Non-translation port over-subscription for proxy devices

Abstract

Some embodiments herein relate to non-translated port over-subscription for a proxy device. In some implementations, a proxy device can intercept a client session associated with a client device and a target device. The proxy device can assign a first port of the proxy device as a source port for a proxy session for the client session. The proxy device can determine, based on assigning the first port, whether session information associated with the proxy session will match session information associated with another proxy session. The proxy device can initiate the proxy session. The source port of the proxy session is one of: the first port of the proxy device based on a determination that the session information associated with the proxy session will not match the session information associated with the another proxy session; or a second port of the proxy device based on a determination that the session information associated with the proxy session will match the session information associated with the another proxy session.

Description

Background Technology

[0001] A proxy device (also known as a proxy server) is a device that acts as a gateway between a client device and a target device, allowing the client device to communicate with the target device via a network (e.g., the Internet). In other words, a proxy device acts as an intermediary server separating the client device from the target device. In some deployments, proxy devices can be used to provide privacy and / or security for client devices. Summary of the Invention

[0002] Some implementations described herein relate to a method. This method may include intercepting client sessions associated with a client device and a target device by a proxy device. This method may include assigning a first port of the proxy device as the source port for a proxy session for the client session. This method may include determining, based on the assigned first port, whether session information associated with the proxy session will match session information associated with another proxy session. This method may include initiating a proxy session by the proxy device after determining whether the session information associated with the proxy session will match session information associated with another proxy session, wherein the source port of the proxy session is one of the following: a first port of the proxy device, based on the determination that the session information associated with the proxy session will not match the session information associated with another proxy session; or the source port of the proxy session is a second port of the proxy device, based on the determination that the session information associated with the proxy session will match the session information associated with another proxy session.

[0003] Some implementations described herein relate to a device. The device may include one or more memories and one or more processors. The device may be configured to intercept a first session associated with a first device and a second device. The device may be configured to assign a first port of the device as the source port of a second session associated with the first session. The device may be configured to determine, based on the assigned first port, whether session information associated with the second session will match session information associated with another session. The device may be configured to initiate a second session after determining whether session information associated with the second session will match session information associated with another session, wherein the source port of the second session is one of the following: the device's first port, based on the determination that session information associated with the second session will not match session information associated with another session; or the device's second port, based on the determination that session information associated with the second session will match session information associated with another session.

[0004] Some implementations described herein relate to a non-transitory computer-readable medium storing an instruction set for a proxy device. When executed by one or more processors of the proxy device, the instruction set enables the proxy device to allocate a first port of the proxy device as the source port of a proxy session for a client session associated with a client device and a target device. When executed by one or more processors of the proxy device, the instruction set enables the proxy device to initiate a proxy session with the target device based on determining whether session information associated with the proxy session will match session information associated with another proxy session, wherein the source port of the proxy session is one of: a first port of the proxy device, based on determining that the session information associated with the proxy session will not match the session information associated with another proxy session; or a second port of the proxy device, based on determining that the session information associated with the proxy session will match the session information associated with another proxy session.

[0005] One aspect of this disclosure provides a method comprising: intercepting a client session associated with a client device and a target device by a proxy device; allocating a first port of the proxy device as a source port for a proxy session for the client session by the proxy device; determining, based on the allocation of the first port, whether session information associated with the proxy session will match session information associated with another proxy session; and initiating the proxy session by the proxy device after determining whether the session information associated with the proxy session will match session information associated with another proxy session, wherein the source port of the proxy session is one of the following: the first port of the proxy device, based on the determination that the session information associated with the proxy session will not match session information associated with another proxy session, or the second port of the proxy device, based on the determination that the session information associated with the proxy session will match session information associated with another proxy session.

[0006] According to one or more embodiments of this disclosure, based on determining that the first port of the proxy device is assigned to at least one proxy session, it is determined whether the session information associated with the proxy session will match the session information associated with another proxy session being executed.

[0007] According to one or more embodiments of this disclosure, it further includes: storing mapping information that associates the proxy session with the client session.

[0008] According to one or more embodiments of this disclosure, the method further includes: allocating the second port of the proxy device as the source port of the proxy session based on determining that the session information associated with the proxy session will match the session information associated with another proxy session; and determining that the session information associated with the proxy session will not match the session information associated with another proxy session.

[0009] According to one or more embodiments of this disclosure, the session information associated with the proxy session indicates: the source address of the proxy session, the source port of the proxy session, the destination address of the proxy session, the destination port of the proxy session, and the protocol associated with the proxy session.

[0010] According to one or more embodiments of this disclosure, the source socket of the proxy session matches the source socket of one or more other proxy sessions initiated by the proxy device.

[0011] According to one or more embodiments of this disclosure, it further includes: storing the session information associated with the proxy session.

[0012] Another aspect of this disclosure provides an apparatus comprising: one or more memories; and one or more processors for: intercepting a first session associated with a first device and a second device; allocating a first port of the device as a source port for a second session associated with the first session; determining, based on the allocation of the first port, whether session information associated with the second session will match session information associated with another session; and initiating the second session after determining whether the session information associated with the second session will match session information associated with another session, wherein the source port of the second session is one of: the first port of the device, based on the determination that the session information associated with the second session will not match session information associated with another session, or the second port of the device, based on the determination that the session information associated with the second session will match session information associated with another session.

[0013] According to one or more embodiments of this disclosure, the one or more processors are further configured to: determine, based on determining that the first port of the device is assigned to at least one session, whether the session information associated with the second session will match session information associated with another session.

[0014] According to one or more embodiments of this disclosure, the one or more processors are further configured to: store mapping information that associates the second session with the first session.

[0015] According to one or more embodiments of this disclosure, the one or more processors are further configured to: allocate the second port of the device as the source port of the second session based on determining that the session information associated with the second session will match the session information associated with another session; and determine that the session information associated with the second session will not match the session information associated with another session.

[0016] According to one or more embodiments of this disclosure, the session information associated with the second session indicates: the source address of the second session, the source port of the second session, the destination address of the second session, the destination port of the second session, and the protocol associated with the second session.

[0017] According to one or more embodiments of this disclosure, the source socket of the second session matches the source socket of one or more other sessions initiated by the device.

[0018] According to one or more embodiments of this disclosure, the one or more processors are further configured to: store the session information associated with the second session.

[0019] Another aspect of this disclosure provides a non-transitory computer-readable medium storing an instruction set comprising: one or more instructions, which, when executed by one or more processors of an agent device, cause the agent device to: allocate a first port of the agent device as a source port for a proxy session for a client session associated with a client device and a target device; and initiate the proxy session with the target device based on determining whether session information associated with the proxy session will match session information associated with another proxy session, wherein the source port of the proxy session is one of: the first port of the agent device based on determining that the session information associated with the proxy session will not match session information associated with another proxy session, or the second port of the agent device based on determining that the session information associated with the proxy session will match session information associated with another proxy session.

[0020] According to one or more embodiments of this disclosure, the one or more instructions further cause the agent device to: determine whether the session information associated with the agent session will match session information associated with another agent session.

[0021] According to one or more embodiments of this disclosure, wherein the one or more instructions cause the proxy device to: determine whether the session information associated with the proxy session will match the session information associated with another proxy session, based on determining that the first port of the proxy device is assigned to at least one proxy session.

[0022] According to one or more embodiments of this disclosure, the one or more instructions further cause the proxy device to: store mapping information that associates the proxy session with the client session.

[0023] According to one or more embodiments of this disclosure, wherein the one or more instructions further cause the proxy device to: allocate the second port of the proxy device as the source port of the proxy session based on determining that the session information associated with the proxy session will match the session information associated with another proxy session; and determine that the session information associated with the proxy session will not match the session information associated with another proxy session.

[0024] According to one or more embodiments of this disclosure, the source socket of the proxy session matches the source socket of one or more other proxy sessions associated with the proxy device. Attached Figure Description

[0025] Figure 1A and Figure 1B This is a diagram illustrating an exemplary implementation associated with oversubscription of a non-converting port for a proxy device.

[0026] Figure 2 This is a diagram illustrating an exemplary environment in which the systems and / or methods described herein may be implemented.

[0027] Figure 3 This is a diagram of an exemplary component of a device associated with oversubscription of a non-converting port used as a proxy device.

[0028] Figure 4 This is a diagram of an exemplary component of a device associated with oversubscription of a non-converting port used as a proxy device.

[0029] Figure 5 This is a flowchart of an exemplary process associated with oversubscription of a non-conversion port for a proxy device. Detailed Implementation

[0030] The following detailed description of an exemplary implementation refers to the accompanying drawings. The same reference numerals in different drawings may identify the same or similar elements.

[0031] In normal operation, proxy devices (e.g., web proxies) are configured to intercept client sessions and initiate proxy sessions to the target device associated with the client session. However, the number of proxy sessions a proxy device can maintain is limited. For example, a proxy device with a single egress interface may be limited to handling a maximum of 65,536 proxy sessions initiated from the proxy device.

[0032] In one example, a client device with an Internet Protocol (IP) address of 115.99.111.113 and using port 60026 initiates a client session to communicate with a first target device (e.g., a first web server) with an IP address of 34.120.237.76 on port 443. Here, a proxy device with an IP address of 10.10.1.10 intercepts the client session, terminates it, and initiates a new proxy session from the proxy device (10.10.1.10) to the first target device using its IP address and port 38095. Here, the number of available ports can be scaled up to 65536, meaning the proxy device can support up to 65536 proxy sessions. Therefore, as the client device continues to initiate client sessions, the proxy device may exhaust the source ports to be allocated to proxy sessions and may therefore be unable to initiate proxy sessions to the target device. This could reduce the reliability of communication for a given client device.

[0033] Some implementations described herein provide techniques and apparatus for non-translation port oversubscription for proxy devices. In some implementations, the proxy device can intercept client sessions and assign a first port of the proxy device as the source port of the proxy session for the client session. The proxy device can then determine, based on the assigned first port, whether session information associated with the proxy session (e.g., a 5-tuple) will match session information associated with another proxy session, and can initiate a proxy session after the determination. Here, the source port of the proxy session can be the first port of the proxy device, based on the determination that the session information associated with the proxy session will not match the session information associated with another proxy session. Alternatively, the source port of the proxy session can be a second port of the proxy device, based on the determination that the session information associated with the proxy session will match the session information associated with another proxy session.

[0034] In some implementations, by utilizing the techniques and apparatus described herein, a proxy device can handle multiple destination sockets (i.e., destination IP / destination port combinations) using a given source socket (i.e., a given proxy IP address / proxy port combination). That is, a given port of the proxy device can be assigned as the source port for multiple proxy sessions, effectively removing session limitations (e.g., the 65536-session limit), thereby improving the reliability of communication to a given client device via the proxy device. Additionally, the techniques and apparatus described herein do not rely on port overload (e.g., port overload using Network Address Translation (NAT) or Port Address Translation (PAT)) to increase the capacity at the proxy device, which means reduced processing overhead at the proxy device (e.g., compared to scenarios where NAT or PAT is applied). Additional details are provided below.

[0035] Figure 1A and Figure 1B This is a diagram of an exemplary implementation 100 associated with oversubscription of a non-translation port for a proxy device. (See diagram for example.) Figure 1A As shown in Figure B, exemplary implementation 100 includes client device 210, proxy device 220, and target device 230. The following is in conjunction with... Figures 2 to 4 Describe these devices in more detail.

[0036] like Figure 1A As shown in reference 102, proxy device 220 can intercept client sessions associated with client device 210 and target device 230. For example, proxy device 220 can receive from client device 210 an indication that client device 210 wants to initiate a session with target device 230. In some implementations, this indication may include a Hypertext Transfer Protocol (HTTP) request.

[0037] In some implementations, proxy device 220 may receive session information associated with a client session when intercepting the client session. For example, an HTTP request may include session information associated with the client session. The session information may include, for example, information indicating: (1) the source address of the client session (e.g., the IP address of client device 210), (2) the source port of the client session (e.g., the port of client device 210), (3) the destination address of the client session (e.g., the IP address of destination device 230), (4) the destination port of the client session (e.g., the port of destination device 230), and / or (5) the protocol associated with the client session (e.g., Transmission Control Protocol (TCP), IP, etc.). Therefore, in some implementations, the session information includes a 5-tuple associated with the client session. In some implementations, proxy device 220 terminates the client session based on interception.

[0038] As shown with reference to 104, proxy device 220 may assign a first port of proxy device 220 as the source port for a proxy session corresponding to a client session. That is, in some implementations, proxy device 220 may assign a port of proxy device 220 as the source port associated with initiating a proxy session corresponding to a client session. In some implementations, proxy device 220 selects the port of proxy device 220 to be assigned for the proxy session in a sequential manner (e.g., such that ports are assigned in a specific order), a randomized manner (e.g., such that ports are assigned in a random order), a priority order (e.g., such that ports not currently used for the proxy session are assigned before those ports are used), or another manner configured on proxy device 220.

[0039] In some implementations, proxy device 220 may allocate a first port of proxy device 220 as a source port for a proxy session based on the determination that the first port has not been allocated to any proxy session. That is, in some implementations, proxy device 220 may identify a port of proxy device 220 that has not been allocated to any proxy session and may allocate the identified port as a source port for a proxy session. In this way, proxy device 220 may, in some implementations, allocate an unassigned port of proxy device 220 as a source port for a proxy session and then reuse a given assigned port of proxy device 220 for another proxy session.

[0040] As shown with reference to 106, proxy device 220 can determine whether session information associated with a proxy session will match session information associated with another proxy session based on the allocation of a first port. For example, proxy device 220 can determine session information (e.g., a 5-tuple) associated with a proxy session that will use the first port of proxy device 220 as the source port for the proxy session. Proxy device 220 can then compare this session information with session information (e.g., 5-tuples) associated with other proxy sessions supported by proxy device 220.

[0041] As a specific example, proxy device 220 may receive a 5-tuple associated with a client session, indicating: the source address of the client session (e.g., the IP address of client device 210, such as 115.99.111.113), the source port of the client session (e.g., a port of client device 210, such as 60026), the destination address of the client session (e.g., the IP address of destination device 230, such as 34.120.237.76), the destination port of the client session (e.g., a port of destination device 230, such as 443), and the protocol associated with the client session (e.g., TCP / IP). In this example, proxy device 220 uses a specific IP address of proxy device 220 (e.g., 10.10.1.10) as the source address for the proxy session and assigns a first port of proxy device 220 (e.g., 38095) as the source port for the proxy session. Therefore, in this example, the session information associated with the proxy session will be a 5-tuple indicating: the source address of the proxy session (e.g., 10.10.1.10 – the IP address of proxy device 220), the source port of the proxy session (e.g., 38095 – the first port assigned to client device 210), the destination address of the proxy session (e.g., 34.120.237.76 – the IP address of target device 230), the destination port of the proxy session (e.g., 443 – the port of target device 230), and the protocol associated with the proxy session (e.g., TCP / IP). Here, proxy device 220 compares the 5-tuple associated with the proxy session with 5-tuples associated with other proxy sessions supported by proxy device 220 and determines whether any 5-tuple associated with other proxy sessions matches the 5-tuple associated with the proxy session.

[0042] In some implementations, when each item in the session information associated with the proxy session (e.g., source address, source port, destination address, destination port, and protocol) is identical to a corresponding item in the session information associated with another proxy session, the proxy device 220 determines that the session information associated with the proxy session will match the session information associated with the other proxy session. Using the above example, when the 5-tuples included in the session information associated with other sessions are identical to the 5-tuples in the session information associated with the proxy session (e.g., 10.10.1.10, 38095, 34.120.237.76, 443, TCP / IP), the proxy device 220 will determine that the session information associated with the proxy session matches the session information associated with the other proxy session. Conversely, when at least one item in the session information associated with the proxy session differs from a corresponding item in the session information associated with other proxy sessions, the proxy device 220 determines that the session information associated with the proxy session will not match the session information associated with the other proxy session. Using the above example, when the 5-tuple included in the session information associated with another session is different from the 5-tuple of the session information associated with the proxy session (e.g., 10.10.1.10, 38095, 142.250.69.206, 443, TCP / IP), the proxy device 220 will determine that the session information associated with the proxy session does not match the session information associated with another proxy session. Therefore, as long as at least one item of the information included in the session information associated with the proxy session (such as the destination address or destination port) is different from the corresponding item included in the session information associated with other proxy sessions, the proxy device 220 determines that the session information associated with the proxy session does not match the session information associated with other proxy sessions.

[0043] In some implementations, proxy device 220 may compare session information associated with the proxy session with session information associated with multiple other proxy sessions supported by proxy device 220 (e.g., enabling proxy device 220 to determine whether the session information associated with the proxy session matches the session information associated with any proxy session supported by proxy device 220). For example, proxy device 220 may compare the session information associated with the proxy session with the session information of each other proxy session supported by proxy device 220, where the source socket (i.e., source address and source port) used by each other proxy session is the same as the source socket that the proxy session will use.

[0044] In some implementations, proxy device 220 can determine whether session information associated with a proxy session will match session information associated with another proxy session based on the determination that a first port of proxy device 220 is assigned to at least one proxy session. That is, in some implementations, proxy device 220 can maintain port allocation information identifying ports already assigned to proxy device 220 (e.g., ports used for other proxy sessions). Here, if proxy device 220 determines that its first port is assigned to at least one proxy session, it can determine whether the session information associated with that proxy session will match session information associated with at least one other proxy session, where the first port is assigned to that at least one other proxy session (e.g., in the manner described above). Conversely, if proxy device 220 determines that its first port is not assigned to at least one proxy session, it can initiate a proxy session with target device 230, where the source port of the proxy session is the first port of proxy device 220. In other words, when the first port is not assigned to any proxy session, the proxy device 220 can continue to use the first port to initiate a proxy session without having to compare the session information with the session information associated with other proxy sessions.

[0045] As shown in reference 108, if proxy device 220 determines that the session information associated with the proxy session will not match the session information associated with another proxy session, then proxy device 220 can initiate a proxy session with target device 230, wherein the source port of the proxy session is the first port of the proxy device. In other words, if proxy device 220 determines that the session information associated with the proxy session will not match the session information associated with another proxy session, then proxy device 220 can use the first port as the source port for the proxy session.

[0046] Conversely, refer to Figure 1B If proxy device 220 determines that session information associated with a proxy session will match session information associated with another proxy session, then proxy device 220 may initiate a proxy session with target device 230 in some implementations, wherein the source port of the proxy session is a different port of the proxy device (e.g., a port of proxy device 220 other than the first port).

[0047] For example, as shown with reference to 110, proxy device 220 may allocate a second port of the proxy device as the source port of the proxy session based on determining that the session information associated with the proxy session will match the session information associated with another proxy session. That is, if the first port will be used as the source port for the proxy session, proxy device 220 may allocate a second (different) port as the source port for the proxy session based on determining that the session information associated with the proxy session will match the session information associated with another proxy session. In some implementations, proxy device 220 may allocate the second port in a manner similar to that described above regarding the allocation of the first port (e.g., in a specific order, in a randomized order, in a prioritized order, etc.).

[0048] As shown in reference 112, after allocating the second port, proxy device 220 can determine that the session information associated with the proxy session will not match the session information associated with another proxy session. For example, proxy device 220 can determine whether the session information associated with the proxy session will match the session information associated with another proxy session based on the allocation of the second port. As a specific example, proxy device 220 can determine the session information (e.g., a 5-tuple) associated with the proxy session that will use the second port of proxy device 220 as the source port for the proxy session. Proxy device 220 can then compare this session information with the session information (e.g., a 5-tuple) associated with other proxy sessions supported by proxy device 220 in the manner described above. Here, when the second port is used as the source port of the proxy session, proxy device 220 can determine that the session information associated with the proxy session will not match the session information associated with another proxy session. In this scenario, as shown in reference 114, proxy device 220 can initiate a proxy session with target device 230, where the source port of the proxy session is the second port of the proxy device. In other words, if the proxy device 220 determines that the session information associated with the proxy session will not match the session information associated with another proxy session, the proxy device 220 can use the second port as the source port for the proxy session.

[0049] In an alternative scenario, when using a second port as the source port for a proxy session, proxy device 220 can determine that session information associated with the proxy session will match session information associated with another proxy session. In this scenario, proxy device 220 can assign a third port as the source port for the proxy session, and when using the third port as the source port for the proxy session, determine whether the session information associated with the proxy session will match session information associated with another proxy session. Typically, proxy device 220 can repeat these operations until proxy device 220 assigns a port as the source port for the proxy session, which will result in session information not matching session information associated with another proxy session supported by proxy device 220.

[0050] In some implementations, proxy device 220 stores session information associated with the proxy session. For example, proxy device 220 may store a 5-tuple associated with the proxy session based on the initiation of the proxy session (e.g., using a first port of proxy device 220 as the source port or using a second port of proxy device 220 as the source port). In some implementations, proxy device 220 stores session information such that it can compare the session information associated with a proxy session to be established later with the session information associated with the proxy session in the manner described above.

[0051] In some implementations, proxy device 220 may store mapping information that associates proxy sessions with client sessions. For example, based on initiating a proxy session (e.g., using a first port of proxy device 220 as the source port or using a second port of proxy device 220 as the source port), proxy device 220 may store mapping information that associates client sessions with proxy sessions. In some implementations, the mapping information may include an indication of associating a session identifier of the client session with a session identifier of the proxy session. In some implementations, proxy device 220 uses mapping information associated with routing services between client device 210 and target device 230.

[0052] It is worth noting that, according to the implementation described herein, the source socket of a proxy session can, in some cases, match the source socket of one or more other proxy sessions initiated by proxy device 220. That is, a given socket (e.g., a given source IP address and source socket pair) can be used for multiple proxy sessions initiated by proxy device 220. In this way, any given port of proxy device 220 (e.g., all 65536 ports of proxy device 220) can support multiple proxy sessions, thereby effectively removing session limitations (e.g., the 65536-session limit) and improving communication reliability.

[0053] As mentioned above, providing Figure 1A and Figure 1B As an example. Other examples may be found related to... Figure 1A and Figure 1B The examples described are different. Figure 1A and Figure 1B The number and arrangement of the equipment shown are provided as an example. In practice, with Figure 1A and Figure 1B Compared to the equipment shown, there may be additional equipment, fewer equipment, different equipment, or equipment with different arrangements. Furthermore, Figure 1A and Figure 1B The two or more devices shown can be implemented within a single device, or Figure 1A and Figure 1B The single device shown can be implemented as multiple distributed devices. Alternatively, Figure 1A and Figure 1B The set of devices shown (e.g., one or more devices) can perform actions described by Figure 1A and Figure 1B The other set of devices shown performs one or more functions.

[0054] Figure 2 This is a diagram of an exemplary environment 200 in which the systems and / or methods described herein can be implemented. (See diagram 200 for details.) Figure 2 As shown, environment 200 may include one or more client devices 210 (shown as client devices 210-1 to client devices 210-M (M≥1)), proxy device 220, one or more target devices (shown as target devices 230-1 to target devices 230-N (N≥1)), and network 240. The devices in environment 200 may be interconnected via wired connection, wireless connection, or a combination of wired and wireless connection.

[0055] Client device 210 includes one or more devices capable of receiving, generating, storing, processing, and / or providing information (such as the information described herein). For example, client device 210 may include mobile phones (e.g., smartphones or wireless phones), laptop computers, tablet computers, desktop computers, handheld computers, gaming devices, wearable communication devices (e.g., smartwatches, smart glasses, heart rate monitors, fitness trackers, smart clothing, smart jewelry, or head-mounted displays) or similar types of devices. In some implementations, client device 210 may receive network traffic from and / or provide network traffic to other client devices 210, proxy devices 220, and / or target devices 230 via network 240 (e.g., by using proxy device 220 as an intermediary to route packets).

[0056] Agent device 220 includes one or more devices capable of receiving, processing, storing, routing, and / or providing services (e.g., packets or other information or metadata) in the manner described herein. For example, agent device 220 may include routers such as label switching routers (LSRs), label edge routers (LERs), ingress routers, egress routers, provider routers (e.g., provider edge routers or provider core routers), virtual routers, or another type of router. Additionally or alternatively, agent device 220 may include gateways, switches, firewalls, hubs, bridges, reverse proxies, servers (e.g., proxy servers, cloud servers, or data center servers), load balancers, and / or similar devices. In some implementations, agent device 220 may be a physical device implemented within a enclosure such as a chassis. In some implementations, agent device 220 may be a virtual device implemented by one or more computer devices in a cloud computing environment or data center. In some implementations, a group of agent devices 220 may be a group of data center nodes used to route services over network 240.

[0057] Target device 230 includes one or more devices capable of receiving, generating, storing, processing, and / or providing information (such as the information described herein). For example, target device 230 may include a laptop computer, tablet computer, desktop computer, a group of target devices, or similar types of devices associated with a multicast service. In some implementations, target device 230 may receive information from and / or transmit information (e.g., multicast service) to client device 210 via network 240 (e.g., by using proxy device 220 as an intermediary to route packets).

[0058] Network 240 includes one or more wired and / or wireless networks. For example, network 240 may include packet-switched networks, cellular networks (e.g., fifth-generation (5G) networks, fourth-generation (4G) networks such as Long Term Evolution (LTE) networks, third-generation (3G) networks), code division multiple access (CDMA) networks, public land mobile networks (PLMNs), local area networks (LANs), wide area networks (WANs), metropolitan area networks (MANs), telephone networks (e.g., public switched telephone networks (PSTNs)), private networks, self-organizing networks, intranets, the Internet, fiber-optic-based networks, cloud computing networks, and / or combinations of these or other types of networks.

[0059] supply Figure 2 The number and arrangement of devices and networks shown are for illustrative purposes. In practice, relative to... Figure 2 The equipment and / or networks shown may include additional equipment and / or networks, fewer equipment and / or networks, different equipment and / or networks, or equipment and / or networks with different arrangements. Furthermore, Figure 2The two or more devices shown can be implemented within a single device, or Figure 2 The single device shown can be implemented as multiple distributed devices. Additionally or alternatively, the set of devices in environment 200 (e.g., one or more devices) can perform one or more functions described as being performed by another set of devices in environment 200.

[0060] Figure 3 This is a diagram of exemplary components of device 300 associated with oversubscription of a non-converting port for a proxy device. Device 300 may correspond to client device 210, proxy device 220, and / or target device 230. In some implementations, client device 210, proxy device 220, and / or target device 230 include one or more devices 300 and / or one or more components of device 300. Figure 3 As shown, device 300 may include bus 310, processor 320, memory 330, input unit 340, output unit 350 and communication unit 360.

[0061] Bus 310 includes one or more components for enabling wired and / or wireless communication between components of device 300. Bus 310 can... Figure 3 Two or more components are coupled together, such as via operational coupling, communication coupling, electronic coupling, and / or electrical coupling. Processor 320 includes a central processing unit, graphics processing unit, microprocessor, controller, microcontroller, digital signal processor, field-programmable gate array, application-specific integrated circuit, and / or another type of processing unit. Processor 320 is implemented in hardware, firmware, or a combination of hardware and software. In some implementations, processor 320 includes one or more processors that can be programmed to perform one or more operations or processes described elsewhere herein.

[0062] Memory 330 includes volatile and / or non-volatile memory. For example, memory 330 may include random access memory (RAM), read-only memory (ROM), hard disk drive, and / or another type of memory (e.g., flash memory, magnetic memory, and / or optical memory). Memory 330 may include internal memory (e.g., RAM, ROM, or hard disk drive) and / or removable memory (e.g., removable via a universal serial bus connection). Memory 330 may be a non-transitory computer-readable medium. Memory 330 stores information, instructions, and / or software (e.g., one or more software applications) related to the operation of device 300. In some implementations, memory 330 includes one or more memories, such as those coupled to one or more processors (e.g., processor 320) via bus 310.

[0063] Input component 340 enables device 300 to receive input, such as user input and / or sensed input. For example, input component 340 may include a touchscreen, keyboard, keypad, mouse, button, microphone, switch, sensor, GPS sensor, accelerometer, gyroscope, and / or actuator. Output component 350 enables device 300 to provide output, such as via a display, speaker, and / or light-emitting diode. Communication component 360 enables device 300 to communicate with other devices via wired and / or wireless connections. For example, communication component 360 may include a receiver, transmitter, transceiver, modem, network interface card, and / or antenna.

[0064] Device 300 can perform one or more of the operations or procedures described herein. For example, a non-transitory computer-readable medium (e.g., memory 330) can store a set of instructions (e.g., one or more instructions or code) for execution by processor 320. Processor 320 can execute the set of instructions to perform one or more of the operations or procedures described herein. In some implementations, execution of the set of instructions by one or more processors 320 causes one or more processors 320 and / or device 300 to perform one or more of the operations or procedures described herein. In some implementations, hardwired circuitry is used in place of instructions or in combination with instructions to perform one or more of the operations or procedures described herein. Additionally or alternatively, processor 320 can be configured to perform one or more of the operations or procedures described herein. Therefore, the implementations described herein are not limited to any particular combination of hardware circuitry and software.

[0065] supply Figure 3 The number and arrangement of components shown are for illustrative purposes. Figure 3 Compared to the components shown, device 300 may include additional components, fewer components, different components, or components arranged differently. Additionally or alternatively, a set of components of device 300 (e.g., one or more components) may perform one or more functions described as being performed by another set of components of device 300.

[0066] Figure 4 This is a diagram of exemplary components of device 400 associated with non-translation port oversubscription for a proxy device. Device 400 may correspond to proxy device 220. In some implementations, proxy device 220 may include one or more devices 400 and / or one or more components of device 400. Figure 4 As shown, device 400 may include one or more input components 410-1 to 410-B (B≥1) (hereinafter collectively referred to as input components 410, and individually referred to as input components 410), switching component 420, one or more output components 430-1 to 430-C (C≥1) (hereinafter collectively referred to as output components 430, and individually referred to as output components 430), and controller 440.

[0067] Input component 410 may be one or more attachment points of a physical link and may be one or more entry points for incoming traffic (such as packets). Input component 410 may process incoming traffic, such as by performing data link layer encapsulation or decapsulation. In some implementations, input component 410 may transmit and / or receive packets. In some implementations, input component 410 may include an input line card, which includes one or more packet processing components (e.g., in the form of integrated circuits), such as one or more interface cards (IFCs), packet forwarding components, line card controller components, input ports, processors, memory, and / or input queues. In some implementations, device 400 may include one or more input components 410.

[0068] Switching unit 420 interconnects input unit 410 with output unit 430. In some implementations, switching unit 420 may be implemented via one or more crossbar switches, via a bus, and / or via shared memory. Shared memory may act as a temporary buffer to store packets from input unit 430 before they are ultimately scheduled for delivery to output unit 410. In some implementations, switching unit 420 may enable input unit 410, output unit 430, and / or controller 440 to communicate with each other.

[0069] Output component 430 can store packets and schedule packets for transmission over the output physical link. Output component 430 can support data link layer encapsulation or decapsulation, and / or various higher-level protocols. In some implementations, output component 430 can transmit and / or receive packets. In some implementations, output component 430 may include an output line card, which includes one or more packet processing components (e.g., in the form of integrated circuits), such as one or more IFCs, packet forwarding components, line card controller components, output ports, processors, memory, and / or output queues. In some implementations, device 400 may include one or more output components 430. In some implementations, input component 410 and output component 430 may be implemented from the same set of components (e.g., and the input / output component may be a combination of input component 410 and output component 430).

[0070] Controller 440 includes a processor in the form of, for example, a CPU, GPU, APU, microprocessor, microcontroller, DSP, FPGA, ASIC, and / or another type of processor. The processor is implemented in hardware, firmware, or a combination of hardware and software. In some implementations, controller 440 may include one or more processors that can be programmed to perform functions.

[0071] In some implementations, controller 440 may include RAM, ROM, and / or another type of dynamic or static storage device (e.g., flash memory, magnetic memory, optical memory, etc.) that stores information and / or instructions for use by controller 440.

[0072] In some implementations, controller 440 can communicate with other devices, networks, and / or systems connected to device 400 to exchange information about the network topology. Controller 440 can create routing tables based on the network topology information, create forwarding tables based on the routing tables, and forward the forwarding tables to input unit 410 and / or output unit 430. Input unit 410 and / or output unit 430 can use the forwarding tables to perform route looks for incoming and / or outgoing packets.

[0073] Controller 440 may perform one or more of the processes described herein. Controller 440 may perform these processes in response to executing software instructions stored on a non-transitory computer-readable medium. A computer-readable medium is defined herein as a non-transitory memory device. A memory device includes memory space within a single physical storage device or memory space distributed across multiple physical storage devices.

[0074] Software instructions may be read from another computer-readable medium or from another device via a communication interface into memory and / or memory components associated with controller 440. When executed, the software instructions stored in the memory and / or memory components associated with controller 440 cause controller 440 to perform one or more processes described herein. Additionally or alternatively, hard-wired circuitry may be used in place of or in combination with software instructions to perform one or more processes described herein. Therefore, the implementations described herein are not limited to any particular combination of hardware circuitry and software.

[0075] supply Figure 4 The number and arrangement of components shown are for illustrative purposes only. In reality, with... Figure 4 Compared to the components shown, device 400 may include additional components, fewer components, different components, or components arranged differently. Additionally or alternatively, a set of components of device 400 (e.g., one or more components) may perform one or more functions described as being performed by another set of components of device 400.

[0076] Figure 5 This is a flowchart of an exemplary process 500 associated with oversubscription of a non-translation port for a proxy device. In some implementations, Figure 5 One or more process frames are executed by an agent device (e.g., agent device 220). Additionally or alternatively, Figure 5One or more process blocks are executed by one or more components of device 300 (e.g., processor 320, memory 330, input component 340, output component 350, and / or communication component 360) and / or by one or more components of device 400 (e.g., input component 410, switching component 420, output component 430, and / or controller 440).

[0077] like Figure 5 As shown, process 500 may include intercepting client sessions associated with a client device and a target device (block 510). For example, a proxy device may intercept client sessions associated with a client device (e.g., client device 210) and a target device (e.g., target device 230), as described above.

[0078] like Figure 5 As further shown, process 500 may include assigning a first port of the proxy device as the source port of the proxy session for the client session (block 520). For example, as described above, the proxy device may assign a first port of the proxy device as the source port of the proxy session for the client session.

[0079] like Figure 5 As further shown, process 500 may include determining, based on the allocation of a first port, whether session information associated with a proxy session will match session information associated with another proxy session (block 530). For example, as described above, the proxy device may determine, based on the allocation of a first port, whether session information associated with a proxy session will match session information associated with another proxy session.

[0080] like Figure 5 As further shown, process 500 may include initiating a proxy session after determining whether session information associated with the proxy session will match session information associated with another proxy session, wherein the source port of the proxy session is one of the following: a first port of the proxy device, based on determining that the session information associated with the proxy session will not match the session information associated with another proxy session; or a second port of the proxy device, based on determining that the session information associated with the proxy session will match the session information associated with another proxy session (box 540). For example, as described above, the proxy device may initiate a proxy session after determining whether the session information associated with the proxy session will match the session information associated with another proxy session. In some implementations, the source port of the proxy session is the first port of the proxy device (e.g., based on determining that the session information associated with the proxy session will not match the session information associated with another proxy session). In some implementations, the source port of the proxy session is the second port of the proxy device (e.g., based on determining that the session information associated with the proxy session will match the session information associated with another proxy session).

[0081] Process 500 may include additional implementations, such as any single implementation or any combination of implementations described below and / or in conjunction with one or more other process descriptions elsewhere herein.

[0082] In the first implementation, the determination of whether session information associated with a proxy session will match session information associated with another proxy session is performed based on the determination that a first port of the proxy device is assigned to at least one proxy session.

[0083] In the second implementation, alone or in combination with the first implementation, process 500 includes storing mapping information that associates a proxy session with a client session.

[0084] In the third implementation, either alone or in combination with one or more of the first and second implementations, process 500 includes allocating a second port of the proxy device as the source port of the proxy session based on determining that session information associated with the proxy session will match session information associated with another proxy session, and determining that session information associated with the proxy session will not match session information associated with another proxy session.

[0085] In the fourth implementation, either alone or in combination with one or more of the first to third implementations, the session information associated with the proxy session indicates: the source address of the proxy session, the source port of the proxy session, the destination address of the proxy session, the destination port of the proxy session, and the protocol associated with the proxy session.

[0086] In the fifth implementation, either alone or in combination with one or more of the first through fourth implementations, the source socket of the proxy session matches the source socket of one or more other proxy sessions initiated by the proxy device.

[0087] In the sixth implementation, either alone or in combination with one or more of the first through fifth implementations, process 500 includes storing session information associated with the proxy session.

[0088] although Figure 5 An exemplary box for process 500 is shown, but in some implementations, it differs from... Figure 5 Compared to the boxes depicted, process 500 includes additional boxes, fewer boxes, different boxes, or boxes with different arrangements. Alternatively or concurrently, two or more boxes of process 500 may be executed in parallel.

[0089] The foregoing disclosure provides illustrations and descriptions, but is not intended to be exhaustive or to limit implementations to the precise forms disclosed. Modifications and variations may be made based on the foregoing disclosure or may be obtained from the practice of implementation.

[0090] As used herein, services or content may include a set of packets. A packet may refer to a communication structure used to transmit information, such as a Protocol Data Unit (PDU), a Service Data Unit (SDU), a network packet, a datagram, a segment, a message, a block, a frame (e.g., an Ethernet frame), a portion of any of the above data, and / or another type of formatted or unformatted data unit that can be transmitted over a network.

[0091] As used herein, the term "component" is intended to be interpreted broadly as hardware, firmware, or a combination of hardware and software. It will be apparent that the systems and / or methods described herein can be implemented in various forms of hardware, firmware, and / or combinations of hardware and software. The actual dedicated control hardware or software code used to implement these systems and / or methods does not limit the implementation. Therefore, the operation and behavior of the systems and / or methods are described herein without reference to any specific software code—it should be understood that the systems and / or methods can be implemented using software and hardware based on the description herein.

[0092] Although specific combinations of features are described in the claims and / or disclosed in the specification, these combinations are not intended to limit the disclosure of various implementations. In fact, many of these features can be combined in ways not specifically described in the claims and / or not disclosed in the specification. While each dependent claim listed below may depend directly on only one claim, the disclosure of various implementations includes combinations of each dependent claim with every other claim in the claim set. As used herein, the phrase “at least one of” in the list of items refers to any combination of those items, including a single member. As an example, “at least one of a, b, or c” is intended to cover a, b, c, ab, ac, bc, and abc, as well as any combination having multiple identical items.

[0093] Unless explicitly stated otherwise, no element, action, or instruction used herein should be construed as critical or necessary. Furthermore, as used herein, the terms “a” and “an” are intended to include one or more items and are used interchangeably with “one or more.” Additionally, as used herein, the article “described” is intended to include one or more items referenced in conjunction with the article “described” and is used interchangeably with “described one or more.” Moreover, as used herein, the term “set” is intended to include one or more items (e.g., related items, unrelated items, or a combination of related and unrelated items) and is used interchangeably with “one or more.” If only one item is anticipated, the phrase “only one” or similar language is used. Furthermore, as used herein, the terms “having,” “possessing,” “having,” etc., are intended to be open-ended terms. Additionally, unless explicitly stated otherwise, the phrase “based on” is intended to mean “at least partially based on.” Moreover, as used herein, the term “or” is intended to be inclusive when used in a series and is interchangeable with “and / or” unless otherwise expressly stated (e.g., if used in combination with “either one” or “only one of…”).

Claims

1. A method for oversubscribing to a proxy device, the method comprising: The proxy device intercepts client sessions associated with the client device and the target device; The proxy device assigns its first port as the source port for the first proxy session for the client session; The proxy device determines whether the session information associated with the first proxy session will match the session information associated with the second proxy session based on the allocation of the first port and based on whether the first port of the proxy device has been allocated to at least one proxy session; as well as After determining whether the session information associated with the first proxy session will match the session information associated with the second proxy session, the proxy device initiates the first proxy session. The source port of the first proxy session is one of the following: The first port of the proxy device, based on the determination that the session information associated with the first proxy session will not match the session information associated with the second proxy session, or The second port of the proxy device will match the session information associated with the second proxy session based on the session information associated with the first proxy session.

2. The method according to claim 1, further comprising: Store mapping information that associates the first proxy session with the client session.

3. The method according to claim 1, further comprising: Based on the determination that the session information associated with the first proxy session will match the session information associated with the second proxy session, the second port of the proxy device is allocated as the source port of the first proxy session; and It is determined that the session information associated with the first proxy session will not match the session information associated with the third proxy session.

4. The method of claim 1, wherein the session information associated with the first proxy session indicates: the source address of the first proxy session, the source port of the first proxy session, the destination address of the first proxy session, the destination port of the first proxy session, and the protocol associated with the first proxy session.

5. The method of claim 1, wherein the source socket of the first proxy session matches the source socket of one or more other proxy sessions initiated by the proxy device.

6. The method according to claim 1, further comprising: Store the session information associated with the first agent session.

7. An agent device, comprising: One or more memory units; as well as One or more processors, for: Intercept client sessions associated with the first and second devices; The first port of the proxy device is assigned as the source port of the first proxy session for the client sessions associated with the first device and the second device; Based on the allocation of the first port and based on determining whether the first port of the proxy device has been allocated to at least one proxy session, it is determined whether the session information associated with the first proxy session will match the session information associated with the second proxy session; as well as After determining whether the session information associated with the first proxy session will match the session information associated with the second proxy session, the first proxy session is initiated. The source port of the first proxy session is one of the following: The first port of the proxy device, based on the determination that the session information associated with the first proxy session will not match the session information associated with the second proxy session, or The second port of the proxy device will match the session information associated with the second proxy session based on the session information associated with the first proxy session.

8. The proxy device of claim 7, wherein the one or more processors are further configured to: store mapping information that associates the first proxy session with the client session.

9. The agent device of claim 7, wherein the one or more processors are further configured to: Based on the determination that the session information associated with the first proxy session will match the session information associated with the second proxy session, the second port of the proxy device is assigned as the source port of the first proxy session; and It is determined that the session information associated with the first proxy session will not match the session information associated with the third proxy session.

10. The proxy device of claim 7, wherein the session information associated with the first proxy session indicates: the source address of the first proxy session, the source port of the first proxy session, the destination address of the first proxy session, the destination port of the first proxy session, and the protocol associated with the first proxy session.

11. The proxy device of claim 7, wherein the source socket of the first proxy session matches the source socket of one or more other proxy sessions initiated by the proxy device.

12. The proxy device of claim 7, wherein the one or more processors are further configured to: store the session information associated with the first proxy session.

13. A non-transitory computer-readable medium storing an instruction set, the instruction set comprising: One or more instructions, when executed by one or more processors of the agent device, cause the agent device to: Intercept client sessions associated with both the client device and the target device; The first port of the proxy device is assigned as the source port of the first proxy session for the client session associated with the client device and the target device; Based on the allocation of the first port and based on determining whether the first port of the proxy device has been allocated to at least one proxy session, it is determined whether the session information associated with the first proxy session will match the session information associated with the second proxy session; as well as After determining whether the session information associated with the first proxy session matches the session information associated with the second proxy session, the first proxy session is initiated. The source port of the first proxy session is one of the following: The first port of the proxy device, based on the determination that the session information associated with the first proxy session will not match the session information associated with the second proxy session, or The second port of the proxy device will match the session information associated with the second proxy session based on the session information associated with the first proxy session.

14. The non-transitory computer-readable medium of claim 13, wherein the session information associated with the first proxy session indicates the source address of the first proxy session, the source port of the first proxy session, the destination address of the first proxy session, the destination port of the first proxy session, and the protocol associated with the first proxy session.

15. The non-transitory computer-readable medium of claim 13, wherein one or more instructions further cause the agent device to: store mapping information that associates the first agent session with the client session.

16. The non-transitory computer-readable medium of claim 13, wherein one or more instructions further cause the agent device to: Based on the determination that the session information associated with the first proxy session will match the session information associated with the second proxy session, the second port of the proxy device is allocated as the source port of the first proxy session; and It is determined that the session information associated with the first proxy session will not match the session information associated with the third proxy session.

17. The non-transitory computer-readable medium of claim 13, wherein the source socket of the first proxy session matches the source socket of one or more other proxy sessions associated with the proxy device.

Images