Method and system for connecting manipulation equipment between operator's premises and the internet
View Patent ↗Traffic passing between remote terminals and corporate intranets through an access server provider network can encounter security and addressing problems. Intercepting and manipulating this traffic can overcome these, as well as other problems. For such traffic that is being transported over a plurality of Network Based Tunnels (NBT), this manipulation can be performed by manipulation equipment that may reside in the access server provider's network between an Access Gateway (AGW) and a Border Gateway (BGW). The manipulation equipment may manipulate received NBT packets by parsing the original packet that is encapsulated in the NBT packet, manipulating the original packet and reconstructing the NBT packet with the manipulated data of the original packet.
1. A method for manipulating, via manipulation equipment residing within an access network to the Internet, the transportation of packets between a plurality of remote clients on one side of the access network and a plurality of corporate intranets on another side of the access network, the method comprising the steps of:
(a) intercepting network based tunnel (NBT) packets transferred between a plurality of remote clients and a plurality of corporate intranets through a plurality of network based tunnels that carry data traffic between a plurality of remote clients and a plurality of corporate intranets, wherein at least two of the remote clients are in communication with different corporate intranets;
(b) parsing an intercepted NBT packet that was directed toward a destination on one side of the access network and retrieving an original packet that is encapsulated within the NBT packet;
(c) parsing the original packet; and
(d) wherein the original packet is determined to have been targeted toward the manipulation equipment:
(i) updating a cross-reference table, the cross-reference table containing information that is useful for reconstruction of an NBT;
(ii) manipulating the original packet into a manipulated packet by sending the original packet to the manipulation equipment;
(iii) reconstructing, via the updated cross-reference table the NBT connection from which the NBT packet was intercepted; and
(iv) transferring the manipulated packet toward the destination over the reconstructed NBT connection;
(e) wherein the step of reconstructing the NBT connection further comprises using a source port number of the received packet coming from the manipulation equipment.
2. The method of claim 1 , wherein determining whether an original packet is targeted toward the manipulation system is based on the destination address of the original packet.
3. A method for manipulating, via manipulation equipment residing within an access network to the Internet, the transportation of packets between a plurality of remote clients on one side of the access network and a plurality of corporate intranets on another side of the access network, the method comprising the steps of:
(a) intercepting network based tunnel (NBT) packets transferred between a plurality of remote clients and a plurality of corporate intranets through a plurality of network based tunnels that carry data traffic between a plurality of remote clients and a plurality of corporate intranets, wherein at least two of the remote clients are in communication with different corporate intranets;
(b) parsing an intercepted NBT packet that was directed toward a destination on one side of the access network and retrieving an original packet that is encapsulated within the NBT packet;
(c) parsing the original packet; and
(d) wherein the original packet is determined to have been targeted toward the manipulation equipment:
(i) updating a cross-reference table, the cross-reference table containing information that is useful for reconstruction of an NBT;
(ii) manipulating the original packet into a manipulated packet by sending the original packet to the manipulation equipment;
(iii) reconstructing, via the updated cross-reference table, the NBT connection from which the NBT packet was intercepted; and
(iv) transferring the manipulated packet toward the destination over the reconstructed NBT connection;
(e) wherein the step of updating the cross-reference table further comprises using the IP address of the manipulation equipment.
4. The method of claim 3 , wherein determining whether an original packet is targeted toward the manipulation system is based on the destination address of the original packet.
5. A method for manipulating, via manipulation equipment residing within an access network to the Internet, the transportation of packets between a plurality of remote clients on one side of the access network and a plurality of corporate intranets on another side of the access network, the method comprising the steps of:
(a) intercepting network based tunnel (NBT) packets transferred between a plurality of remote clients and a plurality of corporate intranets through a plurality of network based tunnels that carry data traffic between a plurality of remote clients and a plurality of corporate intranets, wherein at least two of the remote clients are in communication with different corporate intranets;
(b) parsing an intercepted NBT packet that was directed toward a destination on one side of the access network and retrieving an original packet that is encapsulated within the NBT packet;
(c) parsing the original packet; and
(d) wherein the original packet is determined to have been targeted toward the manipulation equipment:
(i) updating a cross-reference table, the cross-reference table containing information that is useful for reconstruction of an NBT;
(ii) manipulating the original packet into a manipulated packet by sending the original packet to the manipulation equipment;
(iii) reconstructing, via the updated cross-reference table, the NBT connection from which the NBT packet was intercepted; and
(iv) transferring the manipulated packet toward the destination over the reconstructed NBT connection;
(e) wherein the step of updating the cross-reference table further comprises using the IP address of the destination.
6. The method of claim 5 , wherein determining whether an original packet is targeted toward the manipulation system is based on the destination address of the original packet.
7. A method for manipulating, via manipulation equipment residing within an access network to the Internet, the transportation of packets between a plurality of remote clients on one side of the access network and a plurality of corporate intranets on another side of the access network, the method comprising the steps of:
(a) intercepting network based tunnel (NBT) packets transferred between a plurality of remote clients and a plurality of corporate intranets through a plurality of network based tunnels that carry data traffic between a plurality of remote clients and a plurality of corporate intranets, wherein at least two of the remote clients are in communication with different corporate intranets;
(b) parsing an intercepted NBT packet that was directed toward a destination on one side of the access network and retrieving an original packet that is encapsulated within the NBT packet;
(c) parsing the original packet; and
(d) wherein the original packet is determined to have been targeted toward the manipulation equipment:
(i) updating a cross-reference table, the cross-reference table containing information that is useful for the reconstruction of an NBT;
(ii) manipulating the original packet into a manipulated packet by sending the original packet to the manipulation equipment;
(iii) reconstructing, via the updated cross-reference table, the NBT connection from which the NBT packet was intercepted; and
(iv) transferring the manipulated packet toward the destination over the reconstructed NBT connection;
(e) wherein the step of updating the cross-reference table further comprises using the IP address of the source.
8. The method of claim 7 , wherein determining whether an original packet is targeted toward the manipulation system is based on the destination address of the original packet.
9. A method for manipulating the transportation of original packets transported via an access network to the Internet between a plurality of remote clients and a plurality of IP based private data networks, wherein the original packets are encapsulated in network based tunnel packets, and wherein the manipulation is done at the access network service provider's premises, the method comprising the steps of:
intercepting, at the access network service provider's premises, the transportation between the plurality of remote clients and the plurality of IP based private data networks, wherein at least two of the remote clients are in communication with different IP based private data networks;
parsing a received network based tunnel packet to determine if its encapsulated original packet is targeted toward a manipulation system;
forwarding the received network based tunnel packet, as is, towards a destination if the encapsulated original packet is not targeted toward the manipulation system;
if the encapsulated original packet is targeted toward the manipulation system, then:
retrieving the original packet out of the network based tunnel packet;
updating a cross-reference table with parameters that associate the original packet with the received network based tunnel packet, the cross-reference table enabling the reconstruction of a manipulated network based tunnel packet that will be transferred to the destination after the manipulation of the received original packet;
transferring the original packet toward the manipulation system;
manipulating the original packet into a manipulated original packet;
reconstructing the manipulated network based tunnel packet with the manipulated original received packet; and
transferring the manipulated network based tunnel packet to the destination over network based tunnels;
wherein the step of updating the cross-reference table further comprises using parameters, wherein the parameters that are used comprise a source port number of packets coming from the manipulation system.
10. The method of claim 9 , wherein determining whether an original packet is targeted toward the manipulation system is based on the destination address of the original packet.
11. A method for manipulating the transportation of original packets transported via an access network to the Internet between a plurality of remote clients and a plurality of IP based private data networks, wherein the original packets are encapsulated in network based tunnel packets, and wherein the manipulation is done at the access network service provider's premises, the method comprising the steps of:
intercepting, at the access network service provider's premises, the transportation between the plurality of remote clients and the plurality of IP based private data networks, wherein at least two of the remote clients are in communication with different IP based private data networks;
parsing a received network based tunnel packet to determine if its encapsulated original packet is not targeted toward the manipulation system;
forwarding the received network based tunnel packet, as is, towards a destination if the encapsulated original packet is not targeted toward a manipulation system;
if the encapsulated original packet is targeted toward the manipulation system, then:
retrieving the original packet out of the network based tunnel packet;
updating a cross-reference table with parameters that associate the original packet with the received network based tunnel packet, the cross-reference table enabling the reconstruction of a manipulated network based tunnel packet that will be transferred to the destination after the manipulation of the received original packet;
transferring the original packet toward the manipulation system;
manipulating the original packet into a manipulated original packet;
reconstructing the manipulated network based tunnel packet with the manipulated original received packet; and
transferring the manipulated network based tunnel packet to the destination over network based tunnels;
wherein the step of updating the cross-reference table further comprises using parameters, wherein the parameters that are used for updating the cross-reference table comprise the IP address of the manipulation system.
12. The method of claim 11 , wherein determining whether an original packet is targeted toward the manipulation system is based on the destination address of the original packet.
13. A method for manipulating the transportation of original packets transported via an access network to the Internet between a plurality of remote clients and a plurality of IP based private data networks, wherein the original packets are encapsulated in network based tunnel packets, and wherein the manipulation is done at the access network service provider's premises, the method comprising the steps of:
intercepting, at the access network service provider's premises, the transportation between the plurality remote clients and the plurality of IP based private data networks, wherein at least two of the remote clients are in communication with different IP based private data networks;
parsing a received network based tunnel packet to determine if its encapsulated original packet is targeted toward a manipulation system;
forwarding the received network based tunnel packet, as is, towards a destination if the encapsulated original packet is not targeted toward the manipulation system;
if the encapsulated original packet is targeted toward the manipulation system, then:
retrieving the original packet out of the network based tunnel packet;
updating a cross-reference table with parameters that associate the original packet with the received network based tunnel packet, the cross-reference table enabling the reconstruction of a manipulated network based tunnel packet that will be transferred to the destination after the manipulation of the received original packet;
transferring the original packet toward the manipulation system;
manipulating the original packet into a manipulated original packet;
reconstructing the manipulated network based tunnel packet with the manipulated original received packet; and
transferring the manipulated network based tunnel packet to the destination over network based tunnels;
wherein the step of updating the cross-reference table further comprises using parameters, wherein the parameters that are used for updating the cross-reference table further comprise the IP address of one of the plurality of IP based private data networks.
14. The method of claim 13 , wherein determining whether an original packet is targeted toward the manipulation system is based on the destination address of the original packet.
15. A method for manipulating the transportation of original packets transported via an access network to the Internet between a plurality of remote clients and a plurality of IP based private data networks wherein the original packets are encapsulated in network based tunnel packets, and wherein the manipulation is done at the access network service provider's premises, the method comprising the steps of:
intercepting, at the access network service provider's premises, the transportation between the plurality of remote clients and the plurality of IP based private data networks, wherein at least two of the remote clients are in communication with different IP based private data networks;
parsing a received network based tunnel packet to determine if its encapsulated original packet is targeted toward a manipulation system;
forwarding the received network based tunnel packet, as is, towards a destination if the encapsulated original packet is not targeted toward the manipulation system;
if the encapsulated original packet is targeted toward the manipulation system, then:
retrieving the original packet out of the network based tunnel packet;
updating a cross-reference table with parameters that associate the original packet with the received network based tunnel packet, the cross-reference table enabling the reconstruction of a manipulated network based tunnel packet that will be transferred to the destination after the manipulation of the received original packet;
transferring the original packet toward the manipulation system;
manipulating the original packet into a manipulated original packet;
reconstructing the manipulated network based tunnel packet with the manipulated original received packet; and
transferring the manipulated network based tunnel packet to the destination over network based tunnels;
wherein the step of updating the cross-reference table further comprises using parameters, wherein the parameters that are used for updating the cross-reference table further comprise the IP address of one of the plurality of remote clients.
16. The method of claim 15 , wherein determining whether an original packet is targeted toward the manipulation system is based on the destination address of the original packet.
17. A system for manipulating the transportation of original packets transported between a plurality of remote clients via an access network and a plurality of IP based private data networks, wherein the original packets are encapsulated in network based tunnel packets, and wherein the system is at the access network service provider's premises, the system comprising:
an access gateway interface module that interfaces between the plurality of remote clients and the access network;
a border gateway interface module that interfaces between the access network and the plurality of IP based private data networks;
a manipulation module for manipulating the original packets that are encapsulated in the network based tunnel packets;
a manipulation interface module, interfacing to the access gateway interface module and the border gateway interface module and the manipulation module and that receives network based tunnel packets from, and sends network based tunnel packets to, the access gateway interface and the border gateway interface modules;
wherein the manipulation equipment interface being further operable to parse a received network based tunnel packet, retrieve an original packet, determine whether the retrieved original packet is targeted toward the manipulation system and, if the retrieved original packet is determined to have been targeted toward the manipulation system, send the retrieved original packet to the manipulation module, receive a manipulated packet that is the result of the manipulation of the original packet, reconstruct the network based tunnel packet by installing the manipulated original packet, and forward the reconstructed network based tunnel packet to either the access gateway interface or the border gateway interface,
wherein the access gateway interface module maintains a table of the plurality of IP based private data networks that are users of the manipulation equipment.