controller, the intercepting controller being operative to read incoming data packets, to resolve IP addresses and port numbers to determine whether the data packets correspond to a proxied application based on the proxy quad list; and

a proxy application, the proxy application being operative to determine that a new connection should be added to the quad list and add the new connection to the quad list, the proxy application being configured to establish and maintain a proxy connection to the protected machine by sending communications packets having a header in which the source address and the source port number are the same as the source address and the source port number of the incoming data packets;

wherein a proxied connection is maintained.