Transparent Proxying Router and External Server
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In large-scale networks, explicit proxy configurations are problematic due to the need for manual client configuration, which leads to issues with Network Address Translation (NAT) policies, firewall compatibility, and resource sharing when routers and proxies are integrated, resulting in lost packet classification and inefficient resource utilization.
Innovation Solution
A method for transparent proxying between a client and a server, where a router and proxy collaborate using a unique ID and messaging protocol (like ASDP) to maintain connection transparency, allowing the proxy to intercept and process packets without modifying client or server network addresses, and enabling seamless integration with existing network infrastructure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If an explicit proxy is deployed to intercept and process packets between client and server, then the proxy can perform functions such as firewall protection and NAT, but manual client configuration is required which creates deployment complexity and conflicts with NAT policies
Solution Approach 1:
The patent introduces a router as an intermediary device between the explicit proxy and the network traffic. The router intercepts packets before they reach the proxy, performs classification and rewriting operations, and forwards them to the proxy. This mediator approach allows the proxy to function reliably without requiring client configuration changes, as the router handles the interception transparently.
Solution Approach 2:
The patent segments the proxy functionality into two parts: the explicit proxy application running on a server, and the packet interception/classification logic residing in the router. This segmentation allows the proxy to maintain its reliability while the router handles the complex interception tasks, reducing overall deployment complexity.
2Reliability
If the proxy uses its own network address to connect to the server (PAT), then connection interception is achieved, but packet classification is lost and NAT policies conflict
Solution Approach 1:
The router performs preliminary actions on packets before they reach the proxy. It rewrites the source IP address to the proxy's IP address and preserves classification information in custom TCP options or IP headers. This preliminary rewriting allows the proxy to use its own address (maintaining interception capability) while the router retains packet classification information for later use.
Solution Approach 2:
The router creates a copy of the original packet with modified headers that preserve classification information. The custom TCP options or IP headers contain copies of the original source/destination addresses and ports, allowing the system to maintain packet classification even when the proxy uses its own address for connection establishment.
3Productivity
If router and proxy are integrated into one device, then resource utilization improves, but virtual router constraints and resource sharing issues arise
Solution Approach 1:
The patent merges the router and proxy into a single physical device, allowing them to share hardware resources such as CPU, memory, and network interfaces. This improves resource utilization efficiency while maintaining their functional separation through software partitioning, allowing each component to operate independently with its own resource allocation.
Solution Approach 2:
The integrated device performs multiple functions: the router component handles packet interception, classification, and rewriting, while the proxy component handles application-layer processing. This multi-functionality allows a single device to replace what would traditionally require separate router and proxy infrastructure, improving resource utilization without sacrificing adaptability.
Data Source
AI summary
Methods and apparatus are disclosed for processing data packets using a router and a proxy in order to transparently proxy a connection between a client and a server. One method involves mapping a TCP connection to a connection ID and sending a segment from the TCP connection to a proxy, including the connection ID, a direction value and an identifier of an assigned proxy application, such that the segment appears to be from the connection. The method further involves a proxy creating and reading from an IP socket which corresponds to the segment, the connection ID, direction and assigned proxy application and then spoofing the segment using the connection ID, a second direction value, and an identifier of the assigned proxy application.