Back to results
US 11,457,040 B1Granted
Reverse TCP/IP stack
AssigneeBarracuda Networks, Inc.
InventorsPablo German Sole, Jose Luis Ferras Pereira, Sinan Eren, Luisa Marina Moya Praca de Araujo Lima
Life of this patent
Estimating the term…
Abstract
A reverse TCP/IP stack infrastructure is disclosed. In an example use, an application executing on a client device as an operating system extension that uses a virtual private network stack of the operating system intercepts a first IP packet generated by a client program. The application determines that the first IP packet comprises a Transmission Control Protocol synchronize message and opens a socket to a destination Internet Protocol address and destination port. A synchronize acknowledgement is received. A packet to transmit to the client program is synthesized that includes a synchronize acknowledgment.
Claims6
A system, comprising:
- a processor configured to:
- intercept, by an application executing on a client device as an operating system extension that uses a virtual private network (VPN) stack of the operating system, a first IP packet generated by a client program, wherein the application is initiated and launched at startup time by the operating system and wherein the application extends a functionality of the operating system;
- determine, by the application, that the first IP packet comprises a Transmission Control Protocol (TCP) synchronize (SYN) message, and open a socket to a destination Internet Protocol (IP) address and destination port;
- receive, from the destination IP address, a SYN acknowledgement (SYN-ACK);
- receive, from the destination IP address, a plurality of packets;
- synthesize the plurality of packets received from the destination IP address for network security threat;
- transmit from the application to the client program a SYN-ACK and further transmit from the application to the client program the plurality of packets in response to determining no network security threat associated with the plurality of packets;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
6 more elements
A system, comprising:
- a processor configured to:
- intercept, by an application executing on a client device as an operating system extension that uses a virtual private network (VPN) stack of the operating system, a first IP packet generated by a client program, wherein the application is initiated and launched at startup time by the operating system and wherein the application extends a functionality of the operating system;
- determine, by the application, that the first IP packet comprises a Transmission Control Protocol (TCP) packet associated with an existing session using an open socket to a destination Internet Protocol (IP) address and destination port;
- receive, from the destination IP address, a response TCP packet having a payload;
- receive, from the destination IP address, a plurality of packets;
- synthesize a packet received from the destination IP address for network security threat and further transmit to the client program that includes the payload in response to determining no network security threat associated with the synthetized packet;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
5 more elements
A system, comprising:
- a processor configured to:
- intercept, by an application executing on a client device as an operating system extension that uses a virtual private network (VPN) stack of the operating system, a first IP packet generated by a client program, wherein the application is initiated and launched at startup time by the operating system and wherein the application extends a functionality of the operating system;
- determine, by the application, that the first IP packet comprises a Transmission Control Protocol (TCP) finish (FIN) message, transmit a FIN message to a destination Internet Protocol (IP) address and destination port;
- receive, from the destination IP address, a FIN acknowledgement (FIN-ACK) and close an open socket associated with the destination IP address;
- receive, from the destination IP address, a plurality of packets;
- synthesize the plurality of packets received from the destination IP address for network security threat and further transmit from the application to the client program the plurality of packets in response to determining no network security threat associated with the plurality of packets;
- transmit to the client program that includes a FIN-ACK;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
6 more elements
Dependencies are inferred from the claim text.