Method and system for automatically bypassing network proxies in the presence of interdependent traffic flows

Patent metadata

Field	Value
Publication number	US-10187475-B2
Application number	US-201514986588-A
Country	US
Kind code	B2
Filing date	Dec 31, 2015
Priority date	Dec 31, 2015
Publication date	Jan 22, 2019
Grant date	Jan 22, 2019

Abstract

A method and system for automatically bypassing a network proxy in the presence of interdependent traffic flows. Messages from a client attempting to establish communication with an origin server are monitored to detect the presence of certain state information. If the origin server is present in one or more bypass lists, the network proxy is bypassed and communication is established between the client and origin sever directly. Otherwise, communication between the client and origin server is established though the network proxy. Messages between at least the origin server and client are monitored in order to identify origin servers for which the network proxy should be bypassed. The bypass lists are automatically updated for such origin servers.

First claim

What is claimed is:

1. A method comprising:
initiating, by a client device, a communication session with an origin server;
determining, by a terminal facilitating communication between the client device and a remotely located gateway over a first network, if messages in the communication session contain state information associated with a secure session;
querying a first database within the terminal for an internet protocol (IP) address of the origin server, if the messages do not contain state information, the first database containing, at least in part, one or more bypass IP addresses;
establishing the communication session directly with the origin server via the gateway and over a public network if the messages contain state information or if the IP address of the origin server is present in the first database;
establishing the communication session, via a proxy server within the gateway and over the public network, with the origin server if the messages do not contain state information and if the IP address of the origin server is not present in the first database; and
automatically updating a second database within the terminal with a symbolic name of the origin server if the communication session is established directly with the origin server, the second database containing, at least in part, one or more symbolic names.

2. The method of claim 1 , wherein establishing the communication session via a proxy server further comprises:
querying the second database for the symbolic name of the origin server; and
automatically updating the first database with the IP address of the origin server if the symbolic name is present in the second database.

3. The method of claim 1 , further comprising:
detecting an incomplete state message resulting from the communication session established via the proxy server;
querying the second database for a host name contained in the incomplete state message; and
automatically updating the first database with an IP address corresponding to the host name contained in the incomplete state message, if the host name is present in the second database.

4. The method of claim 1 , wherein initiating a communication session further comprises:
monitoring a port number associated with the communication session; and
concluding that messages in the communication session contain state information if the port number is reserved for secure communication.

5. The method of claim 4 , wherein the port number is reserved for secure communication, and the concluding further comprises:
performing a reverse Domain Name System (DNS) lookup of the destination IP address of the origin server in order to obtain a resulting symbolic name;
querying the second database for the resulting symbolic name; and
automatically updating the first database with the IP address of the origin server if the resulting symbolic name is present in the second database.

6. The method of claim 4 , wherein the port number is reserved for secure communication, and the concluding further comprises:
performing a reverse DNS lookup of the IP address of the origin server in order to obtain a resulting symbolic name; and
automatically updating the second database with the resulting symbolic name.

7. The method of claim 4 , wherein the port number is reserved for secure communication, and the concluding further comprises:
examining a client hello message transmitted while initiating the communication session;
extracting a domain name stored within a “server name” field of the client hello message; and
updating the second database with the extracted domain name.

8. The method of claim 1 , further comprising:
receiving a 3xx status response from the origin server after the communication session has been established;
detecting a secure Uniform Resource Locator (URL) in a “location field” of the 3xx status response; and
updating the first database with the IP address of the origin server.

9. The method of claim 1 , further comprising:
performing a deep packet inspection of a request header transmitted while initiating the communication session;
extracting a protocol stored in an “upgrade” field of the request header;
determining whether the extracted protocol can support a secure communication session; and
updating the first database with the destination IP address of the origin server.

10. The method of claim 1 , further comprising:
monitoring responses from DNS lookups to detect canonical name (CNAME) responses and detect one or more IP addresses corresponding to the CNAME responses;
automatically updating the first database with the detected one or more IP addresses; and
automatically updating the second database with the detected CNAME response.

11. A system comprising:
at least one client device capable of initiating a communication session with an origin server;
a terminal configured, at least in part, to facilitate communication to/from the at least one client device over a first network, the terminal comprising:
a proxy routing unit,
a proxy communication unit,
a first database for storing a plurality of bypass IP addresses, and
a second database for storing symbolic names of a plurality of origin servers; and

a gateway for routing traffic to/from the terminal over the first network and to/from the origin server over a public network, the gateway comprising:
a proxy server configured to provide intermediary functions between the at least one client device and the origin server, and
at least one processor configured, at least in part, to manage routing operations and intermediary functions,

wherein the proxy routing unit is configured to:
determine if messages in the communication session contain state information associated with a secure session,
query the first database for an internet protocol (IP) address of the origin server, if the messages do not contain state information, the first database containing, at least in part, one or more bypass IP addresses,
establish the communication session directly with the origin server, via the gateway and the public network, if the messages contain state information or if the IP address of the origin server is present in the first database, and
automatically updating a second database with a symbolic name of the origin server if the communication session is established directly with the origin server, the second database containing, at least in part, one or more symbolic names,

wherein the proxy communication unit is configured to establish the communication session, via the proxy server and the public network, with the origin server if the messages do not contain state information and if the IP address of the origin server is not present in the first database, and
wherein the gateway is remotely located from the terminal.

12. The system of claim 11 , wherein the proxy communication unit is further configured to:
query the second database for the symbolic name of the origin server; and
update the first database with the IP address of the origin server if the symbolic name is present in the second database.

13. The system of claim 11 , wherein the proxy communication unit is further configured to:
detect an incomplete state message resulting from the communication session established via the proxy server;
query the second database for a host name contained in the incomplete state message; and
update the first database with an IP address corresponding to the host name contained in the incomplete state message, if the host name is present in the second database.

14. The system of claim 11 , wherein the proxy routing unit is further co

Assignees

• Hughes Network Systems Llc

Inventors

• Choquette George
• Ramachandran Ganeshan
• Javali Nagesh
• Torres Rob

Classifications

• H04L67/141 Primary

  Setup of application sessions (admission control or resource allocation in data switching networks H04L47/70) · CPC title

• H04L67/146

  Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding · CPC title

• H04L61/2007

  Electricity · mapped topic

• H04L61/1511

  Electricity · mapped topic

• H04L61/6009

  Electricity · mapped topic