# US 11,115,481 B2 · Transmission control of protocol state exchange for dynamic stateful service insertion > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,115,481 B2 - Document ID: US11115481B2 - Status: Granted - Kind: B2 - Application number: 16/805,881 - Filed: 2020-03-02 - Published: 2020-06-25 - Granted: 2021-09-07 - Earliest claimed: 2015-08-12 - Assignees: A10 Networks, Inc. - Applicants: A10 Networks, Inc. - Inventors: Micheal Thompson; Martin Grimm; Vernon Richard Groves; Rajkumar Jalan - Web page: https://patentgrep.com/patent/US11115481B2 ## CPC - H04L 67/141: Setup of application sessions (admission control or resource allocation in data switching networks H04L47/70) - H04L 63/10: {for controlling access to devices or network resources} - H04L 69/163: In-band adaptation of TCP data exchange; In-band control procedures - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Provided are methods and systems for a Transmission Control Protocol (TCP) state handoff of a data traffic flow. A method for a TCP state handoff of a data traffic flow comprises determining a TCP state at predetermined times by a state machine unit. The TCP state includes data concerning a session between a client and a server. The TCP state for the predetermined times is stored to a database. A request to apply a predetermined policy to the session is received by a transaction processing unit and, in response to the request, a session request associated with the session between the client and the server is sent to an access control unit. The session request is processed by the access control unit based on the TCP state and according to the predetermined policy. ## Claims ### Claim 1 A system for a Transmission Control Protocol (TCP) state handoff of a data traffic flow, the system comprising: a hardware state machine unit operable to: determine a TCP state at predetermined times, wherein the TCP state includes data concerning a session between a client and a server; a hardware transaction processing unit operable to: receive a request to apply a predetermined policy to the session, the session being processed by the hardware transaction processing unit, wherein the applying the predetermined policy includes transferring the processing of the session to a hardware access control unit; and based on the request, transferring the processing of the session from the hardware transaction processing unit to the hardware access control unit by sending a session request associated with the session between the client and the server to the hardware access control unit; and the hardware access control unit operable to: based on the session request, process the session based on the TCP state, the processing including: re-establishing, by the hardware access control unit, the session between the client and the server based on the TCP state, the hardware access control unit acting exclusively as a proxy between the client and the server in the session; communicating data packets associated with the session by: receiving, by the hardware access control unit, a first portion of the data packets directly from the client and sending, by the hardware access control unit, the first portion of the data packets directly to the server; and receiving, by the hardware access control unit, a second portion of the data packets directly from the server and sending, by the hardware access control unit, the second portion of the data packets directly to the client; and applying the predetermined policy to the data packets associated with the session. ### Claim 2 (depends on 1) The system of claim 1, wherein the processing of the session further includes establishing a further session between the client and the server, the further session being established based on the TCP state retrieved by the hardware access control unit. ### Claim 3 (depends on 1) The system of claim 1, wherein the hardware state machine unit is further configured to store the TCP state for the predetermined times to at least one of the hardware state machine unit and a database. ### Claim 4 (depends on 3) The system of claim 3, wherein the storing of the TCP state includes: initializing a further state machine unit; and storing the TCP state to the further state machine unit. ### Claim 5 (depends on 3) The system of claim 3, wherein the storing of the TCP state includes: encoding the TCP state into a signal; and sending the signal to the hardware access control unit. ### Claim 6 (depends on 1) The system of claim 1, wherein the processing includes sending a reset request to the client, the reset request prompting the client to resend the session request. ### Claim 7 (depends on 1) The system of claim 1, wherein the session request is sent to the hardware access control unit using a magic packet, the magic packet including the TCP state and an instruction to process the session according to the predetermined policy. ### Claim 8 (depends on 1) The system of claim 1, wherein the data concerning the session include at least one or more of the following: a source port destination, a current sequence number, a window, a timestamp, and a timer. ### Claim 9 (depends on 1) The system of claim 1, wherein the hardware transaction processing unit is further operable to delay the sending of the session request until the hardware state machine unit determines the TCP state. ### Claim 10 A method for a Transmission Control Protocol (TCP) state handoff of a data traffic flow, the method comprising: determining, by a state machine unit, a TCP state at predetermined times, wherein the TCP state includes data concerning a session between a client and a server; receiving, by a transaction processing unit, a request to apply a predetermined policy to the session, the session being processed by the transaction processing unit, wherein the applying the predetermined policy includes transferring the processing of the session to an access control unit; based on the request, transferring the processing of the session from the transaction processing unit to the access control unit by sending, by the transaction processing unit, a session request associated with the session between the client and the server to the access control unit; and based on the session request, processing, by the access control unit, the session based on the TCP state, the processing including: re-establishing, by the access control unit, the session between the client and the server based on the TCP state, the access control unit acting exclusively as a proxy between the client and the server in the session; communicating data packets associated with the session by: receiving, by the access control unit, a first portion of the data packets directly from the client and sending, by the access control unit, the first portion of the data packets directly to the server; and receiving, by the access control unit, a second portion of the data packets directly from the server and sending, by the access control unit, the second portion of the data packets directly to the client; and applying the predetermined policy to the data packets associated with the session. ### Claim 11 (depends on 10) The method of claim 10, wherein the processing of the session further includes establishing a further session between the client and the server, the further session being established based on the TCP state retrieved by the access control unit. ### Claim 12 (depends on 10) The method of claim 10, further comprising storing the TCP state for the predetermined times to at least one of the state machine unit and a database. ### Claim 13 (depends on 12) The method of claim 12, wherein the storing of the TCP state further includes: initializing a further state machine unit; and storing the TCP state to the further state machine unit. ### Claim 14 (depends on 12) The method of claim 12, wherein the storing of the TCP state includes: encoding the TCP state into a signal; and sending the signal to the access control unit. ### Claim 15 (depends on 10) The method of claim 10, wherein the processing includes sending a reset request to the client, the reset request prompting the client to resend the session request. ### Claim 16 (depends on 10) The method of claim 10, wherein the session request is sent to the access control unit using a magic packet, the magic packet including the TCP state and an instruction to process the session according to the predetermined policy. ### Claim 17 (depends on 10) The method of claim 10, wherein the data concerning the session include at least one or more of the following: a source port destination, a current sequence number, a window, a timestamp, and a timer. ### Claim 18 (depends on 10) The method of claim 10, wherein the predetermined policy includes one or more of the following: a security policy and a forwarding policy. ### Claim 19 (depends on 10) The method of claim 10, further comprising delaying, by the transaction processing unit, sending the session request until the state machine unit determines the TCP state. ### Claim 20 A system for a Transmission Control Protocol (TCP) state handoff of a data traffic flow, the system comprising: a hardware state machine unit operable to: determine a TCP state at predetermined times, wherein the TCP state includes data concerning a session between a client and a server; a hardware transaction processing unit operable to: receive a request to apply a predetermined policy to the session, the session being processed by the hardware transaction processing unit, wherein the applying the predetermined policy includes transferring the processing of the session to a hardware access control unit; and based on the request, transferring the processing of the session from the hardware transaction processing unit to the hardware access control unit by sending a session request associated with the session between the client and the server to the hardware access control unit, wherein the session request is sent to the hardware access control unit using a magic packet, the magic packet including the TCP state and an instruction to process the session according to the predetermined policy; and the hardware access control unit operable to: based on the session request, process the session based on the TCP state, wherein the processing of the session includes: re-establishing, by the hardware access control unit, the session between the client and the server based on the TCP state, the TCP state being retrieved by the hardware access control unit from the magic packet, the hardware access control unit acting exclusively as a proxy between the client and the server in the session; communicating data packets associated with the session by: receiving, by the hardware access control unit, a first portion of the data packets directly from the client and sending, by the hardware access control unit, the first portion of the data packets directly to the server; and receiving, by the hardware access control unit, a second portion of the data packets directly from the server and sending, by the hardware access control unit, the second portion of the data packets directly to the client; and applying the predetermined policy to the data packets associated with the session.