US6473406B1
Expired / Lapsed
US
⏱️ 0.0 years remaining
Method and apparatus for transparently proxying a connection
Assignee: Cisco Technology Inc
•
Filing: 1997-07-31
•
Granted: 2002-10-29
•
Expires: 2017-07-31
Abstract
Abstract A system and method are disclosed for transparently proxying a connection to a protected machine. The method includes monitoring a communication packet on a network at a proxy machine. The communication packet has a communication packet source address, a communication packet source port number, a communication packet destination address, and a communication packet destination port number. The proxy determines whether to intercept the communication packet based on whether the communication packet destination address and the communication packet destination port number correspond to a protected destination address and a protected destination port number stored in a proxy list. The proxy then determines whether to proxy a proxied connection associated with the communication packet based on the communication packet source address and the communication packet source port number. A protected connection is terminated from the proxy machine to a protected machine. The protected machine corresponds to the communication packet destination address and the communication packet destination port number. A response is formed to the communication packet under a network protocol by sending a responsive packet from the proxy machine. The responsive packet has a header having a responsive packet source address and a responsive packet source port number such that the responsive packet source address and the responsive packet source port number are the same as to the communication packet destination source address and the communication packet destination port number.
Inventors
- 👤 Brantley W. Coile
- 👤 Richard A. Howes
- 👤 William M. LeBlanc
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-01 00:23
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/02; H04L63/0281; H04L69/00; H04L69/16; H04L69/161; H04L69/163; H04L9/00; H04L9/40; H04L63/08; H04L67/00; H04L67/50; H04L67/56; H04L67/568
Claims Analysis
Total Claims: 26
Claim 1
Independent Claim
344 words
A method of transparently proxying a connection to a protected machine comprising: monitoring communication packets directed to the protected machine on a network at a proxy machine, the communication packet having a communication packet source address, a communication packet source port number, a communication packet destination address, and a communication packet destination port number, the proxy machine being located within a communication path of the protected machine for monitoring all packets routed to the protected machine, the communications packet not being addressed to the proxy machine by the originator of the communication packet under any network communication protocol; determining to intercept the communication packet at the proxy machine based on whether the communication packet destination address and the communication packet destination port number correspond to a protected destination address and a protected destination port number stored in a proxy list; determining to proxy a proxied connection associated with the communication packet based on the communication packet source address and the communication packet source port number; terminating a protected connection from the proxy machine to a protected machine, the protected machine corresponding to the communication packet destination address and the communication packet destination port number, each communication sent from the proxy machine to the protected machine having a header in which the source address and the source port number are the same as the communication packet source address and the communication packet source port number; and forming a response to the communication packet under a network protocol by sending a responsive packet from the proxy machine wherein the responsive packet has a header having a responsive packet source address and a responsive packet source port number wherein the responsive packet source address and the responsive packet source port number are the same as to the communication packet destination source address and the communication packet destination port number; whereby the proxy machine terminates a protected connection to the protected machine and the proxy machine responds to the communication packet acting on behalf of the protected machine and the proxy machine appears to be the protected machine.
Claim 2
Independent Claim
344 words
A method of transparently proxying a connection to a protected machine comprising: monitoring communication packets directed to the protected machine on a network at a proxy machine, the communication packet having a communication packet source address, a communication packet source port number, a communication packet destination address, and a communication packet destination port number, the proxy machine being located within a communication path of the protected machine for monitoring all packets routed to the protected machine, the communications packet not being addressed to the proxy machine by the originator of the communication packet under any network communication protocol; determining to intercept the communication packet at the proxy machine based on whether the communication packet destination address and the communication packet destination port number correspond to a protected destination address and a protected destination port number stored in a proxy list; determining to proxy a proxied connection associated with the communication packet based on the communication packet source address and the communication packet source port number; terminating a protected connection from the proxy machine to a protected machine, the protected machine corresponding to the communication packet destination address and the communication packet destination port number, each communication sent from the proxy machine to the protected machine having a header in which the source address and the source port number are the same as the communication packet source address and the communication packet source port number; and forming a response to the communication packet under a network protocol by sending a responsive packet from the proxy machine wherein the responsive packet has a header having a responsive packet source address and a responsive packet source port number wherein the responsive packet source address and the responsive packet source port number are the same as to the communication packet destination source address and the communication packet destination port number; whereby the proxy machine terminates a protected connection to the protected machine and the proxy machine responds to the communication packet acting on behalf of the protected machine and the proxy machine appears to be the protected machine.
Claim 3
Dependent Claim
42 words
A method of transparently proxying a connection to a protected machine as recited in claim 1 wherein the protected machine has a protected machine IP address and the protected machine IP address is the same address as the communication packet destination address.
Claim 4
Dependent Claim
24 words
A method of transparently proxying a connection to a protected machine as recited in claim 1 wherein the communication packet is a SYN packet.
Claim 5
Dependent Claim
38 words
A method of transparently proxying a connection to a protected machine as recited in claim 1 wherein the proxy machine terminates an outside connection with an outside machine, the outside machine being the sender of the communication packet.
Claim 6
Dependent Claim
30 words
A method of transparently proxying a connection to a protected machine as recited in claim 4 wherein the proxy machine pretends to be the protected machine on the outside connection.
Claim 7
Dependent Claim
43 words
A method of transparently proxying a connection to a protected machine as recited in claim 5 wherein the proxy machine includes the protected machine IP address as the source address in packets that are sent from the proxy machine to the outside machine.
Claim 8
Dependent Claim
59 words
A method of transparently proxying a connection to a protected machine as recited in claim 4 further including receiving on the outside connection an outside data packet containing outside data from the outside machine, reading the outside data at the proxy machine, and relaying the outside data to the protected machine via a socket corresponding to the protected connection.
Claim 9
Dependent Claim
26 words
A method of transparently proxying a connection to a protected machine as recited in claim 7 further including modifying the outside data at the proxy machine.
Claim 10
Dependent Claim
59 words
A method of transparently proxying a connection to a protected machine as recited in claim 1 further including receiving on the protected connection an protected data packet containing protected data from the protected machine, reading the protected data at the proxy machine, and relaying the protected data to the outside machine via a socket corresponding to the protected connection.
Claim 11
Dependent Claim
26 words
A method of transparently proxying a connection to a protected machine as recited in claim 9 further including modifying the protected data at the proxy machine.
Claim 12
Dependent Claim
59 words
A method of transparently proxying a connection to a protected machine as recited in claim 7 further including receiving on the protected connection an protected data packet containing protected data from the protected machine, reading the protected data at the proxy machine, and relaying the protected data to the outside machine via a socket corresponding to the protected connection.
Claim 13
Dependent Claim
31 words
A method of transparently proxying a connection to a protected machine as recited in claim 7 wherein the outside data is used to authenticate the outside machine to the protected machine.
Claim 14
Dependent Claim
24 words
A method of transparently proxying a connection to a protected machine as recited in claim 9 wherein the protected data includes an authentication request.
Claim 15
Dependent Claim
33 words
A method of transparently proxying a connection to a protected machine as recited in claim 7 further including requesting and obtaining data from the protected machine that is responsive to the outside data.
Claim 16
Dependent Claim
24 words
A method of transparently proxying a connection to a protected machine as recited in claim 1 wherein the proxy machine is a web server.
Claim 17
Dependent Claim
23 words
A method of transparently proxying a connection to a protected machine as recited in claim 1 wherein the proxy machine is a PIX.
Claim 18
Dependent Claim
23 words
A method of transparently proxying a connection to a protected machine as recited in claim 1 wherein the proxy machine is a firewall.
Claim 19
Dependent Claim
47 words
A method of transparently proxying a connection to a protected machine as recited in claim 1 wherein an intercepting controller determines whether to direct the communication packet to a local application or a proxy application or to drop the communication packet based on a proxy quad list.
Claim 20
Dependent Claim
22 words
A method of transparently proxying a connection to a protected machine as recited in claim 1 wherein the network protocol is TCP.
Claim 21
Independent Claim
395 words
A method of transparently proxying a connection to a protected machine comprising: monitoring a communication packet on a network at a proxy machine, the communication packet having a communication packet source address, a communication packet source port number, a communication packet destination address, and a communication packet destination port number, the communications packet not being addressed to the proxy machine by the originator of the communication packet under any network communication protocol; determining to intercept the communication packet at the proxy machine based on whether the communication packet destination address and the communication packet destination port number correspond to a protected destination address and a protected destination port number stored in a proxy list; determining to proxy a proxied connection associated with the communication packet based on the communication packet source address and the communication packet source port number; terminating a protected connection from the proxy machine to a protected machine, the protected machine corresponding to the communication packet destination address and the communication packet destination port number, each communication sent from the proxy machine to the protected machine having a header in which the source address and the source port number are the same as the communication packet source address and the communication packet source port number; forming a response to the communication packet under a network protocol by sending a responsive packet from the proxy machine wherein the responsive packet has a header having a responsive packet source address and a responsive packet source port number wherein the responsive packet source address and the responsive packet source port number are the same as to the communication packet destination source address and the communication packet destination port number; receiving on an outside connection an outside data packet containing outside data from an outside machine, the outside machine being the sender of the communication packet, reading the outside data at the proxy machine, and relaying the outside data to the protected machine via a socket corresponding to the protected connection; and acknowledging the receipt of the outside data packet at the proxy machine after a protected machine acknowledges receipt of data contained in the outside data packet; whereby the proxy machine terminates a protected connection to the protected machine and the proxy machine responds to the communication packet acting on behalf of the protected machine and the proxy machine appears to be the protected machine.
Claim 22
Independent Claim
395 words
A method of transparently proxying a connection to a protected machine comprising: monitoring a communication packet on a network at a proxy machine, the communication packet having a communication packet source address, a communication packet source port number, a communication packet destination address, and a communication packet destination port number, the communications packet not being addressed to the proxy machine by the originator of the communication packet under any network communication protocol; determining to intercept the communication packet at the proxy machine based on whether the communication packet destination address and the communication packet destination port number correspond to a protected destination address and a protected destination port number stored in a proxy list; determining to proxy a proxied connection associated with the communication packet based on the communication packet source address and the communication packet source port number; terminating a protected connection from the proxy machine to a protected machine, the protected machine corresponding to the communication packet destination address and the communication packet destination port number, each communication sent from the proxy machine to the protected machine having a header in which the source address and the source port number are the same as the communication packet source address and the communication packet source port number; forming a response to the communication packet under a network protocol by sending a responsive packet from the proxy machine wherein the responsive packet has a header having a responsive packet source address and a responsive packet source port number wherein the responsive packet source address and the responsive packet source port number are the same as to the communication packet destination source address and the communication packet destination port number; receiving on an outside connection an outside data packet containing outside data from an outside machine, the outside machine being the sender of the communication packet, reading the outside data at the proxy machine, and relaying the outside data to the protected machine via a socket corresponding to the protected connection; and acknowledging the receipt of the outside data packet at the proxy machine after a protected machine acknowledges receipt of data contained in the outside data packet; whereby the proxy machine terminates a protected connection to the protected machine and the proxy machine responds to the communication packet acting on behalf of the protected machine and the proxy machine appears to be the protected machine.
Claim 23
Dependent Claim
173 words
A proxy system for proxying a connection from an outside machine to a protected machine comprising: an outside connection stack, the outside connection stack being operative to establish an outside connection to an outside party; a proxy quad list, the proxy quad list containing a list of proxied connections; an intercepting controller, the intercepting controller being operative to read incoming data packets, to resolve IP addresses and port numbers to determine whether the data packets correspond to a proxied application based on the proxy quad list; and a proxy application, the proxy application being operative to determine that a new connection should be added to the quad list and add the new connection to the quad list, the proxy application being configured to establish and maintain a proxy connection to the protected machine by sending communications packets having a header in which the source address and the source port number are the same as the source address and the source port number of the incoming data packets; wherein a proxied connection is maintained.
Claim 24
Dependent Claim
173 words
A proxy system for proxying a connection from an outside machine to a protected machine comprising: an outside connection stack, the outside connection stack being operative to establish an outside connection to an outside party; a proxy quad list, the proxy quad list containing a list of proxied connections; an intercepting controller, the intercepting controller being operative to read incoming data packets, to resolve IP addresses and port numbers to determine whether the data packets correspond to a proxied application based on the proxy quad list; and a proxy application, the proxy application being operative to determine that a new connection should be added to the quad list and add the new connection to the quad list, the proxy application being configured to establish and maintain a proxy connection to the protected machine by sending communications packets having a header in which the source address and the source port number are the same as the source address and the source port number of the incoming data packets; wherein a proxied connection is maintained.
Claim 25
Dependent Claim
31 words
A method of transparently proxying a connection to a protected machine as recited in claim 1 wherein the communication packet is not encapsulated with a device address of the proxy machine.
Claim 26
Dependent Claim
76 words
A method of transparently proxying a connection to a protected machine as recited in claim 1 wherein determining to intercept the communication packet at the proxy machine comprises intercepting the communication packet only if the communication packet destination address and the communication packet destination port number correspond to a protected destination address and a protected destination port number stored in the proxy list or a destination address and a destination port number of the proxy machine.
References Cited (Backward Citations)
US5319712A
Cited
US5623601A
Cited
US5592611A
Cited
US5699513A
Cited
US5884025A
Cited
US5802320A
Cited
US5757924A
Cited
US5828846A
Cited
US5781550A
Cited
US5826014A
Cited
US6003084A
Cited
US5898830A
Cited
US5778174A
Cited
US5915087A
Cited
US6104716A
Cited
US6006268A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2005-10-28 | 2006-04-29 | 2006-10-29 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2009-10-28 | 2010-04-29 | 2010-10-29 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2013-10-28 | 2014-04-29 | 2014-10-29 | $7700.00 | Window Closed / Lapsed |