Redirecting from a cloud service to a third party website to save costs without sacrificing security

• US 9,736,260 B2
• Filed: 06/21/2012
• Issued: 08/15/2017
• Est. Priority Date: 06/21/2012
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Wheeldon, Richard
• Primary Examiner(s): Eskandarnia, Arvin
• Assistant Examiner(s): DUONG, THAO DUC
• Application Number:
  US13/529,025
• Publication Number:
  US 20130346472A1
• Time in Patent Office: 1,881 Days
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/2876 Pairs of inter-processing entities at each side of the network, e.g. split proxies
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 67/563 Data redirection of data network streams

Abstract

Techniques are provided for receiving a request from a client proxy device to access a file on a server. The file is associated with a uniform resource locator (URL). In response to receiving the request, the server proxy device evaluates the request for presence of information that indicates that the client proxy device is able to obtain redirect instructions to access the file. When the evaluating indicates that the request includes the information, the server proxy device requests and receives identifier information associated with the URL from the server. The server proxy device retrieves from a database stored identifier information associated with the URL to compare it to the stored identifier information associated with the URL. When there is a match, the redirect instructions are sent to the client proxy device instructing the client proxy device to retrieve the file directly from the server.

Claims

1. A method comprising:

at a server proxy device, receiving from a client proxy device a request to access a file that is on a server and associated with a uniform resource locator (URL);

in response to the receiving, evaluating the request to determine when the request includes information that indicates that the client proxy device is able to obtain redirect instructions to access the file directly from the server;

when the evaluating indicates that the request includes the information, requesting identifier information associated with the URL from the server;

receiving the identifier information associated with the URL from the server;

retrieving stored identifier information associated with the URL from a database;

comparing the identifier information associated with the URL to the stored identifier information associated with the URL to determine at least one of a request count or a change count associated with the URL;

determining whether the file associated with the URL is expected to remain unchanged based on at least one of the request count or the change count;

identifying mirror servers of the server from which the file is also retrievable; and

when the comparing determines that the file is expected to remain unchanged, sending the redirect instructions to the client proxy device to instruct the client proxy device to retrieve the file associated with the URL directly from one of the mirror servers.

2. The method of claim 1, wherein receiving the identifier information associated with the URL comprises receiving one or more of:

a filename, trailing path segments of the URL, second and top level domains of the URL, a timestamp of retrieval of the file, a hit count associated with the URL, hypertext transfer protocol (HTTP) response headers, a checksum value and a file type associated with the file.

3. The method of claim 1, wherein sending the redirect instructions comprises sending the redirect instructions such that the server proxy device does not have to download the file from the server.

4. The method of claim 1, further comprising updating the database to include the identifier information associated with the URL received from the server.

5. The method of claim 1, wherein sending the redirect instructions comprises sending the redirect instructions to the client proxy device to instruct the client proxy device to retrieve the file associated with the URL without the server proxy having to determine whether or not the file is malicious or otherwise presents a security threat.

6. The method of claim 1, wherein sending the redirect instructions to the client proxy device comprises sending the redirect instructions comprising a secure hash.

7. One or more non-transitory computer readable storage media encoded with software comprising computer executable instructions and when the software is executed operable to:

receive from a client proxy device a request to access a file that is on a server and associated with a uniform resource locator (URL);

evaluate the request to determine when the request includes information that indicates that the client proxy device is able to obtain redirect instructions to access the file directly from the server;

when the request includes the information, request identifier information associated with the URL from the server;

receive the identifier information associated with the URL from the server;

retrieve stored identifier information associated with the URL from a database;

compare the identifier information associated with the URL to the stored identifier information associated with the URL to determine at least one of a request count or a change count associated with the URL;

determine whether the file associated with the URL is expected to remain unchanged based on at least one of the request count or the change count;

identify mirror servers of the server from which the file is also retrievable; and

send the redirect instructions to the client proxy device to instruct the client proxy device to retrieve the file associated with the URL directly from one of the mirror servers when the file is expected to remain unchanged.

8. The computer readable storage media of claim 7, wherein the instructions operable to receive the identifier information associated with the URL comprise instructions operable to receive one or more of:

a filename, trailing path segments of the URL, second and top level domains of the URL, a timestamp of retrieval of the file, a hit count associated with the URL, hypertext transfer protocol (HTTP) response headers, a checksum value and a file type associated with the file.

9. The computer readable storage media of claim 7, wherein the instructions operable to send the redirect instructions comprise instructions operable to send redirect instructions without having to download the file from the server.

10. The computer readable storage media of claim 7 further comprising instructions operable to update the database to include the identifier information associated with the URL received from the server.

11. The computer readable storage media of claim 7, wherein the instructions operable to send the redirect instructions comprise instructions operable to send the redirect instructions to the client proxy device to instruct the client proxy device to retrieve the file associated with the URL without having to determine whether or not the file is malicious or otherwise presents a security threat.

12. The computer readable storage media of claim 7, wherein the redirect instructions comprise a secure hash.

13. An apparatus comprising:

a network interface unit;

a memory unit; and

a processor coupled to the network interface unit and the memory and configured to;

receive from a client proxy device a request to access a file that is on a server and associated with a uniform resource locator (URL);

evaluate the request to determine when the request includes information that indicates that the client proxy device is able to obtain redirect instructions to access the file directly from the server;

when the request includes the information, request identifier information associated with the URL from the server;

receive the identifier information associated with the URL from the server;

retrieve stored identifier information associated with the URL from a database;

compare the identifier information associated with the URL to the stored identifier information associated with the URL to determine at least one of a request count or a change count associated with the URL;

determine whether the file associated with the URL is expected to remain unchanged based on at least one of the request count or the change count;

identify minor servers of the server from which the file is also retrievable; and

send the redirect instructions to the client proxy device to instruct the client proxy device to retrieve the file associated with the URL directly from one of the mirror servers when the file associated with the URL is expected to remain unchanged.

14. The apparatus of claim 13, wherein the processor is configured to send the redirect instructions without having to download the file from the server.

15. The apparatus of claim 13, wherein the processor is configured to receive the identifier information associated with the URL by receiving one or more of:

a filename, trailing path segments of the URL, second and top level domains of the URL, a timestamp of retrieval of the file, a hit count associated with the URL, hypertext transfer protocol (HTTP) response headers, a checksum value or a file type associated with the file.

16. The apparatus of claim 13, wherein the processor is further configured to:

update the database to include the identifier information associated with the URL received from the server.

17. The apparatus of claim 13, wherein the processor is configured to send the redirect instructions to the client proxy device to instruct the client proxy device to retrieve the file associated with the URL without having to determine whether or not the file is malicious or otherwise presents a security threat.

18. The apparatus of claim 13, wherein the redirect instructions comprise a secure hash.