Method and system for automatically bypassing network proxies in the presence of interdependent traffic flows

Patent metadata

Field	Value
Publication number	US-2017195427-A1
Application number	US-201514986588-A
Country	US
Kind code	A1
Filing date	Dec 31, 2015
Priority date	Dec 31, 2015
Publication date	Jul 6, 2017
Grant date	—

Abstract

A method and system for automatically bypassing a network proxy in the presence of interdependent traffic flows. Messages from a client attempting to establish communication with an origin server are monitored to detect the presence of certain state information. If the origin server is present in one or more bypass lists, the network proxy is bypassed and communication is established between the client and origin sever directly. Otherwise, communication between the client and origin server is established though the network proxy. Messages between at least the origin server and client are monitored in order to identify origin servers for which the network proxy should be bypassed. The bypass lists are automatically updated for such origin servers.

First claim

What is claimed is:

1 . A method comprising:
initiating a communication session with an origin server over a network; determining if messages in the communication session contain state information associated with a secure session; querying a first database for an internet protocol (IP) address of the origin server, if the messages do not contain state information, the first database containing, at least in part, one or more bypass IP addresses; establishing the communication session directly with the origin server if the messages contain state information or if the IP address of the origin server is present in the first database; establishing the communication session, via a proxy server, with the origin server if the messages do not contain state information and if the IP address of the origin server is not present in the first database; and automatically updating a second database with a symbolic name of the origin server if the communication session is established directly with the origin server, the second database containing, at least in part, one or more symbolic names.

2 . The method of claim 1 , wherein establishing the communication session via a proxy server further comprises:
querying the second database for the symbolic name of the origin server; and automatically updating the first database with the IP address of the origin server if the symbolic name is present in the second database.

3 . The method of claim 1 , further comprising:
detecting an incomplete state message resulting from the communication session established via the proxy server; querying the second database for a host name contained in the incomplete state message; and automatically updating the first database with an IP address corresponding to the host name contained in the incomplete state message, if the host name is present in the second database.

4 . The method of claim 1 , wherein initiating a communication session further comprises:
monitoring a port number associated with the communication session; and concluding that messages in the communication session contain state information if the port number is reserved for secure communication.

5 . The method of claim 4 , wherein the port number is reserved for secure communication, and the concluding further comprises:
performing a reverse Domain Name System (DNS) lookup of the destination IP address of the origin server in order to obtain a resulting symbolic name; querying the second database for the resulting symbolic name; and automatically updating the first database with the IP address of the origin server if the resulting symbolic name is present in the second database.

6 . The method of claim 4 , wherein the port number is reserved for secure communication, and the concluding further comprises:
performing a reverse DNS lookup of the IP address of the origin server in order to obtain a resulting symbolic name; and automatically updating the second database with the resulting symbolic name.

7 . The method of claim 4 , wherein the port number is reserved for secure communication, and the concluding further comprises:
examining a client hello message transmitted while initiating the communication session; extracting a domain name stored within a “server name” field of the client hello message; and updating the second database with the extracted domain name.

8 . The method of claim 1 , further comprising:
receiving a 3xx status response from the origin server after the communication session has been established; detecting a secure Uniform Resource Locator (URL) in a “location field” of the 3xx status response; and updating the first database with the IP address of the origin server.

9 . The method of claim 1 , further comprising:
performing a deep packet inspection of a request header transmitted while initiating the communication session; extracting a protocol stored in an “upgrade” field of the request header; determining whether the extracted protocol can support a secure communication session; and updating the first database with the destination IP address of the origin server.

10 . The method of claim 1 , further comprising:
monitoring responses from DNS lookups to detect canonical name (CNAME) responses and detect one or more IP addresses corresponding to the CNAME responses; automatically updating the first database with the detected one or more IP addresses; and automatically updating the second database with the detected CNAME response.

11 . A system comprising:
at least one device capable of initiating a communication session with an origin server; a terminal configured, at least in part, to facilitate communication between the at least one device and the origin server over a public network, the terminal comprising:
a proxy routing unit,
a proxy communication unit,
a first database for storing a plurality of bypass IP addresses, and
a second database for storing symbolic names of a plurality of origin servers; and
a gateway for routing traffic between the terminal and the origin server via the public network, the gateway comprising:
a proxy server configured to provide intermediary functions between the at least one device and the origin server, and
at least one processor configured, at least in part, to manage routing operations and intermediary functions,
wherein the proxy routing unit is configured to:
determine if messages in the communication session contain state information associated with a secure session,
query the first database for an internet protocol (IP) address of the origin server, if the messages do not contain state information, the first database containing, at least in part, one or more bypass IP addresses,
establish the communication session directly with the origin server if the messages contain state information or if the IP address of the origin server is present in the first database, and
automatically updating a second database with a symbolic name of the origin server if the communication session is established directly with the origin server, the second database containing, at least in part, one or more symbolic names, and
wherein the proxy communication unit is configured to establish the communication session, via the proxy server, with the origin server if the messages do not contain state information and if the IP address of the origin server is not present in the first database.

12 . The system of claim 11 , wherein the proxy communication unit is further configured to:
query the second database for the symbolic name of the origin server; and update the first database with the IP address of the origin server if the symbolic name is present in the second database.

13 . The system of claim 11 , wherein the proxy communication unit is further configured to:
detect an incomplete state message resulting from the communication session established via the proxy server; query the second database for a host name contained in the incomplete state message; and update the first database with an IP address corresponding to the host name contained in the incomplete state message, if the host name is present in the second database.

14 . The system of claim 11 , wherein the proxy routing unit is further configured to:
monitoring a port number associated with the communication session; and conclude that messages in the communication session contain state information if the port number is reserved for secure communication.

15 . The system of claim 14 , wherein:
the port number is reserved for secure communication; the terminal further co

Assignees

• Hughes Network Systems Llc

Inventors

• Choquette George
• Ramachandran Ganeshan
• Javali Nagesh
• Torres Rob

Classifications

• H04L67/146

  Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding · CPC title

• H04L67/141 Primary

  Setup of application sessions (admission control or resource allocation in data switching networks H04L47/70) · CPC title

• H04L61/6068

  Electricity · mapped topic

• H04L61/1511

  Electricity · mapped topic

• H04L67/42

  Electricity · mapped topic