Methods and systems for secured end-to-end data communication

• US 10,635,716 B2
• Filed: 08/24/2016
• Issued: 04/28/2020
• Est. Priority Date: 08/24/2016
• Status: Active Grant

• Current Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Original Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Inventors: Naar, Dekel Shmuel
• Primary Examiner(s): Chung, Hoon J
• Application Number:
  US15/246,290
• Publication Number:
  US 20180062995A1
• Time in Patent Office: 1,343 Days
• CPC Class Codes: G06F 16/9017 using directory or table look-up use of a directory or look-up table in file systems G06F16/13
• CPC Class Codes: G06F 16/955 using information identifiers, e.g. uniform resource locators [URL]
• CPC Class Codes: H04L 45/745 Address table lookup; Address filtering
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/561 Adding application-functional data or data for application control, e.g. adding metadata

Abstract

Methods and systems for forwarding data packets by a server system (e.g., a proxy server) are disclosed. The proxy server is coupled to a user device and a plurality of web servers. The proxy server receives a first data packet directed to a first web server of the plurality of web servers from the user device. The first data packet includes a first synthesized address associated with the first web server. The proxy server identifies a first actual address of the first web server. The proxy server replaces the first synthesized address in the first data packet with the first actual address of the first web server. The proxy server further forwards the first data packet to the first web server using the first actual address of the first web server.

Claims

1. A method, comprising:

at a proxy server having one or more processors and memory storing instructions for execution by the one or more processors, wherein the proxy server is coupled to a user device and a plurality of web servers;

receiving, from the user device, a request directed to the proxy server for accessing a first web server of the plurality of web servers and a first data packet directed to the first web server, the first data packet including a first synthesized address previously system-generated by the proxy server, wherein;

the first synthesized address is associated with the first web server; and

the first synthesized address includes a domain name of the proxy server;

looking up the first synthesized address in a lookup table stored at a database of the proxy server to identify a first actual address of the first web server;

replacing the first synthesized address in the first data packet with the first actual address of the first web server; and

forwarding the first data packet to the first web server using the first actual address of the first web server.

2. The method of claim 1, wherein the first synthesized address comprises a first synthesized identifier associated with the first web server.

3. The method of claim 2, wherein the first actual address comprises an actual port number used for communicating with the first web server.

4. The method of claim 1, wherein the request is for a secure connection between the user device and the first web server.

5. The method of claim 4, wherein the first data packet is forwarded from the user device to the first web server by the proxy server without the proxy server checking a payload of the first data packet.

6. The method of claim 1, wherein the request is for zero-rated content items from the first web server and the first data packet is encrypted.

7. The method of claim 1, wherein the first data packet from the user device is associated with submitting data to the first web server at zero-rating, and wherein the first data packet is encrypted.

8. The method of claim 1, further comprising:

in response to forwarding the first data packet to the first web server, receiving a second data packet from the first web server, wherein the second data packet includes a security certificate associated with the first web server; and

forwarding the second data packet to the user device.

9. The method of claim 8, wherein the second data packet is forwarded from the first web server to the user device by the proxy server without the proxy server checking the security certificate of the second data packet.

10. The method of claim 8, wherein the second data packet comprises the first actual address of the first web server, and wherein the method further comprises:

replacing the first actual address with the first synthesized address associated with the first web server.

11. The method of claim 8, further comprising:

receiving, from the user device, a second request to access the first web server and a third data packet including a session key generated from the security certificate; and

forwarding, to the first web server, the received third packet.

12. The method of claim 1, wherein the first synthesized address includes at least a portion of a domain name of the web server.

13. A non-transitory computer-readable storage medium storing one or more programs configured for execution by one or more processors of a proxy server coupled to a user device and a plurality of web servers, the one or more programs including instructions for:

receiving, from the user device, a request directed to the proxy server for accessing a first web server of the plurality of web servers and a first data packet directed to the first web server, the first data packet including a first synthesized address previously system-generated by the proxy server, wherein;

the first synthesized address is associated with the first web server; and

the first synthesized address includes a domain name of the proxy server;

looking up the first synthesized address in a lookup table to identify a first actual address of the first web server;

replacing the first synthesized address in the first data packet with the first actual address of the first web server; and

forwarding the first data packet to the first web server using the first actual address of the first web server.