Apparatus and method for virtual edge placement of web sites

• US 20050021863A1
• Filed: 05/25/2004
• Published: 01/27/2005
• Est. Priority Date: 06/23/2000
• Status: Active Grant

• Current Assignee: Lookingglass Cyber Solutions, LLC
• Original Assignee: CloudShield Technologies, Inc. (ZeroFox Holdings, Inc.)
• Inventors: Jungck, Peder J.
• Granted Patent: US 7,437,482 B2
• Time in Patent Office: Days
• US Class Current: 709/246
• CPC Class Codes: G06F 15/16 Combinations of two or more digital computers each having at least an arithmetic unit, a program unit and a register, e.g. for a simultaneous processing of several programs coordinating program control therefor G06F9/52; in regulating and control system G05B
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/19 at layers above the network layer network arrangements for networked applications for scheduling or organising the servicing of application requests H04L67/60
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

An apparatus and method for enhancing the infrastructure of a network such as the Internet is disclosed. Multiple edge servers and edge caches are provided at the edge of the network so as to cover and monitor all points of presence. The edge servers selectively intercept domain name translation requests generated by downstream clients, coupled to the monitored points of presence, to subscribing Web servers and provide translations which either enhance content delivery services or redirect the requesting client to the edge cache to make its content requests. Further, network traffic monitoring is provided in order to detect malicious or otherwise unauthorized data transmissions.

Claims

1. An apparatus for facilitating communications between a client and a first server over a network, said network comprising a first sub-network comprising said client, said apparatus comprising:

a proxy server coupled with said first sub-network and operative to selectively proxy said communications, directed by said client to said proxy server, between said client and said first server;

a filter coupled between said network and said proxy server and operative to intercept said communications prior to receipt by said proxy server.

2. The apparatus of claim 1, wherein said filter is further operative to filter out said communications originating from a second sub-network different from said first sub-network.

3. The apparatus of claim 2, wherein said filter is further operative to identify an originating sub-network of said communications based on an internet protocol address associated with said communications.

4. The apparatus of claim 1, wherein said filter is further operative to filter out communications not originating from said client.

5. The apparatus of claim 1;

, wherein said filter is further operative to filter out malicious program code within said communications.

6. The apparatus of claim 1, wherein said filter is further operative to filter out unauthorized program code within said communications.

7. The apparatus of claim 1 further comprising a first cache server coupled with said proxy server and said filter and operative to cache communications from said first server to said client.

8. The apparatus of claim 7, wherein said first cache server is proximate to said client.

9. The apparatus of claim 8, wherein said first cache server is geographically proximate to said client.

10. The apparatus of claim 8, wherein said first cache server is logically proximate to said client based on a topology of said first sub-network.

11. The apparatus of claim 7, wherein said first cache server is further operative to share cached data with a second cache server.

12. The apparatus of claim 7, wherein said communications further comprises a request generated by said client to said server, and further wherein said filter is further operative to attempt to satisfy said request from said cache server before sending said request to said proxy server.

13. The apparatus of claim 1 further operative to prevent said client from directly communicating with said first server.

14. The apparatus of claim 1, wherein said proxy server is not bound to said client.

15. The apparatus of claim 1, wherein said filter and said proxy server are coupled with an address translator, said address translator operative to selectively substitute an address associated with said proxy server and return said address to said client to direct communications from said client to said proxy server instead of said first server.

16. The apparatus of claim 1, wherein said proxy server is selectively bound to said first server.

17. The apparatus of claim 16 further comprising a second server not bound with said proxy server and wherein said filter is further operative to filter out communications between said client and said second server and allow communications between said client and said first server to reach said proxy server.

18. The apparatus of claim 1, wherein said communications further comprises a request generated by said client to said first server, said filter being further operative to validate said request and validate said first server.

19. The apparatus of claim 1 further comprising a point of presence.

20. An apparatus for facilitating communications between a client and a first server over a network, said network comprising a first sub-network comprising said client, said apparatus comprising:

a request interceptor coupled with said first sub-network and operative to selectively intercept a first request generated by said client and directed by said client to said first server prior to receipt by said first server;

a request transmitter operative to transmit said intercepted first request to said first server as if originated by said apparatus;

a response receiver operative to receive a response from said first server in response to said originated intercepted first request;

a response transmitter operative to transmit said response to said client; and

a request filter coupled between said request interceptor and said request transmitter and operative to selectively filter said intercepted first request prior to said request transmitter acting on said request.

21. The apparatus of claim 20, wherein said request filter is further operative to filter out a second request originating from a second sub-network different from said first sub-network.

22. The apparatus of claim 21, wherein said request filter is further operative to identify an originating sub-network of said second request based on an internet protocol address associated with said second request.

23. The apparatus of claim 20, wherein said request filter is further operative to filter out a second request not originating from said client.

24. The apparatus of claim 20, wherein said request filter is further operative to filter out malicious program code within said request.

25. The apparatus of claim 20, wherein said request filter is further operative to filter out unauthorized program code within said request.

26. The apparatus of claim 20 further comprising a first cache server coupled with said response receiver, said response transmitter and said request filter and operative to cache said response from said first server to said response receiver.

27. The apparatus of claim 26, wherein said first cache server is proximate to said client.

28. The apparatus of claim 27, wherein said first cache server is geographically proximate to said client.

29. The apparatus of claim 27, wherein said first cache server is logically proximate to said client based on a topology of said first sub-network.

30. The apparatus of claim 26, wherein said first cache server is further operative to share cached data with a second cache server.

31. The apparatus of claim 26, wherein said filter is further operative to attempt to satisfy said request from said cache server before sending said request to said request transmitter.

32. The apparatus of claim 20 further operative to prevent said client from directly communicating with said first server.

33. The apparatus of claim 20, wherein said client intends said request to be received by said first server.

34. The apparatus of claim 20 further comprising an address translator, said address translator operative to selectively substitute an address associated with said request interceptor and return said address to said client to direct said request from said client to said request interceptor instead of said first server.

35. The apparatus of claim 20, wherein said request filter is selectively affiliated with said first server.

36. The apparatus of claim 35 further comprising a second server not affiliated with said request filter and wherein said request filter is further operative to filter out communications between said client and said second server and allow communications between said client and said first server to reach said request transmitter.

37. The apparatus of claim 20, wherein said filter is further operative to validate said request and validate said first server.

38. The apparatus of claim 20 further comprising a point of presence.

39. A method for facilitating communications between a client and a first server over a network, said network comprising a first sub-network comprising said client, said method comprising:

(a) intercepting, selectively, a first data transmission generated by said client and directed by said client to said first server prior to receipt by said first server;

(b) filtering said selectively intercepted first data transmission; and

(c) proxying said filtered selectively intercepted first data transmission to said first server.

40. The method of claim 39, wherein (b) further comprises filtering out a second request originating from a second sub-network.

41. The method of claim 39, wherein (b) further comprises filtering out malicious program code within said selectively intercepted first data transmission.

42. The method of claim 39, wherein (b) further comprises filtering out unauthorized program code with said selectively intercepted first data transmission.

43. The method of claim 39, further comprising:

(d) caching, selectively, a second data transmission generated by said first server in a cache server.

44. The method of claim 43, wherein said selectively intercepted first data transmission further comprises a request, and wherein (b) further comprises attempting to satisfy said request from said cache server.

45. The method of claim 39, further comprising:

(d) preventing said client from directly communicating with said first server.

46. The method of claim 39, wherein (a) further comprises said selective intercepting being implemented by a transmission interceptor, said method further comprising:

(d) directing said client to send said first data transmission to said transmission interceptor.

47. The method of claim 39, wherein (b) further comprises validating said first data transmission and validating said first server.

48. The method of claim 39, wherein (a) further comprises selectively intercepting said first data transmission at a point of presence.

49. A method for facilitating communications between a client and a first server over a network, said network comprising a first sub-network comprising said client, said method comprising:

(a) intercepting, selectively, a first data transmission generated by said client and directed by said client to said first server prior to receipt by said first server;

(b) filtering said selectively intercepted first data transmission;

(c) originating said filtered selectively intercepted first data transmission to said first server;

(d) receiving a response from said first server in response to said originated filtered selectively intercepted first data transmission; and

(e) transmitting said response to said client.

50. The method of claim 49, wherein (b) further comprises filtering out a second data transmission originating from a second sub-network.

51. The method of claim 49, wherein (b) further comprises filtering out malicious program code within said selectively intercepted first data transmission.

52. The method of claim 49, wherein (b) further comprises filtering out unauthorized program code with said selectively intercepted first data transmission.

53. The method of claim 49, further comprising:

(d) caching, selectively, said response in a cache server.

54. The method of claim 53i wherein said selectively intercepted first data transmission further comprises a request, and wherein (b) further comprises attempting to satisfy said request from said cache server.

55. The method of claim 49, further comprising:

(d) preventing said client from directly communicating with said first server.

56. The method of claim 49, wherein (a) further comprises said selective intercepting being implemented by a transmission interceptor, said method further comprising:

(d) directing said client to send said first data transmission to said transmission interceptor.

57. The method of claim 49, wherein (b) further comprises validating said first data transmission and validating said first server.

58. The method of claim 49, wherein (a) further comprises selectively intercepting said first data transmission at a point of presence.