Cooperative proxy auto-discovery and connection interception through network address translation
View Patent ↗Proxy devices associate their direct connection with a client/server connection passing through one or more NAT devices. First proxy device receives a network connection request from a client. First proxy device stores connection information in association with a connection identifier. Connection information may reflect the usage of NAT devices between the two proxy devices. First proxy device sends a connection response including the connection identifier to the client. Second proxy device sends a direct connection request to first proxy device to establish a direct connection. Direct connection request includes the connection identifier, which is used by first proxy device to associate the direct connection with stored connection information. First proxy device may use the connection information to direct network traffic received via this direct connection to the correct destination and to divert network traffic from the server to the client through the direct connection and first and second proxy devices.
1. A method of establishing a network connection between proxy devices, the method comprising:
receiving, at a first proxy device, a connection request message from a first network device to a second network device, wherein the connection request message includes an auto-discovery indicator adapted to indicate that an existence of a second proxy device and connection information associated with the first and second network devices, wherein the first proxy device receives the connection request message directed from a public network address of the first network device to a private address of the second network device, and wherein the second proxy device receives the connection request message directed from a private network address of the first network device to a public address of the second network device;
storing the connection information in association with a connection identifier at the first proxy device;
sending a connection response message including the connection identifier to the first network device, wherein the connection response message is adapted to indicate the existence of the first proxy device to the second proxy device;
receiving an inner network connection setup message at the first proxy device from the second proxy device, wherein the inner network connection setup message is adapted to establish an inner network connection between the first and second proxy devices and includes the connection identifier;
retrieving the connection information using the connection identifier; and
using the connection information, directing network traffic associated with the inner network connection to the second network device.
2. The method of claim 1 , wherein the connection request message is associated with first network addresses of the first and second network devices that are different from second network addresses of the first and second proxy devices used for the inner connection setup message.
3. The method of claim 1 , wherein storing the connection information in association with the connection identifier at the first proxy device comprises:
generating, at the first proxy device, the connection identifier.
4. The method of claim 1 , wherein storing the connection information in association with the connection identifier at the first proxy device comprises:
retrieving, at the first proxy device, the connection identifier from the connection request message, wherein the connection identifier was previously generated by the second proxy device.
5. The method of claim 1 , wherein the connection information includes at least one network address of the first and/or second network devices.
6. The method of claim 5 , wherein the network address includes a public network address associated with the first network device as detected by the first proxy device.
7. The method of claim 5 , wherein the network address includes a private network address associated with the second network device as detected by the first network proxy.
8. The method of claim 1 , comprising:
using the connection information, intercepting second network traffic from the second network device directed to the first network device.
9. The method of claim 1 , wherein the network traffic associated with the inner network connection is generated at the first proxy device based on optimized network traffic received at the first proxy device via the inner connection.
10. A method of establishing a network connection between proxy devices, the method comprising:
receiving, at a first proxy device, a connection request message from a first network device to a second network device, wherein the first proxy device receives the connection request message directed from a private network address of the first network device to a public address of the second network device;
forwarding a modified connection request message based on the connection request message and including an auto-discovery indicator adapted to indicate the existence of the first proxy device;
receiving a connection response message including an auto-discovery response indicator adapted to indicate the presence of a second proxy device between the first proxy device and the second network device, wherein the connection response message includes a connection identifier, and wherein the second proxy device receives the connection request message directed from a public network address of the first network device to a private address of the second network device; and
sending an inner connection setup message to the second proxy device, wherein the inner connection setup message includes the connection identifier.
11. The method of claim 10 , wherein the connection request message is associated with first network addresses of the first and second network devices that are different from second network addresses of the first and second proxy devices used for the inner connection setup message.
12. The method of claim 10 , wherein the connection request message is associated by the first proxy device with first network addresses of the first and second network devices and the connection response message is associated by the second proxy device with second network addresses of the first and second network device.
13. The method of claim 12 , wherein the connection identifier is adapted to indicate to the second proxy device an association between the second network addresses and the inner connection setup message.
14. The method of claim 13 , wherein the connection identifier is adapted to enable the second proxy device to retrieve stored connection information including at least a portion of the second network addresses.
15. The method of claim 12 , wherein the first network addresses include a private network address of the first network device and a public network address of the second network device.
16. The method of claim 12 , wherein the second network addresses include a public network address of the first network device and a private network address of the second network device.
17. The method of claim 10 , wherein forwarding the modified connection request message comprises:
generating the connection identifier at the first proxy device; and
including the connection identifier in the modified connection request message.
18. The method of claim 10 , wherein receiving the connection response message includes receiving the connection identifier generated at the second proxy device.