Internet-based proxy service to limit internet visitor connection speed

• US 10,621,263 B2
• Filed: 12/31/2018
• Issued: 04/14/2020
• Est. Priority Date: 04/01/2010
• Status: Active Grant

• Current Assignee: CloudFlare Incorporated
• Original Assignee: CloudFlare Incorporated
• Inventors: Holloway, Lee Hahn, Prince, Matthew Browning, Pye, Ian Gerald
• Primary Examiner(s): Baturay, Alicia
• Application Number:
  US16/237,572
• Publication Number:
  US 20190138560A1
• Time in Patent Office: 470 Days
• Field of Search: 709227
• CPC Class Codes: G06F 15/16 Combinations of two or more digital computers each having at least an arithmetic unit, a program unit and a register, e.g. for a simultaneous processing of several programs coordinating program control therefor G06F9/52; in regulating and control system G05B
• CPC Class Codes: G06F 16/95 Retrieval from the web
• CPC Class Codes: G06F 16/958 Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 40/14 Tree-structured documents parsing G06F40/205; validation G06F40/226
• CPC Class Codes: G06F 40/143 Markup, e.g. Standard Generalized Markup Language [SGML] or Document Type Definition [DTD]
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: G06Q 30/0241 Advertisements
• CPC Class Codes: G06Q 30/0251 Targeted advertisements
• CPC Class Codes: G06Q 30/0277 Online advertisement
• CPC Class Codes: H04L 47/745 Reaction in network
• CPC Class Codes: H04L 51/42 Mailbox-related aspects, e.g. synchronisation of mailboxes
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/59 using proxies for addressing
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/0254 Stateful filtering
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/083 : using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0861 : using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/102 : Entity profiles
• CPC Class Codes: H04L 63/126 : the source of the received data
• CPC Class Codes: H04L 63/1416 : Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1433 : Vulnerability analysis
• CPC Class Codes: H04L 63/1441 : Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1458 : Denial of Service
• CPC Class Codes: H04L 63/1466 : Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 67/02 : based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/146 : Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding
• CPC Class Codes: H04L 67/56 : Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 67/561 : Adding application-functional data or data for application control, e.g. adding metadata
• CPC Class Codes: H04L 67/568 : Storing data temporarily at an intermediate stage, e.g. caching
• CPC Class Codes: H04L 69/40 : for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection management of faults, events, alarms or notifications in data switching networks H04L41/06

Abstract

A proxy server for limiting Internet connection speed of visitors that pose a threat. The proxy server receives from a client device a request to perform an action on an identified resource that is hosted at an origin server for a domain. The proxy server analyzes the request to determine whether a visitor belonging to the request poses a threat. If the proxy server determines that the visitor poses a threat, the proxy server reduces the speed at which the proxy server processes the request while keeping a connection to the client device open.

Claims

1. A method in a proxy server for limiting Internet connection speed of visitors that pose a threat, comprising:

receiving, from a client device at the proxy server, a request to perform an action on an identified resource that is hosted at an origin server for a domain;

analyzing the request to determine whether a visitor associated with the request poses a threat;

determining, from the analyzing, that the visitor associated with the request poses a threat; and

responsive to the determining that the visitor associated with the request poses a threat, reducing the speed at which the proxy server processes the request while keeping a connection to the client device open.

2. The method of claim 1, wherein analyzing the request to determine whether the visitor poses a threat includes performing the following:

determining whether an IP address of the request is on one or more of;

a global restricted IP address list that identifies IP addresses that are not allowed to access content of any of a plurality of origin servers, and

a local IP restricted address list that identifies IP addresses that are not allowed to access content of the origin server for the domain.

3. The method of claim 1, wherein responsive to the determining that the visitor associated with the request poses a threat, further performing the following:

blocking the request from being transmitted to the origin server;

generating a response that includes a set of one or more false links to one or more false pages of one or more domains such that if the visitor follows one of those links, the corresponding request is received at the proxy server and processed at the reduced speed and will cause another response to be generated that includes another set of one or more false links to one or more false pages of one or more of the domains that are processed at the reduced speed in an attempt to occupy that visitor; and

transmitting the response to the client device.

4. The method of claim 1, wherein responsive to the determining that the visitor associated with the request poses a threat, further performing the following:

determining whether the identified resource is available in cache;

responsive to determining that the identified resource is available in cache, transmitting, at a reduced speed to the client device, a response having the identified resource without transmitting the request to the origin server; and

responsive to determining that the identified resource is not available in cache, performing the following;

transmitting the request at a reduced speed to the origin server;

receiving a response to the request from the origin server; and

transmitting the response to the client device at the reduced speed.

5. The method of claim 4, further comprising:

including, in the response, a mechanism for the visitor to prove their legitimacy and thereby increase their connection speed;

determining that the visitor has proven their legitimacy; and

removing the processing of subsequent requests and responses at a reduced speed.

6. The method of claim 4, further comprising:

including in the response a set of one or more false links to one or more false pages of one or more domains such that if the visitor follows one of those links, the corresponding request is received at the proxy server and processed at the reduced speed and will cause another response to be generated that includes another set of one or more false links to one or more false pages of one or more domains that are processed at the reduced speed in an attempt to occupy that visitor.

7. The method of claim 6, wherein the set of false links are hidden from a rendered view of the response while being capable of being read and followed by bots that scan a source of the response.

8. A proxy server to limit Internet connection speed of visitors that pose a threat, comprising:

a memory to store instructions;

a processor coupled with the memory to process the stored instructions to;

receive, from a client device at the proxy server, a request to perform an action on an identified resource that is hosted at an origin server;

analyze the request to determine whether a visitor associated with the request poses a threat;

determine, from the analysis, that the visitor associated with the request poses a threat; and

responsive to the determination that the visitor associated with the request poses a threat, reduce the speed at which the proxy server processes the request while keeping a connection to the client device open.

9. The proxy server of claim 8, wherein the analysis of the request to determine whether the visitor associated with the request poses a threat includes the following:

determine whether an IP address of the request is on one or more of;

a global restricted IP address list that identifies IP addresses that are not allowed to access content of any of a plurality of origin servers, and

a local IP restricted address list that identifies IP addresses that are not allowed to access content of the origin server for the domain.

10. The proxy server of claim 8, wherein responsive to the determination that the visitor associated with the request poses a threat, further performing the following:

block the request from being transmitted to the origin server;

generate a response that includes a set of one or more false links to one or more false pages of one or more domains such that if the visitor follows one of those links, the corresponding request is received at the proxy server and processed at the reduced speed and will cause another response to be generated that includes another set of one or more false links to one or more false pages of one or more of the domains that are processed at the reduced speed in an attempt to occupy that visitor; and

transmit the response to the client device.

11. The proxy server of claim 8, wherein responsive to the determining that the visitor associated with the request poses a threat, further performing the following:

determine whether the identified resource is available in cache;

responsive to a determination that the identified resource is available in cache, transmit, at a reduced speed to the client device, a response having the identified resource without transmitting the request to the origin server;

responsive to a determination that the identified resource is not available in cache, perform the following;

transmit the request at a reduced speed to the origin server;

receive a response to the request from the origin server; and

transmit the response to the client device at the reduced speed.

12. The proxy server of claim 11, wherein the processor is further to process the stored instructions to:

include, in the response, a mechanism for the visitor to prove their legitimacy and thereby increase their connection speed;

determine that the visitor has proven their legitimacy; and

remove the processing of subsequent requests and responses at a reduced speed.

13. The proxy server of claim 11, wherein the processor is further to process the stored instructions to:

include in the response a set of one or more false links to one or more false pages of one or more domains such that if the visitor follows one of those links, the corresponding request is received at the proxy server and processed at the reduced speed and will cause another response to be generated that includes another set of one or more false links to one or more false pages of one or more domains that are processed at the reduced speed in an attempt to occupy that visitor.

14. The proxy server of claim 13, wherein the processor is to include the set of false links in the response such that they are hidden from a rendered view of the response while being capable of being read and followed by bots that scan a source of the response.

15. A non-transitory machine-readable storage medium that provides instructions that, when executed by a processor of a proxy server, cause said processor to perform operations comprising:

receiving, from a client device at the proxy server, a request to perform an action on an identified resource that is hosted at an origin server for a domain;

analyzing the request to determine whether a visitor associated with the request poses a threat;

determining, from the analyzing, that the visitor associated with the request poses a threat; and

responsive to the determining that the visitor associated with the request poses a threat, reducing the speed at which the proxy server processes the request while keeping a connection to the client device open.

16. The non-transitory machine-readable storage medium of claim 15, wherein analyzing the request to determine whether the visitor poses a threat includes performing the following:

determining whether an IP address of the request is on one or more of;

a global restricted IP address list that identifies IP addresses that are not allowed to access content of any of a plurality of origin servers, and

a local IP restricted address list that identifies IP addresses that are not allowed to access content of the origin server for the domain.

17. The non-transitory machine-readable storage medium of claim 15, wherein responsive to the determining that the visitor associated with the request poses a threat, further performing the following:

blocking the request from being transmitted to the origin server;

generating a response that includes a set of one or more false links to one or more false pages of one or more domains such that if the visitor follows one of those links, the corresponding request is received at the proxy server and processed at the reduced speed and will cause another response to be generated that includes another set of one or more false links to one or more false pages of one or more of the domains that are processed at the reduced speed in an attempt to occupy that visitor; and

transmitting the response to the client device.

18. The non-transitory machine-readable storage medium of claim 15, wherein responsive to the determining that the visitor associated with the request poses a threat, further performing the following:

determining whether the identified resource is available in cache;

responsive to determining that the identified resource is available in cache, transmitting, at a reduced speed to the client device, a response having the identified resource without transmitting the request to the origin server; and

responsive to determining that the identified resource is not available in cache, performing the following;

transmitting the request at a reduced speed to the origin server;

receiving a response to the request from the origin server; and

transmitting the response to the client device at the reduced speed.

19. The non-transitory machine-readable storage medium of claim 18, wherein the operations further comprise:

including, in the response, a mechanism for the visitor to prove their legitimacy and thereby increase their connection speed;

determining that the visitor has proven their legitimacy; and

removing the processing of subsequent requests and responses at a reduced speed.

20. The non-transitory machine-readable storage medium of claim 18, wherein the operations further comprise:

including in the response a set of one or more false links to one or more false pages of one or more domains such that if the visitor follows one of those links, the corresponding request is received at the proxy server and processed at the reduced speed and will cause another response to be generated that includes another set of one or more false links to one or more false pages of one or more domains that are processed at the reduced speed in an attempt to occupy that visitor.

21. The non-transitory machine-readable storage medium of claim 20, wherein the set of false links are hidden from a rendered view of the response while being capable of being read and followed by bots that scan a source of the response.