# US 2019/0379768 A1 · Dynamic tcp stream processing with modification notification

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2019/0379768 A1
- Document ID: US20190379768A1
- Status: Published application
- Kind: A1
- Application number: 16/002,148
- Filed: 2018-06-07
- Published: 2019-12-12
- Earliest claimed: 2018-06-07
- Assignees: Hyannis Port Research, Inc.
- Applicants: Hyannis Port Research, Inc.
- Inventors: Anthony D. Amicangioli; Timothy G. Field; Dominick S. Grochowina; Bernard J. Rosen; Andrew C. Carp; Yura Pyatnychko
- Web page: https://patentgrep.com/patent/US20190379768A1

## CPC

- H04L 69/22: Parsing or analysis of headers
- G06Q 40/04: Trading; Exchange, e.g. stocks, commodities, derivatives or currency exchange
- H04L 1/08: by repeating transmission, e.g. Verdan system {(H04L1/1858 and H04L1/189 take precedence)}
- H04L 1/1642: {Formats specially adapted for sequence numbers}
- H04L 47/34: ensuring sequence integrity, e.g. using sequence numbers
- H04L 63/0245: {Filtering by information in the payload}
- H04L 63/0414: {during transmission, i.e. party's identity is protected against eavesdropping, e.g. by using temporary identifiers, but is known to the other party or parties involved in the communication}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR

## Abstract

Techniques for content inspection in a communication network, including detecting a packet in transit between a first and second endpoint, determining that content of the packet fails a content check, modifying a payload containing the content, adjusting a sequence number to account for the modification, and injecting a response message into a corresponding stream in an opposite direction. The response message may contain information relating to a reason for the rejection.

## Claims

### Claim 1

A method comprising:
during a duplex networked session established between a first endpoint and a second endpoint,
inspecting a stream of packets;
upon determining that a message within a selected packet sent from the first endpoint is to be modified,
modifying the message in the selected packet to generate a modified packet;
determining a modified sequence number to account for modifying the message;
sending the modified packet to the second endpoint;
sending a reply message to the first endpoint, the reply message comprising a reason that the original message was modified.

### Claim 2 (depends on 1)

The method of claim 1 wherein the step of determining a modified sequence number comprises:
determining a sequence marker value based on the sequence number of the packet that was modified;
maintaining an accumulator value;
storing a delta value representing a difference in byte count between the original selected packet and the modified packet;
detecting an acknowledgement of the modified packet from the second endpoint; and
adding the delta value to the accumulator value.

### Claim 3 (depends on 2)

The method of claim 2 additionally comprising:
when a subsequently received packet has a sequence number greater than or equal to the sequence marker value
modifying, by the accumulator value, a sequence number of a subsequent packet received from the first endpoint.

### Claim 4 (depends on 3)

The method of claim 3 additionally comprising:
adjusting based on the accumulator value an acknowledgement sequence number of another packet received from the second endpoint.

### Claim 5 (depends on 1)

The method of claim 1 wherein modifying the message in the selected packet comprises replacing the message in the packet with a second message having a different length.

### Claim 6 (depends on 5)

The method of claim 5, wherein the second message comprises one of a heartbeat message, a test message, or a sequence filler message.

### Claim 7 (depends on 1)

The method of claim 1 wherein modifying the message in the selected packet comprises removing the message from the packet.

### Claim 8 (depends on 1)

The method of claim 1 wherein the first endpoint is a client device associated with a trading firm, the second endpoint is a market device associated with a securities exchange system, and the messages are orders to trade a security.

### Claim 9 (depends on 1)

The method of claim 1 wherein sending the reply message to the first endpoint comprises injecting a reply packet comprising the reply message into the stream of packets.

### Claim 10 (depends on 1)

The method of claim 1 wherein the reason that the message was modified relates to at least one of compliance with a trading rule, a security risk, and packet content filtering.

### Claim 11 (depends on 2)

The method of claim 2 additionally comprising:
determining whether an ACK for the modified packet has been received from the second endpoint; and
when it has been determined that an ACK for the modified packet has not been received, then
retransmitting the modified packet; and
disconnecting the session after a time out period.

### Claim 12 (depends on 11)

The method of claim 11, wherein determining whether an ACK for the modified packet has been received is carried out at a regular interval.

### Claim 13 (depends on 11)

The method of claim 11 additionally comprising:
when the ACK received from the second endpoint has a sequence number greater than or equal to the sequence marker, then
clearing a mod pending value.

### Claim 14 (depends on 11)

The method of claim 11, wherein determining whether an ACK for the modified message has been received comprises periodically polling the delta value.

### Claim 15 (depends on 1)

The method of claim 1 additionally comprising:
when an ACK for the modified packet has not yet been received, and
while a subsequent packet also needs to be modified to generate a second modified packet,
stalling the second modified packet until the ACK for the modified packet is received.

### Claim 16 (depends on 15)

The method of claim 15 additionally comprising:
polling the delta value to determine when the ACK for the modified packet has been received;
retransmitting the modified packet in a predetermined time interval;
disconnecting the session after expiration of a predetermined time without receiving the ACK for the modified packet.

### Claim 17

A method comprising:
during a duplex TCP session established between a first TCP endpoint and a second TCP endpoint,
inspecting TCP packets received from the first TCP endpoint;
extracting a TCP sequence number from a selected TCP packet;
identifying a TCP session associated with the selected TCP packet;
determining whether content in the selected TCP packet complies with a rule;
when the selected TCP packet complies with the rule,
allowing the selected TCP packet to reach the second TCP endpoint;
when the selected TCP packet does not comply with the rule,
determining a rejection reason data value;
preventing at least a portion of the selected TCP packet from reaching the second TCP endpoint;
removing at least a portion of the selected TCP packet to form a modified TCP packet;
setting a delta value to a value that depends on the size of the portion thus removed;
applying the delta value to a per-session TCP accumulator associated with the TCP session;
adjusting a TCP sequence number of the modified TCP packet by a value that depends on a size of the per-session TCP accumulator;
sending the modified TCP packet to the second TCP endpoint;
generating a response packet having a value indicating a reason for the rejection; and
sending the response packet to the first TCP endpoint.

### Claim 18

An apparatus comprising:
a fixed logic cut-through device having a first network interface and a second network interface operating independently of one another, the fixed logic cut-through device enabling one or more TCP packet streams to travel between the first and second network interfaces;
a packet inspection device, for inspecting the TCP packet stream to
extract a TCP sequence number from a selected TCP packet;
identifying a session associated with the selected TCP packet;
determining whether the selected TCP packet contains content that does not comply with a rule;
when the selected TCP packet does not comply,
preventing at least a portion of the selected TCP packet from reaching the second network interface;
a controller, comprising fixed logic and one or more programmable data processors, the controller for:
receiving the selected TCP packet and a rejection reason data value from the packet inspection device;
storing as a per-session TCP sequence marker a value based on the sequence number of the selected TCP packet;
trimming the rejected content from the TCP packet to form a modified TCP packet;
writing the modified packet to a memory shared with the fixed-cut through device for sending the modified packet over the second network interface;
setting a per-session delta value to a value that depends on the size of the trimmed content;
adjusting the TCP sequence number of the modified TCP packet according to a value in a per-session TCP accumulator;
extracting a sequence number and a session identifier of TCP packets subsequently arriving over the second network interface;
if a subsequently arriving TCP packet over the second network interface has an ACK sequence number equal to or greater than the associated session's TCP sequence marker, then applying the associated per-session delta value to the TCP accumulator associated with the session;
adjusting the ACK sequence number of the subsequently arriving packet over the second network interface by the value of the TCP accumulator associated with the session; and
generating a response packet for sending over the first network interface, the response packet comprising a value indicating a reason for the rejection.

### Claim 19 (depends on 18)

The apparatus of claim 18 wherein the controller is further for:
setting a Connection Stall mode for the session associated with the selected packet that does not comply with a rule;
when a subsequent packet received from the second network interface belongs to the session which set the Connection Stall mode,
forwarding the generated response packet to the first interface;
forwarding the subsequent packet to the first interface after having forwarded the generated response packet to the first interface; and
clearing the Connection Stall mode of the session.

### Claim 20 (depends on 18)

The apparatus of claim 18 wherein the fixed logic in the controller performs one or more of the steps of:
receiving the selected TCP packet and a rejection reason data value from the packet inspection device;
storing as a per-session TCP sequence marker a value based on the sequence number of the selected TCP packet;
adjusting the TCP sequence number of the modified TCP packet according to a value in a per-session TCP accumulator;
extracting a sequence number and a session identifier of TCP packets subsequently arriving over the second network interface;
if a subsequently arriving TCP packet over the second network interface has an ACK sequence number equal to or greater than the associated session's TCP sequence marker, then applying the associated per-session delta value to the TCP accumulator associated with the session; and
adjusting the ACK sequence number of the subsequently arriving packet over the second network interface by the value of the TCP accumulator associated with the session.

### Claim 21 (depends on 20)

The apparatus of claim 20 wherein the programmable data processor executes program code to perform one or more of the steps of:
trimming the rejected content from the TCP packet to form a modified TCP packet;
writing the modified packet to a memory shared with the fixed-cut through device;
setting a per-session delta value to a value that depends on the size of the trimmed content;
extracting a sequence number and a session identifier of TCP packets subsequently arriving over the second network interface; and
generating a response packet for sending over the first network interface, the response packet comprising a value indicating a reason for the rejection.

### Claim 22 (depends on 18)

The apparatus of claim 18, wherein the controller is further for:
setting a prevention mode indicator value for the session associated with the selected TCP packet that does not comply with a rule;
storing information associated with packets subsequently arriving over the first network interface in a processing queue;
determining whether the information associated with the packets in the processing queue has been processed; and
when it has been determined that the information associated with the packets in the processing queue has been processed, then clearing the prevention mode indicator.