Proxyless TCP Handshake for Client Identity Injection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In multi-tiered network serving architectures, the lack of physical proxies in Software Defined Networks (SDNs) hinders the application of client-specific policies due to the loss of client identification information, posing challenges for third-party solutions and hindering workload transitions without network reconfiguration.
Innovation Solution
A proxyless controller intercepts TCP connection requests, injects client information into the connection with a destination server using a modified sequence number, and generates acknowledgment messages to enable direct client-server communication, emulating proxy functionality without packet modification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a proxy server is used to route client data to destination servers, then client-specific policies can be applied, but the destination servers lose access to client information
Solution Approach 1:
The patent segments the TCP connection establishment process into distinct phases: initial connection request from client to proxy, proxy to destination server connection establishment, and selective information injection. By dividing the connection process, the system can maintain client identification in control plane messages while allowing data plane traffic to flow directly, resolving the contradiction between proxy-based policy enforcement and information loss at destination servers.
Solution Approach 2:
The proxyless controller acts as an intermediary that establishes direct TCP connections between clients and destination servers while maintaining client identification information. This mediator enables the destination server to receive both the direct connection benefits and the client information needed for policy enforcement, eliminating the need for traditional proxy servers that hide client identity.
2Reliability
If traditional proxy servers are deployed, then client information can be maintained, but packet processing throughput is reduced
Solution Approach 1:
The patent extracts the client identification information injection from the data plane packet processing path and places it in the control plane connection establishment phase. By taking out the information injection operation from the high-speed data path, the system maintains client identification without requiring deep packet inspection or modification during throughput-critical data transmission, thus preserving near-line-rate processing performance.
Solution Approach 2:
The system performs client information injection as a preliminary action during TCP connection establishment before bulk data transfer begins. This preliminary injection of client identification into the connection context allows subsequent data packets to be processed at high speed without repeated inspection or modification, resolving the throughput penalty associated with traditional proxy servers.
3Productivity
If proxy servers are removed in SDNs, then packet processing speed increases, but client-specific policies cannot be applied
Solution Approach 1:
The proxyless controller serves as a mediator that enables both high-speed direct client-server communication and client-specific policy enforcement. It establishes direct TCP connections for high throughput while simultaneously injecting client identification information into the connection context, allowing destination servers to apply client-specific policies without requiring traditional proxy servers in the data path.
Solution Approach 2:
The patent implements a universal solution where a single proxyless controller provides multiple functions: establishing direct TCP connections, injecting client identification information, and enabling both high-speed data transfer and policy enforcement. This multi-functional approach eliminates the need for separate proxy infrastructure while maintaining adaptability for client-specific policies.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
A method (400) includes intercepting, from a client (102), a first TCP connection request (210) requesting to establish a TCP connection between the client and a proxy for routing data to a destination server (110). The request includes client information (104) and a first sequence number (212). The method also includes transmitting, to the destination server, a second TCP connection request to establish a TCP connection between the client and the destination server. The second request includes a second sequence number less than the first sequence number. 'The method also includes intercepting, from the destination server, an acknowledgment message (220) indicating acknowledgment of the second 'TCP connection request and transmitting, to the destination server, a proxy protocol header message (230) with the client information. The method also includes generating and transmitting a new acknowledgment message to the client.