-
公开(公告)号：US10069787B2
公开(公告)日：2018-09-04
申请号：US14676631
申请日：2015-04-01
Applicant: CLOUDFLARE, INC.
Inventor： Lee Hahn Holloway , Ray Raymond Bejjani , Dane Orion Knecht , Matthew Browning Prince , John Graham-Cumming
IPC: G06F15/173 , H04L29/12
Abstract: A method and apparatus for managing CNAME records such that CNAME records at the root domain are supported while complying with the RFC specification (an IP address is returned for any Address query for the root record). The authoritative DNS infrastructure acts as a DNS resolver where if there is a CNAME at the root record, rather than returning that record directly, a recursive lookup is used to follow the CNAME chain until an A record is located. The address associated with the A record is then returned. This effectively “flattens” the CNAME chain. This complies with the requirements of the DNS specification and is invisible to any service that interacts with the DNS server.
-
公开(公告)号：US20180007085A1
公开(公告)日：2018-01-04
申请号：US15603256
申请日：2017-05-23
Applicant: CLOUDFLARE, INC.
Inventor： Lee Hahn Holloway , Srikanth N. Rao , Matthew Browning Prince , Matthieu Philippe François Tourne , Ian Gerald Pye , Ray Raymond Bejjani , Terry Paul Rodery, JR.
IPC: H04L29/06
CPC classification number: H04L63/1458 , G06F21/552 , G06F21/577 , H04L63/0281 , H04L63/1408 , H04L63/1416 , H04L63/1425 , H04L63/1433 , H04L63/1466 , H04L63/20
Abstract: A proxy server in a cloud-based proxy service receives a message that indicates that a domain, whose traffic passes through the proxy server, may be under a denial-of-service (DoS) attack. The proxy server enables a rule for the domain that specifies that future requests for resources at that domain are subject to at least initially passing a set of one or more challenges. In response to receiving a request for a resource of that domain from a visitor, the proxy server presents the set of challenges that, if not passed, are an indication that that the visitor is part of the DoS attack. If the set of challenges are passed, the request may be processed. If the set of challenges are not passed, the request may be dropped.
-
83.发明申请公开(公告)号：US20160315767A1
公开(公告)日：2016-10-27
申请号：US15202371
申请日：2016-07-05
Applicant: CloudFlare, Inc.
Inventor： Sébastien Andreas Henry Pahl , Matthieu Philippe François Tourne , Piotr Sikora , Ray Raymond Bejjani , Dane Orion Knecht , Matthew Browning Prince , John Graham-Cumming , Lee Hahn Holloway , Nicholas Thomas Sullivan , Albertus Strasheim
CPC classification number: H04L9/0844 , H04L9/14 , H04L9/30 , H04L9/321 , H04L9/3263 , H04L9/3268 , H04L63/061 , H04L63/166
Abstract: A server establishes a secure session with a client device where a private key used in the handshake when establishing the secure session is stored in a different server. During the handshake procedure, the server proxies messages to/from the different server including a set of signed cryptographic parameters signed using the private key on the different server. The different server generates the master secret, and generates and transmits the session keys to the server that are to be used in the secure session for encrypting and decrypting communication between the client device and the server.
-
84.发明授权公开(公告)号：US09450950B2
公开(公告)日：2016-09-20
申请号：US14675385
申请日：2015-03-31
Applicant: CLOUDFLARE, INC.
Inventor： Sébastien Andreas Henry Pahl , Matthieu Philippe François Tourne , Piotr Sikora , Ray Raymond Bejjani , Dane Orion Knecht , Matthew Browning Prince , John Graham-Cumming , Lee Hahn Holloway , Nicholas Thomas Sullivan , Albertus Strasheim
CPC classification number: H04L9/3263 , G06F21/33 , H04L9/083 , H04L9/0841 , H04L9/0844 , H04L9/14 , H04L9/3013 , H04L9/3247 , H04L63/0428 , H04L63/0485 , H04L63/061 , H04L63/0823 , H04L63/0869 , H04L63/164 , H04L63/166 , H04L63/205 , H04L67/141 , H04L67/42
Abstract: A server establishes a secure session with a client device where a private key used in the handshake when establishing the secure session is stored in a different server. During the handshake procedure, the server receives a premaster secret that has been encrypted using a public key bound with a domain for which the client device is attempting to establish a secure session with. The server transmits the encrypted premaster secret to the different server for decryption along with other information necessary to compute a master secret. The different server decrypts the encrypted premaster secret, generates the master secret, and transmits the master secret to the server. The server receives the master secret and continues with the handshake procedure including generating one or more session keys that are used in the secure session for encrypting and decrypting communication between the client device and the server.
-
公开(公告)号：US09319315B2
公开(公告)日：2016-04-19
申请号：US13858635
申请日：2013-04-08
Applicant: CloudFlare, Inc.
CPC classification number: H04L45/741 , H04L61/1511 , H04L61/25 , H04L67/1023 , H04L67/28 , H04L67/2809
Abstract: A first packet is received at a proxy server from a client and includes a first incoming request for an action to be performed on an identified resource. The first packet is received at the proxy server as a result of a DNS request for a domain corresponding to the identified resource resolving to an IP address of the proxy server. The proxy server selects, based on at least in part on a set of parameters associated with the first packet, one of multiple IP addresses for use as a source IP address for a second packet that carries an outgoing request and transmits the second packet. The proxy server receives a third packet that includes an incoming response from the destination origin server in response to the outgoing request and transmits a fourth packet to the client that includes an outgoing response based on the incoming response.
-
Patent Agency Ranking
86.发明授权Secure session capability using public-key cryptography without access to the private key 有权使用公共密钥加密技术安全的会话功能，无需访问私钥公开(公告)号：US09184911B2
公开(公告)日：2015-11-10
申请号：US14248254
申请日：2014-04-08
Applicant: CLOUDFLARE, INC.
Inventor： Sébastien Andreas Henry Pahl , Matthieu Philippe François Tourne , Piotr Sikora , Ray Raymond Bejjani , Dane Orion Knecht , Matthew Browning Prince , John Graham-Cumming , Lee Hahn Holloway , Nicholas Thomas Sullivan , Albertus Strasheim
CPC classification number: H04L63/061 , G06F21/33 , H04L9/0844 , H04L9/085 , H04L63/0442 , H04L63/045 , H04L63/0869 , H04L63/16 , H04L63/164 , H04L63/166 , H04L63/168
Abstract: A server establishes a secure session with a client device where a private key used in the handshake when establishing the secure session is stored in a different server. During the handshake procedure, the server receives a premaster secret that has been encrypted using a public key bound with a domain for which the client device is attempting to establish a secure session. The server transmits the encrypted premaster secret to the different server for decryption along with other information necessary to compute a master secret and session keys for the secure session. The different server decrypts the encrypted premaster secret, generates the master secret, and generates session keys that are used in the secure session for encrypting and decrypting communication between the client device and the server and transmits those session keys to that server.
Abstract translation: 服务器与客户端设备建立安全会话，其中在建立安全会话时用于握手的私钥被存储在不同的服务器中。 在握手过程中，服务器接收使用与客户端设备尝试建立安全会话的域绑定的公共密钥进行加密的预安全秘密。 服务器将加密的前提密码传送到不同的服务器以进行解密以及计算安全会话的主密钥和会话密钥所需的其他信息。 不同的服务器解密加密的前提秘密，生成主密钥，并生成在安全会话中使用的会话密钥，用于加密和解密客户端设备与服务器之间的通信，并将这些会话密钥发送到该服务器。
-
公开(公告)号：US20150229481A1
公开(公告)日：2015-08-13
申请号：US14692397
申请日：2015-04-21
Applicant: CLOUDFLARE, INC.
Inventor： Matthew Browning Prince , Srikanth N. Rao , Lee Hahn Holloway , Ian Gerald Pye
CPC classification number: H04L9/3268 , H04L63/0464 , H04L63/0823 , H04L63/0884 , H04L63/166 , H04L67/28 , H04W76/10
Abstract: A proxy server in a cloud-based proxy service receives a secure session request from a client device as a result of a Domain Name System (DNS) request for a domain resolving to the proxy server. The proxy server participates in a secure session negotiation with the client device including transmitting a digital certificate to the client device that is bound to domain and multiple other domains. The proxy server receives an encrypted request from the client device for an action to be performed on a resource that is hosted at an origin server corresponding to the domain. The proxy server decrypts the request and participates in a secure session negotiation with the origin server including receiving a digital certificate from the origin server. The proxy server encrypts the decrypted request using the digital certificate from the origin server and transmits the encrypted request to the origin server.
Abstract translation: 基于云的代理服务器中的代理服务器由于针对解析到代理服务器的域的域名系统（DNS）请求而从客户端设备接收安全会话请求。 代理服务器参与与客户端设备的安全会话协商，包括将数字证书发送到绑定到域和多个其他域的客户端设备。 代理服务器从客户端设备接收对在与域对应的原始服务器上托管的资源执行的操作的加密请求。 代理服务器解密请求并参与与原始服务器的安全会话协商，包括从原始服务器接收数字证书。 代理服务器使用来自原始服务器的数字证书对解密的请求进行加密，并将加密的请求发送到原始服务器。
-
公开(公告)号：US12001504B2
公开(公告)日：2024-06-04
申请号：US17234517
申请日：2021-04-19
Applicant: CloudFlare, Inc.
IPC: G06F16/00 , G06F15/16 , G06F16/95 , G06F16/958 , G06F21/00 , G06F21/55 , G06F40/14 , G06F40/143 , G06Q10/107 , G06Q30/0241 , G06Q30/0251 , H04L9/40 , H04L47/74 , H04L51/42 , H04L61/4511 , H04L61/5007 , H04L67/02 , H04L67/146 , H04L67/56 , H04L67/561 , H04L67/568 , H04L69/40 , H04L61/59
CPC classification number: G06F16/958 , G06F15/16 , G06F16/95 , G06F21/00 , G06F21/552 , G06F40/14 , G06F40/143 , G06Q10/107 , G06Q30/0241 , G06Q30/0251 , G06Q30/0277 , H04L47/745 , H04L51/42 , H04L61/4511 , H04L61/5007 , H04L63/0236 , H04L63/0245 , H04L63/0254 , H04L63/0281 , H04L63/083 , H04L63/0861 , H04L63/102 , H04L63/126 , H04L63/1416 , H04L63/1433 , H04L63/1441 , H04L63/1458 , H04L63/1466 , H04L67/02 , H04L67/146 , H04L67/56 , H04L67/561 , H04L67/568 , H04L69/40 , H04L61/59
Abstract: A proxy server receives from a client device a request for a network resource that is hosted at an origin server for a domain. The request is received at the proxy server as a result of DNS request for the domain returning an IP address of the proxy server instead of an IP address of the origin server. The proxy server retrieves the requested network resource. The proxy server determines that the retrieved network resource includes at least one modification token that is of a type that indicates a threat to the client device. For at least this modification token, the proxy server automatically modifies at least a portion of the retrieved network resource that corresponds to that modification token. The proxy server transmits the modified network resource to the client device.
-
公开(公告)号：US20240163350A1
公开(公告)日：2024-05-16
申请号：US18419265
申请日：2024-01-22
Applicant: CLOUDFLARE, INC.
Inventor： Christopher Philip Branch , Naga Sunil Tripirineni , Rustam Xing Lalkaka , Nick Wondra , Mohd Irtefa , Matthew Browning Prince , Andrew Taylor Plunk , Oliver Yu , Vlad Krasnov
CPC classification number: H04L67/63 , H04L12/4633 , H04L12/4641 , H04L63/0272 , H04L67/10
Abstract: A request is received from a client device over a Virtual Private Network (VPN) tunnel. The request is received at a first one of a plurality of edge servers of a distributed cloud computing network. A destination of the request is determined and an optimized route for transmitting the request toward an origin server is determined. The optimized route is based at least in part on probe data between edge servers of the distributed cloud computing network. The request is transmitted to a next hop as defined by the optimized route.
-
公开(公告)号：US11818167B2
公开(公告)日：2023-11-14
申请号：US17509829
申请日：2021-10-25
Applicant: CloudFlare, Inc.
Inventor： Lee Hahn Holloway , Srikanth N. Rao , Matthew Browning Prince , Matthieu Philippe François Tourne , Ian Gerald Pye , Ray Raymond Bejjani , Terry Paul Rodery, Jr.
CPC classification number: H04L63/1458 , G06F21/552 , G06F21/577 , H04L63/0281 , H04L63/1408 , H04L63/1416 , H04L63/1425 , H04L63/1433 , H04L63/1466 , H04L63/20
Abstract: An authoritative DNS server receives DNS requests for domains. The authoritative DNS server responds to the requests with address records that include IP addresses that are selected from a larger pool of IP addresses, where a first response to a DNS query for a domain can include IP addresses different from IP addresses included in a second response for the same domain. Also, the same IP addresses may be returned for a first domain and a different, second domain. The authoritative DNS server may randomly select the IP addresses to include in responses to the requests regardless of the domain.
-
-
-
-
-
-
-
-
-
Search Results
118
records
(took 0.029 seconds)
