Distributing transmission of requests across multiple IP addresses of a proxy server in a cloud-based proxy service

• US 9,319,315 B2
• Filed: 04/08/2013
• Issued: 04/19/2016
• Est. Priority Date: 09/27/2011
• Status: Active Grant

• Current Assignee: CloudFlare Incorporated
• Original Assignee: CloudFlare Incorporated
• Inventors: Prince, Matthew Browning, Holloway, Lee Hahn, Tourne, Matthieu Philippe Franois
• Primary Examiner(s): Dennison, Jerry
• Application Number:
  US13/858,635
• Publication Number:
  US 20130227167A1
• Time in Patent Office: 1,107 Days
• Field of Search: 709/217
• US Class Current: 1/1
• CPC Class Codes: H04L 45/741 Routing in networks with a plurality of addressing schemes, e.g. with both IPv4 and IPv6
• CPC Class Codes: H04L 61/25 of the same type
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 67/1023 based on a hash applied to IP addresses or costs
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 67/562 Brokering proxy services

Abstract

A first packet is received at a proxy server from a client and includes a first incoming request for an action to be performed on an identified resource. The first packet is received at the proxy server as a result of a DNS request for a domain corresponding to the identified resource resolving to an IP address of the proxy server. The proxy server selects, based on at least in part on a set of parameters associated with the first packet, one of multiple IP addresses for use as a source IP address for a second packet that carries an outgoing request and transmits the second packet. The proxy server receives a third packet that includes an incoming response from the destination origin server in response to the outgoing request and transmits a fourth packet to the client that includes an outgoing response based on the incoming response.

Claims

1. A method in a proxy server of a cloud-based proxy service, comprising:

receiving, from a client, a first packet that includes a first incoming request for an action to be performed on an identified resource, wherein the first packet is received at the proxy server as a result of a Domain Name System (DNS) request for a domain corresponding to the identified resource resolving to an Internet Protocol (IP) address of the proxy server;

selecting a first IP address from a plurality of IP addresses of a same IP protocol version type of the proxy server for use as a source IP address for a second packet that carries a first outgoing request to be transmitted by the proxy server to a destination origin server, wherein the step of selecting is based at least in part on a set of one or more parameters associated with the first packet;

transmitting the second packet that includes the first outgoing request to the destination origin server that hosts the identified resource, wherein the first outgoing request is based on the first incoming request, wherein the second packet includes the selected first IP address as the source IP address of the second packet;

receiving a third packet that includes a first incoming response from the destination origin server in response to the first outgoing request; and

transmitting a fourth packet to the client, the fourth packet including a first outgoing response that is based on the first incoming response.

2. The method of claim 1, wherein the step of selecting the first one of the plurality of IP addresses includes using a hash function on one or more of the set of parameters to select the first one of the plurality of IP addresses.

3. The method of claim 1, wherein the first one of the plurality of IP addresses is a least recently used IP address of the plurality of IP addresses for the destination origin server.

4. The method of claim 1, wherein the selected first one of the plurality of IP addresses is the IP address of the proxy server that has been used as a source IP address for outgoing requests to a destination origin server a least number of times compared to other ones of the plurality of IP addresses that have been used as source IP addresses for outgoing requests to the destination origin server.

5. The method of claim 1, wherein the set of parameters include one or more of:

a source IP address of the first packet, a source port of the first packet, the requested domain of the incoming request, a type of content of the identified resource, and one or more cookies associated with the incoming request.

6. The method of claim 1, wherein prior to the step of transmitting the second packet, selecting one of a plurality of IP address of the destination origin server for a destination IP address of the second packet, wherein the step of selecting is based on a set of one or more destination address rules configured by an owner of the domain.

7. The method of claim 1, further comprising:

receiving, from the client, a fifth packet that includes a second incoming request for an action to be performed on an identified resource at the domain; and

transmitting a sixth packet that includes a second outgoing request to the destination origin server, wherein the sixth packet includes the first IP address as a source IP address of the sixth packet.

8. The method of claim 7, wherein the first outgoing request and the second outgoing request are related to a same session.

9. The method of claim 1, further comprising:

receiving, from the client, a fifth packet that includes a second incoming request for an action to be performed on an identified resource at the domain;

selecting a second one of the plurality of IP addresses of the proxy server for use as a source IP address based at least in part on a set of one or more parameters associated with the fifth packet; and

transmitting a sixth packet that includes a second outgoing request to the destination origin server, wherein the sixth packet includes the second IP address as a source IP address of the sixth packet, and wherein the first outgoing request and the second outgoing request are not related to a same session.

10. A method in a proxy server of a cloud-based proxy service, comprising:

receiving, from a plurality of clients a plurality of first incoming requests respectively, wherein each incoming request is for an action to be performed on an identified resource and is received at the proxy server as a result of a Domain Name System (DNS) request for a same domain corresponding to the identified resource resolving to an Internet Protocol (IP) address of the proxy server;

for each first incoming request, creating a first outgoing request to transmit to a destination origin server that hosts the resource identified in that first incoming request;

for each of the first outgoing requests, selecting an IP address from a plurality of IP addresses of a same IP protocol version type of the proxy server to use as a source IP address for that first outgoing request, wherein a number of the plurality of IP addresses is less than a number of the plurality of clients; and

transmitting each of the first outgoing requests to the destination origin server.

11. The method of claim 10, wherein the step of selecting the IP address from the plurality of IP addresses of the proxy server include performing, for each of the first incoming requests, a hash function on one or more parameters of that first incoming request to select one of the plurality of IP address of the proxy server.

12. The method of claim 10, wherein the step of selecting each IP address from the plurality of IP addresses of the proxy server include an ordered selection of the plurality of IP addresses based on incoming request arrival.

13. The method of claim 10, further comprising:

receiving, from a first one of the plurality of clients, a set of one or more second incoming requests, wherein each second incoming request is for an action to be performed on an identified resource of the same domain as the first incoming requests;

for each of the set of second incoming requests, creating a second outgoing request to transmit to the destination origin server that hosts the resource identified in that second incoming request; and

transmitting each second outgoing request from a same IP address of the proxy server as used in the first outgoing request transmitted for the first one of the plurality of clients.

14. A non-transitory machine-readable storage medium that provides instructions that, when executed by a processor of a proxy server of a cloud-based proxy service, cause said processor to perform operations comprising:

receiving, from a client, a first packet that includes a first incoming request for an action to be performed on an identified resource, wherein the first packet is received at the proxy server as a result of a Domain Name System (DNS) request for a domain corresponding to the identified resource resolving to an Internet Protocol (IP) address of the proxy server;

selecting a first IP address from a plurality of IP addresses of a same IP protocol version type of the proxy server for use as a source IP address for a second packet that carries a first outgoing request to be transmitted by the proxy server to a destination origin server, wherein the step of selecting is based at least in part on a set of one or more parameters associated with the first packet;

transmitting the second packet that includes the first outgoing request to the destination origin server that hosts the identified resource, wherein the first outgoing request is based on the first incoming request, wherein the second packet includes the selected first IP address as the source IP address of the second packet;

receiving a third packet that includes a first incoming response from the destination origin server in response to the first outgoing request; and

transmitting a fourth packet to the client, the fourth packet including a first outgoing response that is based on the first incoming response.

15. The non-transitory machine-readable storage medium of claim 14, wherein the step of selecting the first one of the plurality of IP addresses includes using a hash function on one or more of the set of parameters to select the first one of the plurality of IP addresses.

16. The non-transitory machine-readable storage medium of claim 14, wherein the first one of the plurality of IP addresses is a least recently used IP address of the plurality of IP addresses for the destination origin server.

17. The non-transitory machine-readable storage medium of claim 14, wherein the selected first one of the plurality of IP addresses is the IP address of the proxy server that has been used as a source IP address for outgoing requests to a destination origin server a least number of times compared to other ones of the plurality of IP addresses that have been used as source IP addresses for outgoing requests to the destination origin server.

18. The non-transitory machine-readable storage medium of claim 14, wherein the set of parameters include one or more of:

a source IP address of the first packet, a source port of the first packet, the requested domain of the incoming request, a type of content of the identified resource, and one or more cookies associated with the incoming request.

19. The non-transitory machine-readable storage medium of claim 14, wherein prior to the step of transmitting the second packet, selecting one of a plurality of IP address of the destination origin server for a destination IP address of the second packet, wherein the step of selecting is based on a set of one or more destination address rules configured by an owner of the domain.

20. The non-transitory machine-readable storage medium of claim 14, further comprising instructions, that when executed by the processor, cause the processor to perform the following:

receiving, from the client, a fifth packet that includes a second incoming request for an action to be performed on an identified resource at the domain; and

transmitting a sixth packet that includes a second outgoing request to the destination origin server, wherein the sixth packet includes the first IP address as a source IP address of the sixth packet.

21. The non-transitory machine-readable storage medium of claim 20, wherein the first outgoing request and the second outgoing request are related to a same session.

22. The non-transitory machine-readable storage medium of claim 14, further comprising instructions, that when executed by the processor, cause the processor to perform the following:

receiving, from the client, a fifth packet that includes a second incoming request for an action to be performed on an identified resource at the domain;

selecting a second one of the plurality of IP addresses of the proxy server for use as a source IP address based at least in part on a set of one or more parameters associated with the fifth packet; and

transmitting a sixth packet that includes a second outgoing request to the destination origin server, wherein the sixth packet includes the second IP address as a source IP address of the sixth packet, and wherein the first outgoing request and the second outgoing request are not related to a same session.

23. A non-transitory machine-readable storage medium that provides instructions that, when executed by a processor of a proxy server of a cloud-based proxy service, cause said processor to perform operations comprising:

receiving, from a plurality of clients a plurality of first incoming requests respectively, wherein each incoming request is for an action to be performed on an identified resource and is received at the proxy server as a result of a Domain Name System (DNS) request for a same domain corresponding to the identified resource resolving to an Internet Protocol (IP) address of the proxy server;

for each first incoming request, creating a first outgoing request to transmit to a destination origin server that hosts the resource identified in that first incoming request;

for each of the first outgoing requests, selecting an IP address from a plurality of IP addresses of a same IP protocol version type of the proxy server to use as a source IP address for that first outgoing request, wherein a number of the plurality of IP addresses is less than a number of the plurality of clients; and

transmitting each of the first outgoing requests to the destination origin server.

24. The non-transitory machine-readable storage medium of claim 23, wherein the step of selecting the IP address from the plurality of IP addresses of the proxy server include performing, for each of the first incoming requests, a hash function on one or more parameters of that first incoming request to select one of the plurality of IP address of the proxy server.

25. The non-transitory machine-readable storage medium of claim 23, wherein the step of selecting each IP address from the plurality of IP addresses of the proxy server include an ordered selection of the plurality of IP addresses based on incoming request arrival.

26. The non-transitory machine-readable storage medium of claim 23, further comprising instructions, that when executed by the processor, cause the processor to perform the following:

receiving, from a first one of the plurality of clients, a set of one or more second incoming requests, wherein each second incoming request is for an action to be performed on an identified resource of the same domain as the first incoming requests;

for each of the set of second incoming requests, creating a second outgoing request to transmit to the destination origin server that hosts the resource identified in that second incoming request; and

transmitting each second outgoing request from a same IP address of the proxy server as used in the first outgoing request transmitted for the first one of the plurality of clients.