Low latency server-side redirection of UDP-based transport protocols traversing a client-side NAT firewall

Patent metadata

Field	Value
Publication number	US-10129216-B2
Application number	US-201715475044-A
Country	US
Kind code	B2
Filing date	Mar 30, 2017
Priority date	Mar 7, 2013
Publication date	Nov 13, 2018
Grant date	Nov 13, 2018

Abstract

Systems, methods, and machine-readable media for low latency server-side redirection of User Datagram Protocol (UDP)-based transport protocols traversing a client-side Network Address Translation (NAT) are provided. A request may be sent from a client for a data resource to a first server. The data resource may be received from a second server that has not been previously connected to the client. Receiving the data resource from the second server may be facilitated by the first server through redirecting the request to the second server and providing for the second server to connect to the client and directly respond to the request. The first server may lack at least one of the requested data resource or resources for providing the requested data resource.

First claim

What is claimed is:

1. A computer-implemented method comprising:
sending, from a client to a first server, a resource request for a data resource and client preparatory data comprising a Quick UDP Internet Connection (QUIC) session identifier and a key; and
in response to the sending, receiving at the client the data resource together with server connection information and the QUIC session identifier from a second server that has not been previously connected to the client, the data resource being received through a client-side firewall using security information based on the client preparatory data and one or more server-to-server messages transmitted, between the first server and the second server, after the resource request was sent from the client, the security information comprising the key and the server connection information being for establishing a network connection between the client and the second server; and
establishing the network connection between the client and the second server using the server connection information and the QUIC session identifier.

2. The computer-implemented method of claim 1 , further comprising:
receiving, at the client from the first server, one or more informative messages related to a connection formed between the first server and the second server based on the one or more server-to-server messages transmitted after the resource request was sent, the one or more informative messages being received after the server connection information and comprising the QUIC session identifier; and
delaying, based on the informative messages comprising the QUIC session identifier, processing of the server connection information by the client until the informative messages are received from the first server.

3. The computer-implemented method of claim 1 , wherein the data resource is received using a spoofed address of the first server, the method further comprising:
ignoring, by the client, the spoofed address based on receiving the data resource together with the QUIC session identifier.

4. The computer-implemented method of claim 1 , wherein the key is a public key comprising a Diffie-Hellman public Key for use in a QUIC HELLO packet.

5. The computer-implemented method of claim 1 , wherein the client preparatory data comprises cryptographic materials for encrypting messages on behalf of the client.

6. The computer-implemented method of claim 5 , wherein the cryptographic materials comprise a master secret for use in constructing a session symmetric key.

7. The computer-implemented method of claim 1 , wherein:
the client-side firewall comprises a Network Address Translation (NAT) firewall that blocks data lacking an identifiable source or destination address from being received by the client,
the client comprises a web browser,
the resource request comprises a Hyper Text Transport Protocol (HTTP) request, and
the data resource comprises at least one of a web page, media content comprising one or more audio or video files, or a document comprising one or more text and/or image files.

8. A system, comprising:
one or more processors; and
a memory comprising instructions stored thereon that, when executed by the one or more processors, perform operations comprising:
sending, to a first server, a resource request for a data resource and client preparatory data comprising a Quick UDP Internet Connection (QUIC) session identifier and a key; and
in response to sending the resource request, receiving the data resource together with server connection information and the QUIC session identifier from a second server that has not been previously connected to the system, the data resource being received through a client-side firewall using security information based on the client preparatory data and one or more server-to-server messages transmitted, between the first server and the second server, after the resource request was sent, the security information comprising the key and the server connection information being for establishing a network connection with the second server; and
establishing the network connection with the second server using the server connection information and the QUIC session identifier.

9. The system of claim 8 , wherein the operations further comprise:
receiving, at the system from the first server, informative messages related to a connection formed between the first server and the second server based on one or more server-to-server messages transmitted after the resource request was sent, the informative messages being received after the server connection information and comprising the QUIC session identifier; and
delaying, based on the informative messages comprising the QUIC session identifier, processing of the server connection information by the system until the informative messages are received from the first server.

10. The system of claim 8 , wherein the client preparatory data comprises cryptographic materials for encrypting messages on behalf of the system.

11. The system of claim 10 , wherein the cryptographic materials comprise a master secret for use in constructing a session symmetric key.

12. The system of claim 8 , wherein:
the client-side firewall comprises a Network Address Translation (NAT) firewall that blocks data lacking an identifiable source or destination address from being received by the system,
the resource request comprises a Hyper Text Transport Protocol (HTTP) request, and
the data resource comprises at least one of a web page, media content comprising one or more audio or video files, or a document comprising one or more text and/or image files.

13. A non-transitory computer-readable storage medium comprising instructions stored therein, which when executed by a client computing device, cause the client computing devices to:
send, from the client computing device to a first server, a resource request for a data resource and client preparatory data comprising a client-selected Quick UDP Internet Connection (QUIC) session identifier and a key; and
in response to sending the resource request, receive the data resource together with server connection information and the client-selected QUIC session identifier from a second server that has not been previously connected to the client computing device, the data resource being received through a client-side firewall using security information based on the client preparatory data and one or more server-to-server messages transmitted, between the first server and the second server, after the resource request was sent from the client, the security information comprising the key and the server connection information being for establishing a network connection with the second server; and
establishing the network connection between the client and the second server using the server connection information and the QUIC session identifier.

14. The non-transitory computer-readable storage medium of claim 13 , wherein the instructions further cause the client computing device to:
receiving, at the client computing device from the first server, one or more informative messages related to a connection formed between the first server and the second server based on one or more server-to-server messages transmitted after the resource request was sent, the one or more informative messages being received after the server connection information and comprising the client-selected QUIC session identifier;
delaying, based on the one or more informative messages comprising the client-selected QUIC session identifier, processing of the server connection information by the client computing device until the informative

Assignees

• Google Inc
• Google Llc

Inventors

• Roskind James Anthony
• Swett Ian Douglas

Classifications

• H04L63/029 Primary

  Firewall traversal, e.g. tunnelling or, creating pinholes · CPC title

• H04L63/123

  received data contents, e.g. message integrity · CPC title

• H04L63/04

  for providing a confidential data exchange among entities communicating through data packet networks · CPC title

• H04L63/0435

  wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06) · CPC title

• H04L9/3013

  involving the discrete logarithm problem, e.g. ElGamal or Diffie-Hellman systems · CPC title