Systems and Methods of Providing Security and Reliability to Proxy Caches

• US 20080229017A1
• Filed: 03/12/2007
• Published: 09/18/2008
• Est. Priority Date: 03/12/2007
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Plamondon, Robert
• Granted Patent: US 8,103,783 B2
• Time in Patent Office: Days
• US Class Current: 711/118
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 67/5681 Pre-fetching or pre-delivering data based on network characteristics
• CPC Class Codes: H04L 69/04 Protocols for data compression, e.g. ROHC

Abstract

The present solution provides a variety of techniques for accelerating and optimizing network traffic, such as HTTP based network traffic. The solution described herein provides techniques in the areas of proxy caching, protocol acceleration, domain name resolution acceleration as well as compression improvements. In some cases, the present solution provides various prefetching and/or prefreshening techniques to improve intermediary or proxy caching, such as HTTP proxy caching. In other cases, the present solution provides techniques for accelerating a protocol by improving the efficiency of obtaining and servicing data from an originating server to server to clients. In another cases, the present solution accelerates domain name resolution more quickly. As every HTTP access starts with a URL that includes a hostname that must be resolved via domain name resolution into an IP address, the present solution helps accelerate HTTP access. In some cases, the present solution improves compression techniques by prefetching non-cacheable and cacheable content to use for compressing network traffic, such as HTTP. The acceleration and optimization techniques described herein may be deployed on the client as a client agent or as part of a browser, as well as on any type and form of intermediary device, such as an appliance, proxying device or any type of interception caching and/or proxying device.

Claims

1. A method of providing security or reliability to serving cached objects for a session communicated via a transport layer connection between a client and a server, the method comprising the steps of:

(a) receiving, by a device, a request for an object via a session communicated over a transport layer connection between a client to a server;

(b) determining, by the device, the object is stored in a cache;

(c) forwarding, by the device, the request to the server;

(d) deferring, by the device, serving the object from the cache until receiving a response from the server; and

(e) determining, by the device, to serve the object from the cache based on the response received from the server.

2. The method of claim 1, wherein step (e) comprises determining, by the device, from the received response that the server would provide the object to the client.

3. The method of claim 1, wherein step (e) comprises determining, by the device, from the received response that the server authorizes one of the client or user of the client to receive the object.

4. The method of claim 1, wherein step (e) comprises determining, by the device, from the received response that the server is one of available or able to serve the object to the client.

5. The method of claim 1, wherein step (e) comprises determining, by the device, the server is transmitting the object to the client.

6. The method of claim 1, wherein step (d) comprises deferring, by the device, serving the object from the cache until determining the server has transferred the object to the client at least once.

7. The method of claim 1, wherein step (e) comprises determining, by the device, from the received response that the server would not provide the object to the client, and in response to the determination, not serving the object from the cache.

8. The method of claim 7, comprising determining, by the device, from the received response that the server does not authorize one of the client or user of the client to receive the object, and in response to the determination, not serving the object from the cache.

9. The method of claim 7, comprising determining, by the device, from the received response that the server requires authentication of one of a user of the client, and in response to the determination, not serving the object from the cache.

10. The method of claim 1, wherein step (e) comprises determining, by the device, from the received response that the server is one of not available or not able to provide the object to the client, and in response to the determination, not serving the object from the cache.

11. The method of claim 1, wherein the device comprises a proxy transparent to the client and the server.

12. The method of claim 1, wherein the device comprises one of a client or an appliance.

39. The appliance of claim 38, wherein the appliance receives a SYN-ACK packet as the response from the server to the client'"'"'s transport control protocol connection request.

13. An appliance for providing security or reliability to serving cached objects for a session communicated via a transport layer connection between a client and a server, the appliance comprising:

means for receiving a request for an object via a session communicated over a transport layer connection between a client to a server;

means for determining the object is stored in a cache;

means for forwarding the request to the server;

means for deferring serving the object from the cache until receiving a response from the server; and

means for determining to serve the object from the cache based on the response received from the server.

14. The appliance of claim 13, wherein the appliance determines from the received response that the server would provide the object to the client.

15. The appliance of claim 13, wherein the appliance determines from the received response that the server authorizes one of the client or user of the client to receive the object.

16. The appliance of claim 13, wherein the appliance determines from the received response that the server is one of available or able to serve the object to the client.

17. The appliance of claim 13, wherein the appliance determines the server is transmitting the object to the client.

18. The appliance of claim 13, wherein the appliance defers serving the object from the cache until determining the server has transferred the object to the client at least once.

19. The appliance of claim 13, wherein the appliance determines from the received response that the server would not provide the object to the client, and in response to the determination, not serving the object from the cache.

20. The appliance of claim 19, wherein the appliance determines from the received response that the server does not authorize one of the client or user of the client to receive the object, and in response to the determination, not serving the object from the cache.

21. The appliance of claim 20, wherein the appliance determines from the received response that the server requires authentication of one of a user of the client, and in response to the determination, not serving the object from the cache.

22. The appliance of claim 13, where the appliance determines from the received response that the server is one of not available or not able to provide the object to the client, and in response to the determination, not serving the object from the cache.

23. The appliance of claim 13, wherein the appliance comprises a proxy transparent to the client and the server.

25. The method of claim 23, wherein step (a) comprises receiving, by the device, a SYN packet of the transport control protocol connection request of the client, and forwarding the intercepted SYN packet to the server.

27. The method of claim 23, wherein the device is constructed to perform one or more acceleration techniques on the transport layer connection.

29. The method of claim 23, comprising identifying, by the device, the server does not accept the transport layer connection request, and determining, by the device, to not accept the transport layer connection as a connection to proxy.

30. The method of claim 23, comprising identifying, by the device, the server is one of unavailable or unable to establish the transport layer connection, and determining, by the appliance, to not to proxy the transport layer connection.

31. The method of claim 29, comprising deferring, by the device, acceptance of the transport layer connection until receiving an indication that the server is one of available or able to establish the transport layer connection.

32. The method of claim 23, comprising identifying, by the device, the server does not authorize the client to establish a transport layer connection with the server, and determining, by the appliance, to not accept the transport layer connection as a connection to proxy

33. The method of claim 23 comprising identifying, by the device, the server requires authentication to establish a transport layer connection with the server, and deferring, by the appliance, accepting the transport layer connection as a connection to proxy until receiving an indication from the server a user of the client is authenticated.

34. The method of claim 23, comprising deferring, by the device, proxying the transport layer connection between the client and server until the server successfully transfers an object to the client.

35. The method of claim 23, wherein the device comprises a proxy transparent to the client and the server.

36. The method of claim 23, wherein the device comprises one of the client or an appliance.

24. A method of providing security or reliability to proxying a connection between a client and a server, the method comprising the steps of:

(a) forwarding, by a device, to a server a transport layer connection request received from a client;

(b) deferring, by the device, acceptance of the transport layer connection as a connection to proxy until receiving a response from the server to the transport layer connection request of the client;

(c) identifying, by the device, from the response of the server that the server accepts the transport layer connection; and

(d) determining, by the device, to proxy the transport layer connection in response to identifying the server'"'"'s acceptance of the transport layer connection.

26. The method of claim 24, wherein step (c) comprises receiving, by the device, a SYN-ACK packet as the response from the server to the client'"'"'s transport control protocol connection request.

28. The method of claim 26, comprising performing, by the device, an acceleration technique on the transport layer connection in response to the determination of step (d).

37. An appliance providing security or reliability to proxying a connection between a client and a server, the appliance comprising:

means for forwarding to a server a transport layer connection request received from a client;

means for deferring acceptance of the transport layer connection as a connection to proxy until receiving a response from the server to the transport layer connection request of the client;

means for identifying from the response of the server that the server accepts the transport layer connection; and

means for determining to proxy the transport layer connection in response to identifying the server'"'"'s acceptance of the transport layer connection.

38. The appliance of claim 37, wherein the appliance receives a SYN packet of the transport control protocol connection request of the client, and forwarding the intercepted SYN packet to the server.

40. The appliance of claim 37, wherein the appliance is constructed to perform one or more acceleration techniques on the transport layer connection.

41. The appliance of claim 40, wherein the appliance performs an acceleration technique on the transport layer connection in response to the determination.

42. The appliance of claim 37, wherein the appliance identifies the server does not accept the transport layer connection request, and determining, by the appliance, to not accept the transport layer connection as a connection to proxy.

43. The appliance of claim 37, wherein the appliance identifies the server is one of unavailable or unable to establish the transport layer connection, and determining, by the appliance, to not to proxy the transport layer connection.

44. The appliance of claim 43, wherein the appliance defers acceptances of the transport layer connection with the client as a connection to proxy until receiving an indication that the server is one of available or able to establish the transport layer connection.

45. The appliance of claim 37, wherein the appliance identifies the server does not authorize the client to establish a transport layer connection with the server, and determining, by the appliance, to not accept the transport layer connection as a connection to proxy

46. The appliance of claim 37, wherein the appliance identifies the server requires authentication to establish a transport layer connection with the server, and deferring, by the appliance, accepting the transport layer connection as a connection to proxy until receiving an indication from the server a user of the client is authenticated.

47. The appliance of claim 37, wherein the appliance defers proxying the transport layer connection between the client and server until the server successfully transfers an object to the client.