Patent Publication Number: US-2005144290-A1

Title: Arbitrary java logic deployed transparently in a network

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS  
      This application claims priority to and incorporates by reference provisional patent application Ser. No. 60/492,177, filed Aug. 1, 2003. 
    
    
     BACKGROUND OF THE INVENTION  
      1. Field of the Invention  
      This invention relates generally to a hardware network appliance running Java software and providing connections between a back end server and a client, wherein it is desirable for the back end server to be able to see the original source IP address of the client, instead of the IP address of the network appliance, and wherein it is desirable to achieve this client-side transparency without using the Berkeley Software Design™ (BSD™) socket system call interface.  
      2. Description of Related Art  
      The state of the art in client-side transparency is characterized by a network appliance relying on a native BSD socket system call interface that requires support from the native kernel. It is generally desirable to take advantage of a socket because the programmer needs only to read and write data to and from the socket, and then manipulate the socket as desired, in order to transport data across a network. This eliminates much of the complication of sending TCP/IP messages across a network.  
      Accordingly, the BSD socket system call interface was developed to enable communication with and control of sockets. Programmers rely on low level C code to achieve client-side transparency through a hook to the BSD socket system call interface. Thus, the socket use is relatively inflexible and coded at a relatively low level in C in order to achieve the objective of client-side transparency.  
      It would be an advantage over the prior art to provide a network appliance capable of intercepting network traffic and providing client-side transparency, thus enabling a back-end server to see the original source IP address of a client, without relying on low level programming. It would be another advantage to achieve client-side transparency without relying on calls to the BSD socket system call interface.  
     BRIEF SUMMARY OF THE INVENTION  
      It is an object of the present invention to provide a network appliance that enables client-side transparency to a back-end server without making calls to the BSD socket system call interface.  
      It is another object to provide a network appliance that can respond to changes in functionality more rapidly than a C coded device, thereby achieving greater flexibility in architecture.  
      In a preferred embodiment, the present invention is a networking appliance having a Java proxy engine that provides client-side transparency, thereby enabling a back-end server to see the original source IP address of the client without having to use the BSD socket system call interface, wherein the network appliance is able to use high level Java code to achieve flexibility and rapid prototyping of modifications to the network appliance.  
      These and other objects, features, advantages and alternative aspects of the present invention will become apparent to those skilled in the art from a consideration of the following detailed description taken in combination with the accompanying drawings.  
    
    
     BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS  
       FIG. 1  is a block diagram of services that are arranged in accordance with the principles of the present invention.  
       FIG. 2  is a flow chart of the operations that are performed in an embodiment of the present invention. 
    
    
     DETAILED DESCRIPTION OF THE INVENTION  
      Reference will now be made to the drawings in which the various elements of the present invention will be given numerical designations and in which the invention will be discussed so as to enable one skilled in the art to make and use the invention. It is to be understood that the following description is only exemplary of the principles of the present invention, and should not be viewed as narrowing the claims which follow.  
      The presently preferred embodiment of the invention is a network appliance that intercepts network traffic. In the prior art, a proxy engine in the network appliance that is written in C code is programmed to perform desired functions. For example, consider the general flow of network data.  
       FIG. 1  shows software elements of a network appliance  10 . This network appliance  10  can be configured in an in-line mode wherein network traffic must pass through it to get to another side, or in a proxy mode. The goal of the present invention is to enable client-side transparency, wherein a back-end server is able to see the original source IP address of the client even though there is an intervening network appliance, but without having to make BSD socket calls. By avoiding BSD socket calls, the present invention avoids having to use the cumbersome low level C code to control socket functions. In other words, by enabling client-side transparency to occur using high level Java code, changes to the network appliance can be made quickly and easily by avoiding use of the C programming language.  
      The present invention overcomes several drawbacks to the prior art scenario described above. The advantages of the present invention will be described while referring to  FIG. 1 .  
       FIG. 1  is a block diagram of the basic elements of the present invention. These elements include a Java HTTP proxy  12 , Java Native Interface (JNI) layer access to the kernel  14 , and kernel transparency code  16 .  
      An example of the operation of these elements of the present invention will be described using the example of performing security operations on intercepted network traffic and as will be described in  FIG. 2 .  
      Consider a network appliance that is operating either in an in-line mode where network traffic must pass through it to get to another side, or in a proxy mode. Network traffic is intercepted in step  1  ( 20 ) by the network appliance. A TCP/IP packet enters an Ethernet port of the network appliance. The network appliance compares the TCP/IP packet to security policies of the network appliance in step  2  ( 22 ). If a security policy must be applied, the TCP/IP packet is sent up to the Application layer. In this layer, the Java proxy engine processes a data portion of the TCP/IP packet in step  3  ( 24 ). Once the security functions have been applied, such as signing, verification, encryption, etc., the Java proxy engine is ready to send the data back to the back-end server.  
      At this time in the process, the Java proxy engine has the back-end server&#39;s IP and TCP port addresses. The desire now is to connect to the back end server with the original source IP. This original source IP address should still be present at the connection. It is important to note that the Java proxy engine has no access to the BSD socket system call interface. Thus, the Java proxy engine cannot enable client-side transparency.  
      The Java proxy engine makes a special Java Native Interface (JNI) call in step  4  ( 26 ) with the parameters being &lt;client IP, client port, backend IP, backend port&gt;. These parameters are then stored in a kernel transparency database in step  5  ( 28 ). The Java proxy engine makes an ordinary high level HTTP URL connect call to the client IP and client TCP ports in step  6  ( 30 ). The kernel TCP_CONNECT code has a hook where it intercepts the call and determines if the destination IP and destination TCP ports match the ports saved in the kernel transparency database in step  7  ( 32 ). If there is a match then it is desirable to obtain client side transparency for this connection in step  8  ( 34 ). Accordingly, the destination IP and TCP ports are replaced with the actual back-end server&#39;s IP and TCP ports. In addition, the client IP address is replaced with the original client&#39;s IP address which is also stored in the kernel transparency database.  
      This process has several advantages over the prior art. First, a Java coded proxy engine is performing this operation. A Java coded proxy engine enables rapid prototyping of this function instead of having to use C code. Furthermore, this step is performed at relatively high speeds, thus performance is not being sacrificed by using the Java coded proxy engine. In addition, using a Java coded proxy engine means that the network appliance maintains its operating system platform independence because of the ubiquitous availability of Java virtual machines in operating systems.  
      It is envisioned that the Java and C proxy engines will be ported to a software platform on a desktop PC or a notebook PC running Windows 2000 or Windows XP. However, this should not be considered a limiting factor, and the present invention can be ported to other operating systems and other hardware platforms as well.  
      The advantages of the present invention over the prior art are substantial. The present invention is versatile because of its platform independence that is enabled by the use of the Java language. Use of the Java language inherently means that the prototyping of changes and improvements is rapid because of the ease of use of the Java language. Furthermore, high speed performance is maintained because of the use of the Java language.  
      It is to be understood that the above-described arrangements are only illustrative of the application of the principles of the present invention. Numerous modifications and alternative arrangements may be devised by those skilled in the art without departing from the spirit and scope of the present invention. The appended claims are intended to cover such modifications and arrangements.