Local interception of traffic to a remote forward proxy

Patent metadata

Field	Value
Publication number	US-11088994-B2
Application number	US-201816058567-A
Country	US
Kind code	B2
Filing date	Aug 8, 2018
Priority date	Dec 1, 2017
Publication date	Aug 10, 2021
Grant date	Aug 10, 2021

Abstract

An application using a virtual private network (VPN) is programmed to transmit proxy traffic to a remote proxy server. Traffic to the proxy server is intercepted, shifted to user space, and processed according to one or more options. Traffic may be terminated by a local proxy that resolves domain names in traffic and requests referenced content. Intercepted traffic may include plain text data in headers that is encrypted before forwarding to a different proxy server. Traffic may be evaluated, such as a User Agent string in order to determine routing choices, such as blocking, throttling, local termination, transmitting through a VPN, or other options. Multiple VPNs may operate on the same user computer and proxy traffic may be intercepted and processed by transmitting it through a VPN, bypassing all VPNs, or routing through a different VPN.

First claim

The invention claimed is:

1. A system comprising one or more processing units and one or more memory units operably coupled to the one or more processing units, the one or more memory units storing executable code effective to cause the one or more processing units to:
receive a first request, the first request being formatted as a proxy server request to a proxy server at a destination associated with a first network identifier, the destination being remote from the system, the first request containing a first domain name and a User Agent string; and
select as a selected processing choice one of a plurality of processing choices to apply to the first request based at least partially on content of the User Agent string;
wherein a first processing choice of the plurality of processing choices includes:
terminating the first request by a local proxy on the system; and
then sending the first request to a second destination associated with the first domain name without forwarding any part of the first request to the destination associated with the first network identifier.

2. The system of claim 1 , wherein a second processing choice of the plurality of processing choices includes forwarding at least a portion of the first request to a second remote proxy server associated with a second network identifier that is different from the first network identifier.

3. The system of claim 1 , wherein a second processing choice of the plurality of processing choices includes blocking the first request without sending data from the first request to either of the destination associated with the first network identifier and the second destination associated with the first domain name.

4. The system of claim 1 , wherein the executable code is further effective to cause the one or more processing units to select the selected processing choice from the plurality of processing choices by analyzing at least a portion of the User Agent string.

5. The system of claim 4 , wherein the executable code is further effective to cause the one or more processing units to analyze the at least the portion of the User Agent string by sending a classification request to a remote classification computer in a computer network and receiving a classification response from the remote classification computer.

6. The system of claim 1 , wherein the first domain name and the User Agent string are included in the first request as plain text whereas a payload of the first request is encrypted before being received by the system.

7. The system of claim 6 , where the payload is encrypted according to Hyper Text Transport Protocol Secure (HTTPS) specification.

8. The system of claim 1 , wherein the first domain name is included in the first request within a header selected from the group consisting of CONNECT, HOST and SNI headers.

9. A system comprising one or more processing units and one or more memory units operably coupled to the one or more processing units, the one or more memory units storing executable code effective to cause the one or more processing units to:
receive a first request formatted as a proxy server request to a proxy server at a destination associated with a first network identifier and remote from the system, the first request containing a first domain name;
determine an application that issued the first request; and
select as a selected processing choice one of a plurality of processing choices to apply to the first request based on the application that issued the first request;
wherein a first processing choice of the plurality of processing choices includes terminating the first request by a local proxy and then sending the first request to a second destination associated with the first domain name without forwarding any part of the first request to the destination associated with the first network identifier.

10. The system of claim 9 , wherein determining the application that issued the first request being at least partially dependent on the first domain name.

11. The system of claim 9 , wherein the executable code is further effective to cause the one or more processing units to at least partially determine the application that issued the first request using contents of at least one header selected from the group consisting of CONNECT, HOST and SNI headers included in the first request.

12. The system of claim 9 , wherein the first request additionally containing a User Agent string; and
wherein the executable code, when executed by the one or more processing units, further causes the one or more processing units to at least partially determine the application that issued the first request based on the content of the User Agent string.

13. The system of claim 12 , wherein the executable code, when executed by the one or more processing units, further causes the one or more processing units to at least partially determine the application that issued the first request based on contents of at least two headers selected from the group consisting of USER_AGENT, CONNECT, HOST and SNI headers included in the first request.

14. The system of claim 9 , wherein the executable code, when executed by the one or more processing units, further causes the one or more processing units to select the selected processing choice from the plurality of processing choices for the first request by analyzing one or more previously intercepted requests associated with one or more different applications.

15. The system of claim 14 , wherein the executable code, when executed by the one or more processing units, further causes the one or more processing units to block the first request if the one or more previously intercepted requests were associated with one or more applications of a pre-defined list of high-priority applications.

16. The system of claim 14 , wherein the executable code, when executed by the one or more processing units, further causes the one or more processing units to block the first request issued if the one or more previously intercepted requests were associated with higher priority applications than the application that issued the first request.

17. The system of claim 9 further comprising a second remote proxy server associated with a second network identifier that is different from the first network identifier, wherein a second processing choice of the plurality of processing choices includes forwarding at least a portion of the first request to the second remote proxy server.

18. The system of claim 17 , wherein the second remote proxy server being programmed to throttle a rate of data exchange between the application that issued the first request and a content server associated with the first domain name.

19. The system of claim 9 , wherein a second processing choice of the plurality of processing choices includes sending at least a portion of the first request through an encrypted tunnel established between a local Virtual Private Network (VPN) client and a remote VPN server.

20. The system of claim 9 , wherein a second processing choice of the plurality of processing choices includes measuring an amount of data consumed by traffic associated with the application that issued the first request.

Assignees

• Anchorfree Inc
• Twingate Inc

Inventors

• Lapidous Eugene
• Ghiocel Sean
• Molchanov Maxim
• Panisset Eduardo

Classifications

• H04L61/58

  Caching of addresses or names · CPC title

• H04L61/4511

  using domain name system [DNS] · CPC title

• H04L67/56

  Provisioning of proxy services (store-and-forward switching systems in data switching networks H04L12/54) · CPC title

• H04L67/564

  Enhancement of application control based on intercepted application data · CPC title

• H04L12/4641 Primary

  Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272) · CPC title