Network Bridge Connection Pooling for Client IP Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network bridges and proxies face challenges in determining client device locations due to limitations in TCP Option 28 and XFR, which are susceptible to spoofing and do not support multiple sources per packet, leading to network congestion.
Innovation Solution
A system and method for providing network bridge connections using proxied network metrics, where a network device analyzes downstream connections for potential threats and manages upstream connections through a connection pool database, dynamically allocating and updating connections based on network metrics such as geographical location and TLS configuration.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If TCP Option 28 is used to identify client IP address, then the client IP address can be carried to the server, but it is limited to identifying a single IP address which leads to complexities for determining client device location if a next hop overwrites it or does not forward it correctly
Solution Approach 1:
The patent segments the connection management into multiple independent connection objects, each representing a distinct client device. Instead of using a single TCP Option 28 field that can only hold one IP address, the system creates separate connection entries for each client, allowing independent tracking of multiple client IP addresses without interference or overwriting issues.
Solution Approach 2:
The patent transitions from a single-dimension approach (one TCP Option 28 field for one IP address) to a multi-dimensional approach by introducing connection pooling with multiple connection objects. Each connection object exists in its own dimension within the pool, allowing the system to handle multiple client IP addresses simultaneously without the limitations of the original single-field approach.
2Adaptability or versatility
If XFR is used to identify originating IP address, then multiple sources can be identified, but it may be rendered useless by encrypted traffic without performing complex decryption operations
Solution Approach 1:
The patent performs preliminary action by extracting and storing client IP address information in the connection pool database before the traffic reaches the point where decryption would be needed. The connection objects are created with client identification data already populated, allowing the system to identify multiple sources without needing to perform complex decryption operations on encrypted traffic later in the processing chain.
Solution Approach 2:
The patent introduces connection objects as intermediaries between the encrypted traffic and the IP address identification process. These connection objects serve as mediators that already contain the necessary client identification information, eliminating the need for direct decryption operations to extract IP addresses from encrypted traffic.
3Reliability
If network bridges and proxies are used to inspect and analyze traffic, then traffic inspection capability is improved, but network congestion increases due to additional processing
Solution Approach 1:
The patent performs preliminary action by pre-processing and storing connection information in the connection pool database before traffic inspection is needed. By creating connection objects and storing client IP address information in advance, the system reduces the amount of real-time processing required during traffic inspection, thereby maintaining reliability while reducing network congestion and improving throughput.
4Productivity
If connections are reused and pipeline requests, then connection efficiency is improved, but security risks increase due to potential spoofing
Solution Approach 1:
The patent applies local quality by creating distinct connection objects with unique identifiers and properties for each client device. Instead of using a generic reused connection that could be spoofed, each connection object has localized, specific attributes (such as client IP address, connection metrics) that are verified and stored in the connection pool database. This ensures that even when connections are reused, each connection maintains its unique security identity and cannot be incorrectly associated with another client.
Data Source
AI summary
An upstream network bridge connection request is received in a network device from first network component for connecting to a second network component. This upstream network bridge connection request is analyzed by the network bridge to determine if a network attack threat is associated with the client device requesting the upstream network bridge connection to the server device preferably by inspecting certain network metrics present in the downstream connection associated with the client device. If no, then a determination is made as to whether a preexisting upstream network bridge connection between the client device and the server device exists in a connection pool database. If yes, then the preexisting upstream network bridge connection is retrieved from the connection pool database and is implemented for creating an upstream network connection between the client and server devices.