Distributing transmission of requests across multiple IP addresses of a proxy server in a cloud-based proxy service

• US 8,438,240 B2
• Filed: 09/27/2011
• Issued: 05/07/2013
• Est. Priority Date: 09/27/2011
• Status: Active Grant

• Current Assignee: CloudFlare Incorporated
• Original Assignee: CloudFlare Incorporated
• Inventors: Prince, Matthew Browning, Holloway, Lee Hahn, Tourne, Matthieu Philippe Franois
• Primary Examiner(s): DENNISON, JERRY B
• Application Number:
  US13/246,737
• Publication Number:
  US 20130080575A1
• Time in Patent Office: 588 Days
• Field of Search: 709/217
• US Class Current: 709/217
• CPC Class Codes: H04L 45/741 Routing in networks with a plurality of addressing schemes, e.g. with both IPv4 and IPv6
• CPC Class Codes: H04L 61/25 of the same type
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 67/1023 based on a hash applied to IP addresses or costs
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 67/562 Brokering proxy services

Abstract

A first packet is received at a proxy server from a client and includes a first incoming request for an action to be performed on an identified resource. The first packet is received at the proxy server as a result of a DNS request for a domain corresponding to the identified resource resolving to an IP address of the proxy server. The proxy server selects, based on at least in part on a set of parameters associated with the first packet, one of multiple IP addresses for use as a source IP address for a second packet that carries an outgoing request and transmits the second packet. The proxy server receives a third packet that includes an incoming response from the destination origin server in response to the outgoing request and transmits a fourth packet to the client that includes an outgoing response based on the incoming response.

Claims

1. A method in a proxy server of a cloud-based proxy service, comprising:

receiving, from a client, a first packet that includes a first incoming request for an action to be performed on an identified resource, wherein the first packet is received at the proxy server as a result of a Domain Name System (DNS) request for a domain corresponding to the identified resource resolving to an Internet Protocol (IP) address of the proxy server;

selecting a first one of a plurality of IP addresses of a same protocol type of the proxy server for use as a source IP address for a second packet that carries an outgoing request, wherein the step of selecting is based at least in part on a set of one or more parameters associated with the first packet, and wherein the selected first one of the plurality of IP addresses is a least recently used IP address of the plurality of IP addresses for a destination origin server;

transmitting a second packet that includes a first outgoing request to the destination origin server that hosts the identified resource, wherein the first outgoing request is based on the first incoming request, wherein the second packet includes the selected first IP address as the source IP address of the second packet;

receiving a third packet that includes a first incoming response from the destination origin server in response to the first outgoing request; and

transmitting a fourth packet to the client, the fourth packet including a first outgoing response that is based on the first incoming response.

2. The method of claim 1, wherein the set of parameters include one or more of:

a source IP address of the first packet, a source port of the first packet, the requested domain of the incoming request, a type of content of the identified resource, and one or more cookies associated with the incoming request.

3. The method of claim 1, wherein prior to the step of transmitting the second packet, selecting one of a plurality of IP address of the destination origin server for a destination IP address of the second packet, wherein the step of selecting is based on a set of one or more destination address rules configured by an owner of the domain.

4. The method of claim 1, further comprising:

receiving, from the client, a fifth packet that includes a second incoming request for an action to be performed on an identified resource at the domain; and

transmitting a sixth packet that includes a second outgoing request to the destination origin server, wherein the sixth packet includes the first IP address as a source IP address of the sixth packet.

5. The method of claim 4, wherein the first outgoing request and the second outgoing request are related to a same session.

6. The method of claim 1, further comprising:

receiving, from the client, a fifth packet that includes a second incoming request for an action to be performed on an identified resource at the domain;

selecting a second one of the plurality of IP addresses of the proxy server for use as a source IP address based at least in part on a set of one or more parameters associated with the fifth packet; and

transmitting a sixth packet that includes a second outgoing request to the destination origin server, wherein the sixth packet includes the second IP address as a source IP address of the sixth packet, and wherein the first outgoing request and the second outgoing request are not related to a same session.

7. A non-transitory machine-readable storage medium that provides instructions that, when executed by a processor of a proxy server of a cloud-based proxy service, cause said processor to perform operations comprising:

receiving, from a client, a first packet that includes a first incoming request for an action to be performed on an identified resource, wherein the first packet is received at the proxy server as a result of a Domain Name System (DNS) request for a domain corresponding to the identified resource resolving to an Internet Protocol (IP) address of the proxy server;

selecting a first one of a plurality of IP addresses of a same protocol type of the proxy server for use as a source IP address for a second packet that carries an outgoing request, wherein the step of selecting is based at least in part on a set of one or more parameters associated with the first packet, and wherein the selected first one of the plurality of IP addresses is a least recently used IP address of the plurality of IP addresses for a destination origin server;

transmitting a second packet that includes a first outgoing request to the destination origin server that hosts the identified resource, wherein the first outgoing request is based on the first incoming request, wherein the second packet includes the selected first IP address as the source IP address of the second packet;

receiving a third packet that includes a first incoming response from the destination origin server in response to the first outgoing request; and

transmitting a fourth packet to the client, the fourth packet including a first outgoing response that is based on the first incoming response.

8. The non-transitory machine-readable storage medium of claim 7, wherein the set of parameters include one or more of:

a source IP address of the first packet, a source port of the first packet, the requested domain of the incoming request, a type of content of the identified resource, and one or more cookies associated with the incoming request.

9. The non-transitory machine-readable storage medium of claim 7, wherein prior to the step of transmitting the second packet, selecting one of a plurality of IP address of the destination origin server for a destination IP address of the second packet, wherein the step of selecting is based on a set of one or more destination address rules configured by an owner of the domain.

10. The non-transitory machine-readable storage medium of claim 7, further comprising instructions, that when executed by the processor, cause the processor to perform the following:

receiving, from the client, a fifth packet that includes a second incoming request for an action to be performed on an identified resource at the domain; and

transmitting a sixth packet that includes a second outgoing request to the destination origin server, wherein the sixth packet includes the first IP address as a source IP address of the sixth packet.

11. The non-transitory machine-readable storage medium of claim 10, wherein the first outgoing request and the second outgoing request are related to a same session.

12. The non-transitory machine-readable storage medium of claim 7, further comprising instructions, that when executed by the processor, cause the processor to perform the following:

receiving, from the client, a fifth packet that includes a second incoming request for an action to be performed on an identified resource at the domain;

selecting a second one of the plurality of IP addresses of the proxy server for use as a source IP address based at least in part on a set of one or more parameters associated with the fifth packet; and

transmitting a sixth packet that includes a second outgoing request to the destination origin server, wherein the sixth packet includes the second IP address as a source IP address of the sixth packet, and wherein the first outgoing request and the second outgoing request are not related to a same session.

13. A method in a proxy server of a cloud-based proxy service, comprising:

receiving, from a client, a first packet that includes a first incoming request for an action to be performed on an identified resource, wherein the first packet is received at the proxy server as a result of a Domain Name System (DNS) request for a domain corresponding to the identified resource resolving to an Internet Protocol (IP) address of the proxy server;

selecting a first one of a plurality of IP addresses of a same protocol type of the proxy server for use as a source IP address for a second packet that carries an outgoing request, wherein the step of selecting is based at least in part on a set of one or more parameters associated with the first packet, and wherein the selected first one of the plurality of IP addresses is an IP address of the proxy server that has been used as a source IP address for outgoing requests to a destination origin server a least number of times compared to other ones of the plurality of IP addresses that have been used as source IP addresses for outgoing requests to the destination origin server;

transmitting a second packet that includes a first outgoing request to the destination origin server that hosts the identified resource, wherein the first outgoing request is based on the first incoming request, wherein the second packet includes the selected first IP address as the source IP address of the second packet;

receiving a third packet that includes a first incoming response from the destination origin server in response to the first outgoing request; and

transmitting a fourth packet to the client, the fourth packet including a first outgoing response that is based on the first incoming response.

14. The method of claim 13, wherein the set of parameters include one or more of:

a source IP address of the first packet, a source port of the first packet, the requested domain of the incoming request, a type of content of the identified resource, and one or more cookies associated with the incoming request.

15. The method of claim 13, wherein prior to the step of transmitting the second packet, selecting one of a plurality of IP address of the destination origin server for a destination IP address of the second packet, wherein the step of selecting is based on a set of one or more destination address rules configured by an owner of the domain.

16. The method of claim 13, further comprising:

receiving, from the client, a fifth packet that includes a second incoming request for an action to be performed on an identified resource at the domain; and

transmitting a sixth packet that includes a second outgoing request to the destination origin server, wherein the sixth packet includes the first IP address as a source IP address of the sixth packet.

17. The method of claim 16, wherein the first outgoing request and the second outgoing request are related to a same session.

18. The method of claim 13, further comprising:

receiving, from the client, a fifth packet that includes a second incoming request for an action to be performed on an identified resource at the domain;

selecting a second one of the plurality of IP addresses of the proxy server for use as a source IP address based at least in part on a set of one or more parameters associated with the fifth packet; and

transmitting a sixth packet that includes a second outgoing request to the destination origin server, wherein the sixth packet includes the second IP address as a source IP address of the sixth packet, and wherein the first outgoing request and the second outgoing request are not related to a same session.

19. A non-transitory machine-readable storage medium that provides instructions that, when executed by a processor of a proxy server of a cloud-based proxy service, cause said processor to perform operations comprising:

receiving, from a client, a first packet that includes a first incoming request for an action to be performed on an identified resource, wherein the first packet is received at the proxy server as a result of a Domain Name System (DNS) request for a domain corresponding to the identified resource resolving to an Internet Protocol (IP) address of the proxy server;

selecting a first one of a plurality of IP addresses of a same protocol type of the proxy server for use as a source IP address for a second packet that carries an outgoing request, wherein the step of selecting is based at least in part on a set of one or more parameters associated with the first packet, and wherein the selected first one of the plurality of IP addresses is an IP address of the proxy server that has been used as a source IP address for outgoing requests to a destination origin server a least number of times compared to other ones of the plurality of IP addresses that have been used as source IP addresses for outgoing requests to the destination origin server;

transmitting a second packet that includes a first outgoing request to the destination origin server that hosts the identified resource, wherein the first outgoing request is based on the first incoming request, wherein the second packet includes the selected first IP address as the source IP address of the second packet;

receiving a third packet that includes a first incoming response from the destination origin server in response to the first outgoing request; and

transmitting a fourth packet to the client, the fourth packet including a first outgoing response that is based on the first incoming response.

20. The non-transitory machine-readable storage medium of claim 19, wherein the set of parameters include one or more of:

a source IP address of the first packet, a source port of the first packet, the requested domain of the incoming request, a type of content of the identified resource, and one or more cookies associated with the incoming request.

21. The non-transitory machine-readable storage medium of claim 19, wherein prior to the step of transmitting the second packet, selecting one of a plurality of IP address of the destination origin server for a destination IP address of the second packet, wherein the step of selecting is based on a set of one or more destination address rules configured by an owner of the domain.

22. The non-transitory machine-readable storage medium of claim 19, further comprising instructions, that when executed by the processor, cause the processor to perform the following:

receiving, from the client, a fifth packet that includes a second incoming request for an action to be performed on an identified resource at the domain; and

transmitting a sixth packet that includes a second outgoing request to the destination origin server, wherein the sixth packet includes the first IP address as a source IP address of the sixth packet.

23. The non-transitory machine-readable storage medium of claim 22, wherein the first outgoing request and the second outgoing request are related to a same session.

24. The non-transitory machine-readable storage medium of claim 19, further comprising instructions, that when executed by the processor, cause the processor to perform the following:

receiving, from the client, a fifth packet that includes a second incoming request for an action to be performed on an identified resource at the domain;

selecting a second one of the plurality of IP addresses of the proxy server for use as a source IP address based at least in part on a set of one or more parameters associated with the fifth packet; and

transmitting a sixth packet that includes a second outgoing request to the destination origin server, wherein the sixth packet includes the second IP address as a source IP address of the sixth packet, and wherein the first outgoing request and the second outgoing request are not related to a same session.