公开(公告)号：US10069787B2

公开(公告)日：2018-09-04

申请号：US14676631

申请日：2015-04-01

Applicant: CLOUDFLARE, INC.

Inventor： Lee Hahn Holloway ,  Ray Raymond Bejjani ,  Dane Orion Knecht ,  Matthew Browning Prince ,  John Graham-Cumming

IPC: G06F15/173 ,  H04L29/12

Abstract: A method and apparatus for managing CNAME records such that CNAME records at the root domain are supported while complying with the RFC specification (an IP address is returned for any Address query for the root record). The authoritative DNS infrastructure acts as a DNS resolver where if there is a CNAME at the root record, rather than returning that record directly, a recursive lookup is used to follow the CNAME chain until an A record is located. The address associated with the A record is then returned. This effectively “flattens” the CNAME chain. This complies with the requirements of the DNS specification and is invisible to any service that interacts with the DNS server.

公开(公告)号：US20180069945A1

公开(公告)日：2018-03-08

申请号：US15811623

申请日：2017-11-13

Applicant: Cloudflare, Inc.

Inventor： John Graham-Cumming ,  Andrew Galloni ,  Terin Stock

IPC: H04L29/08 ,  H04L29/06

CPC classification number: H04L67/2842 ,  H04L67/02 ,  H04L67/14 ,  H04L67/322 ,  H04L67/42

Abstract: A browser receives a web page that includes a script that is configured to control subsequent requests of the browser for at least the web page and caches a first portion of the web page that includes reference(s) to other web resource(s). A subsequent request for the web page is dispatched to the script which returns the cached first portion of the web page to the browser and a request for the full web page is made. Request(s) are also transmitted for the web resource(s) referenced in the first portion of the web page without waiting for the full web page to be received. When the full web page is received, if the first portion of the page matches the corresponding portion of the full page, that corresponding portion is removed from the full page and the remaining page is returned to the browser.

公开(公告)号：US09584328B1

公开(公告)日：2017-02-28

申请号：US14875645

申请日：2015-10-05

Applicant: CLOUDFLARE, INC.

Inventor： John Graham-Cumming

IPC: H04L29/06 ,  H04L9/32 ,  H04L29/12

CPC classification number: H04L63/1416 ,  H04L9/3263 ,  H04L61/1511 ,  H04L61/2007 ,  H04L61/2076 ,  H04L61/6004 ,  H04L61/6059 ,  H04L63/0281 ,  H04L63/0428 ,  H04L63/0823 ,  H04L63/1441 ,  H04L63/166 ,  H04L63/168 ,  H04L67/141 ,  H04L2209/24 ,  H04L2209/64

Abstract: A network address includes a predefined portion that identifies a hostname, where the predefined portion is less than all of the network address. A request is received for a secure session at the network address. The hostname is identified from the predefined portion of the network address and a secure session negotiation is made including returning a digital certificate for the identified hostname.

Abstract translation: 网络地址包括标识主机名的预定义部分，其中预定义部分小于所有网络地址。 收到网络地址上的安全会话请求。 从网络地址的预定义部分识别主机名，并进行安全会话协商，包括返回所识别的主机名的数字证书。

公开(公告)号：US20160315767A1

公开(公告)日：2016-10-27

申请号：US15202371

申请日：2016-07-05

Applicant: CloudFlare, Inc.

Inventor： Sébastien Andreas Henry Pahl ,  Matthieu Philippe François Tourne ,  Piotr Sikora ,  Ray Raymond Bejjani ,  Dane Orion Knecht ,  Matthew Browning Prince ,  John Graham-Cumming ,  Lee Hahn Holloway ,  Nicholas Thomas Sullivan ,  Albertus Strasheim

IPC: H04L9/08 ,  H04L9/14 ,  H04L9/30 ,  H04L9/32 ,  H04L29/06

CPC classification number: H04L9/0844 ,  H04L9/14 ,  H04L9/30 ,  H04L9/321 ,  H04L9/3263 ,  H04L9/3268 ,  H04L63/061 ,  H04L63/166

Abstract: A server establishes a secure session with a client device where a private key used in the handshake when establishing the secure session is stored in a different server. During the handshake procedure, the server proxies messages to/from the different server including a set of signed cryptographic parameters signed using the private key on the different server. The different server generates the master secret, and generates and transmits the session keys to the server that are to be used in the secure session for encrypting and decrypting communication between the client device and the server.

公开(公告)号：US09450950B2

公开(公告)日：2016-09-20

申请号：US14675385

申请日：2015-03-31

Applicant: CLOUDFLARE, INC.

Inventor： Sébastien Andreas Henry Pahl ,  Matthieu Philippe François Tourne ,  Piotr Sikora ,  Ray Raymond Bejjani ,  Dane Orion Knecht ,  Matthew Browning Prince ,  John Graham-Cumming ,  Lee Hahn Holloway ,  Nicholas Thomas Sullivan ,  Albertus Strasheim

IPC: H04L29/06 ,  G06F21/33 ,  H04L9/08 ,  H04L29/08

CPC classification number: H04L9/3263 ,  G06F21/33 ,  H04L9/083 ,  H04L9/0841 ,  H04L9/0844 ,  H04L9/14 ,  H04L9/3013 ,  H04L9/3247 ,  H04L63/0428 ,  H04L63/0485 ,  H04L63/061 ,  H04L63/0823 ,  H04L63/0869 ,  H04L63/164 ,  H04L63/166 ,  H04L63/205 ,  H04L67/141 ,  H04L67/42

Abstract: A server establishes a secure session with a client device where a private key used in the handshake when establishing the secure session is stored in a different server. During the handshake procedure, the server receives a premaster secret that has been encrypted using a public key bound with a domain for which the client device is attempting to establish a secure session with. The server transmits the encrypted premaster secret to the different server for decryption along with other information necessary to compute a master secret. The different server decrypts the encrypted premaster secret, generates the master secret, and transmits the master secret to the server. The server receives the master secret and continues with the handshake procedure including generating one or more session keys that are used in the secure session for encrypting and decrypting communication between the client device and the server.

公开(公告)号：US20150333912A1

公开(公告)日：2015-11-19

申请号：US14659995

申请日：2015-03-17

Applicant: CloudFlare, Inc.

Inventor： John Graham-Cumming

IPC: H04L9/32 ,  H04L29/06

CPC classification number: H04L9/3239 ,  H04L9/12 ,  H04L9/3271 ,  H04L69/163

Abstract: A Transmission Control Protocol (TCP) receiver receives a SYN segment from a TCP initiator that initiates a TCP handshake between the TCP initiator and a TCP server. A first value is extracted from a predefined portion of the SYN segment. A second value is computed using an authentication algorithm that includes at least using a cryptographic hash function that takes as input at least the source IP address of the encapsulating IP packet of the SYN segment and a shared secret between the TCP initiator and the TCP receiver. If the computed second value matches the extracted first value, then the TCP handshake is allowed to continue. If the computed second value does not match the extracted first value, then the TCP handshake is not allowed to continue.

Abstract translation: 传输控制协议（TCP）接收器从TCP启动器接收SYN段，该TCP启动器在TCP启动器和TCP服务器之间发起TCP握手。 从SYN段的预定义部分提取第一值。 使用认证算法计算第二值，所述认证算法至少包括使用加密散列函数，所述加密散列函数至少将SYN段的封装IP分组的源IP地址和TCP启动器与TCP接收者之间的共享密钥作为输入。 如果计算出的第二个值与提取的第一个值匹配，则允许TCP握手继续。 如果计算出的第二个值与提取的第一个值不匹配，则不允许TCP握手继续。

公开(公告)号：US09184911B2

公开(公告)日：2015-11-10

申请号：US14248254

申请日：2014-04-08

Applicant: CLOUDFLARE, INC.

Inventor： Sébastien Andreas Henry Pahl ,  Matthieu Philippe François Tourne ,  Piotr Sikora ,  Ray Raymond Bejjani ,  Dane Orion Knecht ,  Matthew Browning Prince ,  John Graham-Cumming ,  Lee Hahn Holloway ,  Nicholas Thomas Sullivan ,  Albertus Strasheim

IPC: H04L29/06 ,  H04L9/08 ,  G06F21/33

CPC classification number: H04L63/061 ,  G06F21/33 ,  H04L9/0844 ,  H04L9/085 ,  H04L63/0442 ,  H04L63/045 ,  H04L63/0869 ,  H04L63/16 ,  H04L63/164 ,  H04L63/166 ,  H04L63/168

Abstract: A server establishes a secure session with a client device where a private key used in the handshake when establishing the secure session is stored in a different server. During the handshake procedure, the server receives a premaster secret that has been encrypted using a public key bound with a domain for which the client device is attempting to establish a secure session. The server transmits the encrypted premaster secret to the different server for decryption along with other information necessary to compute a master secret and session keys for the secure session. The different server decrypts the encrypted premaster secret, generates the master secret, and generates session keys that are used in the secure session for encrypting and decrypting communication between the client device and the server and transmits those session keys to that server.

Abstract translation: 服务器与客户端设备建立安全会话，其中在建立安全会话时用于握手的私钥被存储在不同的服务器中。 在握手过程中，服务器接收使用与客户端设备尝试建立安全会话的域绑定的公共密钥进行加密的预安全秘密。 服务器将加密的前提密码传送到不同的服务器以进行解密以及计算安全会话的主密钥和会话密钥所需的其他信息。 不同的服务器解密加密的前提秘密，生成主密钥，并生成在安全会话中使用的会话密钥，用于加密和解密客户端设备与服务器之间的通信，并将这些会话密钥发送到该服务器。

公开(公告)号：US11736740B2

公开(公告)日：2023-08-22

申请号：US17020580

申请日：2020-09-14

Applicant: Cloudflare, Inc.

Inventor： Dane Orion Knecht ,  Igor Postelnik ,  Oliver Yu ,  John Graham-Cumming ,  Dani Grant ,  Nitin Rao

IPC: H04N21/231 ,  H04N21/232 ,  H04N21/845 ,  H04N21/239 ,  H04N21/218 ,  H04N21/262

CPC classification number: H04N21/23103 ,  H04N21/2181 ,  H04N21/2323 ,  H04N21/2393 ,  H04N21/26258 ,  H04N21/8456

Abstract: A server in a content delivery network (CDN) receives a request for a web page of a domain handled by an origin server. The server retrieves the web page and the web page references a video. The server retrieves a file that indicates a list of locations of the domain in which segments of the video are located. The server fetches at least an initial portion of the segments. The server receives a request for the video. The server transmits to the requester at least the initial portion of the segments. The server receives a subsequent request of a different portion of the segments. The server transmits a response to the requester that instructs the requester to transmit the request for the different portion of segments to a second server in the CDN.

公开(公告)号：US11438178B2

公开(公告)日：2022-09-06

申请号：US16820489

申请日：2020-03-16

Applicant: CLOUDFLARE, INC.

Inventor： Sébastien Andreas Henry Pahl ,  Matthieu Philippe François Tourne ,  Piotr Sikora ,  Ray Raymond Bejjani ,  Dane Orion Knecht ,  Matthew Browning Prince ,  John Graham-Cumming ,  Lee Hahn Holloway ,  Nicholas Thomas Sullivan ,  Albertus Strasheim

IPC: H04L29/06 ,  H04L9/32 ,  H04L9/40 ,  G06F21/33 ,  H04L9/08 ,  H04L67/141 ,  H04L67/01 ,  H04L9/14 ,  H04L9/30

Abstract: A server establishes a secure session with a client device where a private key used in the handshake when establishing the secure session is stored in a different server. During the handshake procedure, the server receives a premaster secret that has been encrypted using a public key bound with a domain for which the client device is attempting to establish a secure session with. The server transmits the encrypted premaster secret to the different server for decryption along with other information necessary to compute a master secret. The different server decrypts the encrypted premaster secret, generates the master secret, and transmits the master secret to the server. The server receives the master secret and continues with the handshake procedure including generating one or more session keys that are used in the secure session for encrypting and decrypting communication between the client device and the server.

公开(公告)号：US11316825B2

公开(公告)日：2022-04-26

申请号：US16883116

申请日：2020-05-26

Applicant: CLOUDFLARE, INC.

Inventor： Dane Orion Knecht ,  John Graham-Cumming ,  Dani Grant ,  Christopher Philip Branch ,  Tom Paseka

IPC: H04L61/2592 ,  H04L61/4511 ,  H04L67/02 ,  H04L67/01 ,  H04L12/46 ,  H04L67/1031 ,  H04L67/10 ,  H04L67/1017 ,  H04L61/5007

Abstract: An edge server of a distributed edge compute and routing service receives a tunnel connection request from a tunnel client residing on an origin server, that requests a tunnel be established between the edge server and the tunnel client. The request identifies the hostname that is to be tunneled. An IP address is assigned for the tunnel. DNS record(s) are added or changed that associate the hostname with the assigned IP address. Routing rules are installed in the edge servers of the distributed edge compute and routing service to reach the edge server for the tunneled hostname. The edge server receives a request for a resource of the tunneled hostname from another edge server that received the request from a client, where the other edge server is not connected to the origin server. The request is transmitted from the edge server to the origin server over the tunnel.