Filtering Platform TCP Tunneling via User Mode Callout Drivers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
SSL VPN clients face difficulties due to complex network drivers at the data link layer, leading to error-prone and hard-to-maintain solutions that require extensive kernel mode modifications, making them prone to errors and system crashes.
Innovation Solution
The implementation of a Filtering Platform (FP) with both user mode and kernel mode APIs that allows for developing callout drivers to access and modify TCP or IP packets without re-implementing the network stack, enabling secure tunneling of packets to a VPN server without compromising security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If packet interception is performed at the data link layer using complex network drivers, then secure remote access can be achieved, but the system becomes error-prone and difficult to maintain
Solution Approach 1:
The patent segments the network driver functionality into two distinct components: a lightweight data link layer driver for packet capture and a user-mode Filtering Platform for processing. This separation eliminates the need for complex kernel-mode processing while maintaining security, directly resolving the contradiction between reliability and device complexity.
Solution Approach 2:
The patent introduces the Filtering Platform as an intermediary layer between the data link layer and higher protocol layers. This mediator handles all complex processing tasks in user mode, allowing the kernel-mode driver to remain simple and reliable while still achieving secure remote access.
2Adaptability or versatility
If kernel mode modifications are made to add features like IPv6 support, then functionality is enhanced, but system stability deteriorates due to potential crashes
Solution Approach 1:
The patent segments protocol handling functionality from the kernel-mode driver and places it in the user-mode Filtering Platform. This allows protocol support to be enhanced without modifying the stable kernel-mode code, resolving the contradiction between adaptability and system stability.
Solution Approach 2:
The Filtering Platform acts as an intermediary that handles protocol-specific processing in user mode. This mediator absorbs all the complexity and potential instability of protocol modifications, protecting the kernel-mode driver from crashes while maintaining enhanced functionality.
3Adaptability or versatility
If the network stack is re-implemented to add tunneling capabilities, then tunneling functionality is achieved, but resource consumption increases
Solution Approach 1:
The patent uses the Filtering Platform as an intermediary to implement tunneling capabilities without re-implementing the entire network stack. The platform leverages existing system networking resources while adding tunneling functionality, thereby achieving adaptability without excessive resource consumption.
Solution Approach 2:
The Filtering Platform provides multi-functional support for multiple tunneling protocols and modes (including TCP, UDP, and IPsec) within a single user-mode application. This universal approach achieves enhanced adaptability while avoiding the resource overhead of implementing separate network stacks for each protocol.
Data Source
AI summary
Described embodiments provide systems and methods for tunneling data packets to a server. A computing device can include a processor and a network interface. The processor is configured to execute a network service, a local application, and a virtual private network (VPN) application. The network service can receive a packet from the local application for transmission via a VPN tunnel, the packet comprising a source address of the computing device and a source port associated with the local application. The network service can determine that the packet matches a first tunnel filter. The network service can encapsulate, responsive to the determination that the packet matches the first tunnel filter, the packet with the header comprising a localhost destination address and a destination port associated with the VPN application. The network service can provide the encapsulated packet to the VPN application.