QUIC Anycast Proxy Failover Using Global Session Mapping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network solutions for connecting remote users to private enterprise applications face challenges such as increased attack surfaces with VPN tunneling, performance impacts with proxy-based solutions, difficulty in handling QUIC protocol failovers, and lack of mechanisms for proxying Layer 2 ethernet packets over MASQUE tunnels.
Innovation Solution
The use of QUIC and Multiplexed Application Substrate over QUIC Encryption (MASQUE) protocols to establish secure connection tunnels, handle QUIC connection migrations, and enforce network policies without decrypting or proxying connections, while enabling Layer 2 ethernet frame tunneling through EoMASQUE.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If VPN tunneling is used for remote access, then any application and protocol can be accessed, but the attack surface within the network increases
Solution Approach 1:
The patent introduces a reverse proxy as an intermediary component that sits between external clients and internal applications. The proxy terminates external connections and opens new internal connections, acting as a mediator that prevents direct access to internal resources. This reduces the attack surface while maintaining protocol compatibility through the proxy's ability to handle various protocols at the edge.
Solution Approach 2:
The patent segments the network connection into external and internal portions, with the reverse proxy serving as the boundary. The external connection is terminated at the proxy, and a separate internal connection is established to the target application. This segmentation isolates the internal network from external threats while preserving access capabilities.
2Object-affected harmful factors
If proxy-based solutions are used for remote access, then edge controls are improved and attack surface is reduced, but performance is impacted due to protocol conversion requirements
Solution Approach 1:
The patent changes the operational parameters of the proxy by making it QUIC-aware and enabling native QUIC protocol support. Instead of converting QUIC to TCP, the proxy can natively terminate QUIC connections and establish QUIC connections internally, eliminating the performance overhead of protocol conversion while maintaining security benefits.
Solution Approach 2:
The patent introduces dynamic protocol handling where the proxy can adapt to different protocols including native QUIC support. The system dynamically selects the appropriate protocol for internal connections based on the target application's capabilities, optimizing performance while maintaining security through the proxy architecture.
3Ease of operation
If traditional proxy techniques are used on QUIC protocol, then connection termination and new connection opening can be performed, but failover and replacement of proxy nodes becomes difficult
Solution Approach 1:
The patent implements feedback mechanisms where QUIC connection information including connection IDs and state data are continuously monitored and reported to a centralized data store. This feedback loop enables real-time tracking of active connections and facilitates automatic failover by providing the necessary state information to replacement proxy nodes.
Solution Approach 2:
The patent performs preliminary actions by pre-establishing connection state information in a data store before failover is needed. Connection metadata, including QUIC connection IDs and mapping information, are maintained in advance, enabling rapid failover without requiring complex real-time negotiation or state reconstruction when a proxy node needs to be replaced.
4Adaptability or versatility
If QUIC protocol is used for remote access, then modern application support is improved, but middlebox interoperability and session migration handling become challenging
Solution Approach 1:
The patent positions the reverse proxy as an intermediary that mediates between QUIC clients and internal applications. The proxy terminates QUIC connections from clients and establishes new connections internally, acting as a middlebox that is specifically designed to handle QUIC protocol. This approach simplifies middlebox interoperability by having a dedicated QUIC-aware proxy rather than requiring general-purpose middleboxes to understand QUIC.
Solution Approach 2:
The patent replaces the need for complex QUIC-aware middleboxes throughout the network with a simpler architecture where a dedicated reverse proxy handles all QUIC protocol processing. This substitution eliminates the need for multiple complex middleboxes and simplifies the overall system while maintaining full QUIC protocol support for modern applications.
Data Source
AI summary
Techniques for managing migrations of QUIC connection session(s) across proxy nodes, data centers, and/or private application nodes are described herein. A global key-value datastore, accessible by proxy nodes and/or application nodes, may store mappings between a first QUIC connection, associated with a proxy node and a client device, on the frontend of the proxy node and a second QUIC connection, associated with the proxy node and an application node, on the backend of the proxy node. With the global key-value datastore being accessible by the proxy nodes, when a proxy node receives a QUIC packet on the front end or the back end, the proxy node may determine where to map this connection to on the opposite end. Additionally, with the global key-value datastore being accessible to the application nodes, when an application node receives a QUIC packet, the application node may determine the client device associated with the connection.