# US 2014/0195797 A1 · Efficient forwarding of encrypted tcp retransmissions > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0195797 A1 - Document ID: US20140195797A1 - Status: Published application - Kind: A1 - Application number: 13/737,907 - Filed: 2013-01-09 - Published: 2014-07-10 - Earliest claimed: 2013-01-09 - Assignees: Netronome Systems, Inc. - Inventors: Roelof Nico du Toit - Web page: https://patentgrep.com/patent/US20140195797A1 ## CPC - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/168: {above the transport layer} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A network device receives TCP segments of a flow via a first SSL session and transmits TCP segments via a second SSL session. Once a TCP segment has been transmitted, the TCP payload need no longer be stored on the network device. Substantial memory resources are conserved, because the device may have to handle many retransmit TCP segments at a given time. If the device receives a retransmit segment, then the device regenerates the retransmit segment to be transmitted. A data structure of entries is stored, with each entry including a decrypt state and an encrypt state for an associated SSL byte position. The device uses the decrypt state to initialize a decrypt engine, decrypts an SSL payload of the retransmit TCP segment received, uses the encrypt state to initialize an encrypt engine, re-encrypts the SSL payload, and then incorporates the re-encrypted SSL payload into the regenerated retransmit TCP segment. ## Claims ### Claim 1 A method comprising: (a) receiving onto a network appliance a first retransmit TCP (Transmission Control Protocol) segment, wherein the first retransmit TCP segment has: 1) a TCP sequence number in a TCP header of the first retransmit TCP segment, and 2) a first encrypted SSL (Secure Sockets Layer) payload; (b) determining from the TCP sequence number in the TCP header a second TCP sequence number, wherein the second TCP sequence number corresponds to a start of the first encrypted SSL payload; (c) determining from the second TCP sequence number a first start byte position in SSL sequence space, wherein the first start byte position in SSL sequence space corresponds to the start of the first encrypted SSL payload; (d) using the first start byte position to determine: 1) a second start byte position in SSL sequence space, and 2) a decrypt engine state associated with the second start byte position; (e) putting a decrypt engine into the decrypt engine state determined in (d); (f) incrementing the state of the decrypt engine an amount, wherein the amount is a function of the first start byte position and the second start byte position; (g) using the decrypt engine to decrypt the first encrypted SSL payload thereby generating a decrypted SSL payload; (h) encrypting the decrypted SSL payload thereby generating a second encrypted SSL payload; and (i) transmitting from the network appliance a second retransmit TCP segment, wherein the second retransmit TCP segment includes the second encrypted SSL payload that was generated in (h), and wherein the first and second retransmit TCP segments are both communicated across the same flow of the same TCP connection. ### Claim 2 (depends on 1) The method of claim 1, wherein the determining of (d) involves identifying an entry in a data structure, wherein the entry comprises the second start byte position and the associated decrypt engine state. ### Claim 3 (depends on 2) The method of claim 2, wherein at a time there are more unacknowledged TCP segments that were transmitted from the network appliance across the flow of the TCP connection than there are entries in the data structure. ### Claim 4 (depends on 3) The method of claim 3, wherein the entries in the data structure are changed over time as TCP segments are communicated across the flow of the TCP connection. ### Claim 5 (depends on 3) The method of claim 3, wherein the number of entries in the data structure is changed over time as TCP segments are communicated across the flow of the TCP connection. ### Claim 6 (depends on 1) The method of claim 1, wherein the determining of (d) involves identifying an entry in a data structure, wherein the entry comprises the second start byte position, the associated decrypt engine state, and an associated encrypt engine state. ### Claim 7 (depends on 1) The method of claim 1, further comprising: (j) transmitting a TCP segment from the network appliance, wherein the transmitting of (i) occurs prior to the receiving of (a), and wherein the second retransmit TCP segment transmitted in (i) has identical TCP payload to the TCP segment transmitted in (j). ### Claim 8 (depends on 7) The method of claim 7, wherein at the time of the receiving of (a) the network appliance does not store the TCP payload that was transmitted in (j) as part of the TCP segment. ### Claim 9 (depends on 1) The method of claim 1, wherein the decrypt engine implements a stream cipher. ### Claim 10 A method comprising: (a) receiving a first TCP (Transmission Control Protocol) segment from a client in a first SSL session and transmitting the first TCP segment to a server in a second SSL session, wherein the first TCP segment is communicated from the client through a network appliance and to the server via a flow of a TCP connection; (b) receiving a retransmit TCP segment from the client onto the network appliance, wherein the retransmit TCP segment is a retransmit of the first TCP segment, wherein the first TCP segment as transmitted from the client in (a) had a TCP payload, and wherein at the time of the receiving of (b) the network appliance did not store the TCP payload; (c) storing a number of decrypt states on the network appliance, wherein the decrypt states are decrypt states for the flow of the TCP connection, wherein at a time a number of TCP segments communicated from the network appliance to the server via the flow are unacknowledged, and wherein the number of decrypt states stored in (c) is smaller than the number of unacknowledged TCP segments; (d) using one of the decrypt engine states to set the state of a decrypt engine; (e) using the decrypt engine to decrypt an SSL (Secure Sockets Layer) payload of the retransmit TCP segment thereby generating an unencrypted SSL payload, wherein the decrypt engine implements a stream cipher; (f) encrypting the unencrypted SSL payload thereby generating a re-encrypted SSL payload; and (g) transmitting a retransmit TCP segment from the network appliance to the server, wherein the retransmit TCP segment transmitted in (g) includes the re-encrypted SSL payload. ### Claim 11 (depends on 10) The method of claim 10, wherein the number of decrypt states stored in (c) for the flow of the TCP connection varies over time and TCP segments are communicated across the flow of the TCP connection. ### Claim 12 (depends on 10) The method of claim 10, wherein the using of the decrypt engine state in (d) to set the state of the decrypt engine involves: 1) loading the decrypt engine state into the decrypt engine, and 2) after the loading then incrementing the decrypt engine. ### Claim 13 (depends on 10) The method of claim 10, wherein the network appliance stores a data structure having a plurality of entries, wherein each entry includes: 1) a TCP sequence number for the start of an SSL payload in TCP sequence space, and 2) a start byte position for the start of the SSL payload in SSL sequence space. ### Claim 14 (depends on 13) The method of claim 13, wherein the network appliance uses a TCP sequence number in a TCP header of the retransmit TCP segment received in (b) to identify an entry in the data structure. ### Claim 15 (depends on 13) The method of claim 13, wherein the TCP sequence number of an entry in the data structure is not a TCP sequence number in a TCP header. ### Claim 16 (depends on 13) The method of claim 13, wherein a particular TCP segment comprises a first SSL payload and a second SSL payload, wherein the data structure has a first entry for the first SSL payload, and wherein the data structure has a second entry for the second SSL payload. ### Claim 17 A network appliance comprising: first means for storing a first data structure and a second data structure, wherein the first data structure includes a number of first entries for a flow of a TCP (Transmission Control Protocol) connection, wherein each first entry includes: 1) a TCP sequence number for a start of an SSL (Secure Sockets Layer) payload, and 2) a start byte position for the start of the SSL payload in SSL sequence space, wherein the second data structure includes a number of second entries for the flow of the TCP connection, wherein each second entry includes: 1) a start byte position in SSL sequence space, 2) a decrypt engine state, and 3) an encrypt engine state; and second means for receiving a retransmit TCP segment, for using the first and second data structures to decrypt an SSL payload of the retransmit TCP segment thereby generating an unencrypted SSL payload, for encrypting the unencrypted SSL payload thereby generating a re-encrypted SSL payload, and for transmitting a retransmit TCP segment that carries the re-encrypted SSL payload. ### Claim 18 (depends on 17) The network appliance of claim 17, wherein the second means is also for using a TCP sequence number of a TCP header of the retransmit TCP segment received to identify an entry in the first data structure, for using the identified entry in the first data structure to identify an entry in the second data structure, for using a decrypt state of the identified entry in the second data structure to perform said decrypting of the SSL payload, and for using an encrypt state of the identified entry in the second data structure to perform said encrypting of the unencrypted SSL payload. ### Claim 19 (depends on 17) The network appliance of claim 17, wherein the retransmit TCP segment received and the retransmit TCP segment transmitted are communicated across the same TCP connection, wherein the retransmit TCP segment received is communicated via a first SSL session, and wherein the retransmit TCP segment transmitted is communicated via a second SSL session. ### Claim 20 (depends on 17) The network appliance of claim 17, wherein the first means is an amount of semiconductor memory, and wherein the second means comprises transceiver circuitry and a processor. ### Claim 21 (depends on 17) The network appliance of claim 17, wherein at a time a number of TCP segments communicated out of the network appliance via the flow are unacknowledged, and wherein at the time the number of decrypt states stored in the second data structure for the flow is smaller than the number of unacknowledged TCP segments. ### Claim 22 A non-transitory processor-readable medium that stores a set of processor-executable instructions, wherein the set of processor-executable instructions comprises: code for maintaining a first data structure and a second data structure, wherein the first data structure includes a number of first entries for a flow of a TCP (Transmission Control Protocol) connection, wherein each first entry includes: 1) a TCP sequence number for a start of an SSL (Secure Sockets Layer) payload, and 2) a start byte position for the start of the SSL payload in SSL sequence space, wherein the second data structure includes a number of second entries for the flow of the TCP connection, wherein each second entry includes: 1) a start byte position in SSL sequence space, 2) a decrypt engine state, and 3) an encrypt engine state; and code for causing a device: to use the first and second data structures to decrypt an SSL payload of an incoming retransmit TCP segment thereby generating an unencrypted SSL payload, to encrypt the unencrypted SSL payload thereby generating a re-encrypted SSL payload, and to transmit an outgoing retransmit TCP segment that carries the re-encrypted SSL payload.