Methods and Systems for Secured End-To-End Data Communication

• US 20180062995A1
• Filed: 08/24/2016
• Published: 03/01/2018
• Est. Priority Date: 08/24/2016
• Status: Active Grant

• Current Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Original Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Inventors: Naar, Dekel Shmuel
• Granted Patent: US 10,635,716 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 16/9017 using directory or table look-up use of a directory or look-up table in file systems G06F16/13
• CPC Class Codes: G06F 16/955 using information identifiers, e.g. uniform resource locators [URL]
• CPC Class Codes: H04L 45/745 Address table lookup; Address filtering
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/561 Adding application-functional data or data for application control, e.g. adding metadata

Abstract

Methods and systems for forwarding data packets by a server system (e.g., a proxy server) are disclosed. The proxy server is coupled to a user device and a plurality of web servers. The proxy server receives a first data packet directed to a first web server of the plurality of web servers from the user device. The first data packet includes a first synthesized address associated with the first web server. The proxy server identifies a first actual address of the first web server. The proxy server replaces the first synthesized address in the first data packet with the first actual address of the first web server. The proxy server further forwards the first data packet to the first web server using the first actual address of the first web server.

Claims

1. A method, comprising:

at a proxy server having one or more processors and memory storing instructions for execution by the one or more processors, wherein the proxy server is coupled to a user device and a plurality of web servers;

receiving, from the user device, a first data packet directed to a first web server of the plurality of web servers, the first data packet including a first synthesized address associated with the first web server;

identifying a first actual address of the first web server;

replacing the first synthesized address in the first data packet with the first actual address of the first web server; and

forwarding the first data packet to the first web server using the first actual address of the first web server.

2. The method of claim 1, wherein the first synthesized address comprises a first synthesized identifier associated with the first web server.

3. The method of claim 2, wherein the first synthesized identifier is a synthesized port number associated with the first web server, and wherein the first actual address comprises an actual port number used for communicating with the first web server.

4. The method of claim 1, wherein the first data packet is associated with a request for a secure connection between the user device and the first web server.

5. The method of claim 4, wherein the first data packet is forwarded from the user device to the first web server by the proxy server without the proxy server checking a payload of the first data packet.

6. The method of claim 1, wherein the first data packet from the user device is associated with a request for zero-rated content items from the first web server, and wherein the first data packet is encrypted.

7. The method of claim 1, wherein the first data packet from the user device is associated with submitting data to the first web server at zero-rating, and wherein the first data packet is encrypted.

8. The method of claim 1, further comprising:

storing, at a database of the proxy server, a lookup table including;

one or more synthesized addresses in association with one or more web servers respectively, and

one or more actual addresses in association with the one or more web servers respectively,

wherein a respective actual address is used for communicating with a corresponding web server, and wherein a respective synthesized address is not an actual network address of the corresponding web server,

wherein identifying the first actual address of the first web server comprises;

checking the lookup table to identify the first actual address of the first web server from the one or more actual addresses in association with the one or more web servers.

9. The method of claim 1, further comprising:

in response to forwarding the first data packet to the first web server, receiving a second data packet from the first web server, wherein the second data packet includes a security certificate associated with the first web server; and

forwarding the second data packet to the user device.

10. The method of claim 9, wherein the second data packet is forwarded from the first web server to the user device by the proxy server without the proxy server checking the security certificate of the second data packet.

11. The method of claim 9, wherein the second data packet comprises the first actual address of the first web server, and wherein the method further comprises:

replacing the first actual address with the first synthesized address associated with the first web server.

12. A method, comprising:

at a computing device having one or more processors and memory storing instructions for execution by the one or more processors, wherein the computing device is coupled to a proxy server for zero-rating;

providing a list of service identifiers in association with one or more web servers respectively, wherein the one or more web servers provide zero-rated content items to the computing device, and each service identifier from the list of service identifiers is associated with a synthesized address of the corresponding web server;

receiving a user selection of a first service identifier associated with a first web server from the list of service identifiers; and

sending, to the proxy server, a first data packet directed to the first web server, the first data packet including a first synthesized address of the first web server.

13. The method of claim 12, wherein the first synthesized address comprises a first synthesized identifier associated with the first web server.

14. The method of claim 13, wherein the first synthesized identifier is a synthesized port number associated with the first web server.

15. The method of claim 12, further comprising:

in response to sending the first data packet, receiving, from the proxy server, a second data packet including a first security certificate associated with the first web server.

16. The method of claim 15, further comprising:

storing a security list of a plurality of trusted certificate issuers; and

after receiving the second data packet, validating the first security certificate associated with the first web server using the security list.

17. The method of claim 16, further comprising:

in accordance with a determination that the first security certificate associated with the first web server is valid, sending a third data packet including a session key corresponding to a secure connection session between the user device and the first web server, wherein the session key is recognizable by the first web server.

18. The method of claim 15, wherein the first data packet and the second data packet are exchanged between the user device and the first web server at zero-rating.

19. The method of claim 12, wherein the first data packet is encrypted for a secured connection between the user device and the first web server.

20. A non-transitory computer-readable storage medium storing one or more programs for execution by one or more processors of a proxy server coupled to a user device and a plurality of web servers, the one or more programs including instructions for:

receiving, from the user device, a first data packet directed to a first web server of the plurality of web servers, the first data packet including a first synthesized address associated with the first web server;

identifying a first actual address of the first web server;

replacing the first synthesized address in the first data packet with the first actual address of the first web server; and

forwarding the first data packet to the first web server using the first actual address of the first web server.