Managing proxy throughput between paired transport layer connections

A proxy server can be configured to manage flow between terminated transport layer connections despite incongruous network conditions. The proxy server is programmed to dynamically adjust window size of one transport layer connection in the pair of proxy terminated connections to accommodate the other connection. After detecting a network condition related to one of the connections, the proxy server determines a drain rate of the transmit buffer of the transport layer connection corresponding to the impacting network condition. The proxy server then adjusts the transport layer window size for the other connection of the connection pair based on the determined drain rate.

BACKGROUND

The disclosure generally relates to an electronic communication technique and transmission of digital information (CPC H04L).

The connection-oriented communication protocol Transport Control Protocol (TCP) provides a control flow mechanism. During a handshake between TCP endpoints, handshake messages advertise window sizes for the read buffers of the endpoints and establish maximum segment sizes (MSSs). When communicating an acknowledgement segment (ACK), the ACK advertises the window size which indicates the read buffer that is available after removal of the acknowledged segment from the read buffer. A TCP instance advertises window size as part of the control flow mechanism for a receiver to govern the amount of data transmitted to the receiver and prevent a sender endpoint from overwhelming the receiver endpoint. A sender endpoint or sender will send data according to a sliding window protocol. The sender will send data in segments up to the most recently advertised window size. According to the ACKs from the receiver, the sender will proceed with sending additional segments to fill the available read buffer determined from the ACKs. If the receiver endpoint receives a segment while the read buffer is full, then the receiver will advertise a window size of 0 (zero window condition).

DESCRIPTION

The description that follows includes example systems, methods, techniques, and program flows that embody aspects of the disclosure. However, it is understood that this disclosure may be practiced without these specific details. For instance, this disclosure refers to a transport layer security (TLS) proxy and a firewall in illustrative examples. However, embodiments are not limited to a particular proxy implementation. Embodiments can be applied to a variety of environments that involve a proxy between transport layer connections that may experience incongruous network conditions. In other instances, well-known instruction instances, protocols, structures and techniques have not been shown in detail in order not to obfuscate the description.

Overview

A network security device can run a firewall as a TLS proxy server to examine encrypted data traffic traversing the network security device. To manage incongruous network conditions that can impact proxy throughput, a proxy throughput manager is disclosed herein that dynamically adjusts window size of the transport layer connection with a better network condition (e.g., lower bandwidth delay product (BDP)) to accommodate the other connection. After detecting a network condition for a connection of a proxied connection pair that impacts proxy throughput (e.g., a zero window condition), the proxy server determines a drain rate of the write buffer of the transport layer connection corresponding to the impacting network condition. The proxy server then adjusts the transport layer window size for the other connection of the connection pair based on the determined drain rate.

Example Illustrations

FIG.1depicts a diagram of a proxy throughput manager leveraging transport layer flow control to manage throughput of paired transport layer connections with heterogeneous network conditions.FIG.1includes a client103, a proxy server101, and a destination server105. This illustration presumes that a firewall implements the proxy server101. The proxy server101terminates transport layer connections with the client103and the destination server105. The connection between the proxy server101and the client103is labelled as a client connection121and the connection between the proxy server101and the destination server105is labelled as a server connection123. These labels are used merely for descriptive efficiency. The proxy server101hosts an operating system102that includes a transport window size based proxy throughput manager (hereinafter “proxy throughput manager”)113and TCP/IP stack instances109,111. The TCP/IP stack instance109terminates the client connection121and the TCP/IP stack instance terminates the server connection123. The operating system102has allocated a read buffer119and a write buffer115to the TCP/IP stack instance109. The operating system102has allocated a read buffer117and a write buffer121to the TCP/IP stack instance111.

FIG.1is annotated with a series of letters A-D which represent stages of operations, each of which can be one or more operations. Although these stages are ordered for this example, the stages illustrate one example to aid in understanding this disclosure and should not be used to limit the claims. Subject matter falling within the scope of the claims can vary with respect to the order and some of the operations.

At stage A, the proxy throughput manager113detects a trigger for managing proxy throughput. “Proxy throughput” refers to the rate of data being read by the proxy server101from a read buffer of one transport layer connection and then written to the write buffer of the other transport layer connection forming the pair of transport layer connections terminating at the proxy server101. Managing the proxy throughput refers to maintaining a stable flow of data/segments between the terminated transport layer connections. Triggers for managing proxy throughput include events or notifications that indicate a condition that can impact the stable flow between proxy terminated connections. A trigger can relate to condition of the network supporting one of the connections forming a proxy terminated connection pair. InFIG.1, the trigger arises from a network condition of the client connection121.

At stage B, the proxy throughput manager113determines a network statistic of the client connection121. For example, the proxy throughput manager113determines the bandwidth delay product for the client connection121. To determine the BDP, the proxy throughput manager113can access information from the operating system102about data link size or transmission rate capacity of the data link supporting client connection121and obtain round trip delay (RTD) from the TCP/IP stack instance109.

At stage C, the proxy throughput manager113commands the TCP/IP stack instance111to set window size of the read buffer based on the determined network statistic. For instance, the proxy throughput manager113runs a TCP configuration command. The proxy throughput manager113determines a window size for the read buffer117based on the network statistic determined for the client connection121. Assuming the network statistic is a BDP value, then the proxy throughput manager113determines a window size for the read buffer117that can accommodate the BDP value corresponding to the write buffer115. This can prevent a network condition that is impeding draining of the write buffer115from propagating to the server connection123.

At stage D, the TCP/IP stack instance111advertises the window size according to the command from the proxy throughput manager113. The TCP/IP stack instance111sets the window size field in a TCP header of an ACK segment125.

The example illustration ofFIG.1presumes the client connection121is the connection impeding proxy throughput. While a common case will be that the underlying communication network for a client connection (e.g., last mile) has less capacity than the underlying communication network for a server connection, that is not necessarily the case. Varying conditions, environments, infrastructure, can arise to create heterogeneous network conditions on either side of a proxy. And the network conditions may be transient.

FIG.2is a flowchart of example operations for managing proxy throughput between a proxy terminated pair of transport layer connections. The example operations are described with reference to a proxy throughput manager for consistency with the earlier figure. The name chosen for the program code is not to be limiting on the claims. Structure and organization of a program can vary due to platform, programmer/architect preferences, programming language, etc. In addition, names of code units (programs, modules, methods, functions, etc.) can vary for the same reasons and can be arbitrary. The proxy throughput manager can be program code that is integrated into proxy program code or invoked for a proxy.

At block201, the proxy throughput manager sets monitors on a pair of transport layer connections terminated by a proxy associated with the proxy throughput manager. The proxy throughput manager sets the monitors to detect a condition for trigger throughput management (“trigger condition”). After a proxy redirects a client transport connection to a destination server transport layer connection, the proxy indicates the pairing of connections to the proxy throughput manager. If the proxy throughput manager is a separate process from the proxy, then the proxy notifies the proxy throughput manager of the pairing of transport layer connections. If proxy throughput manager is incorporated into the proxy, then the proxy can execute the corresponding program code to launch the proxy throughput manager process.

The proxy throughput manager can set monitors with different techniques. Setting monitors can be subscribing to another process to receive notifications of events, instantiating listener processes that have visibility of ACK segments, monitoring data occupying buffers, etc. The proxy throughput manager can subscribe to the transport layer communication processes (e.g., TCP process) for notifications of throughput impacting events.

At block203, the proxy throughput manager detects a trigger condition to manage proxy throughput for the paired transport layer connections. To distinguish the connections, the transport layer connection corresponding to the trigger condition is referred to as the triggering connection and the other connection is referred to as the adapting connection. The trigger condition indicates that the network condition of the triggering connection is hampering or impeding proxy throughput. In other words, the network condition of the triggering connection cannot consume the data being written from the read buffer of the adapting connection.

At block205, the proxy throughput manager determines a network statistic(s) of the triggering connection. The network statistic(s) relates to the network condition of the triggering connection. Example network statistics include packet loss, RTT, and latency. The example network statistic can be BDP computed from link size and a transport layer statistic.

At block207, the proxy throughput manager determines a window size based on the network statistic(s) of the triggering connection. The proxy throughput manager determines a window size for the adapting connection that can avoid overwhelming the triggering connection. Determining the window size may be according to a rule that specifies a margin with respect to a boundary that is the network statistic or based on the network statistic. For instance, the BDP for the triggering connection may be the network statistic. The rule can specify that the window size for the adapting connection be set above the BDP within a margin or at a predefined distance from the BDP. As an example, the window size can be set to be product of the BDP and a predetermined factor (e.g., 1.2) or a sum of the BDP and a predetermined distance (e.g., 200 kilobytes). Resizing the transport layer window to be between the current window size and the BDP accounts for the various reasons that lead to the triggering condition. One reason may be that the initial window size is insufficient for the network capacity (i.e., the initial window size is too small). Another reason is mismatched latency—the triggering connection has a longer latency than the adapting latency. As a result, the ramp up of throughput for the triggering connection is slower than for the adapting connection. Another reason is temporary network congestion or packet loss on the triggering connection. Sizing the window to be greater than BDP allows the proxy to buffer data sufficient to mitigate the transient network condition. This also avoid consuming memory of the proxy. The proxy throughput manager may also account for historical behavior. The proxy throughput manager may compute an average BDP across a defined time window while the connection pairing has been active and use the average as the network statistic used to set the window size. Assuming a MSS of 512 bytes for the adapting connection and a BDP of 125 kilobytes (kB) for the triggering connection and a window sizing factor of 1.2, then the proxy throughput manager could determine the window size for the adapting connection to be 293 segments or 150,016 bytes.

At block209, the proxy throughput manager configures the window size of the adapting connection based on the determined window size. The proxy throughput manager executes a configuration command for the transport layer process to set the maximum window size to the determined window size.

Variations

The above examples presume throttling of the window size of a higher capacity connection in a transport layer connection pair. When a zero window condition is detected for the triggering connection, then the window size of the adapting connection is adjusted to control flow between the paired connections and maintain stable throughput for the proxy. The proxy throughput manager can periodically query network tools or the network stack instance for improvements as well as degradations in network connections. Embodiments can set a timer after reducing window size and assess the network condition of the triggering connection after expiration of the timer to determine whether the window size of the adapting connection can be increased (e.g., increasing to a midpoint between the current window size and default window size). Embodiments can monitor the write buffers of a pair of transport layer connections and trigger a window size reconfiguration if a drain rate of either write buffer decreases below a threshold of variation or increases and sustains the increase over a defined time period.

FIG.3depicts an example computer system with a transport layer based proxy throughput manager. The computer system includes a processor301(possibly including multiple processors, multiple cores, multiple nodes, and/or implementing multi-threading, etc.). The computer system includes memory307. The memory307may be system memory or any one or more of the above already described possible realizations of machine-readable media. The computer system also includes a bus303and a network interface305. The system also includes a transport layer based proxy throughput manager311. The transport layer based proxy throughput manager311manages or regulates window size of paired transport layer connections terminated by a proxy to facilitate stable flow between the paired connections. This eliminates or reduces the likelihood of one connection overwhelming the other connection and facilitates optimal use of the lesser capacity connection. Any one of the previously described functionalities may be partially (or entirely) implemented in hardware and/or on the processor301. For example, the functionality may be implemented with an application specific integrated circuit, in logic implemented in the processor301, in a co-processor on a peripheral device or card, etc. Further, realizations may include fewer or additional components not illustrated inFIG.3(e.g., video cards, audio cards, additional network interfaces, peripheral devices, etc.). The processor301and the network interface305are coupled to the bus303. Although illustrated as being coupled to the bus303, the memory307may be coupled to the processor301.

Terminology