QUIC Connection Tracking for Middlebox Policy Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The challenge of identifying, tracking, and managing QUIC connections becomes difficult due to frequent changes in IP addresses, port numbers, or connection IDs, which makes it hard for middleboxes to apply control policies effectively, as conventional techniques struggle to recognize that these changes represent the same connection.
Innovation Solution
A method is developed to track QUIC connections by inspecting QUIC packet headers, using a QUIC connection table to store IP-tuples and CIDs, and employing logic to match and update connections based on observed IP addresses, port numbers, and CIDs without decrypting the packets, leveraging long and short headers to maintain connection tracking.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If QUIC connections are encrypted to improve security, then security is improved, but the ability to inspect metadata for connection tracking is lost
Solution Approach 1:
The patent extracts only the necessary metadata (IP addresses, port numbers, connection IDs) from QUIC packet headers for connection tracking, while leaving the rest of the packet encrypted. This selective extraction allows middleboxes to track connections without requiring full packet decryption, thus maintaining security while enabling monitoring capabilities.
Solution Approach 2:
The patent introduces an intermediary layer (middlebox) that can inspect and track QUIC connections by accessing specific header fields without decrypting the encrypted payload. This intermediary capability allows network devices to maintain connection state information while the underlying encryption remains intact for security purposes.
2Ease of operation
If connection tracking is implemented to enable policy control, then ease of operation is improved, but device complexity increases
Solution Approach 1:
The patent segments the connection tracking process into distinct components: identifying QUIC packets, extracting metadata from headers, matching connections using IP-tuples and CIDs, and maintaining connection state. This segmentation allows each component to be handled independently, reducing overall system complexity while enabling comprehensive policy control.
Solution Approach 2:
The patent creates simplified copies of connection information (IP addresses, port numbers, CIDs) from the actual QUIC packets and stores them in connection tracking tables. These copies enable policy control operations without requiring access to or processing of the full encrypted packet data, thus reducing operational complexity.
3Measurement precision
If full packet decryption is performed to enable connection identification, then measurement precision is improved, but use of energy increases
Solution Approach 1:
The patent extracts only the essential identification fields (source/destination IP addresses, port numbers, and connection IDs) from QUIC packet headers, which are sufficient for accurate connection identification. This extraction approach achieves the same identification accuracy as full decryption would provide, but with significantly lower energy consumption since the majority of the packet remains encrypted and unprocessed.
Data Source
AI summary
Techniques are described for managing QUIC connections. The techniques include identifying a first QUIC connection between a first and second device. Determining, from the connection, a first IP address and port number of the first device, a second IP address and port number of the second device, and a first CID. Storing an association between the first and second IP addresses, port numbers and first CID. Identifying a second QUIC connection between the first device and another device. Identifying, from the second connection, the first IP address and port number, a second CID, and a third IP address and port number. Determining if two of the following are met: the second IP address corresponds to the third IP address, the second port number corresponds to the third port number, the second CID corresponds to the first CID, if two are met, the first and second QUIC connections are the same.