TCP proxy providing application layer modifications

• US 7,277,963 B2
• Filed: 06/26/2002
• Issued: 10/02/2007
• Est. Priority Date: 06/26/2002
• Status: Active Grant

• Current Assignee: PNI Canada Acquireco Corp. (Francisco Partners Management LLC)
• Original Assignee: Sandvine Incorporated ULC (Sandvine Corp.)
• Inventors: Dolson, David, Desmond, Matthew, Kuhn, Jim
• Primary Examiner(s): Maung; Zarni
• Assistant Examiner(s): Daftuar; Saket K.
• Application Number:
  US10/179,168
• Publication Number:
  US 20040006643A1
• Time in Patent Office: 1,924 Days
• Field of Search: 709/203, 709230-232, 709246-247, 709/236
• US Class Current: 709/246
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/561 Adding application-functional data or data for application control, e.g. adding metadata
• CPC Class Codes: H04L 67/564 Enhancement of application control based on intercepted application data
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

The invention disclosed is a Transmission Control Protocol (TCP) transport handler for a network intermediary. The handler examines all segments in a TCP/IP data stream between two nodes The handler maintains a list of changes made by an application module to a data segment within a data stream and utilizes that list to ensure that the sequence numbers for both receiver and transmitter refer to the same segments of data. The list of changes is also used to reapply changes to retransmitted packets. Data segments are not acknowledged until the receiver acknowledges a segment, eliminating the requirement of buffering data segments.

Claims

1. A method for modifying a bi-directional stream of TCP segments between two nodes, said method comprising:

providing a state machine configured to;

identify data within said TCP segments, and

create a properly reconstructed stream of TCP segments,

providing an application layer analysis module configured to;

receive said reconstructed stream of TCP segments from the state machine,

examine said reconstructed stream of TCP segments, and

create TCP segment modification tags;

wherein said modification tags represent associations between TCP sequence numbers and TCP segment modifications;

providing a modification module configured to;

accept said TCP segment modification tags, and

create modifications to at least a portion of said TCP segments on a segment by segment basis, based on said modification tags.

2. The method of claim 1 further comprising the step of utilizing a segment generation module for the purpose of determining if a modified TCP segment needs to be fragmented and if so generating new TCP segments and forwarding them to said modification module.

3. The method of claim 1 wherein said modifications to said TCP segments comprises insertion of data into a TCP segment.

4. The method of claim 1 wherein said modifications to said TCP segments comprises deletion of data in a TCP segment.

5. The method of claim 1 wherein said modifications to said TCP segments comprises replacement of data in a TCP segment.

6. The method of claim 1 further comprising the step of utilizing a state retrieval module, said state retrieval module associating a TCP segment with a state machine for each distinct TCP connection between nodes.

7. The method of claim 6 further comprising the step of utilizing a validation module, said validation module screening TCP segments for validity before passing them to said state retrieval module.

8. The method of claim 1 further comprising the step of determining if a TCP segment is an out of order TCP segment and if so, saving said out of order TCP segment and sending an acknowledgement for the last in-order TCP segment.

9. The method of claim 1 further comprising the step of determining if a TCP segment is a deleted TCP segment, based upon said modification tags and if so, generating an acknowledgement for said deleted TCP segment.

10. The method of claim 1 further comprising the step of recording each of said TCP segment modification tags as change points, for the purpose of mapping sequence numbers to modified sequence numbers and vice versa, said change points comprising:

a) a forward sequence number;

b) a forward operation;

c) a value;

d) a reverse sequence number;

e) a reverse operation; and

f) a linkto any modified data.

11. The method of claim 1 further comprising the step of managing said TCP segments in a TCP window by determining if a portion of a TCP segment is within said TCP window and applying applicable modification tags to said TCP segment.

12. The method of claim 11 further comprising the step that if a TCP segment is entirely to the left of said TCP window, dropping said TCP segment.

13. The method of claim 11 further comprising the step that if a TCP segment is entirely to the right of said TCP window, dropping said TCP segment.

14. The method of claim 1 further comprising the step of applying said TCP segment modification tags to retransmitted TCP segments.

15. A system for modifying a bi-directional stream of TCP segments between two nodes, said system comprising:

a state machine configured to;

identify data within TCP segments, and

create a properly reconstructed stream of TCP segments;

an application layer analysis module configured to;

receive said properly reconstructed stream of TCP segments from said state machine,

examine said TCP segments, and

create modification tags, said modification tags representing associations between TCP sequence numbers and TCP segment modifications;

a modification module configured to;

receive said modification tags from said application layer analysis module, and

create modifications to at least a portion of said TCP segments on a segment by segment basis, based on said modification tags.

16. The system of claim 15 further comprising a segment generation module able to determine if a modified TCP segment needs to be fragmented and means for generating new TCP segments and forwarding them to said modification module.

17. The system of claim 15 wherein said modification module further comprises means for inserting data into a TCP segment.

18. The system of claim 15 wherein said modification module further comprises means for deleting data in a TCP segment.

19. The system of claim 15 wherein said modification module further comprises means for replacing data in a TCP segment.

20. The system of claim 15 further comprising a state retrieval module, said state retrieval module able to associate a TCP segment with a state machine for each distinct TCP connection between nodes.

21. The system of claim 20 further comprising a validation module said validation module able to screen TCP segments for validity and means for passing TCP segments to said state retrieval module.

22. The system of claim 15 further comprising means for determining whether a TCP segment is an out of order TCP segment and means for saving said out of order TCP segment and sending an acknowledgement for the last in-order TCP segment.

23. The system of claim 15 further comprising means for determining if a TCP segment is a deleted TCP segment, based upon said modification tags and means for generating an acknowledgement for said deleted TCP segment.

24. The system of claim 15 further comprising means for recording each of said TCP segment modification tags as change points, for the purpose of mapping sequence numbers to modified sequence numbers and vice versa, said change points comprising:

a) a forward sequence number;

b) a forward operation;

c) a value;

d) a reverse sequence number;

e) a reverse operation; and

f) a link to any modified data.

25. The system of claim 15 further comprising means for managing said TCP segments in a TCP window, means for determining if a portion of a TCP segment is within said TCP window and means for applying applicable modification tags to said TCP segment.

26. The system of claim 25 further comprising means for dropping a TCP segment that is entirely to the left of said TCP window.

27. The system of claim 25 further comprising means for dropping a TCP segment that is entirely to the right of said TCP window.

28. A system according to claim 15 said system further comprising means of applying said modification tags to retransmitted TCP segments.

29. A physical computer readable medium including computer executable instructions which, when executed on a computing device, cause the computing device to:

provide a state machine, said state machine configured to;

identify data within TCP segments, and

create a properly reconstructed stream of TCP segments;

provide an application layer analysis module configured to;

receive said reconstructed stream of TCP segments from the state machine,

examine said reconstructed stream of TCP segments, and

create TCP segment modification tags, said modification tags representing associations between TCP sequence numbers and TCP segment modifications;

provide a modification module configured to;

accept said TCP segment modification tags, and

create modifications to at least a portion of said TCP segments on a segment by segment basis, based on said modification tags.

30. A computer readable medium according to claim 29 further comprising applying said TCP segment modification tags to retransmitted TCP segments.