Resilient TCP Splicing for Transparent Proxy Failover
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Transparent application layer proxies, which terminate TCP connections, can cause service disruptions if they crash or become unavailable due to network failures, leading to interruptions in proxy services despite alternate network paths being available.
Innovation Solution
The resilient TCP splicing mechanism ensures continuous end-to-end TCP connection by synchronizing TCP options and sequence numbers, suppressing acknowledgments until the destination receives payload data, and rerouting connections through Layer 2 I/O ingress and egress to bypass the failed proxy, maintaining service integrity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a transparent proxy terminates TCP connections to provide proxy services, then proxy functionality is achieved, but service disruption occurs when the proxy crashes or becomes unavailable
Solution Approach 1:
The patent segments the TCP connection into two separate connections: a client-side connection between the ingress and the client, and a server-side connection between the egress and the server. This segmentation allows the proxy to be removed from the data path while maintaining connection state through synchronization, thereby improving reliability without excessive complexity
Solution Approach 2:
The patent introduces an intermediary mechanism (ingress and egress components) that mediates between the client and server. These intermediaries maintain TCP connection state and synchronize sequence numbers, allowing the proxy to failover without disrupting the end-to-end connection. This mediator approach resolves the contradiction by providing reliability through distributed state management
2Reliability
If the proxy is removed from the data path for high availability, then service availability improves, but TCP connection state synchronization becomes complex
Solution Approach 1:
The patent performs preliminary actions by establishing and synchronizing TCP connection state (sequence numbers, TCP options) between the ingress and egress before failover occurs. This preliminary synchronization enables seamless proxy removal from the data path without requiring complex real-time state management during failover
Solution Approach 2:
The patent implements feedback mechanisms where the ingress and egress continuously synchronize TCP connection state through shared memory or inter-process communication. This feedback loop maintains consistent connection state across failover events, reducing the complexity of state management by using automated synchronization rather than manual coordination
3Reliability
If TCP acknowledgments are suppressed to maintain connection state, then connection integrity is maintained, but data transmission delay increases
Solution Approach 1:
The patent applies partial acknowledgment suppression only to specific TCP packets where sequence number synchronization is critical, rather than suppressing all acknowledgments. This selective approach maintains connection integrity for control packets while allowing normal acknowledgment flow for data packets, thereby minimizing transmission delay while preserving connection state
Data Source
AI summary
A transparent proxy device includes an ingress, an egress, and an application proxy. The ingress and the egress operate up to a layer four communication layer. The transparent proxy device is configured to establish spliced connections in relation to end devices. The spliced connections include layer four connections between the ingress and the application proxy and the application proxy and the egress. The transparent proxy device is configured to maintain an end-to-end connection in relation to the end devices even when the application proxy fails.