Internet-based proxy service to modify internet responses

• US 9,634,993 B2
• Filed: 11/04/2010
• Issued: 04/25/2017
• Est. Priority Date: 04/01/2010
• Status: Active Grant

• Current Assignee: CloudFlare Incorporated
• Original Assignee: CloudFlare Incorporated
• Inventors: Holloway, Lee Hahn, Prince, Matthew Browning, Tourne, Matthieu Philippe Franois
• Primary Examiner(s): Hillery, Nathan
• Application Number:
  US12/939,926
• Publication Number:
  US 20120117458A1
• Time in Patent Office: 2,364 Days
• Field of Search: 715234
• CPC Class Codes: G06F 15/16 Combinations of two or more digital computers each having at least an arithmetic unit, a program unit and a register, e.g. for a simultaneous processing of several programs coordinating program control therefor G06F9/52; in regulating and control system G05B
• CPC Class Codes: G06F 16/95 Retrieval from the web
• CPC Class Codes: G06F 16/958 Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 40/14 Tree-structured documents parsing G06F40/205; validation G06F40/226
• CPC Class Codes: G06F 40/143 Markup, e.g. Standard Generalized Markup Language [SGML] or Document Type Definition [DTD]
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: G06Q 30/0241 Advertisements
• CPC Class Codes: G06Q 30/0251 Targeted advertisements
• CPC Class Codes: G06Q 30/0277 Online advertisement
• CPC Class Codes: H04L 47/745 Reaction in network
• CPC Class Codes: H04L 51/42 Mailbox-related aspects, e.g. synchronisation of mailboxes
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/59 using proxies for addressing
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/0254 Stateful filtering
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/083 : using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0861 : using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/102 : Entity profiles
• CPC Class Codes: H04L 63/126 : the source of the received data
• CPC Class Codes: H04L 63/1416 : Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1433 : Vulnerability analysis
• CPC Class Codes: H04L 63/1441 : Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1458 : Denial of Service
• CPC Class Codes: H04L 63/1466 : Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 67/02 : based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/146 : Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding
• CPC Class Codes: H04L 67/56 : Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 67/561 : Adding application-functional data or data for application control, e.g. adding metadata
• CPC Class Codes: H04L 67/568 : Storing data temporarily at an intermediate stage, e.g. caching
• CPC Class Codes: H04L 69/40 : for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection management of faults, events, alarms or notifications in data switching networks H04L41/06

Abstract

A proxy server receives from a client device a request for a network resource that is hosted at an origin server for a domain. The request is received at the proxy server as a result of a DNS request for the domain resolving to the proxy server. The origin server is one of multiple origin servers that belong to different domains that resolve to the proxy server and are owned by different entities. The proxy server retrieves the requested network resource. The proxy server determines that the requested resource is an HTML page. The proxy server scans the HTML page to locate one or more modification tokens that each indicates content that is subject to being modified. For at least one of the located modification tokens, the proxy server automatically modifies at least a portion of the content of the HTML page that corresponds to that modification token. The proxy server then transmits the modified HTML page to the client device.

Claims

1. A method in a proxy server to modify Internet responses, comprising:

receiving, at the proxy server from a client device, a request for a network resource that is hosted at an origin server for a domain, wherein the request is received at the proxy server as a result of a DNS (Domain Name System) request for the domain returning an IP address of the proxy server instead of an IP address of the origin server, wherein the origin server is one of a plurality of origin servers that belong to different domains in which DNS requests for each of those different domains return the same IP address of the proxy server instead of IP addresses of the respective origin servers, and wherein the plurality of origin servers are owned by different entities;

retrieving, by the proxy server, the requested network resource;

determining, by the proxy server, that the requested network resource is an HTML (HyperText Markup Language) page;

scanning, by the proxy server, the HTML page to locate one or more modification tokens, wherein each modification token indicates content that is subject to being modified;

for at least one located modification token, automatically modifying, by the proxy server, at least a portion of the content of the HTML page that corresponds to that modification token; and

transmitting, by the proxy server, the modified HTML page to the client device.

2. The method of claim 1, wherein retrieving, by the proxy server, the requested network resource includes performing the following:

determining whether the requested network resource is available in cache;

responsive to a determination that the requested network resource is not available in cache, performing the following;

transmitting the request to the origin server, and

receiving the network resource from the origin server; and

responsive to a determination that the requested network resource is available in cache, accessing the cache to retrieve the requested network resource.

3. The method of claim 1, wherein the HTML page includes at least one obfuscation modification token that identifies an element to be obfuscated, wherein the at least one located modification token is the at least one obfuscation modification token, and wherein automatically modifying, by the proxy server, at least the portion of the HTML content corresponding to that obfuscation modification token includes performing the following:

automatically replacing at least the element to be obfuscated of the HTML content that corresponds to the obfuscation modification token with an obfuscation script, which when executed by a client network application of the client device, generates the element such that it will be displayed on the rendered HTML page while not being directly readable by bots that scan a source of the HTML page.

4. The method of claim 3, wherein the element to be obfuscated is one of:

a phone number, an email address, an instant messenger identifier, a street address, a link to another website, a birthdate, a social security number, an IP address, a credit card number, and an account username.

5. The method of claim 3, wherein the element to obfuscated is an email address, and wherein the obfuscation script generates the email address to be displayed in the rendered HTML page and is not readable in the page source of the HTML page, and the obfuscation script further encodes the email address with a mailto attribute such that when selected a new email message will be created that is addressed to that email address.

6. The method of claim 1, wherein the HTML page includes at least one modification token that is a server side defined modification (SSDM) token that is defined by an administrator of the domain and indicates that content is subject to being one of excluded and obfuscated;

and wherein the at least one located modification token is the SSDM token.

7. The method of claim 6, wherein the SSDM token is defined with a set of one or more modification rules that specify the conditions on which the content is to be excluded or obfuscated based on one or more characteristics associated with the request.

8. The method of claim 6, wherein the SSDM token indicates that an element is subject to being obfuscated, and wherein automatically modifying, by the proxy server, at least a portion of the HTML content corresponding to the SSDM token includes performing the following:

automatically replacing at least the element to be obfuscated of the HTML content that corresponds to the SSDM token with an obfuscation script, which when executed by a client network application of the client device, generates the element such that it will be displayed on the rendered HTML page while not being directly readable by bots that scan a source of the HTML page.

9. The method of claim 6, wherein the SSDM token indicates that an element is subject to being excluded from the HTML page, and wherein automatically modifying, by the proxy server, at least a portion of the HTML content corresponding to the SSDM token includes automatically removing at least a portion of the HTML content represented by the SSDM token.

10. The method of claim 1, wherein the at least one located modification token indicates content that is potentially a threat to a visitor, and wherein automatically modifying, by the proxy server, at least the portion of the HTML content corresponding to that modification token includes removing that portion of the HTML content.

11. A proxy server to modify Internet responses, comprising:

a memory to store instructions;

a processor coupled with the memory to process the stored instructions to

receive, from a client device, a request for a network resource that is hosted at an origin server for a domain, wherein the request is received at the proxy server as a result of a DNS (Domain Name System) request for the domain returning an IP address of the proxy server instead of an IP address of the origin server, wherein the origin server is one of a plurality of origin servers that belong to different domains in which DNS requests for each of those different domains return the same IP address of the proxy server instead of IP addresses of the respective origin servers, and wherein the plurality of origin servers are owned by different entities;

retrieve the requested network resource;

determine that the requested network resource is an HTML (HyperText Markup Language) page;

scan the HTML page to locate one or more modification tokens, wherein each modification token indicates content that is subject to being modified;

for at least one located modification token, automatically modify at least a portion of the content of the HTML page that corresponds to that modification token; and

transmit the modified HTML page to the client device.

12. The proxy server of claim 11, wherein retrieval of the requested network resource includes the processor to process the stored instructions to perform the following:

determine whether the requested network resource is available in cache;

responsive to a determination that the requested network resource is not available in cache, perform the following;

transmit the request to the origin server, and

receive the network resource from the origin server; and

responsive to a determination that the requested network resource is available in cache, access the cache to retrieve the requested network resource.

13. The proxy server of claim 11, wherein the HTML page includes at least one obfuscation modification token that identifies an element to be obfuscated, and wherein the automatic modification of at least a portion of the HTML content corresponding to that obfuscation modification token includes the processor to process the stored instructions to perform the following:

automatically replace at least the element to be obfuscated of the HTML content that corresponds to the obfuscation modification token with an obfuscation script, which when executed by a client network application of the client device, generates the element such that it will be displayed on the rendered HTML page while not being directly readable by bots that scan a source of the HTML page.

14. The proxy server of claim 13, wherein the element to be obfuscated is one of:

a phone number, an email address, an instant messenger identifier, a street address, a link to another website, a birthdate, a social security number, an IP address, a credit card number, and an account username.

15. The proxy server of claim 13, wherein the element to obfuscated is an email address, and wherein the obfuscation script generates the email address to be displayed in the rendered HTML page and is not readable in the page source of the HTML page, and the obfuscation script further encodes the email address with a mailto attribute such that when selected a new email message will be created that is addressed to that email address.

16. The proxy server of claim 11, wherein the HTML page includes at least one modification token that is a server side defined modification (SSDM) token that is defined by an administrator of the domain and indicates that content is subject to being one of excluded and obfuscated.

17. The proxy server of claim 16, wherein the SSDM token is defined with a set of one or more modification rules that specify the conditions on which the content is to be excluded or obfuscated based on one or more characteristics associated with the request.

18. The proxy server of claim 16, wherein the SSDM token indicates that an element is subject to being obfuscated, and wherein automatic modification of at least a portion of the HTML content corresponding to the SSDM token includes the processor to process the stored instructions to perform the following:

automatically replace at least the element to be obfuscated of the HTML content that corresponds to the SSDM token with an obfuscation script, which when executed by a client network application of the client device, generates the element such that it will be displayed on the rendered HTML page while not being directly readable by bots that scan a source of the HTML page.

19. The proxy server of claim 16, wherein the SSDM token indicates that an element is subject to being excluded from the HTML page, and wherein automatic modification of at least a portion of the HTML content corresponding to the SSDM token includes the processor to process the stored instructions to automatically remove at least a portion of the HTML content represented by the SSDM token.

20. The proxy server of claim 11, wherein the at least one located modification token indicates content that is potentially a threat to a visitor, and wherein the automatic modification of at least the portion of the HTML content corresponding to that modification token includes the processor to process the stored instructions to remove that portion of the HTML content.

21. A non-transitory machine-readable storage medium that provides instructions that, when executed by a processor of a proxy server, cause said processor to perform operations comprising:

receiving, from a client device, a request for a network resource that is hosted at an origin server for a domain, wherein the request is received at the proxy server as a result of a DNS (Domain Name System) request for the domain returning an IP address of the proxy server instead of an IP address of the origin server, wherein the origin server is one of a plurality of origin servers that belong to different domains in which DNS requests for each of those different domains return the same IP address of the proxy server instead of IP addresses of the respective origin servers, and wherein the plurality of origin servers are owned by different entities;

retrieving the requested network resource;

determining that the requested network resource is an HTML (HyperText Markup Language) page;

scanning the HTML page to locate one or more modification tokens, wherein each modification token indicates content that is subject to being modified;

for at least one located modification token, automatically modifying at least a portion of the content of the HTML page that corresponds to that modification token; and

transmitting the modified HTML page to the client device.

22. The non-transitory machine-readable storage medium of claim 21, wherein retrieving the requested network resource includes performing the following:

determining whether the requested network resource is available in cache;

responsive to a determination that the requested network resource is not available in cache, performing the following;

transmitting the request to the origin server, and receiving the network resource from the origin server; and

responsive to a determination that the requested network resource is available in cache, accessing the cache to retrieve the requested network resource.

23. The non-transitory machine-readable storage medium of claim 21, wherein the HTML page includes at least one obfuscation modification token that identifies an element to be obfuscated, and wherein automatically modifying at least a portion of the HTML content corresponding to that obfuscation modification token includes performing the following:

automatically replacing at least the element to be obfuscated of the HTML content that corresponds to the obfuscation modification token with an obfuscation script, which when executed by a client network application of the client device, generates the element such that it will be displayed on the rendered HTML page while not being directly readable by bots that scan a source of the HTML page.

24. The non-transitory machine-readable storage medium of claim 23, wherein the element to be obfuscated is one of:

a phone number, an email address, an instant messenger identifier, a street address, a link to another website, a birthdate, a social security number, an IP address, a credit card number, and an account username.

25. The non-transitory machine-readable storage medium of claim 23, wherein the element to obfuscated is an email address, and wherein the obfuscation script generates the email address to be displayed in the rendered HTML page and is not readable in the page source of the HTML page, and the obfuscation script further encodes the email address with a mailto attribute such that when selected a new email message will be created that is addressed to that email address.

26. The non-transitory machine-readable storage medium of claim 21, wherein the HTML page includes at least one modification token that is a server side defined modification (SSDM) token that is defined by an administrator of the domain and indicates that content is subject to being one of excluded and obfuscated.

27. The non-transitory machine-readable storage medium of claim 26, wherein the SSDM token is defined with a set of one or more modification rules that specify the conditions on which the content is to be excluded or obfuscated based on one or more characteristics associated with the request.

28. The non-transitory machine-readable storage medium of claim 26, wherein the SSDM token indicates that an element is subject to being obfuscated, and wherein automatically modifying at least a portion of the HTML content corresponding to the SSDM token includes performing the following:

automatically replacing at least the element to be obfuscated of the HTML content that corresponds to the SSDM token with an obfuscation script, which when executed by a client network application of the client device, generates the element such that it will be displayed on the rendered HTML page while not being directly readable by bots that scan a source of the HTML page.

29. The non-transitory machine-readable storage medium of claim 26, wherein the SSDM token indicates that an element is subject to being excluded from the HTML page, and wherein modifying at least a portion of the HTML content corresponding to the SSDM token includes automatically removing at least a portion of the HTML content represented by the SSDM token.

30. The non-transitory machine-readable storage medium of claim 21, wherein the at least one located modification token indicates content that is potentially a threat to a visitor, and wherein automatically modifying, by the proxy server, at least the portion of the HTML content corresponding to that modification token includes removing that portion of the HTML content.