Redirecting From a Cloud Service to a Third Party Website to Save Costs Without Sacrificing Security

• US 20130346472A1
• Filed: 06/21/2012
• Published: 12/26/2013
• Est. Priority Date: 06/21/2012
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Wheeldon, Richard
• Granted Patent: US 9,736,260 B2
• Time in Patent Office: Days
• US Class Current: 709/203
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/2876 Pairs of inter-processing entities at each side of the network, e.g. split proxies
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 67/563 Data redirection of data network streams

Abstract

Techniques are provided for receiving a request from a client proxy device to access a file on a server. The file is associated with a uniform resource locator (URL). In response to receiving the request, the server proxy device evaluates the request for presence of information that indicates that the client proxy device is able to obtain redirect instructions to access the file. When the evaluating indicates that the request includes the information, the server proxy device requests and receives identifier information associated with the URL from the server. The server proxy device retrieves from a database stored identifier information associated with the URL to compare it to the stored identifier information associated with the URL. When there is a match, the redirect instructions are sent to the client proxy device instructing the client proxy device to retrieve the file directly from the server.

Claims

1. A method comprising:

at a server proxy device, receiving from a client proxy device a request to access a file on a server and associated with a uniform resource locator (URL);

in response to the receiving, evaluating the request for presence of information that indicates that the client proxy device is able to obtain redirect instructions to access the file directly from the server;

when the evaluating indicates that the request includes the information, requesting identifier information associated with the URL from the server;

receiving the identifier information associated with the URL from the server;

retrieving from a database stored identifier information associated with the URL;

comparing the identifier information associated with the URL to the stored identifier information associated with the URL to determine whether there is a match; and

when the comparing determines that there is the match, sending the redirect instructions to the client proxy device to instruct the client proxy device to retrieve the file associated with the URL directly from the server.

2. The method of claim 1, wherein receiving the identifier information associated with the URL comprises receiving one or more of:

a filename, trailing path segments of the URL, second and top level domains of the URL, a timestamp of retrieval of the file, a hit count associated with the URL, hypertext transfer protocol (HTTP) response headers, a checksum value and a file type associated with the file.

3. The method of claim 1, wherein sending the redirect instructions comprises sending the redirect instructions such that the server proxy device does not have to download the file from the server.

4. The method of claim 1, further comprising updating the database to include the identifier information associated with the URL received from the server.

5. The method of claim 1, wherein sending the redirect instructions comprises sending the redirect instructions to the client proxy device to instruct the client proxy device to retrieve the file associated with the URL directly from the server without the server proxy having to determine whether or not the file is malicious or otherwise presents a security threat.

6. The method of claim 1, wherein sending the redirect instructions to the client proxy device comprises sending the redirect instructions comprising a secure hash.

7. The method of claim 1, wherein sending the redirect instructions to the client proxy device comprises sending the redirect instructions to a location other than a location associated with the file such that the same content of the file is retrievable at the other location.

8. A method comprising:

at a client proxy device, receiving a request from a client device to access a file on a server and associated with a uniform resource locator (URL);

appending information to the request to indicate that the client proxy device is able to obtain redirect instructions to access the file directly from the server;

forwarding the request with the information to a server proxy device;

receiving the redirect instructions from the server proxy device to retrieve the file associated with the URL directly from the server; and

retrieving the file associated with the URL directly from the server.

9. The method of claim 8, further comprising:

comparing reference identifier information with file identifier information extracted from the file after the retrieving to determine whether there is a match; and

forwarding the file to the client device when the comparing indicates that there is a match.

10. The method of claim 9, further comprising classifying the file associated with the URL as potentially malicious when the comparing does not indicate that there is the match.

11. The method of claim 9, further comprising requesting the file from the server proxy device again with new header information in order to retrieve requested content of the file and to mark the requested content as having been changed or prone to being changed.

12. One or more computer readable storage media encoded with software comprising computer executable instructions and when the software is executed operable to:

receive from a client proxy device a request to access a file on a server and associated with a uniform resource locator (URL);

evaluate the request for presence of information that indicates that the client proxy device is able to obtain redirect instructions to access the file directly from the server;

when the request includes the information, request identifier information associated with the URL from the server;

receive the identifier information associated with the URL from the server;

retrieve from a database stored identifier information associated with the URL;

compare the identifier information associated with the URL to the stored identifier information associated with the URL to determine whether there is a match; and

send the redirect instructions to the client proxy device to instruct the client proxy device to retrieve the file associated with the URL directly from the server when there is the match.

13. The computer readable storage media of claim 12, wherein the instructions operable to receive the identifier information associated with the URL comprise instructions operable to receive one or more of:

a filename, trailing path segments of the URL, second and top level domains of the URL, a timestamp of retrieval of the file, a hit count associated with the URL, hypertext transfer protocol (HTTP) response headers, a checksum value and a file type associated with the file.

14. The computer readable storage media of claim 12, wherein the instructions operable to send the redirect instructions comprise instructions operable to send redirect instructions without having to download the file from the server.

15. The computer readable storage media of claim 12 further comprising instructions operable to update the database to include the identifier information associated with the URL received from the server.

16. The computer readable storage media of claim 12, wherein the instructions operable to send the redirect instructions comprise instructions operable to send the redirect instructions to the client proxy device to instruct the client proxy device to retrieve the file associated with the URL directly from the server without having to determine whether or not the file is malicious or otherwise presents a security threat.

17. One or more computer readable storage media encoded with software comprising computer executable instructions and when the software is executed operable to:

receive a request from a client device to access a file on a server and associated with a uniform resource locator (URL);

append information to the request indicating an ability to obtain redirect instructions to access the file directly from the server;

forward the request with the information to a server proxy device;

receive the redirect instructions from the server proxy device to retrieve the file associated with the URL directly from the server; and

retrieve the file associated with the URL directly from the server.

18. The computer readable storage media of claim 17, wherein the instructions operable to receive the redirect instructions comprise instructions operable to receive the redirect instructions containing reference identifier information comprising one or more of:

a filename, trailing path segments of the URL, second and top level domains of the URL, a timestamp of retrieval of the file, a hit count associated with the URL, hypertext transfer protocol (HTTP) response headers, a checksum value and a file type associated with the file.

19. The computer readable storage media of claim 18, further comprising instructions operable to:

compare reference identifier information with file identifier information extracted from the file after the retrieving to determine whether there is a match; and

forward the file to the client device when the comparing indicates that there is a match.

20. The computer readable storage media of claim 19, further comprising instructions operable to classify the file associated with the URL as potentially malicious when the comparing does not indicate that there is the match.

21. An apparatus comprising:

a network interface unit;

a memory unit; and

a processor coupled to the network interface unit and the memory and configured to;

receive from a client proxy device a request to access a file on a server and associated with a uniform resource locator (URL);

evaluate the request for presence of information that indicates that the client proxy device is able to obtain redirect instructions to access the file directly from the server;

when the request includes the information, request identifier information associated with the URL from the server;

receive the identifier information associated with the URL from the server;

retrieve from a database stored identifier information associated with the URL;

compare the identifier information associated with the URL to the stored identifier information associated with the URL to determine whether there is a match; and

send the redirect instructions to the client proxy device to instruct the client proxy device to retrieve the file associated with the URL directly from the server when there is the match.

22. The apparatus of claim 21, wherein the processor is further configured to send the redirect instructions comprise instructions operable to send redirect instructions without having to download the file from the server.

23. An apparatus comprising:

a network interface unit;

a client device interface unit;

a memory unit; and

a processor coupled to the network interface unit the client device interface unit and the memory unit and configured to;

receive a request from a client device to access a file on a server and associated with a uniform resource locator (URL);

append information to the request indicating an ability to obtain redirect instructions to access the file directly from the server;

forward the request with the information to a server proxy device;

receive the redirect instructions from the server proxy device to retrieve the file associated with the URL directly from the server; and

retrieve the file associated with the URL directly from the server.

24. The apparatus of claim 23, wherein the processor is further configured to receive the redirect instructions comprise instructions operable to receive the redirect instructions containing reference identifier information comprising one or more of:

a filename, trailing path segments of the URL, second and top level domains of the URL, a timestamp of retrieval of the file, a hit count associated with the URL, hypertext transfer protocol (HTTP) response headers, a checksum value and a file type associated with the file.

25. The apparatus of claim 24, wherein the processor is further configured to:

compare reference identifier information with file identifier information extracted from the file after the retrieving to determine whether there is a match; and

forward the file to the client device when the comparing indicates that there is a match.