QUIC Connection Tracking Across IP, Port, And CID Changes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network providers face difficulties in identifying, tracking, and managing QUIC connections due to frequent changes in IP addresses, port numbers, or connection IDs, which makes it challenging for middleboxes to enforce control policies effectively, as conventional techniques struggle to recognize that these changes represent the same connection.
Innovation Solution
A method is employed to create, track, and update QUIC connections by inspecting QUIC packet headers without full decryption, using a QUIC connection table to store IP-tuples and CIDs, and employing logic to match and update connections based on observed similarities, even when encrypted negotiations occur, ensuring efficient management of QUIC sessions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If QUIC connections use encryption to protect security, then security of network traffic packets is improved, but the ability to inspect metadata for traffic management is worsened
Solution Approach 1:
The patent extracts only the necessary metadata (IP addresses, port numbers, connection IDs) from encrypted QUIC packets without requiring full decryption. The middlebox inspects these specific fields that are visible in the packet structure while leaving the encrypted payload intact, thus maintaining security while enabling traffic management.
Solution Approach 2:
The patent introduces a middlebox as an intermediary component that sits between the QUIC endpoints and the network management system. This middlebox acts as a mediator that can observe and track connection metadata without breaking the encryption, allowing traffic management while preserving security.
2Adaptability or versatility
If QUIC connections change IP addresses, port numbers, or connection IDs for flexibility, then adaptability is improved, but the ability to track and manage connections is worsened
Solution Approach 1:
The patent implements a connection tracking mechanism in the middlebox that maintains state information about QUIC connections. When connection parameters change, the middlebox receives feedback about the new parameters and updates its tracking state, allowing it to continuously monitor the same connection even as it migrates to different IP addresses, ports, or connection IDs.
Solution Approach 2:
The patent establishes connection tracking and parameter monitoring in advance, before connection changes occur. The middlebox is pre-configured to watch for specific QUIC packet fields and maintain connection state, enabling it to proactively track connections as they change parameters rather than reacting after changes happen.
Data Source
AI summary
Techniques are described for managing QUIC connections. The techniques include identifying a first QUIC connection between a first and second device. Determining, from the connection, a first IP address and port number of the first device, a second IP address and port number of the second device, and a first CID. Storing an association between the first and second IP addresses, port numbers and first CID. Identifying a second QUIC connection between the first device and another device. Identifying, from the second connection, the first IP address and port number, a second CID, and a third IP address and port number. Determining if two of the following are met: the second IP address corresponds to the third IP address, the second port number corresponds to the third port number, the second CID corresponds to the first CID, if two are met, the first and second QUIC connections are the same.