Granted Patent B2

US 12,413,652 · App. 17/973,115 · Granted Sep 9, 2025

Inventors: Rajvardhan Somraj Deshmukh (San Jose, CA); Nancy Patricia Cam-Winget (Mountain View, CA); James W. Kasper (Leander, TX)

Assignee: Cisco Technology, Inc.

H04L69/16H04L45/02H04L63/0236

Abstract

Claims (106)

1. A method comprising:

identifying, by a network device, a first QUIC connection between a first device and a second device;

determining, from the first QUIC connection, a first IP-tuple including a first IP address and a first port number associated with the first device;

determining, from the first QUIC connection, a second IP-tuple including a second IP address and a second port number associated with the second device;

determining, from the first QUIC connection, a first connection identifier (CID) associated with the first QUIC connection;

storing a first association between the first IP-tuple, the second IP-tuple, and the first CID associated with the first QUIC connection;

identifying, by the network device, a second QUIC connection between the first device and another device;

identifying, from the second QUIC connection, the first IP-tuple, a second CID, and a third IP-tuple including a third IP address and a third port number;

determining whether at least two following connection criteria are met:

the second IP address corresponds to the third IP address;

the second port number corresponds to the third port number; or

the second CID corresponds to the first CID; and

in response to determining that at least two connection criteria are met, determining that the second QUIC connection and the first QUIC connection are a same QUIC connection, and updating the first association based at least in part on the third IP-tuple or the second CID.

2. The method of claim 1 , further comprising:

in response to determining that at least two connection criteria are not met, determining that the second QUIC connection does not correspond to the first QUIC connection; and

storing a second association between the first IP-tuple, the third IP-tuple, and the second CID associated with the second QUIC connection.

3. The method of claim 1 , further comprising:

determining that the second IP address corresponds to the third IP address;

determining that the second port number corresponds to the third port number;

determining that the second CID does not correspond to the first CID; and

storing the second CID in a list of probable CIDs.

4. The method of claim 1 , further comprising:

determining that the second IP-tuple is associated with a server name index (SNI) and wherein storing the first association includes storing an association with the SNI.

5. The method of claim 1 , wherein the network device is a middlebox and is one of a firewall, a Network Address Translator (NAT), a content delivery network (CDN), a load balancer, a WAN optimizer, a cloud based gateway, a cloud based firewall, or a secure router.

6. The method of claim 1 , further comprising:

receiving, by the network device, a QUIC packet;

determining, by the network device, a source IP-tuple, a destination IP-tuple, and a CID from the QUIC packet;

determining, by the network device, that the source IP-tuple, the destination IP-tuple, and the CID from the QUIC packet correspond to the first association associated with the first QUIC connection; and

transmitting the QUIC packet to a destination device associated with the destination IP-tuple.

7. The method of claim 1 , further comprising:

receiving, by the network device, a QUIC packet;

determining, by the network device, a source IP-tuple, a destination IP-tuple, and a CID from the QUIC packet;

determining, by the network device, that the source IP-tuple, the destination IP-tuple, and the CID from the QUIC packet do not correspond to the first association associated with the first QUIC connection; and

dropping the QUIC packet.

8. A system comprising:

one or more processors; and

one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

identifying, by a network device, a first QUIC connection between a first device and a second device;

determining, from the first QUIC connection, a first IP-tuple including a first IP address and a first port number associated with the first device;

determining, from the first QUIC connection, a second IP-tuple including a second IP address and a second port number associated with the second device;

determining, from the first QUIC connection, a first connection identifier (CID) associated with the first QUIC connection;

storing a first association between the first IP-tuple, the second IP-tuple, and the first CID associated with the first QUIC connection;

identifying, by the network device, a second QUIC connection between the first device and another device;

identifying, from the second QUIC connection, the first IP-tuple, a second CID, and a third IP-tuple including a third IP address and a third port number;

determining whether at least two following connection criteria are met:

the second IP address corresponds to the third IP address;

the second port number corresponds to the third port number; or

the second CID corresponds to the first CID; and

in response to determining that at least two connection criteria are met, determining that the second QUIC connection and the first QUIC connection are a same QUIC connection, and updating the first association based at least in part on the third IP-tuple or the second CID.

9. The system of claim 8 , further comprising:

in response to determining that at least two of the connection criteria are not met, determining that the second QUIC connection does not correspond to the first QUIC connection; and

storing a second association between the first IP-tuple, the third IP-tuple, and the second CID associated with the second QUIC connection.

10. The system of claim 8 , further comprising:

determining that the second IP address corresponds to the third IP address;

determining that the second port number corresponds to the third port number;

determining that the second CID does not correspond to the first CID; and

storing the second CID in a list of probable CIDs.

11. The system of claim 8 , further comprising:

determining that the second IP-tuple is associated with a server name index (SNI) and wherein storing the first association includes storing an association with the SNI.

12. The system of claim 11 , further comprising:

determining that the third IP-tuple is associated with the SNI;

determining that the third IP-tuple corresponds to the second IP-tuple;

determining that the second QUIC connection corresponds to the first QUIC connection; and

updating the first association with the second CID.

13. The system of claim 8 , wherein the network device a middlebox and is one of a firewall, a Network Address Translator (NAT), a content delivery network (CDN), a load balancer, or a WAN optimizer.

14. The system of claim 8 , further comprising:

receiving, by the network device, a QUIC packet;

determining, by the network device, a source IP-tuple, a destination IP-tuple, and a CID from the QUIC packet;

determining, by the network device, that the source IP-tuple, the destination IP-tuple, and the CID from the QUIC packet correspond to the first association associated with the first QUIC connection; and

transmitting the QUIC packet to a destination device associated with the destination IP-tuple.

15. The system of claim 8 , further comprising:

receiving, by the network device, a QUIC packet;

determining, by the network device, a source IP-tuple, a destination IP-tuple, and a CID from the QUIC packet;

determining, by the network device, that the source IP-tuple, the destination IP-tuple, and the CID from the QUIC packet do not correspond to the first association associated with the first QUIC connection; and

dropping the QUIC packet.

16. One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:

identifying, by a network device, a first QUIC connection between a first device and a second device;

determining, from the first QUIC connection, a first IP-tuple including a first IP address and a first port number associated with the first device;

determining, from the first QUIC connection, a second IP-tuple including a second IP address and a second port number associated with the second device;

determining, from the first QUIC connection, a first connection identifier (CID) associated with the first QUIC connection;

storing a first association between the first IP-tuple, the second IP-tuple, and the first CID associated with the first QUIC connection;

identifying, by the network device, a second QUIC connection between the first device and another device;

identifying, from the second QUIC connection, the first IP-tuple, a second CID, and a third IP-tuple including a third IP address and a third port number;

determining whether at least two following connection criteria are met:

the second IP address corresponds to the third IP address;

the second port number corresponds to the third port number; or

the second CID corresponds to the first CID; and

in response to determining that at least two connection criteria are met, determining that the second QUIC connection and the first QUIC connection are a same QUIC connection, and updating the first association based at least in part on the third IP-tuple or the second CID.

17. The one or more non-transitory computer-readable media of claim 16 , the operations further comprising:

in response to determining that at least two of the connection criteria are not met, determining that the second QUIC connection does not correspond to the first QUIC connection; and

storing a second association between the first IP-tuple, the third IP-tuple, and the second CID associated with the second QUIC connection.

18. The one or more non-transitory computer-readable media of claim 16 , the operations further comprising:

determining that the second IP address corresponds to the third IP address;

determining that the second port number corresponds to the third port number;

determining that the second CID does not correspond to the first CID; and

storing the second CID in a list of probable CIDs.

19. The one or more non-transitory computer-readable media of claim 16 , the operations further comprising:

receiving, by the network device, a QUIC packet;

determining, by the network device, a source IP-tuple, a destination IP-tuple, and a CID from the QUIC packet;

determining, by the network device, that the source IP-tuple, the destination IP-tuple, and the CID from the QUIC packet correspond to the first association associated with the first QUIC connection; and

transmitting the QUIC packet to a destination device associated with the destination IP-tuple.

20. The one or more non-transitory computer-readable media of claim 16 , the operations further comprising:

receiving, by the network device, a QUIC packet;

determining, by the network device, a source IP-tuple, a destination IP-tuple, and a CID from the QUIC packet;

determining, by the network device, that the source IP-tuple, the destination IP-tuple, and the CID from the QUIC packet do not correspond to the first association associated with the first QUIC connection; and

dropping the QUIC packet.

Assignments (1)

Continuity (2)

References Cited (15)