Transmission control of protocol state exchange for dynamic stateful service insertion

• US 10,581,976 B2
• Filed: 08/12/2015
• Issued: 03/03/2020
• Est. Priority Date: 08/12/2015
• Status: Active Grant

• Current Assignee: A10 Networks Incorporated
• Original Assignee: A10 Networks Incorporated
• Inventors: Thompson, Micheal, Grimm, Martin, Groves, Vernon Richard, Jalan, Rajkumar
• Primary Examiner(s): Vu, Viet D
• Assistant Examiner(s): Mian, Mohammad Yousuf A.
• Application Number:
  US14/825,096
• Publication Number:
  US 20170048356A1
• Time in Patent Office: 1,665 Days
• Field of Search: None
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 69/163 In-band adaptation of TCP data exchange; In-band control procedures

Abstract

Provided are methods and systems for a Transmission Control Protocol (TCP) state handoff of a data traffic flow. A method for a TCP state handoff of a data traffic flow comprises determining a TCP state at predetermined times by a state machine unit. The TCP state includes data concerning a session between a client and a server. The TCP state for the predetermined times is stored to a database. A request to apply a predetermined policy to the session is received by a transaction processing unit and, based on the request, a session request associated with the session between the client and the server is sent to an access control unit. The session request is processed by the access control unit based on the TCP state and according to the predetermined policy.

Claims

1. A system for a Transmission Control Protocol (TCP) state handoff of a data traffic flow, the system comprising:

a hardware state machine unit configured to;

determine a plurality of TCP states at predetermined times, each TCP state of the plurality of TCP states being separately determined at a particular predetermined time,

wherein each of the plurality of TCP states includes data concerning a session between a client and a server at the particular predetermined time;

a hardware transaction processing unit configured to;

store the TCP state for each of the predetermined times to a database;

receive a request to apply a predetermined policy to the session, wherein the session is processed by the hardware transaction processing unit and wherein the applying the predetermined policy to the session includes transferring the processing of the session to a hardware access control unit;

based on the request, transfer the processing of the session from the hardware transaction processing unit to the hardware access control unit by sending a session request associated with the session between the client and the server to the hardware access control unit, the session request including a current TCP state of the plurality of TCP states, the current TCP state being the TCP state stored for a current time and including the data concerning the session for the current time, the session request further including an instruction to process the session according to the predetermined policy; and

the hardware access control unit configured to;

switch from a stand-by mode to an active mode based on receipt of the session request, the hardware access control unit operating in the stand-by mode in absence of session requests from the hardware transaction processing unit;

upon switching to the active mode, in response to the instruction to process the session, act as a TCP proxy in the session between the client and the server by establishing the session between the hardware access control unit and the client and establishing the session between the hardware access control unit and the server based on the current TCP state; and

based on the instruction included in the session request, process the session request and further data packets associated with the session based on the current TCP state and according to the predetermined policy.

2. The system of claim 1, wherein the processing of the session request includes establishing a further session between the client and the server, the further session being established based on the current TCP state retrieved by the hardware access control unit.

3. The system of claim 1, wherein the storing of the TCP state includes storing the TCP state to the hardware state machine unit.

4. The system of claim 1, wherein the processing includes sending a reset request to the client, the reset request prompting the client to resend the session request.

5. The system of claim 1, wherein the storing of the TCP state includes:

initializing a further hardware state machine unit; and

storing the TCP state to the further hardware state machine unit.

6. The system of claim 1, wherein the storing of the TCP state includes:

encoding the TCP state into a signal; and

sending the signal to the hardware access control unit.

7. The system of claim 1, wherein the session request is sent to the hardware access control unit using a magic packet, the magic packet including the TCP state and the instruction to process the session according to the predetermined policy.

8. The system of claim 1, wherein the data concerning the session include at least one or more of the following:

a source port destination, a current sequence number, a window, a timestamp, and a timer.

9. The system of claim 1, wherein the hardware transaction processing unit is further configured to delay the sending of the session request until the hardware state machine unit determines the TCP state.

10. A method for a TCP state handoff of a data traffic flow, the method comprising:

determining, by a hardware state machine unit, a plurality of TCP states at predetermined times, each TCP state of the plurality of TCP states being separately determined at a particular predetermined time, wherein each of the plurality of TCP states includes data concerning a session between a client and a server at the particular predetermined time;

storing, to a database, the TCP state for the predetermined times;

receiving, by a hardware transaction processing unit, a request to apply a predetermined policy to the session, wherein the session is processed by the hardware transaction processing unit and wherein the applying the predetermined policy to the session includes transferring the processing of the session to a hardware access control unit;

based on the request, transferring the processing of the session from the hardware transaction processing unit to the hardware access control unit by sending, by the hardware transaction processing unit, a session request associated with the session between the client and the server to the hardware access control unit, the session request including a current TCP state of the plurality of TCP states, the current TCP state being the TCP state stored for a current time and including the data concerning the session for the current time, the session request further including an instruction to process the session according to the predetermined policy; and

switching, by the hardware access control unit, from a stand-by mode to an active mode based on receipt of the session request, the hardware access control unit operating in the stand-by mode in absence of session requests from the hardware transaction processing unit;

upon switching to the active mode, in response to the instruction to process the session, acting, by the hardware access control unit, as a TCP proxy in the session between the client and the server by establishing the session between the hardware access control unit and the client and establishing the session between the hardware access control unit and the server based on the current TCP state; and

based on the instruction included in the session request, processing, by the hardware access control unit, the session request and further data packets associated with the session based on the current TCP state and according to the predetermined policy.

11. The method of claim 10, wherein the processing of the session request includes establishing a further session between the client and the server, the further session being established based on the current TCP state retrieved by the hardware access control unit.

12. The method of claim 10, wherein the storing of the TCP state includes storing the TCP state to the hardware state machine unit.

13. The method of claim 10, wherein the processing includes sending a reset request to the client, the reset request prompting the client to resend the session request.

14. The method of claim 10, wherein the storing of the TCP state further includes:

initializing a further hardware state machine unit; and

storing the TCP state to the further hardware state machine unit.

15. The method of claim 10, wherein the storing of the TCP state includes:

encoding the TCP state into a signal; and

sending the signal to the hardware access control unit.

16. The method of claim 10, wherein the session request is sent to the hardware access control unit using a magic packet, the magic packet including the TCP state and the instruction to process the session according to the predetermined policy.

17. The method of claim 10, wherein the data concerning the session include at least one or more of the following:

a source port destination, a current sequence number, a window, a timestamp, and a timer.

18. The method of claim 10, wherein the predetermined policy includes one or more of the following:

a security policy and a forwarding policy.

19. The method of claim 10, further comprising delaying, by the hardware transaction processing unit, sending the session request until the hardware state machine unit determines the TCP state.

20. A system for a TCP state handoff of a data traffic flow, the system comprising:

a hardware state machine unit configured to;

determine a plurality of TCP states at predetermined times, each TCP state of the plurality of TCP states being separately determined at a particular predetermined time,

wherein each of the plurality of TCP states includes data concerning a session between a client and a server at the particular predetermined time;

a hardware transaction processing unit configured to;

store the TCP state for each of the predetermined times to a database;

receive a request to apply a predetermined policy to the session, wherein the session is processed by the hardware transaction processing unit and wherein the applying the predetermined policy to the session includes transferring the processing of the session to a hardware access control unit;

based on the request, transferring the processing of the session from the hardware transaction processing unit to the hardware access control unit by sending a session request associated with the session between the client and the server to the hardware access control unit, the session request including a current TCP state of the plurality of TCP states, the current TCP state being the TCP state stored for a current time and including the data concerning the session for the current time, wherein the session request is sent to the hardware access control unit using a magic packet, the magic packet including the current TCP state and an instruction to process the session according to the predetermined policy; and

the hardware access control unit configured to;

switch from a stand-by mode to an active mode based on receipt of the session request, the hardware access control unit operating in the stand-by mode in absence of session requests from the hardware transaction processing unit;

upon switching to the active mode, in response to the instruction to process the session, act as a TCP proxy in the session between the client and the server by establishing the session between the hardware access control unit and the client and establishing the session between the hardware access control unit and the server based on the current TCP state; and

based on the instruction included in the session request, process the session request and further data packets associated with the session based on the current TCP state and according to the predetermined policy, wherein the processing of the session request includes establishing a further session between the client and the server, the further session being established based on the current TCP state retrieved by the hardware access control unit.