US 11,115,481 B2Granted

Transmission control of protocol state exchange for dynamic stateful service insertion

AssigneeA10 Networks, Inc.

InventorsMicheal Thompson, Martin Grimm, Vernon Richard Groves, Rajkumar Jalan

Life of this patent

Estimating the term…

Loading patent…

Abstract

Provided are methods and systems for a Transmission Control Protocol (TCP) state handoff of a data traffic flow. A method for a TCP state handoff of a data traffic flow comprises determining a TCP state at predetermined times by a state machine unit. The TCP state includes data concerning a session between a client and a server. The TCP state for the predetermined times is stored to a database. A request to apply a predetermined policy to the session is received by a transaction processing unit and, in response to the request, a session request associated with the session between the client and the server is sent to an access control unit. The session request is processed by the access control unit based on the TCP state and according to the predetermined policy.

Claims20

Dependent claims

A system for a Transmission Control Protocol (TCP) state handoff of a data traffic flow, the system comprising:

a hardware state machine unit operable to:
determine a TCP state at predetermined times, wherein the TCP state includes data concerning a session between a client and a server;
a hardware transaction processing unit operable to:
receive a request to apply a predetermined policy to the session, the session being processed by the hardware transaction processing unit, wherein the applying the predetermined policy includes transferring the processing of the session to a hardware access control unit;
and
based on the request, transferring the processing of the session from the hardware transaction processing unit to the hardware access control unit by sending a session request associated with the session between the client and the server to the hardware access control unit;
and
the hardware access control unit operable to:
based on the session request, process the session based on the TCP state, the processing including:
re-establishing, by the hardware access control unit, the session between the client and the server based on the TCP state, the hardware access control unit acting exclusively as a proxy between the client and the server in the session;
communicating data packets associated with the session by:
receiving, by the hardware access control unit, a first portion of the data packets directly from the client and sending, by the hardware access control unit, the first portion of the data packets directly to the server;
and
receiving, by the hardware access control unit, a second portion of the data packets directly from the server and sending, by the hardware access control unit, the second portion of the data packets directly to the client;
and
applying the predetermined policy to the data packets associated with the session.

13 more elements

A method for a Transmission Control Protocol (TCP) state handoff of a data traffic flow, the method comprising:

determining, by a state machine unit, a TCP state at predetermined times, wherein the TCP state includes data concerning a session between a client and a server;
receiving, by a transaction processing unit, a request to apply a predetermined policy to the session, the session being processed by the transaction processing unit, wherein the applying the predetermined policy includes transferring the processing of the session to an access control unit;
based on the request, transferring the processing of the session from the transaction processing unit to the access control unit by sending, by the transaction processing unit, a session request associated with the session between the client and the server to the access control unit;
and
based on the session request, processing, by the access control unit, the session based on the TCP state, the processing including:
re-establishing, by the access control unit, the session between the client and the server based on the TCP state, the access control unit acting exclusively as a proxy between the client and the server in the session;
communicating data packets associated with the session by:
receiving, by the access control unit, a first portion of the data packets directly from the client and sending, by the access control unit, the first portion of the data packets directly to the server;
and
receiving, by the access control unit, a second portion of the data packets directly from the server and sending, by the access control unit, the second portion of the data packets directly to the client;
and
applying the predetermined policy to the data packets associated with the session.

9 more elements

A system for a Transmission Control Protocol (TCP) state handoff of a data traffic flow, the system comprising:

a hardware state machine unit operable to:
determine a TCP state at predetermined times, wherein the TCP state includes data concerning a session between a client and a server;
a hardware transaction processing unit operable to:
receive a request to apply a predetermined policy to the session, the session being processed by the hardware transaction processing unit, wherein the applying the predetermined policy includes transferring the processing of the session to a hardware access control unit;
and
based on the request, transferring the processing of the session from the hardware transaction processing unit to the hardware access control unit by sending a session request associated with the session between the client and the server to the hardware access control unit, wherein the session request is sent to the hardware access control unit using a magic packet, the magic packet including the TCP state and an instruction to process the session according to the predetermined policy;
and
the hardware access control unit operable to:
based on the session request, process the session based on the TCP state, wherein the processing of the session includes:
re-establishing, by the hardware access control unit, the session between the client and the server based on the TCP state, the TCP state being retrieved by the hardware access control unit from the magic packet, the hardware access control unit acting exclusively as a proxy between the client and the server in the session;
communicating data packets associated with the session by:
receiving, by the hardware access control unit, a first portion of the data packets directly from the client and sending, by the hardware access control unit, the first portion of the data packets directly to the server;
and
receiving, by the hardware access control unit, a second portion of the data packets directly from the server and sending, by the hardware access control unit, the second portion of the data packets directly to the client;
and
applying the predetermined policy to the data packets associated with the session.

13 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/805,881Filed 2 Mar 2020 · continuation
Priority: 12 Aug 2015
Published: US 2020/0204632 A125 Jun 2020
Granted: 7 Sep 2021
Term ends: Not estimatedThe source records don’t support an estimate.

Classification4 codes

H04L 67/141
Session management: setup of application sessions
H04L 63/10
Network architectures or network communication protocols for network security: for controlling access to devices or network resources
H04L 69/163
Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]: in-band…
H04L
Digital communication

Family

Application14/825,096Parent of this continuation · filed 12 Aug 2015
US 2020/0204632 A1Pre-grant publication · published 25 Jun 2020
US 10,581,976 B2Parent of this continuation
US 2017/0048356 A1Published application
US 11,115,481 B2This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key