Cooperative proxy auto-discovery and connection interception through network address translation

• US 8,938,553 B2
• Filed: 03/31/2012
• Issued: 01/20/2015
• Est. Priority Date: 08/12/2003
• Status: Active Grant

• Current Assignee: Riverbed Technology, LLC (Riverbed Technology Incorporated)
• Original Assignee: Riverbed Technology Incorporated
• Inventors: Ly, Kand, Demmer, Michael J., McCanne, Steven, Landrum, Alfred
• Primary Examiner(s): HOANG, HIEU T
• Application Number:
  US13/436,873
• Publication Number:
  US 20130091273A1
• Time in Patent Office: 1,025 Days
• Field of Search: 709233-239
• US Class Current: 709/236
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 41/0663 Performing the actions predefined by failover planning, e.g. switching to standby network elements
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 61/2567 for reachability, e.g. inquiring the address of a correspondent behind a NAT server
• CPC Class Codes: H04L 61/2589 over a relay server, e.g. traversal using relay for network address translation [TURN]
• CPC Class Codes: H04L 67/146 Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding
• CPC Class Codes: H04L 67/147 Signalling methods or messages providing extensions to protocols defined by standardisation
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 67/561 Adding application-functional data or data for application control, e.g. adding metadata
• CPC Class Codes: H04L 67/564 Enhancement of application control based on intercepted application data
• CPC Class Codes: H04L 67/568 Storing data temporarily at an intermediate stage, e.g. caching

Abstract

Proxy devices associate their direct connection with a client/server connection passing through one or more NAT devices. First proxy device receives a network connection request from a client. First proxy device stores connection information in association with a connection identifier. Connection information may reflect the usage of NAT devices between the two proxy devices. First proxy device sends a connection response including the connection identifier to the client. Second proxy device sends a direct connection request to first proxy device to establish a direct connection. Direct connection request includes the connection identifier, which is used by first proxy device to associate the direct connection with stored connection information. First proxy device may use the connection information to direct network traffic received via this direct connection to the correct destination and to divert network traffic from the server to the client through the direct connection and first and second proxy devices.

Claims

1. A method of establishing a network connection between proxy devices, the method comprising:

receiving, at a first proxy device, a connection request message from a first network device to a second network device, wherein the connection request message includes an auto-discovery indicator adapted to indicate that an existence of a second proxy device and connection information associated with the first and second network devices, wherein the first proxy device receives the connection request message directed from a public network address of the first network device to a private address of the second network device, and wherein the second proxy device receives the connection request message directed from a private network address of the first network device to a public address of the second network device;

storing the connection information in association with a connection identifier at the first proxy device;

sending a connection response message including the connection identifier to the first network device, wherein the connection response message is adapted to indicate the existence of the first proxy device to the second proxy device;

receiving an inner network connection setup message at the first proxy device from the second proxy device, wherein the inner network connection setup message is adapted to establish an inner network connection between the first and second proxy devices and includes the connection identifier;

retrieving the connection information using the connection identifier; and

using the connection information, directing network traffic associated with the inner network connection to the second network device.

2. The method of claim 1, wherein the connection request message is associated with first network addresses of the first and second network devices that are different from second network addresses of the first and second proxy devices used for the inner connection setup message.

3. The method of claim 1, wherein storing the connection information in association with the connection identifier at the first proxy device comprises:

generating, at the first proxy device, the connection identifier.

4. The method of claim 1, wherein storing the connection information in association with the connection identifier at the first proxy device comprises:

retrieving, at the first proxy device, the connection identifier from the connection request message, wherein the connection identifier was previously generated by the second proxy device.

5. The method of claim 1, wherein the connection information includes at least one network address of the first and/or second network devices.

6. The method of claim 5, wherein the network address includes a public network address associated with the first network device as detected by the first proxy device.

7. The method of claim 5, wherein the network address includes a private network address associated with the second network device as detected by the first network proxy.

8. The method of claim 1, comprising:

using the connection information, intercepting second network traffic from the second network device directed to the first network device.

9. The method of claim 1, wherein the network traffic associated with the inner network connection is generated at the first proxy device based on optimized network traffic received at the first proxy device via the inner connection.

10. A method of establishing a network connection between proxy devices, the method comprising:

receiving, at a first proxy device, a connection request message from a first network device to a second network device, wherein the first proxy device receives the connection request message directed from a private network address of the first network device to a public address of the second network device;

forwarding a modified connection request message based on the connection request message and including an auto-discovery indicator adapted to indicate the existence of the first proxy device;

receiving a connection response message including an auto-discovery response indicator adapted to indicate the presence of a second proxy device between the first proxy device and the second network device, wherein the connection response message includes a connection identifier, and wherein the second proxy device receives the connection request message directed from a public network address of the first network device to a private address of the second network device; and

sending an inner connection setup message to the second proxy device, wherein the inner connection setup message includes the connection identifier.

11. The method of claim 10, wherein the connection request message is associated with first network addresses of the first and second network devices that are different from second network addresses of the first and second proxy devices used for the inner connection setup message.

12. The method of claim 10, wherein the connection request message is associated by the first proxy device with first network addresses of the first and second network devices and the connection response message is associated by the second proxy device with second network addresses of the first and second network device.

13. The method of claim 12, wherein the connection identifier is adapted to indicate to the second proxy device an association between the second network addresses and the inner connection setup message.

14. The method of claim 13, wherein the connection identifier is adapted to enable the second proxy device to retrieve stored connection information including at least a portion of the second network addresses.

15. The method of claim 12, wherein the first network addresses include a private network address of the first network device and a public network address of the second network device.

16. The method of claim 12, wherein the second network addresses include a public network address of the first network device and a private network address of the second network device.

17. The method of claim 10, wherein forwarding the modified connection request message comprises:

generating the connection identifier at the first proxy device; and

including the connection identifier in the modified connection request message.

18. The method of claim 10, wherein receiving the connection response message includes receiving the connection identifier generated at the second proxy device.