Internet-based proxy security services

• US 10,102,301 B2
• Filed: 11/04/2010
• Issued: 10/16/2018
• Est. Priority Date: 04/01/2010
• Status: Active Grant

• Current Assignee: CloudFlare Incorporated
• Original Assignee: CloudFlare Incorporated
• Inventors: Holloway, Lee Hahn, Prince, Matthew Browning, Zatlyn, Michelle Marie
• Primary Examiner(s): Najjar, Saleh
• Assistant Examiner(s): Mejia, Feliciano
• Application Number:
  US12/939,908
• Publication Number:
  US 20120117649A1
• Time in Patent Office: 2,903 Days
• Field of Search: 726 22- 25, 726 12, 726 26, 726 11, 709219, 709224, 709229
• CPC Class Codes: G06F 15/16 Combinations of two or more digital computers each having at least an arithmetic unit, a program unit and a register, e.g. for a simultaneous processing of several programs coordinating program control therefor G06F9/52; in regulating and control system G05B
• CPC Class Codes: G06F 16/95 Retrieval from the web
• CPC Class Codes: G06F 16/958 Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 40/14 Tree-structured documents parsing G06F40/205; validation G06F40/226
• CPC Class Codes: G06F 40/143 Markup, e.g. Standard Generalized Markup Language [SGML] or Document Type Definition [DTD]
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: G06Q 30/0241 Advertisements
• CPC Class Codes: G06Q 30/0251 Targeted advertisements
• CPC Class Codes: G06Q 30/0277 Online advertisement
• CPC Class Codes: H04L 47/745 Reaction in network
• CPC Class Codes: H04L 51/42 Mailbox-related aspects, e.g. synchronisation of mailboxes
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/59 using proxies for addressing
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/0254 Stateful filtering
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/083 : using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0861 : using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/102 : Entity profiles
• CPC Class Codes: H04L 63/126 : the source of the received data
• CPC Class Codes: H04L 63/1416 : Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1433 : Vulnerability analysis
• CPC Class Codes: H04L 63/1441 : Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1458 : Denial of Service
• CPC Class Codes: H04L 63/1466 : Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 67/02 : based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/146 : Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding
• CPC Class Codes: H04L 67/56 : Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 67/561 : Adding application-functional data or data for application control, e.g. adding metadata
• CPC Class Codes: H04L 67/568 : Storing data temporarily at an intermediate stage, e.g. caching
• CPC Class Codes: H04L 69/40 : for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection management of faults, events, alarms or notifications in data switching networks H04L41/06

Abstract

A proxy server receives from a client device a request to perform an action on an identified resource that is hosted at an origin server for a domain. The proxy server receives the request as a result of a DNS request for the domain resolving to the proxy server. The origin server is one of multiple origin servers that belong to different domains that resolve to the proxy server and are owned by different entities. The proxy server and the origin servers are owned by different entities. The proxy server analyzes the request to determine whether a visitor belonging to that request poses a threat. If the proxy server determines that the visitor poses a threat, the proxy server blocks the request and transmits a block page to the client device that indicates that the request has been blocked.

Claims

1. A method in a proxy server, comprising:

receiving, from a client device, a request to perform an action on an identified resource that is hosted at an origin server for a domain, wherein the request is received at the proxy server as a result of a DNS (Domain Name System) request for the domain returning an IP address of the proxy server instead of an IP address of the origin server, wherein the origin server is one of a plurality of origin servers that belong to different domains that resolve to the proxy server and are owned by different entities, and wherein the proxy server and the plurality of origin servers are owned by different entities;

analyzing the request to determine whether a visitor belonging to the request poses a threat;

responsive to a determination that the visitor belonging to the request poses a threat, performing the following;

blocking the request, and

transmitting a block page to the client device that indicates that the request has been blocked.

2. The method of claim 1, further comprising:

customizing the block page based on one or more of;

a set of one or more characteristics associated with the request and a set of one or more characteristics associated with the domain.

3. The method of claim 1, wherein analyzing the request to determine whether the visitor poses a threat includes determining whether an IP address of the request is included on one or more of:

a global restricted IP address list that identifies IP addresses that are not allowed to access content of any of the plurality of origin servers, and a local IP restricted address list that identifies IP addresses that are not allowed to access content of the requested origin server.

4. The method of claim 1, wherein the visitor is determined to pose a threat as a result of determining, based on a set of one or more characteristics associated with the request, that the client device potentially has a software vulnerability, and wherein the block page indicates that the client device potentially has a software vulnerability.

5. The method of claim 4, further comprising:

including, as part of the block page, instructions to remedy the software vulnerability including one or more of;

run an anti-virus software program on the client device, download and run an anti-virus software program on the client device, download and install one or more patches on the client device, and upgrade software on the client device.

6. The method of claim 4, further comprising:

including, as part of the block page, one or more advertisements for one or more solution providers that offer one or more products to remedy the software vulnerability.

7. The method of claim 1, wherein the visitor is determined to pose a threat as a result of determining, based on a set of one or more characteristics associated with the request, that the visitor is potentially an automated bot that is part of a botnet.

8. The method of claim 7, further comprising:

including, as part of the block page, a mechanism to dismiss the block page, wherein the mechanism is selected from the group consisting of;

a link to close the block page, a CAPTCHA, and a dismiss code field.

9. The method of claim 8, further comprising:

determining that the visitor has successfully dismissed the block page;

reconstructing the request; and

transmitting the request to the origin server.

28. The method of claim 1, wherein blocking the request includes not transmitting the request to the origin server.

10. A proxy server, comprising:

a memory to store instructions;

a processor coupled with the memory to process the stored instructions to;

receive, from a client device, a request to perform an action on an identified resource that is hosted at an origin server for a domain, wherein the request is received as a result of a DNS (Domain Name System) request for the domain returning an IP address of the proxy server instead of an IP address of the origin server, wherein the origin server is one of a plurality of origin servers that belong to different domains that resolve to the proxy server and are owned by different entities, and wherein the proxy server and the plurality of origin servers are owned by different entities;

analyze the request to determine whether a visitor belonging to the request poses a threat;

responsive to a determination that the visitor belonging to the request poses a threat, perform the following;

block the request, and

transmit a block page to the client device that indicates that the request has been blocked.

11. The proxy server of claim 10, wherein the processor is further to process the stored instructions to:

customize the block page based on one or more of;

a set of one or more characteristics associated with the request and a set of one or more characteristics associated with the domain.

12. The proxy server of claim 10, wherein analyzing the request to determine whether the visitor poses a threat includes a determination of whether an IP address of the request is included on one or more of:

a global restricted IP address list that identifies IP addresses that are not allowed to access content of any of the plurality of origin servers, and a local IP restricted address list that identifies IP addresses that are not allowed to access content of the requested origin server.

13. The proxy server of claim 10, wherein the visitor is determined to pose a threat as a result of determining, based on a set of one or more characteristics associated with the request, that the client device potentially has a software vulnerability, and wherein the block page indicates that the client device potentially has a software vulnerability.

14. The proxy server of claim 13, wherein the processor is further to process the stored instructions to:

include, as part of the block page, instructions to remedy the software vulnerability including one or more of;

run an anti-virus software program on the client device, download and run an anti-virus software program on the client device, download and install one or more patches on the client device, and upgrade software on the client device.

15. The proxy server of claim 13, wherein the processor is further to process the stored instructions to:

include, as part of the block page, one or more advertisements for one or more solution providers that offer one or more products to remedy the software vulnerability.

16. The proxy server of claim 10, wherein the visitor is determined to pose a threat as a result of a determination, based on a set of one or more characteristics associated with the request, that the visitor is potentially an automated bot that is part of a botnet.

17. The proxy server of claim 16, wherein the processor is further to process the stored instructions to:

include, as part of the block page, a mechanism to dismiss the block page, wherein the mechanism is selected from the group consisting of;

a link to close the block page, a CAPTCHA, and a dismiss code field.

18. The proxy server of claim 17, wherein the processor is further to process the stored instructions to:

determine that the visitor has successfully dismissed the block page;

reconstruct the request; and

transmit the request to the origin server.

29. The proxy server of claim 10, wherein blocking the request includes not transmitting the request to the origin server.

19. A non-transitory machine-readable storage medium that provides instructions that, when executed by a processor, cause said processor to perform operations comprising:

receiving, from a client device, a request to perform an action on an identified resource that is hosted at an origin server for a domain, wherein the request is received at the proxy server as a result of a DNS (Domain Name System) request for the domain returning an IP address of the proxy server instead of an IP address of the origin server, wherein the origin server is one of a plurality of origin servers that belong to different domains that resolve to the proxy server and are owned by different entities, and wherein the proxy server and the plurality of origin servers are owned by different entities;

analyzing the request to determine whether a visitor belonging to the request poses a threat;

responsive to a determination that the visitor belonging to the request poses a threat, performing the following;

blocking the request, and

transmitting a block page to the client device that indicates that the request has been blocked.

20. The non-transitory machine-readable storage medium of claim 19, further comprising:

customizing the block page based on one or more of;

a set of one or more characteristics associated with the request and a set of one or more characteristics associated with the domain.

21. The non-transitory machine-readable storage medium of claim 19, wherein analyzing the request to determine whether the visitor poses a threat includes determining whether an IP address of the request is included on one or more of:

a global restricted IP address list that identifies IP addresses that are not allowed to access content of any of the plurality of origin servers, and a local IP restricted address list that identifies IP addresses that are not allowed to access content of the requested origin server.

22. The non-transitory machine-readable storage medium of claim 19, wherein the visitor is determined to pose a threat as a result of determining, based on a set of one or more characteristics associated with the request, that the client device potentially has a software vulnerability, and wherein the block page indicates that the client device potentially has a software vulnerability.

23. The non-transitory machine-readable storage medium of claim 22, further comprising:

including, as part of the block page, instructions to remedy the software vulnerability including one or more of;

run an anti-virus software program on the client device, download and run an anti-virus software program on the client device, download and install one or more patches on the client device, and upgrade software on the client device.

24. The non-transitory machine-readable storage medium of claim 22, further comprising:

including, as part of the block page, one or more advertisements for one or more solution providers that offer one or more products to remedy the software vulnerability.

25. The non-transitory machine-readable storage medium of claim 19, wherein the visitor is determined to pose a threat as a result of determining, based on a set of one or more characteristics associated with the request, that the visitor is potentially an automated bot that is part of a botnet.

26. The non-transitory machine-readable storage medium of claim 25, further comprising:

including, as part of the block page, a mechanism to dismiss the block page, wherein the mechanism is selected from the group consisting of;

a link to close the block page, a CAPTCHA, and a dismiss code field.

27. The non-transitory machine-readable storage medium of claim 26, further comprising:

determining that the visitor has successfully dismissed the block page;

reconstructing the request; and

transmitting the request to the origin server.

30. The non-transitory machine-readable storage medium of claim 19, wherein blocking the request includes not transmitting the request to the origin server.