Proxy auto-configuration for directing client traffic to a cloud proxy
AssigneeAkamai Technologies, Inc.
InventorsEugene (“John”) Neystadt, John Devasia, Christopher Dewar, Eyal Heiman
Life of this patent
Estimating the term…
Abstract
Among other things, this document describes systems, methods and devices for providing a cloud proxy auto-config (PAC) function for clients connected to a private network, such as an enterprise network. The teachings hereof are of particular use with cloud hosted proxy services provided by server deployments outside of the private network (e.g., external to the enterprise or other organizational network). This document also describes systems, methods and devices for providing a proxy auto-config (PAC) function for clients connected to a third party network, such as when the client moves outside of the enterprise network.
Claims24
A method for proxy auto-configuration (PAC) of clients in a private network separated from another network outside the private network at least by a network address translation (NAT) device, the method comprising:
- providing a bouncer component inside of a private network, a PAC generation service deployed outside of the private network, and a proxy server deployed outside of the private network;
- with the bouncer component deployed inside of the private network:
- receiving, from a particular client in the private network, a request for a proxy auto configuration (PAC) file;
- and,
- in response to the request for the PAC file, redirecting the particular client to the PAC generation service deployed outside of the private network, the redirecting comprising providing the particular client with a redirect URL including an identifier for the particular client embedded in the redirect URL;
- with the PAC generation service:
- receiving, as a result of the redirecting, a request from the particular client for the PAC file, the request including the redirect URL with the identifier for the particular client embedded in the redirect URL, the identifier differing from a source IP address in a packet sent by the particular client, due to the source IP address being changed by a NAT device separating the private network from another network outside the private network;
- extracting the identifier from the redirect URL;
- generating a PAC file that includes (i) a proxy hostname that resolves to the proxy server and (ii) the identifier for the particular client that was extracted from the redirect URL;
- and,
- serving the generated PAC file to the particular client.
A system for providing proxy auto-configuration (PAC) of clients in a private network separated from another network outside the private network at least by a network address translation (NAT) device, the system comprising:
- a bouncer component deployed in the private network, the bouncer component comprising circuitry forming a processor and memory holding instructions for execution on the processor to instruct the bouncer component to:
- receive, from a particular client in the private network, a request for a proxy auto configuration (PAC) file;
- and,
- in response to the request for the PAC file, redirect the particular client to a PAC generation service deployed outside of the private network, the redirecting comprising providing the particular client with a redirect URL including an identifier for the particular client embedded in the redirect URL;
- the PAC generation service provided by a computer having circuitry forming a processor and memory holding instructions for execution on the processor to instruct the computer to:
- receive, as a result of the redirecting, a request from the particular client for the PAC file, the request including the redirect URL with the identifier for the particular client embedded in the redirect URL, the identifier differing from a source IP address in a packet sent by the particular client, due to the source IP address being changed by a NAT device separating the private network from another network outside the private network;
- extract the identifier from the redirect URL;
- generate a PAC file that includes (i) a proxy hostname that resolves to a proxy server and (ii) the identifier for the particular client that was extracted from the redirect URL;
- and,
- serve the generated PAC file to the particular client.
A method for proxy auto-configuration (PAC) of clients in a private network separated from another network outside the private network at least by a network address translation (NAT) device, the method comprising:
- at a PAC generation service deployed on the outside of the private network:
- receiving a configuration that applies to a set of one or more clients in the private network, the configuration indicating origin hostnames to which the set of one or more clients should connect via a proxy server rather than the set of one or more clients bypassing the proxy server;
- receiving, from a particular client in the set of one or more clients, a request for a proxy auto configuration (PAC) file;
- in response to the request for the PAC file, generating a PAC file that includes a script with client-executable instructions for the particular client to contact a PAC lookup service deployed outside of the private network for a directive;
- and,
- serving the generated PAC file to the particular client;
- at the PAC lookup service:
- as a result of the particular client's execution of the instructions in the generated PAC file, receiving a request from the particular client for a directive as to whether to connect to a particular origin hostname via the proxy server;
- based at least in part on the configuration, generating a response comprising at least one of:
- a directive to use the proxy server, and a directive to bypass the proxy server;
- and,
- serving the response to the particular client;
- wherein the PAC generation service and the PAC lookup service are deployed in a network outside of the private network, such that communications with the client traverse a network address translation (NAT) device.
A system for providing proxy auto-configuration (PAC) of clients in a private network separated from another network outside the private network at least by a network address translation (NAT) device, the system comprising:
- a PAC generation service deployed on the outside of the private network, the PAC generation service provided by a computer comprising circuitry forming a processor and memory holding instructions for execution on the processor to:
- receive a configuration that applies to a set of one or more clients in the private network, the configuration indicating origin hostnames to which the set of one or more clients should connect via a proxy server rather than the set of one or more clients bypassing the proxy server;
- receive, from a particular client in the set of one or more clients, a request for a proxy auto configuration (PAC) file;
- in response to the request for the PAC file, generate a PAC file that includes a script with client-executable instructions for the particular client to contact a PAC lookup service deployed outside of the private network for a directive;
- and,
- serve the generated PAC file to the particular client;
- the PAC lookup service provided by a computer comprising circuitry forming a processor and memory holding instructions for execution on the processor to:
- as a result of the particular client's execution of the instructions in the generated PAC file, receive a request from the particular client for a directive as to whether to connect to a particular origin hostname via the proxy server;
- based at least in part on the configuration, generate a response comprising at least one of:
- a directive to use the proxy server, and a directive to bypass the proxy server;
- and,
- serve the response to the particular client;
- wherein the PAC generation service and the PAC lookup service are deployed in a network outside of the private network, such that communications with the client traverse a network address translation (NAT) device.
Dependencies are inferred from the claim text.