Proxy Server Preserving TCP Header Options
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In TCP/IP networks, intermediate devices like firewalls often terminate or consume TCP header options, preventing their transmission between client and server connections, and may reject unknown options as security risks, disrupting communication.
Innovation Solution
A bi-directional intelligent proxying system that re-injects transport layer options into network packets and informs clients and servers about these options using an application layer protocol, ensuring seamless communication through transport layer terminating devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If an intermediate device terminates transport layer connections for security inspection, then security control is improved, but TCP header options are consumed and communication functionality is lost
Solution Approach 1:
The patent introduces an intermediary mechanism where the terminating device creates a proxy connection that acts as a mediator between the client and server. The proxy captures TCP header options from the original connection, preserves them in the proxy's connection state, and re-injects them into packets forwarded to the server, thus preventing information loss while maintaining security inspection capability
Solution Approach 2:
The terminating device performs preliminary action by capturing and storing TCP header options before connection termination. The device proactively extracts option information (such as MSS, window scaling, timestamp enabled) and prepares it for later re-injection, ensuring that when packets are forwarded through the proxy, the necessary transport layer parameters are already available
2Reliability
If an intermediate device rejects unknown TCP header options as security risks, then security is improved, but legitimate communication options are blocked
Solution Approach 1:
The proxy connection serves as an intermediary that understands both the security policies of the terminating device and the communication requirements of the application. It translates security constraints into controlled packet forwarding while preserving legitimate TCP options, effectively mediating between security and functionality
Solution Approach 2:
The patent changes the parameter representation by extracting TCP header options as distinct data elements and storing them in the proxy's connection state. This allows the system to distinguish between malicious and legitimate options, enabling selective packet forwarding that maintains both security and communication functionality
3Reliability
If a proxy server re-injects transport layer options into network packets, then communication reliability is improved, but device complexity increases
Solution Approach 1:
The proxy connection mechanism serves multiple functions simultaneously: it terminates connections for security inspection, captures TCP header options, stores them in connection state, and re-injects them into forwarded packets. This multi-functionality reduces overall system complexity by consolidating what would otherwise require separate mechanisms
Data Source
AI summary
The solution of the present invention provides systems and methods for preserving transport layer header options traversing network devices that terminate transport layer connections. The solution described herein provides a bi-directional intelligent proxying system by which a proxy client exchanges transport layer option information with a proxy server via an application layer protocol. The proxy server, which may be in the form of an appliance, re-injects the transport layer options received from the client into the appropriate network packets communicated on the intended network. Likewise, the proxying appliance can inform the proxy client of transport layer options received from the network, such as via a server. With this solution, devices that transmit control information, exchange communications or other functionality via transport layer options may continue to operate in conjunction with transport layer terminating devices.