Establishing tunnels between selective endpoint devices along communication paths

• US 8,949,446 B2
• Filed: 06/03/2013
• Issued: 02/03/2015
• Est. Priority Date: 05/05/2011
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Blue Coat Systems Incorporated (Gen Digital Inc.)
• Inventors: Li, Qing, Huang, Yusheng
• Primary Examiner(s): Nguyen, Hanh N
• Assistant Examiner(s): PEREZ, JOSE L
• Application Number:
  US13/908,880
• Publication Number:
  US 20130266020A1
• Time in Patent Office: 610 Days
• Field of Search: 709/228
• US Class Current: 709/228
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 65/1101 Session protocols

Abstract

In one embodiment, an intermediary device situated along a communication path between two endpoint devices may receive communication packets sent along the communication path. If the intermediary device receives a connection-initiating packet having a customization indicator and a connection-acknowledgement packet having a customization indicator, then the intermediary device may install a bypass rule.

Claims

1. A method comprising:

by a first computing device,

receiving a first communication packet from a second computing device and addressed to a third computing device;

if the first communication packet is a connection-initiating packet having no customization indicator, then;

generating a second connection-initiating packet having a customization indicator with a first value and addressed to the third computing device; and

sending the second connection-initiating packet to the third computing device;

if the first communication packet is a connection-initiating packet having a customization indicator with the first value, then;

generating a third connection-initiating packet having a customization indicator with a second value and addressed to the third computing device; and

sending the third connection-initiating packet to the third computing device;

if the first communication packet is a connection-initiating packet having a customization indicator with the second value, then;

generating a first connection-acknowledgement packet having a customization indicator with the second value and addressed to the second computing device; and

sending the first connection-acknowledgement packet to the second computing device;

if the first communication packet is a connection-acknowledgement packet having no customization indicator, then;

installing an intercept rule;

generating a second connection-acknowledgement packet having a customization indicator with the second value and addressed to the second computing device; and

sending the second connection-acknowledgement packet to the second computing device; and

if the first communication packet is a connection-acknowledgement packet having a customization indicator with the second value, then;

installing a bypass rule.

2. The method of claim 1, wherein the first computing device is situated along a communication path in between the second computing device and the third computing device.

3. The method of claim 1, further comprising if the first communication packet is a connection-initiating packet having no customization indicator, then:

completing a first connection between the first computing device and the second computing device; and

initiating a second connection between the first computing device and the third computing device.

4. The method of claim 1, further comprising if the first communication packet is a connection-initiating packet having a customization indicator with the first value, then:

suspending a first connection between the first computing device and the second computing device;

initiating a second connection between the first computing device and the third computing device; and

holding the first communication packet.

5. The method of claim 1, further comprising if the first communication packet is a connection-acknowledgement packet having a customization indicator with the second value, then

closing a connection between the first computing device and the third computing device;

and

forwarding a previously received connection-initiating packet having a customization indicator with the first value to the third computing device.

6. The method of claim 1, wherein the bypass rule and the intercept rule each comprise a peer identifier, a destination Internet Protocol (IP) address, and a destination port.

7. The method of claim 1, wherein the bypass rule and the intercept rule each comprise a source IP address, a source port, a destination IP address, and a destination port.

8. The method of claim 1, wherein:

if the first communication packet is a connection-initiating packet having no customization indicator, then the first computing device establishes a transparent connection with a concentrator device; and

if the first communication packet is a connection-acknowledgement packet having no customization indicator, then first computing device establishes a transparent connection with a branch device.

9. A first system comprising:

a memory comprising instructions executable by one or more processors; and

the one or more processors coupled to the memory and operable to execute the instructions, the one or more processors being operable when executing the instructions to;

receive a first communication packet from a second system and addressed to a third system;

if the first communication packet is a connection-initiating packet having no customization indicator, then;

generate a second connection-initiating packet having a customization indicator with a first value and addressed to the third system; and

send the second connection-initiating packet to the third system;

if the first communication packet is a connection-initiating packet having a customization indicator with the first value, then;

generate a third connection-initiating packet having a customization indicator with a second value and addressed to the third system; and

send the third connection-initiating packet to the third system;

if the first communication packet is a connection-initiating packet having a customization indicator with the second value, then;

generate a first connection-acknowledgement packet having a customization indicator with the second value and addressed to the second system; and

send the first connection-acknowledgement packet to the second system;

if the first communication packet is a connection-acknowledgement packet having no customization indicator, then;

install an intercept rule;

generate a second connection-acknowledgement packet having a customization indicator with the second value and addressed to the second system; and

send the second connection-acknowledgement packet to the second system; and

if the first communication packet is a connection-acknowledgement packet having a customization indicator with the second value, then;

install a bypass rule.

10. The first system of claim 9, wherein the first system is situated along a communication path in between the second system and the third system.

11. The first system of claim 9, wherein the one or more processors are further operable when executing the instructions to, if the first communication packet is a connection-initiating packet having no customization indicator, then:

complete a first connection between the first system and the second system; and

initiate a second connection between the first system and the third system.

12. The first system of claim 9, wherein the one or more processors are further operable when executing the instructions to, if the first communication packet is a connection-initiating packet having a customization indicator with the first value, then:

suspend a first connection between the first system and the second system;

initiate a second connection between the first system and the third system; and

hold the first communication packet.

13. The first system of claim 9, wherein the one or more processors are further operable when executing the instructions to, if the first communication packet is a connection-acknowledgement packet having a customization indicator with the second value, then

close a connection between the first system and the third system;

and

forward a previously received connection-initiating packet having a customization indicator with the first value to the third system.

14. The first system of claim 9, wherein the bypass rule and the intercept rule each comprise a peer identifier, a destination Internet Protocol (IP) address, and a destination port.

15. The first system of claim 9, wherein the bypass rule and the intercept rule each comprise a source IP address, a source port, a destination IP address, and a destination port.

16. The first system of claim 9, wherein:

if the first communication packet is a connection-initiating packet having no customization indicator, then the first system establishes a transparent connection with a concentrator system; and

if the first communication packet is a connection-acknowledgement packet having no customization indicator, then first system establishes a transparent connection with a branch system.

17. One or more computer-readable non-transitory storage media embodying software operable when executed by a first computer system to:

receive a first communication packet from a second computer system and addressed to a third computer system;

if the first communication packet is a connection-initiating packet having no customization indicator, then;

generate a second connection-initiating packet having a customization indicator with a first value and addressed to the third computer system; and

send the second connection-initiating packet to the third computer system;

if the first communication packet is a connection-initiating packet having a customization indicator with the first value, then;

generate a third connection-initiating packet having a customization indicator with a second value and addressed to the third computer system; and

send the third connection-initiating packet to the third computer system;

if the first communication packet is a connection-initiating packet having a customization indicator with the second value, then;

generate a first connection-acknowledgement packet having a customization indicator with the second value and addressed to the second computer system; and

send the first connection-acknowledgement packet to the second computer system;

if the first communication packet is a connection-acknowledgement packet having no customization indicator, then;

install an intercept rule;

generate a second connection-acknowledgement packet having a customization indicator with the second value and addressed to the second computer system; and

send the second connection-acknowledgement packet to the second computer system; and

if the first communication packet is a connection-acknowledgement packet having a customization indicator with the second value, then;

install a bypass rule.

18. The media of claim 17, wherein the first computer system is situated along a communication path in between the second computer system and the third computer system.

19. The media of claim 17, wherein the software is further operable when executed by the first computer system to, if the first communication packet is a connection-initiating packet having no customization indicator, then:

complete a first connection between the first computer system and the second computer system; and

initiate a second connection between the first computer system and the third computer system.

20. The media of claim 17, wherein the software is further operable when executed by the first computer system to, if the first communication packet is a connection-initiating packet having a customization indicator with the first value, then:

suspend a first connection between the first computer system and the second computer system;

initiate a second connection between the first computer system and the third computer system; and

hold the first communication packet.