Handling of data packets

• US 7,130,266 B2
• Filed: 09/10/2001
• Issued: 10/31/2006
• Est. Priority Date: 03/14/2001
• Status: Expired due to Term

• Current Assignee: Forcepoint LLC
• Original Assignee: Stonesoft Oy (Rtx Corporation)
• Inventors: Salminen, Riku, Virtanen, Tommi
• Primary Examiner(s): Pham, Chi
• Assistant Examiner(s): MURPHY, RHONDA L
• Application Number:
  US09/955,433
• Publication Number:
  US 20020131364A1
• Time in Patent Office: 1,877 Days
• Field of Search: 370/394, 370/470, 370/474, 370/472, 709201-203, 709223-224
• US Class Current: 370/230
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes

Abstract

A method for handling data packets in a network element, such as a gateway, said data packets belonging to a set of data packets. Data packets are captured, and captured data packets are processed. Captured data packets are accepted for processing or declined from processing based on said captured data packet and data packets captured prior to said data packet. When at least one captured data packet is processed, a modification command affecting at least said at least one captured data packet is determined, and a list of modification commands is maintained, said list enabling modification of captured data packets. Captured data packets are modified based on said list of modification commands, and data packets are released. It is also possible to process the captured data packets without determining modification commands, and release the data packets without modifying them.

Claims

1. A method for handling data packets, said data packets belonging to a set of data packets, said method comprising:

capturing data packets,

accepting a captured data packet for processing based on said captured data packet and data packets captured prior to said captured data packet,

when processing at least one captured data packet accepted for processing, determining a modification command affecting at least said at least one captured data packet,

maintaining a list of modification commands, said list enabling modification of captured data packets,

declining a captured data packet from processing if said captured data packet is already processed and modification commands induced by said captured data packet are already determined and maintained in said list of modification commands,

modifying said captured data packet based on said list of modification commands, and

releasing the modified captured data packet.

2. A method according to claim 1, wherein said data packets belonging to a set of data packets are first handled in a first node of a cluster of network elements and said list of modification commands is maintained in said first node, and in that said method further comprises the step of:

transmitting said list of modification commands from said first node to a second node of said cluster of network elements.

3. A method according to claim 2, further comprising:

after said transmission of said list, handling said set of data packets in said second node.

4. A method according to claim 3, further comprising:

when beginning to handle said data packets, storing in said first node in a connection data structure an entry representing said set of data packets, and

before handling said set of data packets in said second node, transmitting said entry from said first node to said second node.

5. A method according to claim 1 further comprising:

defining a plurality of first pieces of information which are to be replaced in the captured data packets with a plurality of corresponding second pieces of information,

and wherein, in the processing of captured data packets,

said first pieces of information are searched for, and

if a first piece of information is found, at least one modification command specifying at least the replacement of said first piece of information with a corresponding second piece of information is determined.

6. A method according to claim 5, wherein, if the length of said first piece of information is different from the length of said corresponding second piece of information and if said first piece of information is found in payload of data packet(s), said modification command comprises instructions for changing value of at least one header field in a data packet.

7. A method according to claim 1, wherein a modification command comprises:

a first identifier indicating the beginning of a first piece of information in the original captured data packets, the first piece of information being subject to be replaced by a second piece of information,

the length of the first piece of information, and

the second piece of information.

8. A method according to claim 1, wherein said data packets contain information fragments belonging to a sequence of information fragments, said method further comprising the steps of:

processing the information fragments of the captured data packets in the order specified by said sequence.

9. A method according to claim 8, wherein each information fragment of said sequence is processed only once.

10. A method according to claim 8, wherein said sequence of information fragments is a sequence of octets of data according to the Transfer Control Protocol.

11. A method for handling data packets, said data packets belonging to a set of data packets having at least partly hierarchical structure, said method comprising:

capturing data packets,

accepting a captured data packet for processing or declining a captured data packet from processing based on said captured data packet and data packets captured prior to said captured data packet,

said accepting comprising accepting data packets for processing in the order specified by said at least partly hierarchical structure

declining a captured data packet from processing if a data packet immediately preceding said captured data packet in said at least partly hierarchical structure is not yet captured,

delaying data packets declined from processing,

accepting a delayed data packet for processing and processing said delayed data packet, if data packet(s) immediately preceding said delayed data packet in said at least partly hierarchical structure is(are) already processed, and

releasing the delayed data packet.

12. A method according to claim 11, further comprising:

when processing at least one captured data packet, determining a modification command affecting said at least one captured data packet, and

maintaining a list of modification commands, said list enabling modification of captured data packets.

13. A method according to claim 12, further comprising:

modifying captured data packets based on said list of modification commands, and

releasing modified captured data packets.

14. A method according to claim 11, further comprising the step of discarding captured data packets that are declined from processing.

15. A method according to claim 11, wherein captured data packets that are declined from processing are delayed.

16. A method according to claim 11, further comprising:

declining a captured data packet from processing, if said captured data packet is already processed, and

releasing the captured data packet.

17. A method according to claim 11, comprising:

accepting a captured data packet for processing, if data packet(s) immediately preceding said captured data packet in said at least partly hierarchical structure is(are) already processed.

18. A method according to claim 11, comprising:

delaying data packets declined from processing,

accepting a captured data packet for processing,

accepting delayed data packet(s) for processing, if data packet(s) immediately preceding said delayed data packet(s) in said at least partly hierarchical structure is(are) accepted for processing,

processing said delayed data packet(s) together with said captured data packet, and

releasing the delayed and the captured data packets.

19. A method according to claim 11, wherein said at least partly hierarchical structure is a sequence of data packets.

20. A method according to claim 11, wherein in that said at least partly hierarchical structure is a hierarchically structured tree.

21. A method for handling data packets, said data packets belonging to a set of data packets and forming a plurality of groups of data packets, said method comprising:

capturing data packets,

declining a captured data packet belonging to a first group of data packets from processing, if all other data packets belonging to said first group of data packets are not yet captured, and delaying said captured data packet, and

processing a captured data packet belonging to a first group of data packets together with delayed data packets belonging to said first group of data packets if said captured data packet belonging to said first group and said delayed data packets belonging to said first group form a full first group of data packets.

22. A method according to claim 21, wherein said plurality of groups of data packets further belong to a set of groups having at least partly hierarchical structure, and further comprising

processing said groups of captured data packets in the order specified by said at least partly hierarchical structure.

23. A method for handling data packets, said data packets belonging to a set of data packets, said method comprising:

capturing data packets,

accepting a captured data packet for processing based on said captured data packet and data packets captured prior to said captured data packet,

when processing at least one captured data packet accepted for processing, determining a modification command affecting at least said at least one captured data packet,

maintaining a list of modification commands, said list enabling modification of captured data packets,

wherein a modification command comprises

a first identifier indicating the beginning of a first piece of information in the original captured data packets, the first piece of information being subject to be replaced by a second piece of information,

the length of the first piece of information,

the second piece of information,

a second identifier indicating the beginning of the second piece of information in the modified captured data packets,

an offset between a third identifier indicating the end of the first piece of information in the original captured data packets and a fourth identifier indicating the end of the second piece of information in the modified captured data packets, and

the length of the second piece of information.

24. A method for handling data packets, said data packets belonging to a set of data packets, said method comprising:

capturing data packets, said data packets containing information fragments belonging to a sequence of information fragments,

declining a captured data packet from processing if a data packet containing the information fragment immediately preceding the information fragments of said captured data packet in said sequence is not yet captured, and

accepting a captured data packet for processing if a data packet containing the information fragment immediately preceding the information fragments of said captured data packet in said sequence is already processed, whereby each information fragment of said sequence is processed only once.

25. A computer readable medium having stored thereon computer readable code comprising the program code means recited below which, when executed by a computer, cause said computer to execute the functions recited below:

program code means for capturing data packets,

program code means for accepting a captured data packet for processing or declining a captured data packet from processing based on said captured data packet and data packets captured prior to said captured data packet,

program code means for handling said data packets belonging to a set of data packets first in a first node of a cluster of network elements and for maintaining said list of modification commands in said first node, said list enabling modification of captured data packets,

program code means for transmitting said list of modification commands from said first node to a second node of a cluster of network elements,

program code means for declining a captured data packet from processing if said captured data packet is already processed and modification commands induced by said captured data packet are already determined and maintained in said list of modification commands,

program code means for modifying said captured data packet based on said list of modification commands, and

program code means for releasing the modified captured data packet.

26. A computer readable medium according to claim 25, further comprising program code means stored on said medium which, when executed by a computer, control said computer to perform the additional functions recited below:

program code means for modifying captured data packets based on said list of modification commands, and

program code means for releasing modified captured data packets.

27. A computer readable medium having stored thereon computer readable code comprising the program code means recited below which, when executed by a computer, cause said computer to execute the functions recited below:

program code means for capturing data packets;

program code means for accepting a captured data packet for processing or declining a captured data packet from processing based on said captured data packet and data packets captured prior to said captured data packet;

program code means for processing received data packets first in a first node of a cluster of network nodes, if said data packets belong to said set of data packets;

program code means for determining a modification command affecting at least received data, as a response to processing said data;

said program code means for outputting said modification command;

program code means for maintaining said list of modification commands in said first node, said list enabling modification of captured data packets;

program code means for transmitting said list of modification commands from said first node to a second node of said cluster of network elements;

program code means for processing said set of data packets in said second node after said transmission of said list of modification commands from said first node to said second node;

program code means for declining a captured data packet from processing if said captured data packet is already processed and modification commands induced by said captured data packet are already determined and maintained in said list of modification commands;

program code means for modifying said captured data packet based on said list of modification commands; and

program code means for releasing the modified captured data packet.

28. A network element for handling data packets in a cluster of network elements, said data packets belonging to a set of data packets, said network element programmed with computer code means recited below which control said network element to perform the functions recited below;

means for capturing data packets,

means for accepting a captured data packet for processing or declining a captured data packet from processing based on said captured data packet and data packets captured prior to said captured data packet,

means for maintaining a list of modification commands, said list enabling modification of captured data packets, and

means for transmitting said list of modification commands to a second network element of said cluster of network elements,

means for declining a captured data packet from processing if said captured data packet is already processed and modification commands induced by said captured data packet are already determined and maintained in said list of modification commands,

means for modifying said captured data packet based on said list of modification commands, and

means for releasing the modified captured data packet.

29. A network element according to claim 28, further comprising program code means recited below which control said network element to perform the functions recited below:

means for processing a captured data packet, and

means for determining a modification command affecting at least one captured data packet as a response to processing said at least one captured data packet.

30. A network element cluster comorised of a plurality of nodes for handling data packets, said data packets belonging to a set of data packets, at least one node of said network element cluster including program code which programs said node to provide the following structural elements:

means for capturing data packets,

means for accepting a captured data packet for processing or declining a captured data packet from processing based on said captured data packet and data packets captured prior to said captured data packets,

means for maintaining a list of modification commands, said list enabling modification of captured data packets,

means for transmitting said list of modification commands from said node to another node of said cluster of network elements,

means for declining a captured data packet from processing, if said captured data packet is already processed and modification commands induced by said captured data packet are already determined and maintained in said list of modification commands,

means for modifying said captured data packet based on said list of modification commands, and

means for releasing the modified captured data packet.

31. A computer readable medium storing program code which, when executed by a computer, controls said computer to handle data packets, said data packets belonging to a set of data packets, said program code comprising:

program code configured to control said computer to capture data packets,

program code configured to control said computer to accept a captured data packet for processing based on said captured data packet and data packets captured prior to said captured data packet,

program code configured to control said computer to, when processing at least one captured data packet accepted for processing, determine a modification command affecting at least said at least one captured data packet,

program code configured to control said computer to maintain a list of modification commands, said list enabling modification of captured data packets,

program code configured to control said computer to decline a captured data packet from processing, if said captured data packet is already processed and modification commands induced by said captured data packet are already determined and maintained in said list of modification commands,

program code configured to control said computer to modify said captured data packet based on said list of modification commands, and

program code configured to control said computer to release the modified captured data packet.

32. A computer-readable medium storing program code which, when executed by a computer, controls said computer to handle data packets, said data packets belonging to a set of data packets having at least partly hierarchical structure, said program code comprising:

program code configured to control said computer to capture data packets,

program code configured to control said computer to accept a captured data packet for processing or declining a captured data packet from processing based on said captured data packet and data packets captured prior to said captured data packet such that data packets are accepted for processing in the order specified by said at least partly hierarchical structure

program code configured to control said computer to decline a captured data packet from processing, if a data packet immediately preceding said captured data packet in said at least partly hierarchical structure is not yet captured,

program code configured to control said computer to delay data packets declined from processing,

program code configured to control said computer to accept a delayed data packet for processing and processing said delayed data packet, if data packet(s) immediately preceding said delayed data packet in said at least partly hierarchical structure is(are) already processed, and

program code configured to control said computer to release the delayed data packet.

33. A computer-readable medium storing program code, which when executed by a computer, controls said computer to handle data packets, said data packets belonging to a set of data packets and forming a plurality of groups of data packets, said program code comprising:

program code configured to control said computer to capture data packets,

program code configured to control said computer to decline a captured data packet belonging to a first group of data packets from processing if all other data packets belonging to said first group of data packets are not yet captured, and delaying said captured data packet, and

program code configured to control said computer to process a captured data packet belonging to a first group of data packets together with delayed data packets belonging to said first group of data packets if said captured data packet belonging to said first group and said delayed data packets belonging to said first group form a full first group of data packets.

34. A computer-readable medium storing program code which, when executed by a computer, causes said computer to handle data packets, said data packets belonging to a set of data packets and forming a plurality of groups of data packets, said program code comprising:

program code configured to control said computer to capture data packets, said data packets containing information fragments belonging to a sequence of information fragments,

program code configured to control said computer to decline a captured data packet from processing, if a data packet containing the information fragment immediately preceding the information fragments of said captured data packet in said sequence is not yet captured, and

program code configured to control said computer to accept a captured data packet for processing if a data packet containing the information fragment immediately preceding the information fragments of said captured data packet in said sequence is already processed, whereby each information fragment of said sequence is processed only once.

35. A network element for handling data packets, said network element comprising a machine whose functions are at least partially controlled by program code, said program code comprising:

program code configuring said network element to capture data packets, said data packets belonging to a set of data packets,

program code configuring said network element to accept a captured data packet for processing based on said captured data packet and data packets captured prior to said captured data packet,

program code configuring said network element to, when processing at least one captured data packet accepted for processing, determine a modification command affecting at least said at least one captured data packet,

program code configuring said network element to maintain a list of modification commands, said list enabling modification of captured data packets,

program code configuring said network element to decline a captured data packet from processing if said captured data packet is already processed and modification commands induced by said captured data packet are already determined and maintained in said list of modification commands,

program code configuring said network element to modify said captured data packet based on said list of modification commands, and

program code configuring said network element to release the modified captured data packet.

36. A network element for handling data packets, said network element comprising a machine whose functions are at least partially controlled by program code, said program code comprising:

program code configuring said network element to capture data packets, said data packets belonging to a set of data packets having at least partly hierarchical structure,

program code configuring said network element to accept a captured data packet for processing or declining a captured data packet from processing based on said captured data packet and data packets captured prior to said captured data packet such that data packets are accepted for processing in the order specified by said at least partly hierarchical structure

program code configuring said network element to decline a captured data packet from processing if a data packet immediately preceding said captured data packet in said at least partly hierarchical structure is not yet captured,

program code configuring said network element to delay data packets declined from processing,

program code configuring said network element to accept a delayed data packet for processing and processing said delayed data packet if data packet(s) immediately preceding said delayed data packet in said at least partly hierarchical structure is(are) already processed, and

program code configuring said network element to release the delayed data packet.

37. A network element for handling data packets, said network element comprising a machine whose functions are at least partially controlled by program code, said program code comprising:

program code configuring said network element to capture data packets, said data packets belonging to a set of data packets and forming a plurality of groups of data packets,

program code configuring said network element to decline a captured data packet belonging to a first group of data packets from processing if all other data packets belonging to said first group of data packets are not yet captured, and delaying said captured data packet, and

program code configuring said network element to process a captured data packet belonging to a first group of data packets together with delayed data packets belonging to said first group of data packets if said captured data packet belonging to said first group and said delayed data packets belonging to said first group form a full first group of data packets.

38. A network element for handling data packets, said network element comprising a machine whose functions are at least partially controlled by program code, said program code comprising:

program code configuring said network element to capture data packets, said data packets belonging to a set of data packets and forming a plurality of groups of data packets and containing information fragments belonging to a sequence of information fragments,

program code configuring said network element to decline a captured data packet from processing if a data packet containing the information fragment immediately preceding the information fragments of said captured data packet in said sequence is not yet captured, and

program code configuring said network element to accept a captured data packet for processing if a data packet containing the information fragment immediately preceding the information fragments of said captured data packet in said sequence is already processed, whereby each information fragment of said sequence is processed only once.