Protecting data integrity in an enhanced network connection
The integrity of a data stream transmitted over a network is protected by adjusting the sequence number, the port number, or another field of a data packet field, for a number of data packets so that the data packets will be considered either valid or invalid by a downstream receiving device. Data packets that have such a field adjusted can be thought of as being rotated outside of a valid range or window, as defined for a network connection. This field of a rotated data packet can be further adjusted, through de-rotation or re-rotation, for various applications. Downstream devices can thus respond to the data packets depending on the state of the rotation.
1. A method of protecting by one or more proxies integrity of data packets of a transport layer connection, comprising:
(a) receiving, by a first performance enhancing proxy, a data packet for a transport layer connection between an endpoint and a server, the data packet having a sequence number within a valid window of sequence numbers for the transport layer connection;
(b) rotating, by the first performance enhancing proxy, the sequence number of the data packet to a value outside of the valid window of sequence numbers;
(c) transmitting, by the first performance enhancing proxy, the data packet to the server;
(d) receiving, by a second performance enhancing proxy, the data packet;
(e) determining, by the second performance enhancing proxy, that the sequence number of the data packet falls outside the valid window of sequence numbers; and
(f) derotating, by the second performance enhancing proxy, the rotated sequence number of the data packet.
2. The method of claim 1 , wherein step (b) further comprises rotating the sequence number to the value that does not overlap a sequence number space associated with the transport layer connection.
3. The method of claim 1 , wherein step (b) further comprises rotating the sequence number to the value that does not overlap a sequence number space associated with a second transport layer connection.
4. The method of claim 1 , wherein step (b) further comprises rotating the sequence number by an amount equal to an amount used for rotating sequence numbers in a second transport layer connection.
5. The method of claim 1 , wherein step (b) further comprises rotating the sequence number by an amount different from an amount used for rotating sequence numbers in a second transport layer connection.
6. The method of claim 1 , wherein step (b) further comprises rotating the sequence number responsive to determining the data packet is enhanced.
7. The method of claim 1 , wherein step (f) further comprises derotating the sequence number responsive to determining that the data packet is enhanced.
8. The method of claim 1 , wherein step (f) further comprises derotating, by the second performance enhancing proxy, the sequence number to the sequence number received by the first performance enhancing proxy.
9. The method of claim 1 , wherein step (f) further comprises derotating, by the second performance enhancing proxy, the rotated sequence number if the data packet received by the second performance enhancing proxy is compatible with the data packet received by the first performance enhancing proxy.
10. The method of claim 1 , further comprising step (g) transmitting, by the second performance enhancing proxy, the derotated data packet to the server.
11. A system for protecting integrity of data packets of a transport layer connection, comprising:
a first performance enhancing proxy executed on a first device that receives a data packet having a sequence number
within a valid window of sequence numbers for a transport layer connection, rotates the sequence number to a value outside the valid window, and transmits the data packet to the server; and
a second performance enhancing proxy executed on a second device that receives the data packet, determines that the
sequence number falls outside the valid window, and de-rotates the rotated sequence number.
12. The system of claim 11 , wherein the first performance enhancing proxy rotates the sequence number to the value that does not overlap a sequence number space associated with the transport layer connection.
13. The system of claim 11 , wherein the first performance enhancing proxy rotates the sequence number to the value that does not overlap a sequence number space associated with a second transport layer connection.
14. The system of claim 11 , wherein the first performance enhancing proxy rotates the sequence number by an amount equal to an amount used for rotating sequence numbers in a second transport layer connection.
15. The system of claim 11 , wherein the first performance enhancing proxy rotates the sequence number by an amount different from an amount used for rotating sequence numbers in a second transport layer connection.
16. The system of claim 11 , wherein the first performance enhancing proxy rotates the sequence number responsive to determining that the data packet is enhanced.
17. The system of claim 11 , wherein the second performance enhancing proxy derotates the sequence number responsive to determining that the data packet is enhanced.
18. The system of claim 11 , wherein the second performance enhancing proxy derotates the rotated sequence number to the sequence number received by the first performance enhancing proxy.
19. The system of claim 11 , wherein the second performance enhancing proxy derotates the rotated sequence number if the data packet received by the second performance enhancing proxy is compatible with the data packet received by the first performance enhancing proxy.
20. The system of claim 11 , wherein the second performance enhancing proxy transmits the derotated data packet to the server.