Out-of-band keep-alive mechanism for clients associated with network address translation systems

• US 7,881,318 B2
• Filed: 02/28/2007
• Issued: 02/01/2011
• Est. Priority Date: 02/28/2007
• Status: Expired due to Fees

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Hagman, Marie, Herzog, Shai
• Primary Examiner(s): Sheikh; Ayaz R
• Assistant Examiner(s): HAMPTON, TARELL A
• Application Number:
  US11/712,123
• Publication Number:
  US 20080209068A1
• Time in Patent Office: 1,434 Days
• Field of Search: 370/401, 709/232
• US Class Current: 370/401
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 61/2553 Binding renewal aspects, e.g. using keep-alive messages
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/142 Managing session states for stateless protocols; Signalling session states; State transitions; Keeping-state mechanisms
• CPC Class Codes: H04L 69/28 Timers or timing mechanisms used in protocols

Abstract

Architecture for maintaining connection state of network address translation (NAT) devices by employing an out-of-band (OOB) technique externally to application connections without imposing additional requirements on the underlying native application(s). The OOB solution can be applied to arbitrary connections without requiring modification to an application protocol and works with TCP and UDP. A keep-alive (KA) application is employed as an OOB mechanism that injects KA packets that appear to the NAT device to be coming from the native connection. These injected packets fool the NAT device into resetting the inactivity timer for that connection, but do not fool or confuse the native application, which is oblivious to the spoofing. Accordingly, the connection will not terminate due to NAT timeouts, and therefore, a client/server protocol, for example, will not need to generate fake activity packets to keep the connection alive.

Claims

1. A computer-implemented system that facilitates connection management, comprising:

a connection component including a network device having an inactivity timer, the connection component providing a communications connection between a first software entity on a first computer system and a second software entity on a second computer system, the connection component being configured to drop the communications connection if the network device does not receive an in-band packet communicated over the communications connection between the first software entity and the second software entity within a timeout period of the inactivity timer initiated for the communications connection by the network device; and

a keep-alive component, distinct from the first software entity and the second software entity, for sending out-of-band (OOB) spoofed packets to the connection component that are perceived by the network device as in-band traffic over the communications connection between the first software entity and the second software entity and reset the timeout period of the inactivity timer to maintain the communications connection between the first software entity and the second software entity,

wherein OOB spoofed packets that appear to be communicated over the communications connection from the first software entity to the second software entity are inserted by the keep-alive component into the communications connection between the first software entity and the network device, processed by the network device to reset the timeout period of the inactivity timer, and removed by the keep-alive component from the communications connection after being processed by the network device and before reaching the second software entity, and

wherein the keep-alive component maintains the communications connection between the first software entity and the second software entity by inserting OOB spoofed packets into the communication connection before the timeout period expires until receiving an indication from at least one of the first software entity and the second software entity that the communications connection is no longer desired.

2. The system of claim 1, wherein the arbitrary communications connection accommodates a transport layer connection-oriented end-to-end protocol.

3. The system of claim 1, wherein the arbitrary communications connection accommodates a transport layer connection-less protocol.

4. The system of claim 1, wherein the connection component includes a network address translation (NAT) device that facilitates connection of a private network with a public network.

5. The system of claim 1, wherein the OOB spoofed packets are keep-alive packets.

6. The system of claim 1, wherein the keep-alive component is an application which inserts the OOB spoofed packets based on table activity of a TCP/IP system table.

7. The system of claim 1, wherein the keep-alive component monitors the timeout period of the inactivity timer, employs a keep-alive refresh period based on the timeout period and, based on the refresh period, generates and inserts the OOB spoofed packets into the communications connection.

8. The system of claim 1, wherein the first computer system comprises one of a client and a server.

9. The system of claim 8, wherein the keep-alive component comprises a server-based keep-alive application and a client-based keep-alive application, the server-based and client-based keep-alive applications sending OOB spoofed packets through the connection component to maintain the connection.

10. The system of claim 1, wherein the OOB spoofed packets processed by the connection component are zero-payload packets.

11. A computer-implemented method of managing a connection, comprising:

establishing a Network Address Translation (NAT) connection for communicating in-band packets between a first native application of a first computing system and a second native application of a second computing system through a NAT device having an inactivity timer, wherein the NAT connection is dropped by the NAT device if the NAT device does not receive an in-band packet communicated over the NAT connection between the first native application and the second native application within a timeout period of the inactivity timer initiated for the NAT connection by the NAT device; and

launching a keep-alive application, distinct from the native applications, configured to automatically send out-of band (OOB) spoofed packets to the NAT device that are perceived by the NAT device as in-band traffic over the NAT connection between the first native application and the second native application and reset the timeout period of the inactivity timer to maintain the NAT connection between the first native application and the second native application,

wherein the OOB spoofed packets that appear to be communicated over the NAT connection from the first native application to the second native application are inserted by the keep-alive application into the NAT connection between the first native application and the NAT device, processed by the NAT device to reset the timeout period of the inactivity timer, and removed by the keep-alive application from the connection after being processed by the NAT device and before reaching the second native application, and

wherein the keep-alive application maintains the NAT connection between the first native application and the second native application by inserting OOB spoofed packets into the NAT connection before the timeout period expires until receiving an indication from at least one of the first native application and the second native application that the NAT connection is no longer desired.

12. The method of claim 11, further comprising automatically inserting the OOB spoofed packets into the connection based upon a predetermined connection policy.

13. The method of claim 11, wherein the NAT connection is facilitated via a transmission control protocol (TCP) communications transport technology.

14. The method of claim 11, further comprising launching corresponding keep-alive applications for the first native application and the second native application, the corresponding keep-alive applications automatically sending OOB spoofed packets to maintain the connection based on a new entry in a TCP/IP system table.

15. The method of claim 14, wherein the corresponding keep-alive applications monitor corresponding system tables for connection state and operate to process connection state for multiple NAT connections.

16. The method of claim 11, further comprising:

discovering a tuple that includes at least two of a protocol number, a source IP address, a source port number, a destination IP address, or a destination port number associated with at least one of the native applications; and

resetting the inactivity timer based on OOB spoofed packets that utilize the tuple.

17. The method of claim 11, wherein the OOB spoofed packets removed by the keep-alive application from the connection between the NAT device and the second computing system utilize a destination IP address associated with the second native application.

18. The method of claim 11, further comprising automatically launching the keep-alive application based on in-band activity of at least one of the native applications.

19. The method of claim 11, further comprising automatically launching one or more keep-alive applications and inserting the OOB spoofed packets via the one or more keep-alive applications based on a type of transport protocol employed.

20. A computer-implemented system including a processing unit and memory, the computer-implemented system comprising:

computer-implemented means for automatically establishing a Network Address Translation (NAT) connection for communicating in-band packets between a first native application of a first computer system and a second native application of a second computer system through a NAT device having an inactivity timer, wherein the NAT connection is dropped by the NAT device if the NAT device does not receive an in-band packet communicated over the NAT connection between the first native application and the second native application within a timeout period of the inactivity timer initiated for the NAT connection by the NAT device;

computer-implemented means for automatically launching one or more keep-alive applications which are distinct from the first native application and the second native application;

computer-implemented means for monitoring the NAT connection for inactivity based on a system table; and

computer-implemented means for automatically sending out-of-band (OOB) spoofed packets to the NAT device in response to sensing the inactivity that are perceived by the NAT device as in-band traffic over the NAT connection between the first native application and the second native application and reset the timeout period of the inactivity timer to maintain the NAT connection between the first native application and the second native application,

wherein OOB spoofed packets that appear to be communicated over the NAT connection from the first native application to the second native application are inserted by a keep-alive application into the NAT connection between the native application and the NAT device based on one of TCP packets and UDP packets, processed by the NAT device to reset the timeout period of the inactivity timer, and removed by a keep-alive application from the NAT connection after being processed by the NAT device and before reaching the second native application, and

wherein the keep-alive application maintains the NAT connection between the first native application and the second native application by inserting OOB spoofed packets into the NAT connection before the timeout period expires until receiving an indication from at least one of the first native application and the second native application that the NAT connection is no longer desired.