Systems and methods implementing name resolution and virtual addresses to enable network connections

Abstract

To provide methods which include receiving a first message including a first IP address by a virtual private network (VPN) server, from a VPN client operating on a computing device, over a VPN connection.SOLUTION: In a network connection process 200, a first network connection method comprises: a step 212 of determining by a VPN server 66 a hostname based on a first IP address; a step 216 of resolving the hostname to a second IP address; and a step 222 of transmitting a first message to a network device at the second IP address.SELECTED DRAWING: Figure 3

Description

Technical Field

[0001] The present invention generally relates to network communication, and more particularly to name resolution that enables network connection.

Background Art

[0002] Host name resolution converts the host name of a device accessible on a network (e.g., "www.example.com") into the Internet Protocol ("IP") address of the device, enabling network communication with the device. A virtual private network ("VPN") is a system that creates a secure data connection between a device and a network, or between networks. In a computing device operating within a VPN, one or more steps of the host name resolution process may occur outside the VPN.

[0003] VPNs primarily began as a means of extending an enterprise or organization's internal network between locations. Eventually, VPNs became a way to connect distributed devices (such as laptops and mobile phones) to a corporate network. In this process of development, VPNs have become an essential element in network design in many respects, often regarded as a necessary evil, with a decrease in speed but, in return, enabling geographically diverse operations. Recently, VPNs have become consumer products. In their marketing and operation, VPNs have shifted from being an organizational necessity to a desirable end-user security feature. As part of this shift, speed and performance have become more important. In fact, in many cases, VPNs currently also function as network accelerators, similar to security services.

Summary of the Invention

[0004] This summary introduces simplified concepts that will be described later in the detailed description of the embodiments. This summary is not intended to identify the key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter.

[0005] A first network connection method is provided. The first network connection method includes receiving, by a VPN server, from a VPN client operating on a computing device, via a VPN connection, a first message including a first IP address. The first network connection method further includes determining, by the VPN server, a host name based on the first IP address, resolving, by the VPN server, the host name to a second IP address, and transmitting, by the VPN server, the first message to a network device of the second IP address.

[0006] A second network connection method is provided. The second network connection method includes receiving, by a first computing system, a host name, and assigning, by the first computing system, a first IP address to the host name based on the host name or a part of the host name. The first computing system transmits, via a network, a message including the first IP address to a second computing system. The second computing system receives the message including the first IP address from the first computing system. The second computing system determines a host name based on the first IP address. The second computing system resolves the host name to a second IP address, and the second computing system transmits the message to a third computing system of the second IP address.

[0007] A computing system is provided. The computing system includes one or more processors and a memory storing executable instructions. The executable instructions cause the system to perform an operation of receiving, via a VPN connection, a first message including a first IP address from a VPN client operating on a computing device as a result of being executed. This operation further includes determining a host name based on the first IP address, resolving the host name to a second IP address, and sending the first message to a network device at the second IP address.

Brief Description of the Drawings

[0008] A more detailed understanding can be obtained from the following description given by way of example in conjunction with the accompanying drawings. The drawings and the detailed description are illustrative. The drawings and the detailed description are not to be regarded as limiting, and other embodiments are possible. Like reference numerals in the figures indicate like elements.

[0009]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

[0010] The core networking function of name resolution remains a significant bottleneck in achieving high-performance virtual private network (VPN) services. Since name resolution requires a round trip to a distant server, the entire signal must traverse the entire VPN tunnel and the entire public Internet before the entire connection the user is creating over the VPN can proceed further. Solutions such as running a Domain Name System (DNS) resolver close to the VPN gateway or running a local resolver on the user's device cannot solve the fundamental problem that at least one DNS lookup must be performed over the VPN tunnel. No matter which conventional approach is chosen, name resolution must occur over the VPN tunnel, between the stub resolver and its upstream resolver / server, or between the client and the resolver located at the gateway. As an alternative, running the DNS resolver outside the VPN tunnel improves speed but comes at a significant cost to security. Various impacts can be considered, from leakage of browsing intent to the potential for phishing and other security breaches. What is described herein is a solution to the problem of domain name resolution, which solution includes splitting and deferring domain name resolution deep within the network. Instead of simply repositioning the DNS server, a new connection negotiation is implemented so that the establishment of the connection can proceed before name resolution occurs. By enabling the connection to proceed without completing name resolution, the long traversal of name resolution between the client and the gateway is eliminated, and the client can connect without DNS resolution. In addition to improving connection speed and performance, the systems and processes described herein have the advantage of significantly reducing the portion of the public Internet over which insecure name resolution data must traverse, thereby reducing the security perimeter of name resolution.The systems and processes described herein uniquely utilize the numerical possibilities of Internet Protocol ("IP") addresses, encode domain names, and modify the Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) connection setup processes to significantly shift the cost of DNS resolution from the VPN client to the VPN server.

[0011] The terms defined herein have the following meanings.

[0012] "Host name" is a fully qualified domain name ("FQDN") and includes domain names such as "example.com", for example, "www.example.com".

[0013] "VPN server" is a network - connectable physical or virtualized computing system configured to establish a VPN connection with a VPN client via a network. The VPN server may provide various levels of encryption. Without loss of generality, the described embodiments apply to any virtualized network service regardless of the specific encryption function, and the VPN servers described herein need not implement encryption.

[0014] "VPN client" is an application operating on a computing device configured to establish a VPN connection with one or more VPN servers via a network.

[0015] As described herein, references to "first", "second", and "third" components (e.g., "first Internet Protocol ("IP") address", "second IP address") are not used to indicate a sequential or numerical limitation or a limitation of quality, but rather are used to distinguish or identify various components.

[0016] Referring to FIG. 1, an environment 10 enabled by a computer network 8 is shown, in which a network - connectable processor - enabled virtual private network ("VPN") server 66 is provided to facilitate secure data transfer between a computing device 12 and other systems within the computer network 8. The computer network 8 includes, for example, one or more wired or wireless networks, such as a local area network ("LAN"), a wide area network ("WAN"), the Internet, a cellular phone network, a wireless data network such as Wi - FiTM or 3G / 4G / 5G cellular networks, or combinations thereof. An application including a VPN client 62 running on the computing device 12 interacts with other applications 60 running on the computing device 12. The applications 60 include, for example, an Internet browser, an email client, a messaging client, a social networking application, or other network - connectable client applications. An operating system ("OS") 56 runs on the computing device 12 and enables the integration of the applications 60 and the VPN client 62. The VPN client 62 is provided integrally with, or as an extension, plugin, or add - on to, one or more applications 60 running on the computing device 12, and provides notifications to the user via a user interface 54. The VPN client 62 running on the computing device 12 establishes a secure VPN connection between the applications 60 and the VPN server 66.

[0017] A web or application ("web / app") server 40 operated by various entities can provide services that enable an application 60 or components of the application 60. The web / app server 40 can further enable online services including network-based applications, web pages, an electronic message provider system (e.g., an email provider system), or other online services accessible via the application 60. A user can become involved in the online services enabled by the web / app server 40, for example, by accessing a web page or accessing a web page to register a user account, and user account authentication information (e.g., a username, a password) is created by the user or an administrator of the online service.

[0018] Referring to FIG. 2, a conventional network connection process 100 is shown. The process 100 is described with reference to the TCP (transmission control protocol) communication standard and the components of an environment 10 including a computing device 12, an application 60, a VPN client 62, a VPN server 66, a DNS server 72, a web / app server 40, and a service 74. Alternatively, the process 100 can be executed via other systems and is not limited to being implemented by the components of the environment 10 or being implemented as a TCP connection process. For example, the network connection process 100 can support the UDP (user datagram protocol) communication standard.

[0019] In step 102, an application 60, such as an Internet browser, sends a request to resolve a host name (e.g., www.example.com) to a VPN client 62. The VPN client 62 propagates a DNS request to a VPN server 66 via a VPN tunnel (step 104), and the VPN server 66 attempts to resolve the host name by a DNS request to a DNS server 72 (step 106). In step 108, the VPN server 66 receives a response from the DNS server 72 that includes an IP address (e.g., 1.2.3.4). The VPN server 66 propagates a DNS response that includes the IP address (e.g., 1.2.3.4) to the VPN client 62 via the VPN tunnel (step 110), and the VPN client 62 transfers the IP address to the application 60 (step 112).

[0020] In step 114, application 60 requests a connection to service 74 (e.g., a web page) hosted on web / application server 40 with an IP address by sending a message. In the case of a TCP connection, the connection request is initiated by sending a synchronization ("SYN") message containing the sequence number of the packets sent from application 60 to VPN client 62. VPN client 62 propagates the request containing the message (SYN message in the case of a TCP connection) to VPN server 66 through the VPN tunnel (step 116). VPN server 66 sends the message (e.g., TCP SYN message) to web / application server 40 hosting service 74 with an IP address (e.g., 1.2.3.4) (step 118). In step 120, VPN server 66 receives a response from web / application server 40, and this response includes a synchronization acknowledgment response ("SYN-ACK") message containing an acknowledgment response of the sequence number from VPN server 66 and another sequence number for the packets sent from web / application server 40. VPN server 66 sends the message (e.g., SYN-ACK message) from web / application server 40 to VPN client 62 through the VPN tunnel (step 122). VPN client 62 sends the message (e.g., SYN-ACK message) from web / application server 40 to application 60 (step 124).

[0021] The VPN client 62 and the VPN server 66 enable a network connection process (e.g., TCP and UDP connection processes) that is superior to the conventional connection process 100 of FIG. 2. The VPN client 62 and the VPN server 66 form a versatile system and can speed up DNS resolution (resolution from a host name to an IP address) when using a VPN or other types of distributed networks. Depending on the situation of the open system interconnection (OSI) layer of the VPN protocol being used, name routing can be realized in at least two ways. When implementing a network-level VPN (“OSI layer 3” VPN), a DNS request from an application 60 on a computing device 12 (i.e., a host machine) is responded to by the VPN client 62 via a local resolver 64 that appears to the application 60 as a local DNS resolver. However, unlike the situation where the DNS resolver is simply executed on the client, the local resolver 64 enabled by the VPN client 62 masquerades as a recursive DNS resolver to enable interoperability with the application 60. The local resolver 64 is a basic part of the VPN engine enabled by the VPN client 62. Instead of resolving a host name to an IP address, the local resolver 64 uses a consistent hashing algorithm or a consistent compression algorithm to assign a name within a virtual address space. The virtual address space corresponds to an Internet Protocol version 4 (IPv4) address space (e.g., including the assigned name “10.0.0.6”) or an Internet Protocol version 6 (IPv6) address space (e.g., including the assigned name “2002:0220:110C:0230:010A:04C0:846C:120B”). This enables an almost instantaneous DNS response from the VPN client 62 to the application 60 for a DNS request because the DNS request is not actually completed but is mapped to the virtual address space.

[0022] When application 60 opens a network connection (such as a TCP or UDP connection) to a virtually resolved address ("virtual address"), application 60 is permitted to proceed as if such an address existed. The VPN client 62 can add information about the originally requested host name, for example including the host name itself or a part of it, to the packets sent by the application. The connection proceeds to the VPN gateway 68 of the VPN server 66, and the VPN gateway 68 performs a routing transformation on the packet in order to map the virtual address (for example, "10.0.0.6" or "2002:0220:110C:0230:010A:04C0:846C:120B") back to the host name (for example, "www.example.com") of the service 74 (such as a web page) hosted on the web / app server 40 targeted by the application 60. The VPN gateway 68 queries the address index 70 to determine the IPv4 address or IPv6 address corresponding to the host name. If the IPv4 or IPv6 address corresponding to the host name does not exist in the address index 70, the VPN gateway 68 queries the DNS server 72 for the IPv4 or IPv6 address corresponding to the host name, and in the meantime, the connection is informed until sufficient information becomes available to complete the transformation from the virtual address space back to the real address space necessary to complete the final connection. Different from network address translation (NAT) that maps the address of a local network to a public IP address based on numerical routing tables and rules, the host name is used as the basis for generating a virtual IPv4 or IPv6 address.

[0023] When the host name is long and cannot be represented in the IPv4 or IPv6 address space, the VPN client 62 enhances the connection to the VPN gateway 68 on the VPN server 66 with additional information necessary to fully restore the hashed or compressed host name to the complete host name on the VPN gateway 68. The additional information includes, for example, the host name or a part thereof. When the length of the domain name of the host name is less than about 24 characters, which applies to a significant number of websites, the host name is deterministically converted into a representation within the IPv6 address space or within the IPv4 address space and used alone as the address sent to the VPN gateway 68 of the VPN server 66. In this case, the VPN client 62 has the advantage of being able to reduce overhead because it does not need to enhance the connection request through the VPN tunnel with additional information to restore the host name, since in such a scenario the host name can be fully restored from the generated IPv6 or IPv4 address.

[0024] Due to slight differences in implementation, the number of characters in the IPv6 or IPv4 address may increase or decrease somewhat. However, generally, there is a limit to the information density in terms of how much information can be transmitted in an IP address. Therefore, regardless of the selected algorithm, in order to support both short and long host names, it is necessary to provide both an option to convert the IP address to a host name and an option that requires additional information to notify the host name to the VPN gateway.

[0025] Referring to FIG. 3, another network connection process 200 is shown. Process 200 is described with reference to the components of environment 10 including the TCP (transmission control protocol) communication standard, and computing device 12, application 60, VPN client 62, local resolver 64, VPN server 66, DNS server 72, address index 70, web / application server 40, and service 74. Alternatively, process 200 can be executed via other systems and is not limited to being implemented by the components of environment 10. For example, network connection process 200 can support the UDP (user datagram protocol) communication standard.

[0026] In step 202, application 60, such as an Internet browser, sends a request to resolve a host name (e.g., "www.example.com" or "example.com") to VPN client 62. In step 204, VPN client 62 applies a compression algorithm via local resolver 64 and assigns a virtual address (e.g., "10.0.0.6" or "2002:0220:110C:0230:010A:04C0:846C:120B") within the virtual address space to the host name. The compression algorithm can take as input, for example, the domain name of the host name excluding the "www" subdomain (e.g., example.com). Alternatively, the entire host name (e.g., www.example.com) can be input to the compression algorithm. Examples of compression algorithms include, as needed, a hash (e.g., a 64-bit highway hash) that truncates the output bits to the number of bytes available for use with a virtual address (e.g., for an IPv4 address). Other non-reversible hashes or compression algorithms can also be used. The compression algorithm functions as an indexing function and does not provide a security function or affect the security of process 200. VPN client 62 sends the virtual address (e.g., 10.0.0.6) to application 60 (step 206).

[0027] In step 208, the application 60 requests a connection (e.g., a TCP or UDP connection) to a service 74 (e.g., a web page) hosted on the web / app server 40 by sending a message containing the virtual address via the VPN client 62 as if the virtual address were a real IP address. In the case of a TCP connection, the application 60 sends the connection request as a SYN message. The VPN client 62 sends a message (e.g., a TCP SYN) containing the virtual address (e.g., 10.0.0.6) from the application 60 to the VPN server 66 via a VPN tunnel enabled by the VPN client 62 and the VPN server 66 (step 210). In step 212, the VPN server 66 applies a decompression algorithm to the virtual address (e.g., 10.0.0.6) to decompress the host name (e.g., www.example.com) and reach the host name. In particular, to calculate the host name, the VPN server 66 applies the inverse of the algorithm used by the VPN client to calculate the virtual address to the virtual address. In step 210, the VPN client 62 can optionally add information regarding the originally requested host name, such as the host name itself or a part thereof, to the packet sent to the VPN server 66, and this information can be used by the VPN server 66 when calculating the host name.

[0028] The VPN server 66 queries the address index 70 to determine whether the host name (e.g., example.com) and its associated IP address are cached there (step 214). If the host name and its associated IP address are cached, process 200 skips steps 216 and 218 and proceeds to step 220. If the host name and its associated IP address are not cached, the VPN server 66 attempts to resolve the host name via a DNS request to the DNS server 72 (step 216). In step 218, the VPN server 66 receives a response from the DNS server 72 that includes the IP address (e.g., 1.2.3.4). In step 220, the VPN server 66 performs a rewrite to change the virtual address (e.g., 10.0.0.6) indicated in the message from the application 60 to the actual IP address (e.g., 1.2.3.4) of the web / application server 40 that hosts the service 74. The VPN server 66 sends the rewritten message (e.g., TCP SYN) to the web / application server 40 that hosts the service 74 at the IP address (e.g., 1.2.3.4) (step 222). For network connections using the UDP communication protocol, the transmission in step 222 is sufficient to initiate the network connection without a confirmation response from the web / application server 40.

[0029] In step 224, the VPN server 66 receives a response from the web / application server 40. This response includes a synchronization confirmation response ("SYN-ACK") message that, in the case of a TCP connection, includes confirmation of the sequence number from the VPN server 66 and another sequence number for the packet sent from the web / application server 40. In step 226, the VPN server 66 performs a rewrite to change the actual IP address (e.g., 1.2.3.4) indicated in the message from the web / application server 40 to the virtual IP address (e.g., 10.0.0.6) generated by the VPN client in step 204. The VPN server 66 sends the rewritten message from the web / application server 40 (e.g., SYN-ACK message) including the description of the virtual IP address through the VPN tunnel to the VPN client 62 (step 228). The VPN client 62 sends the rewritten message from the web / application server 40 (e.g., SYN-ACK message) including the description of the virtual IP address to the application 60 (step 230).

[0030] When the VPN client 62 integrates with the application 60, its embedded medium, at the transport level (OSI layer 4), e.g., when the VPN client 62 operates as an extension, plugin, or add-on integrated with the application 60, the local DNS resolution loops of steps 202, 204, and 206 are integrated. Since an OSI layer 4 request can immediately add details including, for example, a host name or part of a host name, the addition can be performed immediately without the need for the local DNS resolution loops of steps 202, 204, and 206. If necessary, the addition included in step 210 is performed to enable a consistent cache of the address index 70 on the VPN gateway 68.

[0031] Referring to FIG. 4, yet another network connection process 300 is shown. Process 300 is described with reference to the components of environment 10 including the TCP (transmission control protocol) communication standard, and computing device 12, application 60, VPN client 62, local resolver 64, VPN server 66, DNS server 72, address index 70, web / application server 40, and service 74. Alternatively, process 300 can be executed via other systems and is not limited to being implemented by the components of environment 10.

[0032] In step 302, application 60, for example an Internet browser, sends a request to resolve a host name (e.g., "www.longname.com" or "longname.com") to VPN client 62. In step 304, VPN client 62 attempts to apply a compression algorithm via local resolver 64 and assigns a virtual address (e.g., "10.0.0.6" or "2002:0220:110C:0230:010A:04C0:846C:120B") within the virtual address space to the host name. Examples of compression algorithms include, if necessary, a hash (e.g., a 64-bit highway hash) that truncates the output bits to the number of bytes available for use with the virtual address (e.g., for an IPv4 address). Other non-invertible hashes or compression algorithms can also be used. The compression algorithm functions as an indexing function and does not provide a security function or affect the security of process 300. In step 306, VPN client 62 determines that the compression has failed because the host name is too long to generate a virtual address in the IPv4 or IPv6 address space. In response to determining that the compression has failed, VPN client 62 attempts to apply a hash algorithm via local resolver 64 and assigns a virtual address (e.g., 172.16.0.77) within the virtual address space to the host name (step 308). The hash algorithm also performs, if necessary, a hash (e.g., a 64-bit highway hash) that truncates the output bits to the number of bytes available for use with the virtual address (e.g., for an IPv4 address). The hash algorithm functions as an indexing function and does not provide a security function or affect the security of process 300.

[0033] The VPN client 62 sends an indication of a virtual address (e.g., 172.16.0.77) and a host name associated therewith (e.g., longname.com) to the VPN server 66 (step 310). If the host name associated with the virtual address is not yet stored in the address index 70, the VPN server 66 stores the host name associated with the virtual address in the address index 70 (step 312). The VPN server 66 queries the address index 70 to determine whether the host name (e.g., longname.com) and the IP address associated therewith are cached therein (step 314). If the host name and the associated IP address are cached, process 300 skips steps 316 and 318. If the host name and the associated IP address are not cached, the VPN server 66 attempts to resolve the host name via a DNS request to the DNS server 72 (step 316). In step 318, the VPN server 66 receives a response from the DNS server 72 that includes an IP address (e.g., 5.6.7.8).

[0034] The VPN client 62 sends a virtual address (e.g., 172.16.0.77) to the application 60 (step 320). In step 322, the application 60 requests a connection (e.g., a TCP or UDP connection) to a service 74 (e.g., a web page) hosted on the web / application server 40 with the virtual address (e.g., 172.16.0.77) by sending a message via the VPN client 62 as if the virtual address were a real IP address. In the case of a TCP connection, the application 60 sends the connection request as a SYN message. The VPN client 62 sends the message from the application 60 containing the virtual address to the VPN server 66 via a VPN tunnel enabled by the VPN client 62 and the VPN server 66 (step 324). In step 326, the VPN server 66 looks up the virtual address (e.g., 172.16.0.77) in the address index 70 and determines the host name and the IP address associated with that host name.

[0035] In step 328, based on the lookup performed in step 326, the VPN server 66 performs a rewrite to change the virtual address (e.g., 172.16.0.77) indicated in the message from the application 60 to the actual IP address (e.g., 5.6.7.8) of the web / application server 40 hosting the service 74. The VPN server 66 sends the rewritten message (e.g., a SYN message) to the web / application server 40 hosting the service 74 with the IP address (e.g., 5.6.7.8) (step 330). In the case of a network connection using the UDP communication protocol, the transmission in step 330 is sufficient to initiate the network connection without a confirmation response from the web / application server 40.

[0036] In step 332, the VPN server 66 receives from the web / application server 40 a response indicating the IP address of the web / application server 40. This response includes, in the case of a TCP connection, a synchronization acknowledgment response ( "SYN-ACK") message that includes an acknowledgment response of the sequence number from the VPN server 66 and another sequence number of the packet sent from the web / application server 40. In step 334, the VPN server performs a rewrite to change the actual IP address (e.g., 5.6.7.8) indicated in the message from the web / application server 40 to the virtual IP address (e.g., 172.16.0.77) generated by the VPN client in step 308. The VPN server 66 sends the rewritten message from the web / application server 40 (e.g., SYN-ACK message) including the description of the virtual IP address through the VPN tunnel to the VPN client 62 (step 336). The VPN client 62 sends the rewritten message from the web / application server 40 (e.g., SYN-ACK message) including the description of the virtual IP address to the application 60 (step 338).

[0037] The steps defined in process 300 can be performed in an order different from that shown in the figure. For example, steps 320 and 322 can be performed before step 310, and steps 316 and 318 can be performed after step 324. However, step 310 precedes step 324 or is performed simultaneously with step 324, and step 318 precedes step 328.

[0038] When the VPN client 62 integrates with the application 60, which is its embedded medium, at the transport level (OSI layer 4), for example, when the VPN client 62 operates as an extended function, plug-in, or add-on integrated with the application 60, the local DNS resolution loops of steps 302, 304, 306, 308, and 320 are integrated. Since details including, for example, a host name or part of a host name can be immediately added to the OSI layer 4 request, the addition can be executed immediately without the need for the local DNS resolution loops of steps 302, 304, 306, 308, and 320. The addition included in step 310 is executed to enable a consistent cache in the address index 70 on the VPN gateway 68.

[0039] In an alternative implementation, instead of applying an algorithm that compresses or hashes the host name, a counter is used to apply a count to the host name by the VPN client 62, and the count and the associated host name are provided to the VPN gateway 68 of the VPN server 66 and stored in the address index together with the corresponding host name. However, in the counter-based method, address consistency cannot be obtained among the VPN clients 62 on the heterogeneous computing devices 12. In this alternative implementation form, the VPN gateway 68 maintains a unique routing table for each VPN client 62. On the other hand, as described in process 200 or process 300, for a large number of VPN clients 62 of a specific VPN gateway 68, by consistently applying a compression algorithm or a hash algorithm to the host name, the task of determining the final address is distributed among a large number of VPN clients 62, thus improving the performance of the system.

[0040] The first advantage of processes 200, 300 realized by VPN server 66 and VPN client 62 is the speedup obtained by minimizing the round-trip segment length of DNS queries. The second advantage is the improvement of data privacy. According to research, the adoption rate of encrypted DNS has been stagnant, and in VPN deployments that bypass the tunnel and use the resolver of an organization or ISP, privacy will be lost. Of course, there can also be scenarios where the client makes an encrypted DNS connection, such as DNS-over-HTTPS. Processes 200, 300 are also applicable in such scenarios, but local resolver 64 needs to install a client certificate on computing device 12 (a "pinned certificate") to make it appear authorized. Alternatively, in such scenarios, VPN client 62 detects that it does not have a valid certificate for its endpoint and "stands down" by operating as a proxy and not responding to requests. The "pinned certificate" or "stand down" scheme is also applicable in the case of Domain Name System Security Extensions ("DNSSEC"), but DNSSEC is rare in real-world scenarios.

[0041] The processes 200, 300 enabled by the VPN server 66 and the VPN client 62 assist a user of the computing device 12 in reaching web content, particularly websites, faster while reducing loss of privacy. In particular, the user can keep the VPN client 62 enabled on the computing device 12 without suffering the speed penalty that is normally inherent in DNS resolution over the VPN tunnel. In an assumed connection where the round-trip time (RTT) between the user of the computing device 12 and the VPN server 66 is 100 ms, a speed improvement of at least 200 ms is expected in establishing the connection. This speed improvement can be directly seen from the fact that in the conventional network connection process 100, steps 104 and 110 via the network are removed. The corresponding steps 202 and 206 of the network connection process 200 are processed locally, as are steps 302 and 320 of the network connection process 300. Step 310 can be executed asynchronously at any point prior to step 324 in the network connection process 300. Thus, step 320 does not depend on the completion of step 310 and, in fact, occurs almost immediately after receiving a request to resolve the host name at step 302. In a more likely scenario of loading a typical web page that requires multiple domain names and / or a domain name that does not fit in one packet, an even greater performance improvement is expected. By the described process, the number of network-crossing requests is reduced from 9 to 7 in an absolute sense, and of those 7, 2 are executed directly from the VPN server 66 (e.g., steps 216 and 218 of process 200) instead of blocking the VPN client 62 (like steps 106 and 108 of process 100), so that when establishing a new connection, the number of network-crossing calls is reduced to 5 in a practical sense.

[0042] In addition to the above description, referring to FIGS. 3 and 4, network connection processes 200, 300 enable a first network connection method. The first network connection method includes receiving, by VPN server 66, from a VPN client 62 operating on computing device 12, via a VPN connection, a first message including a first IP address (steps 210, 310); determining, by VPN server 66, a host name based on the first IP address (steps 212, 312); resolving, by VPN server 66, the host name to a second IP address (steps 216, 218, 316, 318); and transmitting, by VPN server 66, the first message to a network device (e.g., a web / app server) at the second IP address (steps 222, 330).

[0043] VPN client 62 can apply an algorithm to a host name or a part of a host name to generate a first IP address (steps 204, 304), and VPN server 66 can apply the inverse of this algorithm to the first IP address to generate a host name or a part of a host name to determine the host name (step 212).

[0044] The first network connection method further includes receiving, by VPN client 62, a host name (steps 202, 302); assigning, by VPN client 62, a first IP address to the host name (steps 204, 308); and transmitting, by VPN client 62, a first message including the first IP address to VPN server 66 (steps 210, 324).

[0045] VPN client 62 can compress a host name or a part of a host name to generate a first IP address (step 204). VPN server 66 can decompress a host name or a part of a host name based on the first IP address to determine the host name (step 212).

[0046] The VPN client 62 can hash a host name or a part of the host name to generate a first IP address (step 308), and the VPN client 62 can send the host name or a part of the host name to the VPN server 66 (step 310). The VPN server 66 can receive, from the VPN client 62, an instruction including the first IP address and the host name or a part of the host name before receiving the first message (step 310). The VPN server 66 can store the first IP address in a database based on the instruction (step 312), and the VPN server 66 can store the host name or a part of the host name in the database based on the instruction (step 312). In response to receiving the first message, the VPN server 66 can access the database to determine a host name based on the first IP address (step 326).

[0047] The first network connection method further includes the VPN server 66 rewriting the first message to include a second IP address (steps 220, 328) for sending the first message to a network device with the second IP address (e.g., the web / app server 40) (steps 222, 330). The VPN server 66 receives, from the network device, a second message including the second IP address as the source address of the second message (steps 224, 332). The VPN server 66 rewrites the second message to include the first IP address as the source of the second message (steps 226, 334), and the VPN server 66 sends the second message including the first IP address as the source of the second message to the VPN client 62 (steps 228, 336). The first message can include, for example, a TCP synchronization (SYN) message, and the second message can include, for example, a TCP synchronization acknowledgment response (SYN-ACK) message.

[0048] In the first network connection method, resolving a host name includes the VPN server 66 sending a request including the host name to a Domain Name System (DNS) server (steps 216, 316), and the VPN server 66 receiving a second IP address from the DNS server (steps 218, 318).

[0049] The first network connection method further includes the VPN client 62 receiving, from an application 60 operating on the computing device 12, a request to resolve a host name (steps 202, 302); in response to the request to resolve the host name, the VPN client 62 sending a first IP address from the VPN client 62 to the application 60 (steps 206, 320); and the VPN client 62 receiving a first message from the application 60 (steps 208, 322). The application 60 can include, for example, an Internet browser. The VPN client 62 operates as, for example, one or more of an extension, a plug-in, or an add-on of the application 60.

[0050] In addition to the above description, referring to FIGS. 3 and 4, network connection processes 200, 300 enable a second network connection method. The second network connection method includes receiving a host name by a first computing system (e.g., executing VPN client 62) (steps 202, 302), and assigning a first IP address to the host name based on the host name or a part of the host name by the first computing system (steps 204, 308). The first computing system transmits, via a network, a message including the first IP address to a second computing system (e.g., VPN server 66) (steps 210, 324). The second computing system receives, from the first computing system, a message including the first IP address (e.g., via VPN client 62) (steps 210, 324). The second computing system determines a host name based on the first IP address (steps 212, 326). The second computing system resolves the host name to a second IP address (steps 216, 218, 316, 318), and the second computing system transmits a message to a third computing system (e.g., web / app server 40) at the second IP address (steps 222, 330). The first computing system can apply an algorithm to the host name or a part of the host name to generate the first IP address (steps 204, 308), and the second computing system can apply an inverse algorithm to the first IP address to generate a host name or a part of the host name to determine the host name (step 212).

[0051] In addition to the above description, referring to FIGS. 3 and 4, the network connection processes 200, 300 activate a computing system (e.g., VPN server 66). The computing system includes one or more processors and a memory storing executable instructions, and the executable instructions cause the system to perform operations including receiving, via a VPN connection, from a VPN client 62 operating on a computing device 12, a first message including a first IP address (steps 210, 324). The operations further include determining a host name based on the first IP address (steps 212, 326), resolving the host name to a second IP address (steps 216, 218, 316, 318), and sending the first message to a network device (e.g., web / app server 40) of the second IP address (steps 222, 330).

[0052] The operations further include rewriting the first message to include the second IP address for sending the first message to the network device of the second IP address (steps 220, 328). The operations further include receiving, from the network device, a second message including the second IP address as a source address of the second message (steps 224, 332), rewriting the second message to include the first IP address as a source of the second message (steps 226, 334), and sending the second message including the first IP address as a source of the second message to the VPN client 62 (steps 228, 336).

[0053] FIG. 5 abstractly illustrates the functionality of an exemplary computer system 1000 upon which the systems, methods, and processes described herein may be implemented. For example, computing device 12, VPN server 66, web / app server 40, and DNS server 72 may each be embodied by a particular computer system 1000 or multiple computer systems 1000. The computer system 1000 may be provided in the form of a personal computer, laptop, handheld mobile communication device, mainframe, distributed computing system, or other suitable configuration. Exemplary subject matter may be described herein as computer-executable instructions, for example, in the form of program modules, which may include programs, routines, objects, data structures, components, or architectures configured to perform particular tasks or implement particular abstract data types. The computer-executable instructions may be represented, for example, by executable instructions 1024 executable by the computer system 1000.

[0054] The computer system 1000 can operate as a stand-alone device or can be connected (e.g., networked) to other machines. In a networked deployment, the computer system 1000 can operate with the capabilities of a server or a client machine in a server-client network environment, or as a peer machine in a peer-to-peer (or distributed) network environment. The computer system 1000 can also be considered to include a set (or multiple sets) of machines that individually or jointly execute a set of instructions (or multiple sets of instructions) for performing one or more of the methodologies described herein in, for example, a cloud computing environment.

[0055] Those skilled in the art will understand that other computer systems (including, but not limited to, network - connectable personal computers, minicomputers, mainframe computers, handheld mobile communication devices, multiprocessor systems, microprocessor - based or programmable electronic devices, and smartphones) can be used to enable the systems, methods, and processes described herein. Such computer systems can further be configured as a distributed computer environment in which program modules are enabled and tasks are executed by processing devices linked via a computer network, and the program modules can be located in both local and remote memory storage devices.

[0056] A representative computer system 1000 includes a processor 1002, such as a central processing unit (CPU) or a graphics processing unit (GPU), that communicates via a bus 1008, a main memory 1004, and a static memory 1006. A display device 1010, such as a liquid crystal display (LCD), a light emitting diode (LED) display, or a cathode ray tube (CRT), is provided to display data to a user of the computer system 1000. The display device 1010 can be configured to receive data input from a user via, for example, a resistive or capacitive touch screen. A character input device 1012 can be provided in the form of a physical keyboard, or alternatively, in the form of a program module that enables a user-interactive simulated keyboard on the display device 1010 using, for example, a resistive or capacitive touch screen. An audio input device 1013, such as a microphone, enables voice language input that can be converted to text input by the processor 1002 via an instruction 1024. A pointing / selecting device 1014 is provided in the form of, for example, a computer mouse, or is enabled via a resistive or capacitive touch screen of the display device 1010. A data drive 1016, a signal generator 1018, such as an audio speaker, and a network interface 1020 can also be provided. A positioning system 1017 is also provided, which includes, for example, a GPS receiver and supporting hardware.

[0057] Instructions 1024 and data structures, such as software instructions, that embody or use the systems, methods, and processes described herein are stored on a computer-readable medium 1022 and are accessible via the data drive 1016. Further, when the instructions 1024 are executed, the instructions 1024 can exist, in whole or in part, within the main memory 1004 or within the processor 1002 for a particular period of time. The main memory 1004 and the processor 1002 are also regarded as computer-readable media in this manner.

[0058] Although the computer-readable medium 1022 is shown as one medium, the computer-readable medium 1022 can be considered to include one or more media in, for example, a centralized or distributed database storing the instructions 1024, or a related cache and server. The computer-readable medium 1022 can store, encode, or carry instructions for machine execution, cause a machine to execute any one or more of the methodologies described herein, or be used by or relate to such instructions and can be considered to include any tangible medium that can store, encode, or carry a data structure related to such instructions. Further, the term "computer-readable storage medium" can be considered to include, but is not limited to, solid-state memory, optical media, and magnetic media that can store information in a non-transitory manner. The computer-readable medium can include, for example, non-volatile memory such as semiconductor memory devices (e.g., magnetic disks such as built-in hard disks and removable disks, magneto-optical disks, CD-ROM and DVD-ROM disks, EPROM (Erasable Programmable Read-Only Memory), EEPROM (Electrically Erasable Programmable Read-Only Memory), flash memory devices).

[0059] Command 1024 can be transmitted or received via a computer network, such as computer network 8, using a signal transmission medium via a network interface 1020 that operates under one or more known transfer protocols such as FTP, HTTP, or HTTPs. Examples of computer networks include local area networks (LANs), wide area networks (WANs), the Internet, cellular phone networks, POTS (Plain Old Telephone) networks, and wireless data networks such as Wi-FiTM and 3G / 4G / 5G cellular networks. The term "computer-readable signal medium" can be considered to include any transient non-tangible medium that can store, encode, or carry instructions for machine execution, including digital or analog communication signals, or other non-tangible media for facilitating the communication of such instructions.

[0060] Features and elements are described above in specific combinations, but those skilled in the art will understand that each feature or element can be used alone or in any combination with other features and elements. The implementation of the processes described herein may require or be able to benefit from repeated application of the processes described herein, and each application of the process can be performed independently of another without the need for adjustment during the application of the process. The methods described herein can be implemented in a computer program, software, or firmware incorporated in a computer-readable medium for execution by a computer or processor.

[0061] Although the embodiments have been described in detail above, these embodiments are non-limiting and should be regarded as merely illustrative. Modifications and extensions can be developed, and all such modifications are considered to be within the scope defined by the appended claims.

Claims

1. Receiving, by a VPN server, from a VPN client operating on a computing device, via a VPN connection, a first message including a first IP address; Determining, by the VPN server, a host name based on the first IP address; Resolving, by the VPN server, the host name to a second IP address; Transmitting, by the VPN server, the first message to a network device of the second IP address, a network connection method comprising.

2. Receiving, by the VPN client, the host name; Assigning, by the VPN client, the first IP address to the host name; Further comprising transmitting, by the VPN client, the first message including the first IP address to the VPN server, the method according to claim 1.

3. Applying, by the VPN client, an algorithm to the host name or a part of the host name to generate the first IP address; Generating, by the VPN server, the host name or a part of the host name, and applying, to the first IP address, the inverse of the algorithm to determine the host name, the method according to claim 2 further comprising.

4. Further comprising compressing, by the VPN client, the host name or a part of the host name to generate the first IP address, the method according to claim 3.

5. Further comprising decompressing, by the VPN server, the host name or a part of the host name based on the first IP address to determine the host name, the method according to claim 4.

6. Hashing, by the VPN client, the host name or a part of the host name to generate the first IP address; Further comprising transmitting, by the VPN client, the host name or a part of the host name to the VPN server, the method according to claim 2.

7. Receiving, by the VPN server, from the VPN client, an instruction including the first IP address and the host name or a part of the host name before receiving the first message; The VPN server saves the first IP address in the database based on the instruction; The VPN server saves the host name or a part of the host name in the database based on the instruction; The method according to claim 6, further comprising: the VPN server accessing the database to determine the host name based on the first IP address in response to receiving the first message. **Claim 8** The method according to claim 1, further comprising: the VPN server rewriting the first message to include the second IP address so as to transmit the first message to the network device of the second IP address. **Claim 9** The VPN server receives a second message from the network device, wherein the second message includes the second IP address as the source address of the second message; The VPN server rewrites the second message to include the first IP address as the source of the second message; The method according to claim 8, further comprising: the VPN server transmitting the second message including the first IP address as the source of the second message to the VPN client. **Claim 10** The first message includes a TCP synchronization (SYN) message; The method according to claim 9, wherein the second message includes a TCP synchronization acknowledgment (SYN-ACK) message. **Claim 11** Resolving the host name includes: The VPN server transmitting a request including the host name to a domain name system (DNS) server; The VPN server receiving the second IP address from the DNS server. The method according to claim 1. **Claim 12** The VPN client receives a request to resolve a host name from an application operating on the computing device; In response to the request to resolve the host name, the VPN client transmits the first IP address to the application. The method according to claim 1, further comprising receiving, by the VPN client, the first message from the application.

13. The method according to claim 12, wherein the application includes an Internet browser.

14. The method according to claim 12, wherein the VPN client operates as at least one of an extension, a plugin, and an add-on of the application.

15. The method according to claim 1, wherein the first message includes a TCP synchronization (SYN) message.

16. Receiving, by a first computing system, a host name; Allocating, by the first computing system, a first IP address to the host name based on the host name or a part of the host name; Transmitting, by the first computing system, a message including the first IP address to a second computing system via a network; Receiving, by the second computing system, the message including the first IP address from the first computing system; Determining, by the second computing system, the host name based on the first IP address; Resolving, by the second computing system, the host name to a second IP address; Transmitting, by the second computing system, the message to a third computing system at the second IP address, a network connection method comprising.

17. Applying, by the first computing system, an algorithm to the host name or a part of the host name to generate the first IP address; The network connection method according to claim 16, further comprising applying, by the second computing system, a reverse of the algorithm to the first IP address to generate the host name or a part of the host name to determine the host name.

18. A system comprising one or more processors and a memory storing executable instructions, wherein The executable instructions, when executed, cause the system to Receiving, from a VPN client operating on a computing device via a VPN connection, a first message including a first IP address; Determining a host name based on the first IP address; Resolving the host name to a second IP address; Sending the first message to a network device of the second IP address. A system for performing operations including these steps.

19. The executable instructions, when executed, cause the system to Rewrite the first message to include the second IP address so as to send the first message to the network device of the second IP address. The system according to claim 18, further performing an operation including this step.

20. The executable instructions, when executed, cause the system to Receive, from the network device, a second message, wherein the second message includes the second IP address as the source address of the second message; Rewrite the second message to include the first IP address as the source of the second message; Send the second message including the first IP address as the source of the second message to the VPN client. The system according to claim 18, further performing an operation including these steps.

Images