Apparatus and method for virtual edge placement of web sites

• US 6,829,654 B1
• Filed: 06/23/2000
• Issued: 12/07/2004
• Est. Priority Date: 06/23/2000
• Status: Expired due to Term

• Current Assignee: Lookingglass Cyber Solutions, LLC
• Original Assignee: CloudShield Technologies, Inc. (ZeroFox Holdings, Inc.)
• Inventors: Jungck, Peder J.
• Primary Examiner(s): Vu, Thong
• Application Number:
  US09/602,129
• Time in Patent Office: 1,628 Days
• Field of Search: 709/246, 709/216-218, 709/219, 709/229, 709/225, 709/238, 709/217, 713/201, 707/10, 370/475, 370/230, 379/220, 341/50, 708/204
• US Class Current: 709/246
• CPC Class Codes: G06F 15/16 Combinations of two or more digital computers each having at least an arithmetic unit, a program unit and a register, e.g. for a simultaneous processing of several programs coordinating program control therefor G06F9/52; in regulating and control system G05B
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/19 at layers above the network layer network arrangements for networked applications for scheduling or organising the servicing of application requests H04L67/60
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

An apparatus and method for enhancing the infrastructure of a network such as the Internet is disclosed. Multiple edge servers and edge caches are provided at the edge of the network so as to cover and monitor all points of presence. The edge servers selectively intercept domain name translation requests generated by downstream clients, coupled to the monitored points of presence, to subscribing Web servers and provide translations which either enhance content delivery services or redirect the requesting client to the edge cache to make its content requests. Further, network traffic monitoring is provided in order to detect malicious or otherwise unauthorized data transmissions.

Claims

1. A method of facilitating communications over a network, said network comprising first and second servers and a plurality of sub-networks coupled with said first and second servers, said network further comprising a first sub-network of said plurality of sub-networks coupled with a first translator and a first client, and a second sub-network of said plurality of sub-networks coupled with a second translator and a second client, said method comprising:

(a) monitoring said first sub-network for a first translation request generated by said first client directed to said first translator by said first client;

(b) monitoring said second sub-network for a second translation request generated by said second client directed to said second translator by said second client;

(c) intercepting, selectively, said first translation request prior to receipt by said first translator;

(d) intercepting, selectively, said second translation request prior to receipt by said second translator;

(e) isolating said first translation request from said second sub-network; and

(f) isolating said second translation request from said first sub-network.

2. The method of claim 1, further comprising:

(g) monitoring said first sub-network for a first communications between said first client and one of said first and second servers;

(h) monitoring said second sub-network for a second communications between a second client and one of said first and second servers, said second sub-network different from said first sub-network;

(i) intercepting, selectively, said first and second communications.

3. The method of claim 2, further comprising:

(j) preventing said first communications from being transmitted via said second sub-network; and

(k) preventing said second communications from being transmitted via said first sub-network.

4. The method of claim 2, further comprising:

(j) mediating said first and second communications between said first and second clients and said first and second servers;

(k) diverting, selectively, said first and second communications from said first and second clients to at least one cache server.

5. The method of claim 2, further comprising:

(j) proxying said first and second communications to said first and second servers from said first and second clients;

(k) receiving, selectively, said first and second communications from said first and second servers to at least one cache server; and

(l) transmitting said first and second communications received from said first and second servers from said at least one cache to said first and second clients.

6. An apparatus for facilitating communications between first and second clients and first and second servers over a network, said network comprising a first sub-network coupled with said first client and said first and second servers and a second sub-network coupled with said second client and said first and second servers, said apparatus comprising:

a first request interceptor coupled with said first sub-network and operative to selectively intercept a first request generated by said first client and directed by said first client to a first translator to translate a first address into a first translated address to facilitate said communications between said first client and one of said first and second servers, prior to receipt by said first translator;

a second request interceptor coupled with said second sub-network and operative to intercept a second request generated by said second client and directed by said second client to a second translator to translate a second address into second translated address to facilitate said communications between said second client and one of said first and second servers, prior to receipt by said first translator;

a first request modifier coupled with said first request interceptor and operative to modify said first address to a first modified address; and

a second request modifier coupled with said second request interceptor and operative to modify said second address to a second modified address.

7. The apparatus of claim 6, wherein said first request modifier is further operative to leave said first request unmodified and said second request modifier is further operative to leave said second request unmodified.

8. The apparatus of claim 6, wherein said first and second requests further comprise origination data indicating which of said first and second sub-networks from which said first and second requests originated, said first and second request interceptors being further operative to detect when said origination data of said intercepted request mismatches with said one of said first and second sub-networks that said first and second translation interceptors are coupled with.

9. The apparatus of claim 8, wherein said first and second request modifiers are further operative to delete mismatching intercepted translation requests.

10. The apparatus of claim 8, wherein said first and second request interceptors are further operative to determine an actual originating client of said mismatching translation request.

11. The apparatus of claim 8, wherein said first and second request interceptors are further operative to isolate said mismatching translation requests within their corresponding sub-networks.

12. The apparatus of claim 6, further comprising a first traffic monitor coupled with said first sub-network and a second traffic monitor coupled with said second sub-network, wherein said network is further operative to transmit data between said first and second clients and said first and second servers, said first traffic monitor operative to selectively intercept said transmitted data between said first client and said first and second servers and said second traffic monitor operative to selectively intercept said transmitted data between said second client and said first and second servers.

13. The apparatus of claim 12, wherein said first and second traffic monitors are further operative to detect malicious program code within said transmitted data.

14. The apparatus of claim 12, wherein said first and second traffic monitors are further operative to detect unauthorized data within said transmitted data.

15. The apparatus of claim 14, wherein said first and second traffic monitors re further operative to prevent said unauthorized data from being communicated outside said corresponding sub-network.

16. The apparatus of claim 12, wherein said first and second traffic monitors are further operative to detect forged communications within said transmitted data.

17. The apparatus of claim 6, wherein said first request modifier further comprises a third address translator and said second request modifier further comprises a fourth address translator, wherein upon receipt of said first translation request, said third address translator is operative to translate said first address into a third translated address and return said third translated address to said first client, and wherein upon receipt of said second translation request, said fourth address, translator is operative to translate said third address into a fourth translated address and return said fourth translated address to said second client.

18. The apparatus of claim 17, wherein said third translated address is associated with a first cache which is affiliated with said first and second servers and proximate to said first client and said fourth translated address is associated with a second cache which is affiliated with said first and second servers and proximate to said second client.

19. The apparatus of claim 18, wherein said first cache is geographically proximate to said first client.

20. The apparatus of claim 18, wherein said second cache is geographically proximate to said second client.

21. The apparatus of claim 18, wherein said first cache is logically proximate to said first client based on a topology of said first sub-network.

22. The apparatus of claim 18, wherein said second cache is logically proximate to said second client based on a topology of said second sub-network.

23. The apparatus of claim 18, wherein said first cache is operative to cache data from said first and second servers and said second cache is operative to cache data from said first and second servers.

24. The apparatus of claim 23 being further operative to prevent direct communications between said first and second clients and said first and second servers.

25. The apparatus of claim 18, wherein said first cache is coupled with said first sub-network and said second cache is coupled with said second sub-network.

26. The apparatus of claim 18, wherein said first cache is coupled with said first translation interceptor and said second cache is coupled with said second translation interceptor.

27. The apparatus of claim 18, further comprising said first and second caches.

28. The apparatus of claim 27, wherein said first cache is operative to communicate with said second cache.

29. The apparatus of claim 28, wherein said first cache is operative to communicate with said second cache via said network.

30. The apparatus of claim 28, wherein said communication comprises sharing of cached data from said first and second servers.