Edge server selection for enhanced services network

• US 9,923,897 B2
• Filed: 03/06/2014
• Issued: 03/20/2018
• Est. Priority Date: 03/06/2013
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: SurfEasy, Inc. (Gen Digital Inc.)
• Inventors: Houston, Chris, Nuaimi, Athir, Gross, Josh
• Primary Examiner(s): Colin, Carl
• Assistant Examiner(s): Lavelle, Gary
• Application Number:
  US14/199,035
• Publication Number:
  US 20140259109A1
• Time in Patent Office: 1,475 Days
• CPC Class Codes: G06F 15/17 using an input/output type connection, e.g. channel, I/O port
• CPC Class Codes: H04L 12/28 characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks] wireless communication networks H04W ; arrangements for dividing the transmission path H04W40/00
• CPC Class Codes: H04L 12/56 Packet switching systems
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 9/00 Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

An enhanced services network provides enhanced privacy and/or security over public networks to client subscribers of the service. Client devices access the enhanced services network over a public communications network (e.g., the Internet, cellular network, etc.) via a client-side edge server of the enhanced services network. The enhanced services network interfaces with client-requested network resources hosted by third-party server devices via a resource-side edge server. The particular client-side edge server and/or resource-side edge server that is utilized for a particular client session may be selected by the enhanced services network according to a rule set. The rule set may seek to achieve one or more target goals, such as: (1) limit discoverability of the enhanced services network, (2) minimize or reduce geographic/network distance between an edge server and a target computing device, and/or (3) establish connections that are more secure than the connections originally requested by the client.

Claims

1. A method performed by a computing system implementing an enhanced services network, the method comprising:

authenticating a client at one or more coordinating servers of a server system for one or more sessions of the client for the enhanced services network based on authentication information received from the client over a communications network;

maintaining a client-specific group of client-side edge servers available to the client across all sessions of the client for the enhanced services network in which the client-specific group of client-side edge servers is a limited subset of a domain of client-side edge servers of the enhanced services network, the client-specific group of client-side edge servers including a predefined quantity or proportion of the domain of client-side edge servers;

following a first authentication of the client for a session of the enhanced services network of the one or more sessions, directing a browser program of the client to establish a connection to a first client-side edge server of the client-specific group, the first client-side edge server facilitating, via a first set of one or more resource-side edge servers of the enhanced services network, at least a portion of the session between the client and one or more third-party network resources hosted by one or more third-party servers located outside of the enhanced services network by;

receiving, from the client, a first request initiated via the browser program for the one or more third-party network resources, establishing a virtual private network with the first set of one or more resource-side edge servers located along a communications path to the one or more third-party network resources, and processing the first request on-behalf of the client via the first client-side edge server and the first set of one or more resource-side edge servers; and

following a second authentication of the client for a subsequent session of the enhanced services network of the one or more sessions, directing the browser program of the client to establish a connection to a second client-side edge server of the client-specific group, the second client-side edge server facilitating, via a second set of one or more resource-side edge servers of the enhanced services network that differs from the first set, at least a portion of the subsequent session between the client and one or more third-party network resources hosted by one or more third-party servers located outside of the enhanced services network by;

receiving, from the client, a second request initiated via the browser program for the one or more third-party network resources, establishing a virtual private network with the second set of one or more resource-side edge servers located along a communications path to the one or more third-party network resources hosted by the one or more third-party servers, and processing the second request on-behalf of the client via the second client-side edge server and the second set of one or more resource-side edge servers.

2. The method of claim 1, further comprising:

redirecting the client from the first client-side edge server to the second client-side edge server or a third client-side edge server of the client-specific group during the session, the second client-side edge server or third client-side edge server further facilitating the session between the client and the one or more third-party network resources.

3. The method of claim 1, wherein the client is a first client of a plurality of clients, and wherein the client-specific group is a first client-specific group of a plurality of client-specific groups, the method further comprising:

authenticating a second client at the server system for one or more sessions based on authentication information received from the second client over the communications network;

maintaining a second client-specific group of client-side edge servers available to the second client over the one or more sessions of the domain of client-side edge servers, the second client-specific group of client-side edge servers including the predefined quantity or proportion of the domain of edge servers, and further including one or more different client-side edge servers than the first client-specific group.

4. The method of claim 3, wherein the first client and the second client are located within a geographic proximity to each other or each utilize an IP address that is related within a subdomain of IP addresses.

5. The method of claim 4, further comprising:

authenticating a third client at the server system for one or more sessions based on authentication information received from the third client over the communications network;

maintaining a third client-specific group of client-side edge servers available to the third client over the one or more sessions of the domain of client-side edge servers, the third client-specific group of client-side edge servers including the predefined quantity or proportion of the domain of client-side edge servers, and further including one or more different client-side edge servers than at least one of the first client-specific group and/or the second client-specific group.

6. The method of claim 5, wherein the third-client specific group includes the same client-side edge servers as one of the first client-specific group or the second client specific group if the third client is located outside of the geographic proximity to one of the first client or second client or utilizes an IP address that is unrelated to the subdomain of IP addresses.

7. The method of claim 1, wherein the domain of client-side edge servers is divided into three or more groups of client-side edge servers of which the client-specific group is a first group of the three or more groups, and wherein the three or more groups of client-side edge servers each include one or more different client-side edge servers relative to each other.

8. The method of claim 7, wherein the three or more groups of client-side edge servers each include one or more of the same client-side edge servers relative to each other.

9. The method of claim 1, further comprising:

transmitting selection information from the server system to the first client-side edge server and the second client-side edge server of the group, the selection information indicating a client identifier for the client, and further indicating at least some client-side edge servers of the client-specific group of client-side edge servers for the client;

wherein the selection information enables the first client-side edge server and the second client-side edge server to redirect the client from one of the first client-side edge server and the second client-side edge server to another client-side edge server of the client-specific group during a session.

10. The method of claim 1, wherein the first client-side edge server and the second client-side edge server facilitate at least the portion of the session and the subsequent session, respectively, between the client and the one or more third-party network resources by providing a proxy service for the client that terminates connections and establishes new connections between the client and the one or more third-party network resources hosted by one or more third-party servers.

11. The method of claim 1, wherein the first client-side edge server and the second client-side edge server facilitate at least the portion of the session and the subsequent session, respectively, between the client and the one or more third-party network resources by increasing a level of encryption along a communications path between the client device and the one or more third-party network resources hosted by one or more third-party servers.

12. The method of claim 4, further comprising:

selecting the first client-specific group of client-side edge servers based on a geographic location or IP address of the first client, wherein the first client-specific group of client-side edge servers is selected to minimize or reduce the geographic and/or network distance between the first client-specific group of client-side edge servers and the first client; and

selecting the second client-specific group of client-side edge servers based on a geographic location or IP address of the second client, and further based on the first client-specific group of client-side edge servers, wherein the second client-specific group of client-side edge servers is selected to minimize or reduce the geographic and/or network distance between the second client-specific group of client-side edge servers and the second client, while also maintaining one or more different client-side edge servers in the second client-specific group than the first client-specific group.

13. The method of claim 1, further comprising:

receiving communications from client-side edge servers of the domain of client-side edge servers that were initiated by authenticated clients; and

establishing and/or redirecting the communications to a more secure connection with target network resources hosted by third-party servers on behalf of the authenticated clients.

14. A computing system, comprising:

one or more computer-readable information storage devices having instructions stored thereon, executable by one or more computing devices to;

authenticate a first client for one or more sessions of an enhanced services network based on authentication information received from the first client over a communications network;

select a first client-specific group of client-side edge servers of a domain of client-side edge servers of the enhanced services network that are available to the first client over all sessions of the enhanced services network, the first client-specific group of client-side edge servers including a predefined quantity or proportion forming a first limited subset of the domain of client-side edge servers;

following a first authentication of the first client for a session of the enhanced services network, facilitate, via a first set of one or more resource-side edge servers of the enhanced services network, at least a portion of the session between the first client and one or more third-party network resources hosted by one or more third-party servers located outside of the enhanced services network by;

establishing a virtual private network with the first set of one or more resource-side edge servers located along a communications path to the one or more third-party network resources, providing a proxy service for the first client that terminates connections and establishes new connections between the first client device and the one or more third-party network resources hosted by one or more third-party servers via the first client-side edge server and the first set of one or more resource-side edge servers; and

following a second authentication of the first client for a subsequent session of the enhanced services network, facilitate, via a second set of one or more resource-side edge servers of the enhanced services network that differs from the first set, at least a portion of the subsequent session between the first client and one or more third-party network resources hosted by one or more third-party servers located outside of the enhanced services network by;

establishing a virtual private network with the second set of one or more resource-side edge servers located along a communications path to the one or more third-party network resources, providing the proxy service for the first client that terminates connections and establishes new connections between the first client device and the one or more third-party network resources hosted by one or more third-party servers via the second client-side edge server and the second set of one or more resource-side edge servers.

15. The computing system of claim 14, where the instructions are further executable by the one or more computing devices to:

authenticate a second client for one or more sessions based on authentication information received from the second client over a communications network;

select a second client-specific group of client-side edge servers available to the second client over the one or more sessions of the domain of client-side edge servers, the second client-specific group of client-side edge servers including a predefined quantity or proportion forming a second subset of the domain of client-side edge servers, the second subset including one or more different client-side edge servers than the first subset;

following a first authentication of the second client for a session of the one or more sessions, facilitate at least a portion of the session between the second client and one or more third-party network resources by providing the proxy service for the second client that terminates connections and establishes new connections between the second client device and the one or more network resources hosted by one or more third-party servers; and

following a second authentication of the second client for a subsequent session of the one or more sessions, directing the second client to a second client-side edge server of the second client-specific group, the second client-side edge server facilitating at least a portion of the subsequent session between the second client and one or more third-party network resources by providing the proxy service for the second client that terminates connections and establishes new connections between the second client device and the one or more third-party network resources hosted by one or more third-party servers.

16. The computing system of claim 14, where the instructions are further executable by the one or more computing devices to:

to receive communications from client-side edge servers of the domain of client-side edge servers that were initiated by authenticated clients; and

establish and/or direct the communications to a more secure connection with target network resources hosted by third-party servers on behalf of the authenticated clients.