Methods and systems to split equipment control between local and remote processing units

1. A computer implemented method comprising:

determining which gateway functions of a computer network are to be performed locally on a customer premises and which are to be performed remotely therefrom, the determining comprising

receiving, by customer premises computer equipment, a TCP-based data flow from a client;

the customer premises equipment rewriting an IP header of the data flow and using the rewritten IP header to forward the data flow to a defined TCP port;

a transient termination server process operating in user space of the customer premises equipment, listening to the defined TCP port, and reading an application payload sent by the client;

the transient termination server process sending data corresponding to the data flow to a deep packet inspection engine for protocol identification;

identifying, by the deep packet inspection engine, a protocol associated with the data flow;

the transient termination server process looking up, based on the protocol identified by the deep packet inspection engine, a handling policy from a policy cache stored in the customer premises equipment; and

the customer premises equipment assigning one or more gateway functions corresponding to the data flow to be performed either locally or remotely according to the handling policy.

2. The method of claim 1 , wherein the determining further comprises the customer premises equipment requesting a handling policy from a remote vendor computer if no relevant handling policy is defined in the policy cache.

3. The method of claim 1 , wherein the handling policy indicates that the data should be handled by a fast-path and wherein the method comprises the transient termination server process creating a new TCP connection to a remote vendor computer, sending all application data received from the client to the remote vendor computer, and splicing the client's TCP connection and server TCP connection whereby the transient termination server process removes itself from the connection.

4. The method of claim 1 , wherein the handling policy indicates the application payload data should be sent to a remote vendor computer for malware inspection and wherein the method comprises the transient termination server sending a control plane message to the remote vendor computer to request that the remote vendor computer establish a connection to the server whereby the transient termination server process remains interposed in a conversation between the client and the vendor computer.

5. The method of claim 1 , wherein the determining further comprises sending all application level data received from the client to the transient termination server process and the transient termination server process using the deep packet inspection engine to attempt to classify an application protocol by inspecting the application level data.

6. The method of claim 1 , wherein the determining further comprises the customer premises equipment rewriting an IP header of a client SYN packet with an IP address and port of the transient termination server process and forwarding the SYN packet to a customer premises equipment stack.

7. The method of claim 1 , wherein the determining further comprises:

the transient termination server process recovering port information from an original TCP connection request;

the transient termination server process sending a message to a transient termination proxy process on a remote vendor computer; and

the transient termination proxy process establishing a second TCP connection to a destination server.

8. The method of claim 1 , wherein the determining further comprises:

the customer premises equipment storing a flow table that controls processing of data flow based on known characteristics of a data flow;

a remote vendor computer storing the flow table; and

using the flow table to provide fast path processing through the customer premises equipment.

9. The method of claim 8 , wherein the determining further comprises the remote vendor computer updating the flow table.

10. The method of claim 8 , wherein the determining further comprises:

modeling characteristics of the customer premises equipment as a state;

storing a model of the customer premises equipment on the remote vendor computer; and

handling TCP-based data flow as rules engines that can modify the state of the customer premises equipment when needed.

11. A computer system comprising:

a customer premises computer equipment comprising at least one hardware processor operably connected to memory, the memory storing instructions programmed to determine which gateway functions of a computer network are to be performed locally on a customer premises and which are to be performed remotely therefrom, the determining comprising:

receiving a TCP-based data flow from a client;

rewriting an IP header of the data flow and using the rewritten IP header to forward the data flow to a defined TCP port;

operating a transient termination server process in user space to listen to the defined TCP port and read an application payload sent by the client;

sending data corresponding to the data flow to a deep packet inspection engine for protocol identification;

identifying, by the deep packet inspection engine, a protocol associated with the data flow;

looking up, based on the protocol identified by the deep packet inspection engine, a handling policy from a policy cache stored in the customer premises equipment; and

assigning one or more gateway functions corresponding to the data flow to be performed either locally or remotely according to the handling policy.

12. The system of claim 11 , wherein the customer premises equipment is further programmed to request a handling policy from a remote vendor computer if no relevant handling policy is defined in the policy cache.

13. The system of claim 11 , wherein the handling policy indicates that the data should be handled by a fast-path and wherein the customer premises equipment is programmed to create a new TCP connection to a remote vendor computer, send all application data received from the client to the remote vendor computer, and splice the client's TCP connection and server TCP connection to remove itself from the connection.

14. The system of claim 11 , wherein the handling policy indicates the application payload data should be sent to a remote vendor computer for malware inspection and wherein the customer premises equipment is programmed to send a control plane message to the remote vendor computer to request that the remote vendor computer establish a connection to the server whereby the transient termination server process remains interposed in a conversation between the client and the vendor computer.

15. The system of claim 11 , wherein the customer premises equipment is further programmed to send all application level data received from the client to the transient termination server process and the transient termination server process uses the deep packet inspection engine to attempt to classify an application protocol by inspecting the application level data.

16. The system of claim 11 , wherein the customer premises equipment is further programmed to rewrite an IP header of a client SYN packet with an IP address and port of the transient termination server process and forward the SYN packet to a customer premises equipment stack.

17. The system of claim 11 , wherein the customer premises equipment is further programmed to:

recover port information from an original TCP connection request;

send a message to a transient termination proxy process on a remote vendor computer; and

wherein the remote vendor computer is programmed to:

establish, via the transient termination proxy process, a second TCP connection to a destination server.

18. The system of claim 11 , wherein the customer premises equipment is further programmed to store a flow table that controls processing of data flow based on known characteristics thereof; and

wherein a remote vendor computer is programmed to store the flow table; and

wherein the system is programmed to use the flow table to provide fast path processing through the customer premises equipment.

19. The system of claim 18 , wherein the remote vendor computer is further programmed to update the flow table.

20. The system of claim 18 , wherein the system is programmed to:

model characteristics of the customer premises equipment as a state;

store a model of the customer premises equipment on the remote vendor computer; and

handle TCP-based data flow as rules engines that can modify the state of the customer premises equipment when needed.