SMART ROUTER

• US 20140259147A1
• Filed: 09/28/2012
• Published: 09/11/2014
• Est. Priority Date: 09/29/2011
• Status: Active Grant

• Current Assignee: L'Heureux, Israel, Mark Alleman
• Original Assignee: L'Heureux, Israel, Mark Alleman
• Inventors: L'Heureux, Israel, Alleman, Mark
• Granted Patent: US 9,197,600 B2
• Time in Patent Office: Days
• US Class Current: 726/14
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/563 Data redirection of data network streams

Abstract

An example router device disclosed herein functions as a transport level proxy and application level proxy, is able to host both authenticated user and device sessions with stored session state and access control to resources for enhanced performance and ease of use. The device is able to function as a protocol proxy for improved performance and security. The device may be configured to implement a captive portal login mechanism, and may programmatically force unsecure LAN-side client requests to secure WAN-side connections. The device may execute an API for remote applications to utilize. The router device may pre-fetch content for client devices, and may communicate with other servers and peer routers to ascertain congestion on the WAN, and perform intelligent routing of WAN traffic based on the detected congestion. The device may also employ techniques to enhance privacy, virtualized address spaces, cookie filters, and traffic modification.

Claims

1. A computer networking method, comprising:

at a router device configured to connect via a LAN to a client computing device, and function as a gateway for communications from the client computing device to one or more remote servers over a WAN, programmatically upgrading the security level of requests sent via unsecure protocols from LAN-side client computing devices to the router device, by sending those requests using secure protocols to destination servers over the WAN.

2. The method of claim 1, wherein programmatically upgrading the security level of the requests, includes:

receiving from one of the client computing devices a request for a web resource served by a destination server, sent via an unsecure protocol;

determining if destination server supports a secure protocol;

if it is determined that the destination server supports a secure protocol, then;

sending the request to the server via the supported secure protocol;

receiving a response in the server supported secure protocol; and

forwarding the payload of the response in an unsecure response to the unsecure request received from the client device.

3. The method of claim 2, further comprising:

if it is determined that the destination server does not support a secure protocol, then sending the request to the destination server via the unsecure protocol.

4. A computer networking method, comprising:

at a router device configured to connect via a LAN to a client computing device, and function as a gateway for communications from the client computing device to one or more servers over a WAN,

for traffic passing through the router, virtualizing address space by associating IP addresses of client computing devices on the LAN with virtual LAN-side network addresses and/or servers on the WAN with virtual WAN-side network addresses, such that each request made to servers on the WAN appears to the servers to originate from one of the LAN-side virtual network addresses, and/or such that each response received from the servers appears to the router device to originate from one of the WAN-side virtual network addresses.

5. The computer networking method of claim 4, wherein the virtualized address space is a simulated virtualized address space, achieved by the router device randomizing the selection of outbound gateways to the WAN used to access network resources of the WAN.

6. The computing networking method of claim 5, wherein the outbound gateways include local peer smart routers, remote peer smart routers, or super peer devices.

7. The computer networking method of claim 4, further comprising:

terminating connections at the router device, to enable deep packet inspection of traffic between the client computing devices and servers, and

8. The computer networking method of claim 7, further comprising:

filtering out cookies set by remote services of the WAN before arriving at the clients of the LAN.

9. The computer networking method of claim 7, further comprising

changing user-agent information in a request sent from the client computing device at the router device prior to forwarding the request to a server over the WAN.

10. The computer networking method of claim 9, wherein the user-agent information is selected from the group comprising including application name and version browser type and version, operation system information, and extensions installed with the browser and operating system.

11. The computer networking method of claim 9, wherein changing the user-agent information is accomplished at least in part by normalizing, altering, or randomizing browser (or application program) identity to inhibit detection by servers of the WAN.

12. The computer networking method of claim 4, further comprising:

at the router device, blocking predetermined applications operating on a client device from communicating with services of the WAN that are associated with those applications.

13. The computer networking method of claim 4, further comprising:

at the router device, programmatically monitoring communications between client computing devices of the LAN and services of the WAN for botnets and viruses.

14. The computer networking method of claim 13, wherein programmatically monitoring communications is accomplished by the router device inserting user interface tracking information into a communication sent to the client computing device to enable the router device to identify user interface state at the client device, the user interface state including user input and/or selector position at the client computing device, and determining whether viruses operating at the client device are initiating communications with the WAN if communications are received from the client computing device at the router device that are unrelated to the identified user interface state.

15. The computer networking method of claim 13, wherein programmatically monitoring communications is accomplished by determining whether a communication received at the smart router contains user agent information identifying the communication as originating from an application program or browser that is not currently operating at the client computing device.

16. The computer networking method of claim 4, further comprising:

at a monitoring server on the WAN, monitoring DNS entries for each of a plurality of hostnames;

at the router device, receiving a DNS query from a client computing device for a hostname;

sending the DNS query to a DNS server;

receiving a response from the DNS server, including an IP address for the hostname;

querying the monitoring server on the WAN for IP addresses associated with the hostname;

determining whether the IP address received from the DNS server matches an IP address for the hostname received from the monitoring server; and

if no match is determined, blocking access to the IP address received from the DNS server, or sending a warning message to the client computing device that connecting may be unsecure.

17. The computer networking method of claim 4, further comprising:

receiving a notification at the monitoring service of a pending change to IP addresses associated with a hostname, and if the IP address received from the DNS server matches an IP address in the pending changes, then allowing access to the IP address received from the DNS server.

18. A computer networking method, comprising:

monitoring client sessions at a router device that serves as a communications gateway for one or more LAN-side client devices to one or more servers over a WAN, the monitoring being performed to obtain network performance information for communication paths of the WAN;

sending a report including the network performance information from the smart router to a network service via the WAN; and

receiving a report from the network service at the smart router via the WAN, report including network performance information measured by one or more other router devices.

19. The computer networking method of claim 18, further comprising:

receiving at the smart router, a request for a network resource from a client device via the LAN;

identifying one or more alternative paths for routing the client request to a target server of the WAN based on the report received from the network service; and

forwarding the client request over the one or more alternative paths to the target server.

20. The computer networking method of claim 19, further comprising:

sending a network communications status message from the smart router to the client device to be displayed on a display of the client device.