Inspection of network traffic in a security device at object level
A method, system, and computer-usable medium are disclosed for, responsive to establishment of a connection between a first endpoint device and a second endpoint device: maintaining, by a security device interfaced between the first endpoint device and the second endpoint device for inspecting traffic transmitted over the connection, a first communication state to be identical to a communication state of the first endpoint device; and maintaining, by the security device, a second communication state to be identical to a communication state of the second endpoint device; and responsive to transmission of traffic from the first endpoint and intended for the second endpoint: inspecting individual objects of the traffic; modifying stream identifiers of the individual objects prior to retransmission of the traffic to the second endpoint to maintain ordering of stream identifiers as seen by the second endpoint; and maintaining a mapping of the modified stream identifiers such that the mapping is used by the security device such that responses transmitted by the second endpoint in response to the objects transmitted by first endpoint device are modified to their original stream identifiers of the objects transmitted by first endpoint device.
1. A computer-implementable method for managing network communication, comprising:
responsive to establishment of a connection between a first endpoint device and a second endpoint device:
maintaining, by a security device interfaced between the first endpoint device and the second endpoint device for inspecting traffic transmitted over the connection, a first communication state to be identical to a communication state of the first endpoint device; and
maintaining, by the security device, a second communication state to be identical to a communication state of the second endpoint device; and
responsive to transmission of traffic from the first endpoint and intended for the second endpoint:
inspecting individual objects of the traffic;
modifying stream identifiers of the individual objects prior to retransmission of the traffic to the second endpoint to maintain ordering of stream identifiers as seen by the second endpoint; and
maintaining a mapping of the modified stream identifiers such that the mapping is used by the security device such that responses transmitted by the second endpoint in response to the objects transmitted by first endpoint device are modified to their original stream identifiers of the objects transmitted by first endpoint device.
2. The method of claim 1 , wherein the security device is a gateway device.
3. The method of claim 1 , wherein:
one of the first endpoint device and the second is a client device; and
the other of the first endpoint device and the second is a server device.
4. The method of claim 1 , wherein the connection is a Hypertext Transfer Protocol Version 2-compliant connection.
5. The method of claim 1 , further comprising:
maintaining, by the security device, a third communication state to be identical to a receiving communication state of the first endpoint device; and
maintaining, by the security device, a fourth communication state to be identical to a transmitting communication state of the second endpoint device.
6. The method of claim 1 , wherein the first communication state and the second communication state are each a communication state associated with a header compression algorithm for frames of the traffic.
7. A system comprising:
a processor;
a data bus coupled to the processor; and
a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:
responsive to establishment of a connection between a first endpoint device and a second endpoint device:
maintaining, by a security device interfaced between the first endpoint device and the second endpoint device for inspecting traffic transmitted over the connection, a first communication state to be identical to a communication state of the first endpoint device; and
maintaining, by the security device, a second communication state to be identical to a communication state of the second endpoint device; and
responsive to transmission of traffic from the first endpoint and intended for the second endpoint:
inspecting individual objects of the traffic;
modifying stream identifiers of the individual objects prior to retransmission of the traffic to the second endpoint to maintain ordering of stream identifiers as seen by the second endpoint; and
maintaining a mapping of the modified stream identifiers such that the mapping is used by the security device such that responses transmitted by the second endpoint in response to the objects transmitted by first endpoint device are modified to their original stream identifiers of the objects transmitted by first endpoint device.
8. The system of claim 7 , wherein the security device is a gateway device.
9. The system of claim 7 , wherein:
one of the first endpoint device and the second is a client device; and
the other of the first endpoint device and the second is a server device.
10. The system of claim 7 , wherein the connection is a Hypertext Transfer Protocol Version 2-compliant connection.
11. The system of claim 7 , the instructions further configured for:
maintaining, by the security device, a third communication state to be identical to a receiving communication state of the first endpoint device; and
maintaining, by the security device, a fourth communication state to be identical to a transmitting communication state of the second endpoint device.
12. The system of claim 7 , wherein the first communication state and the second communication state are each a communication state associated with a header compression algorithm for frames of the traffic.
13. The medium of claim 7 , the instructions further configured for:
maintaining, by the security device, a third communication state to be identical to a receiving communication state of the first endpoint device; and
maintaining, by the security device, a fourth communication state to be identical to a transmitting communication state of the second endpoint device.
14. The medium of claim 7 , wherein the first communication state and the second communication state are each a communication state associated with a header compression algorithm for frames of the traffic.
15. A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:
responsive to establishment of a connection between a first endpoint device and a second endpoint device:
maintaining, by a security device interfaced between the first endpoint device and the second endpoint device for inspecting traffic transmitted over the connection, a first communication state to be identical to a communication state of the first endpoint device; and
maintaining, by the security device, a second communication state to be identical to a communication state of the second endpoint device; and
responsive to transmission of traffic from the first endpoint and intended for the second endpoint:
inspecting individual objects of the traffic;
modifying stream identifiers of the individual objects prior to retransmission of the traffic to the second endpoint to maintain ordering of stream identifiers as seen by the second endpoint; and
maintaining a mapping of the modified stream identifiers such that the mapping is used by the security device such that responses transmitted by the second endpoint in response to the objects transmitted by first endpoint device are modified to their original stream identifiers of the objects transmitted by first endpoint device.
16. The medium of claim 15 , wherein the security device is a gateway device.
17. The medium of claim 15 , wherein:
one of the first endpoint device and the second is a client device; and
the other of the first endpoint device and the second is a server device.
18. The medium of claim 15 , wherein the connection is a Hypertext Transfer Protocol Version 2-compliant connection.