Proxy State Signaling for Encrypted Application Traffic Optimization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network elements between proxies lack insight into application traffic due to encryption, hindering effective traffic optimization and policy application, as they cannot distinguish between different applications served by proxies.
Innovation Solution
Leveraging control-plane access to proxies to extract connection states and off-band signaling to correlate proxy flows with application flows, allowing network controllers to optimize traffic without modifying proxies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traffic is encrypted between proxies, then security and privacy are improved, but network elements cannot distinguish traffic between different applications
Solution Approach 1:
The patent introduces a new dimension for traffic identification by using application-layer metadata (URL paths, headers, service names) that exists alongside the encrypted transport-layer data. This metadata dimension allows network elements to identify applications without decrypting the encrypted traffic, thus maintaining security while enabling application-level differentiation.
Solution Approach 2:
The patent uses proxies as intermediaries that have full visibility of application traffic and generate metadata about the traffic patterns. These proxies act as mediators between the encrypted traffic flow and the network elements, providing identification information without requiring network elements to decrypt the traffic.
2Adaptability or versatility
If proxies handle all application traffic, then traffic management flexibility is improved, but network elements lack insight into application traffic for optimization
Solution Approach 1:
The patent implements a feedback mechanism where proxies monitor and analyze their own traffic patterns, then feed this information back to network elements in the form of metadata. This feedback loop enables network elements to make informed optimization decisions based on actual application traffic characteristics observed by the proxies.
Solution Approach 2:
Proxies serve as intermediaries that bridge the gap between application traffic and network elements. They extract meaningful information from encrypted traffic and present it to network elements in a usable format, enabling optimization without requiring network elements to directly inspect encrypted traffic.
3Productivity
If network elements need to optimize application traffic, then traffic performance is improved, but modifying proxies to provide visibility is complex
Solution Approach 1:
The patent enables proxies to self-serve by having them automatically generate and export metadata about their observed traffic patterns. This metadata is made available through standard proxy interfaces or sidecar mechanisms, eliminating the need for complex modifications to proxy core functionality while still providing the visibility needed for optimization.
Solution Approach 2:
The patent introduces lightweight intermediary components (such as sidecar proxies or metadata generators) that work alongside existing proxies to extract and export traffic information. This approach avoids modifying the core proxy infrastructure while still enabling the required visibility for traffic optimization.
Data Source
AI summary
Techniques for signaling, to a network controller, a connection state of a proxy for use by the network controller to correlate proxied-connections with application pairs for traffic optimization. In some examples, the techniques may include receiving, at a controller of a network, control plane information associated with a proxy that manages a proxied flow through the network. Based on the control plane information, the controller may determine that application traffic is flowing across the proxied flow between a first application and a second application. In this way, based at least in part on a policy associated with at least one of the first application or the second application, the controller may reconfigure a network element of the network for optimizing the application traffic flowing across the proxied flow.