Dynamic TCP stream processing with modification notification
AssigneeHyannis Port Research, Inc.
InventorsAnthony D. Amicangioli, Andrew C. Carp, Timothy G. Field, Dominick S. Grochowina, Yura Pyatnychko, Bernard J. Rosen
Life of this patent
Estimating the term…
Abstract
Techniques for content inspection in a communication network, including detecting a packet in transit between a first and second endpoint, determining that content of the packet fails a content check, modifying a payload containing the content, adjusting a sequence number to account for the modification, and injecting a response message into a corresponding stream in an opposite direction. The response message may contain information relating to a reason for the rejection.
Claims29
A method comprising:
- during a duplex networked session established between a first endpoint and a second endpoint,
- inspecting a stream of packets;
- and
- upon determining that a message within a selected packet received from the first endpoint is to be modified,
- modifying the message in the selected packet to generate a modified packet;
- sending the modified packet to the second endpoint;
- sending a reply message to the first endpoint, the reply message comprising a reply packet including a value that depends on a reason that the message was modified;
- determining a modified packet sequence number to account for modifying the message, by further:
- maintaining an accumulator value;
- storing a delta value representing a difference in byte count between the selected packet and the modified packet;
- detecting an acknowledgement of the modified packet from the second endpoint;
- and
- modifying the accumulator value based on the delta value.
An apparatus comprising:
- one or more interfaces configured to establish a duplex networked session between a first endpoint and a second endpoint,
- a packet inspection device configured to
- inspect a stream of packets, to determine that a message within a selected packet received from the first endpoint is to be modified, and to further:
- modify the message in the selected packet to generate a modified packet;
- send the modified packet to the second endpoint via the one or more interfaces;
- send a reply message to the first endpoint via the one or more interfaces, the reply message comprising a reply packet including a value that depends on a reason that the message was modified;
- maintain an accumulator value;
- store a delta value representing a difference in byte count between the selected packet and the modified packet;
- detect an acknowledgement of the modified packet from the second endpoint;
- modify the accumulator value based on the delta value;
- and
- determine a modified sequence number based on the accumulator value.
An apparatus comprising:
- a packet inspection device, for inspecting a packet stream associated with a duplex network session established between a first endpoint and a second endpoint, and
- upon determining that a message within a selected packet received from the first endpoint contains non-compliant content that does not comply with a rule, for further:
- modifying the message in the selected packet to generate a modified packet;
- determining a modified sequence number to account for modifying the message;
- sending the modified packet to the second endpoint;
- and
- sending a reply message to the first endpoint, the reply message comprising a reason that the message was modified.
Dependencies are inferred from the claim text.