Controlling work load of a web server

Abstract

A work load of a web server that is caused by sequence of requests sent by one or more client devices is reduced by blocking (such as discarding, delaying, or dropping) part of, or whole of, the requests in the sequence, so that the one or more client devices are not identified as causing a Denial- of-Service (DoS) attack or Distributed Denial-of-Service attack (DDoS attack). The blocking may be in response to metering, continuously or periodically, of a Round-Trip delay Time (RTT) to the web server, or metering a feature or amount of the sent sequence of requests, the received responses therefrom, or any combination thereof. The blocking may be in response to comparing the metered value to a threshold, or in response to a correlation between the metered values, where the blocking is performed in response to the metered value being above the threshold. The process may be repeated.

Description

[0001] CONTROLLING WORK LOAD OF A WEB SERVER

[0002] RELATED APPLICATION

[0003] This patent application claims priority from U.S. Provisional Application Ser. No. 63 / 661,970, which was filed on June 20, 2024 and entitled: “ Cont rolling work load of a web server", which is hereby incorporated herein by reference in its entirety.

[0004] TECHNICAL FIELD

[0005] This disclosure relates generally to an apparatus, a system, and a method for reducing work load of a web server, such as for avoiding a sequence of requests to be identified as a Denial- of-Service (DoS) attack or Distributed Denial-of-Service attack (DDoS attack). In particular, a work load of a web server may be estimated by metering the sequence of requests or the responses thereto, or by metering of a Round-Trip delay Time (RTT), and blocking, discarding, or delaying requests in response to the estimated work load.

[0006] BACKGROUND

[0007] Unless otherwise indicated herein, the materials described in this section are not prior art to the claims in this application and are not admitted to be prior art by inclusion in this section.

[0008] The Internet is a global system of interconnected computer networks that use the standardized Internet Protocol Suite (TCP / IP), including the Transmission Control Protocol (TCP) and the Internet Protocol (IP), to serve billions of users worldwide. It is a network of networks, that consists of millions of private, public, academic, business, and government networks, of local to global scope, that are linked by a broad array of electronic and optical networking technologies. The Internet carries a vast range of information resources and services, such as the interlinked hypertext documents on the World Wide Web (WWW) and the infrastructure to support electronic mail. The Internet backbone refers to the principal data routes between large, strategically interconnected networks and core routers on the Internet. These data routes are hosted by commercial, government, academic, and other high-capacity network centers, the Internet exchange points and network access points that interchange Internet traffic between the countries, continents, and across the oceans of the world. Traffic interchange between Internet service providers (often Tier 1 networks) participating in the Internet backbone exchange traffic by privately negotiated interconnection agreements, primarily governed by the principle of settlement-free peering. The Transmission Control Protocol (TCP) is one of the core protocols of the Internet Protocol suite (IP) described in RFC 675 and RFC 793, and the entire suite is often referred to as TCP / IP. TCP provides reliable, ordered, and error-checked delivery of a stream of octets between programs running on computers connected to a local area network, intranet or the public Internet, and resides at a transport layer. Web browsers typically use TCP when they connect to servers on the World Wide Web (WWW), and are used to deliver an email and transfer files from one location to another. HTTP, HTTPS, SMTP, POP3, IMAP, SSH, FTP, Telnet and a variety of other protocols that are typically encapsulated in TCP. As the transport layer of TCP / IP suite, the TCP provides a communication service at an intermediate level between an application program and the Internet Protocol (IP). Due to a network congestion, traffic load balancing, or other unpredictable network behavior, IP packets can be lost, duplicated, or delivered out of order. TCP detects these problems, requests retransmission of lost data, rearranges out-of-order data, and even helps minimize the network congestion to reduce the occurrence of the other problems. Once the TCP receiver has reassembled the sequence of octets originally transmitted, it passes them to the receiving application. Thus, TCP abstracts the application's communication from the underlying networking details. The TCP is utilized extensively by many of the Internet's most popular applications, including the World Wide Web (WWW), E-mail, File Transfer Protocol, Secure Shell, peer-to-peer file sharing, and some streaming media applications.

[0009] While the IP layer handles the actual delivery of the data, TCP keeps track of the individual units of data transmission, called segments, which a message is divided into for efficient routing through the network. For example, when an HTML file is sent from a web server, the TCP software layer of that server divides the sequence of octets of the file into segments and forwards them individually to the IP software layer (Internet Layer). The Internet Layer encapsulates each TCP segment into an IP packet by adding a header that includes (among other data) the destination IP address. When the client program on the destination computer receives them, the TCP layer (Transport Layer) reassembles the individual segments and ensures they are correctly ordered and error-free as it streams them to an application.

[0010] The TCP protocol operations may be divided into three phases. Connections must be properly established in a multi-step handshake process (connection establishment) before entering the data transfer phase. After data transmission is completed, the connection termination closes established virtual circuits and releases all allocated resources. A TCP connection is typically managed by an operating system through a programming interface that represents the local endpoint for communications, an Internet socket. During the duration of a TCP connection, the local end-point undergoes a series of state changes. A tutorial on the TCP / IP protocol suite, focusing particularly on the steps in forwarding an IP datagram from source host to destination host through a router, is disclosed in IETF RFC 1180 by Socolofsky, T. el al., entitled “TCP / IP Tutorial”, RFC 1180, dated January 1991, which is incorporated in its entirety for all purposes as if fully set forth herein.

[0011] Since TCP / IP is based on the client / server model of operation, the TCP connection setup involves the client and server preparing for the connection by performing an OPEN operation. A client process initiates a TCP connection by performing an active OPEN, sending a S YN message to a server. The server process using TCP prepares for an incoming connection request by performing a passive OPEN. Both devices create for each TCP session a data structure used to hold important data related to the connection, called a Transmission Control Block (TCB).

[0012] There are two different kinds of OPEN, named ‘Active OPEN’ and ‘Passive OPEN’. In Active OPEN the client process using TCP takes the “active role” and initiates the connection by actually sending a TCP message to start the connection (the SYN message). In Passive OPEN the server process designed to use TCP is contacting TCP and saying: “I am here, and I am waiting for clients that may wish to talk to me to send me a message on the following port number”. The OPEN is called passive because aside from indicating that the process is listening, the server process does nothing. The passive OPEN can in fact specify that the server is waiting for an active OPEN from a specific client, though not all TCP / IP APIs support this capability. More commonly, a server process is willing to accept connections from all comers, and as such the passive OPEN is then to be unspecified.

[0013] In the passive OPEN, the TCP uses a three-way handshake, and before a client attempts to connect with a server, the server must first bind to and listen at a port to open it up for connections. Once the passive OPEN is established, a client may initiate an active OPEN. To establish a connection, the three-way (or 3-step) handshake occurs:

[0014] 1. SYN: The active open is performed by the client sending the SYN to the server. The client sets the segment's sequence number to a random value A.

[0015] 2. SYN-ACK: In response, the server replies with a SYN-ACK. The acknowledgment number is set to one more than the received sequence number, i.e. A+l, and the sequence number that the server chooses for the packet is another random number, B.

[0016] 3. ACK: Finally, the client sends an ACK back to the server. The sequence number is set to the received acknowledgement value, i.e. A+l, and the acknowledgement number is set to one more than the received sequence number i.e., B+l.

[0017] At this point, both the client and server have received an acknowledgment of the connection. The steps 1 and 2 establish the connection parameter (sequence number) for one direction and it is acknowledged. The steps 2 and 3 establish the connection parameter (sequence number) for the other direction and it is acknowledged, and then a full-duplex communication is established.

[0018] TCP keepalive. When two hosts are connected over a network via TCP / IP, TCP Keepalive Packets can be used to determine if the connection is still valid, and terminate it if needed. Most of the hosts that support TCP also support TCP Keepalive, where each host (or peer) periodically sends a TCP packet to its peer which solicits a response. The TCP keepalive scheme involves using timers when setting up a TCP connection, and when the keepalive timer reaches zero, a keepalive probe packet is sent with no data in it and the ACK flag turned on. This procedure is useful because if the other peers lose their connection (for example by rebooting) the broken connection is noticed, even when no traffic on it is being exchanged. If the keepalive probe is not replied to, the connection cannot be considered valid anymore. The TCP keepalive mechanism may be used to prevent inactivity from disconnecting the channel. For example, when being behind a NAT proxy or a firewall, a host may be disconnected without any reason. This behavior is caused by the connection tracking procedures implemented in proxies and firewalls, which keep track of all connections that pass through them. Due to the physical limits of these machines, they can only keep a finite number of connections in their memory. The most common and logical policy is to keep the newest connections and to discard the old and inactive connections first.

[0019] A keepalive signal is often sent at predefined intervals, and plays an important role on the Internet. After a signal is sent, if no reply is received the link is assumed to be down and future data will be routed via another path until the link is up again. The keepalive signal can also be used to indicate to Internet infrastructure that the connection should be preserved. Without a keepalive signal, intermediate NAT-enabled routers can drop the connection after the timeout. Since the only purpose is to find links that don't work or to indicate connections that should be preserved, the keepalive messages tend to be short and not take much bandwidth.

[0020] Transmission Control Protocol (TCP) keepalives are an optional feature, and if included must default to off. The keepalive packet contains null data, and in an Ethernet network, a keepalive frame length is 60 bytes, while the server response to this, also a null data frame, is 54 bytes. There are three parameters related to the keepalive mechanism: (1) Keepalive time is the duration between two keepalive transmissions in an idle condition where the TCP keepalive period is required to be configurable and by default is set to no less than 2 hours; (2) Keepalive interval is the duration between two successive keepalive retransmissions, if acknowledgement to the previous keepalive transmission is not received; and (3) Keepalive retry is the number of retransmissions to be carried out before declaring that remote end is not available. Internet Protocol (IP). The Internet Protocol (IP) is the principal communications protocol used for relaying datagrams (packets) across a network using the Internet Protocol Suite. Responsible for routing packets across network boundaries, it is the primary protocol that establishes the Internet. The IP is the primary protocol in the Internet Layer of the Internet Protocol Suite and has the task of delivering datagrams from the source host to the destination host based on their addresses. For this purpose, IP defines addressing methods and structures for datagram encapsulation. Internet Protocol Version 4 (IPv4) is the dominant protocol of the Internet. Further, IPv4 is described in Internet Engineering Task Force (IETF) Request for Comments (RFC) 791 and RFC 1349, and the successor, Internet Protocol Version 6 (IPv6), is currently active and in growing deployment worldwide. IPv4 uses 32-bit addresses (providing 4 billion: 4.3xl09addresses), while IPv6 uses 128-bit addresses (providing 340 undecillion or 3.4xl038addresses), as described in RFC 2460.

[0021] An overview of an IP-based packet 15 is shown in FIG. 2a. The packet may be generally segmented into the IP data 16b to be carried as payload, and the IP header 16f. The IP header 16f contains the IP address of the source as Source IP Address field 16d and the Destination IP Address field 16c. In most cases, the IP header 16f and the payload 16b are further encapsulated by adding a Frame Header 16e and a Frame Footer 16a used by the higher-layer protocols.

[0022] The Internet Protocol is responsible for addressing hosts and routing datagrams (packets) from a source host to the destination host across one or more IP networks. For this purpose, the Internet Protocol defines an addressing system that has two functions. Addresses identify hosts and provide a logical location service, each packet is tagged with a header that contains the metadata for the purpose of delivery. This process of tagging is also called encapsulation. IP is a connectionless protocol for use in a packet- switched Link Layer network, and does not need circuit setup prior to transmission. The aspects of guaranteeing delivery, proper sequencing, avoidance of duplicate delivery, and data integrity are addressed by an upper transport layer protocol (e.g., TCP - Transmission Control Protocol and UDP - User Datagram Protocol).

[0023] The main aspects of the IP technology are IP addressing and routing. Addressing refers to how IP addresses are assigned to end hosts and how sub-networks of IP host addresses are divided and grouped together. IP routing is performed by all hosts, but most importantly by internetwork routers, which typically use either Interior Gateway Protocols (IGPs) or External Gateway Protocols (EGPs) to help make IP datagram forwarding decisions across IP connected networks. Core routers serving in the Internet backbone commonly use the Border Gateway Protocol (BGP) as per RFC 4098 or Multiprotocol Label Switching (MPLS). Other prior art publications relating to Internet related protocols and routing include the following chapters of the publication number 1-587005-001-3 by Cisco Systems, Inc. (7 / 99) entitled: "Internetworking Technologies Handbook", which are all incorporated in their entirety for all purposes as if fully set forth herein: Chapter 5: "Routing Basics" (pages 5-1 to 5-10), Chapter 30: " Internet Protocols" (pages 30-1 to 30-16), Chapter 32: "IPv6" (pages 32-1 to 32- 6), Chapter 45: " OSI Routing" (pages 45-1 to 45-8) and Chapter 51: "Security" (pages 51-1 to 51-12), as well as in an IBM Corporation, International Technical Support Organization Redbook Documents No. GG24-4756-00, entitled: "Local area Network Concepts and Products: LAN Operation Systems and management", 1st Edition May 1996, Redbook Document No. GG24-4338-00, entitled: "Introduction to Networking Technologies" , 1stEdition April 1994, Redbook Document No. SG24- 2580-01 "IP Network Design Guide", 2"'1Edition June 1999, and Redbook Document No. GG24- 3376-07 "TCP / IP Tutorial and Technical Overview", ISBN 07384946828thEdition Dec. 2006, which are incorporated in their entirety for all purposes as if fully set forth herein.

[0024] An Internet packet typically includes a value of Time-to-Live (TTL) for avoiding the case of packet looping endlessly. The initial TTL value is set in the header of the packet, and each router in the packet path subtracts one from the TTL field, and the packet is discarded upon the value exhaustion. Since the packets may be routed via different and disparately located routers and servers, the TTL of the packets reaching the ultimate destination computer is expected to vary.

[0025] The Internet architecture employs a client-server model, among other arrangements. The terms 'server' or 'server computer' relates herein to a device or a computer (or plurality of computers) connected to the Internet and is used for providing facilities or services to other computers or other devices (referred to in this context as 'clients') connected to the Internet. The server is commonly a host that has an IP address and executes a 'server program', and typically operates as a socket listener. Many servers have dedicated functionality such as web server, Domain Name System (DNS) server (described in RFC 1034 and RFC 1035), Dynamic Host Configuration Protocol (DHCP) server (described in RFC 2131 and RFC 3315), mail server, File Transfer Protocol (FTP) server and database server. Similarly, the term 'client' is used herein to include, but not limited to, a program or to a device (such as a computer or a series of computers) executing this program, which accesses the server over the Internet for a service or a resource. Clients commonly initiate connections that a server may accept. For non-limiting example, web browsers are clients that connect to web servers for retrieving web pages, and email clients connect to mail storage servers for retrieving the mails.

[0026] Web-page. A web-page is typically a collection of information, consisting of one or more resources, intended to be rendered simultaneously, and identified by a single Uniform Resource Identifier. More specifically, the web page may consist of a resource with zero, one, or more embedded resources intended to be rendered as a single unit, and referred to by the URI of the one resource which is not embedded. A Uniform Resource Identifier (URI) is intended to be recognized by a user as representing the identity of a specific Web Page (resource). A resource may include a network data object or service that can be identified by a URI. Resources may be available in multiple representations (e.g., multiple languages, data formats, size, or resolution) or vary in other ways. The URI specification defines a Uniform Resource Identifier (URI) or URL (Uniform Resource Locator) as a compact string of characters for identifying an abstract or physical resource. A web-page may be generated using one or more browser-supported languages including, but are not limited to, JavaScript, VBScript, Hyper Text Markup Language (HTML), or any other type of language for writing web pages. Any web page may be served over the network using one or more servers as may be necessary.

[0027] Hostname. A hostname is a label that is assigned to a device connected to a computer network and that is used to identify the device in various forms of electronic communication, such as the World Wide Web (WWW). The hostnames may be simple names consisting of a single word or phrase, or they may be structured. Each hostname usually has at least one numeric network address associated with it for routing packets for performance and other reasons. Internet hostnames may have appended the name of a Domain Name System (DNS) domain, separated from the host-specific label by a period ("dot"). In the latter form, a hostname is also called a domain name. If the domain name is completely specified, including a top-level domain of the Internet, then the hostname is referred to as a Fully Qualified Domain Name (FQDN). The hostnames that include DNS domains are often stored in the Domain Name System together with the IP addresses of the host they represent for the purpose of mapping the hostname to an address, or the reverse process.

[0028] A hostname may be a domain name, if it is properly organized into the domain name system. A domain name may be a hostname if it has been assigned to an Internet host and associated with the host's IP address. Hostnames are composed of a sequence of labels concatenated with dots. For example, "en.wikipedia.org" is a hostname. Each label must be from 1 to 63 characters long. The entire hostname, including the delimiting dots, has a maximum of 253 ASCII characters. General guidelines on choosing a good hostname are outlined in RFC 1178.

[0029] HTTP. The Hypertext Transfer Protocol (HTTP) is an application protocol for distributed, collaborative, hypermedia information systems, commonly used for communication over the Internet. The HTTP is the protocol to exchange or transfer hypertext, which is a structured text that uses logical links (hyperlinks) between nodes containing text. HTTP version 1.1 was standardized as RFC 2616 (June 1999), which was replaced by a set of standards (obsoleting RFC 2616), including RFC 7230 - ‘HTTP / 1.1: Message Syntax and Routing ’, RFC 7231 - ‘HTTP / 1.1: Semantics and Content’ , RFC 7232 - ‘HTTP / 1.1: Conditional Requests’, RFC 7233 - ‘HTTP / 1.1: Range Requests’, RFC 7234 - ‘HTTP / 1.1: Caching’ , and RFC 7235 - ‘HTTP / 1.1: Authentication . HTTP functions as a requestresponse protocol in the client-server computing model. A web browser, for example, may be the client and an application running on a computer hosting a website may be the server. The client submits an HTTP request message to the server. The server, which provides resources such as HTML files and other content, or performs other functions on behalf of the client, returns a response message to the client. The response contains completion status information about the request and may also contain requested content in its message body. A web browser is an example of a User Agent (UA). Other types of the user agent include the indexing software used by search providers (web crawlers), voice browsers, mobile apps and other software that accesses, consumes or displays web content.

[0030] HTTP is designed to permit intermediate network elements to improve or enable communications between clients and servers. High- traffic websites often benefit from web cache servers that deliver content on behalf of upstream servers to improve response time. Web browsers cache previously accessed web resources and reuse them when possible, to reduce network traffic. HTTP proxy servers at private network boundaries can facilitate communication for clients without a globally routable address, by relaying messages with external servers. HTTP is an application layer protocol designed within the framework of the Internet Protocol Suite. Its definition presumes an underlying and reliable transport layer protocol, and Transmission Control Protocol (TCP) is commonly used. However, HTTP can use unreliable protocols such as the User Datagram Protocol (UDP), for example, in the Simple Service Discovery Protocol (SSDP). HTTP resources are identified and located on the network by Uniform Resource Identifiers (URIs) or, more specifically, Uniform Resource Locators (URLs), using the http or https URI schemes. URIs and hyperlinks in Hypertext Markup Language (HTML) documents form webs of inter-linked hypertext documents. An HTTP session is a sequence of network request-response transactions. An HTTP client initiates a request by establishing a Transmission Control Protocol (TCP) connection to a particular port on a server. An HTTP server listening on that port waits for a client's request message. Upon receiving the request, the server sends back a status line, such as "HTTP / 1.1200 OK", and a message of its own. The body of this message is typically the requested resource, although an error message or other information may also be returned. HTTP is a stateless protocol that does not require the HTTP server to retain information or status.

[0031] HTTP persistent connection, also called HTTP keep-alive, or HTTP connection reuse, refers to using a single TCP connection to send and receive multiple HTTP requests / responses, as opposed to opening a new connection for every single request / response pair. Persistent connections provide a mechanism by which a client and a server can signal the close of a TCP connection. This signaling takes place using the Connection header field. The HTTP persistent connection is described in IETF RFC 2616, entitled: “Hypertext Transfer Protocol — HTTP / 1.1” . In HTTP 1.1, all connections are considered persistent unless declared otherwise. The HTTP persistent connections do not use separate keepalive messages, but they allow multiple requests to use a single connection. The advantages of using persistent connections involve lower CPU and memory usage (because fewer connections are open simultaneously), enabling HTTP pipelining of requests and responses, reduced network congestion (due to fewer TCP connections), and reduced latency in subsequent requests (due to minimal handshaking). Any connection herein may use, or be based on, an HTTP persistent connection.

[0032] HTTPS. HTTPS (also referred to as HTTP over Transport Layer Security (TLS), HTTP over SSL, and HTTP Secure) is a communications protocol for secure communication over a computer network which is widely used on the Internet. HTTPS consists of communication over Hypertext Transfer Protocol (HTTP) within a connection encrypted by Transport Layer Security, or its predecessor, Secure Sockets Layer. The main motivation for HTTPS is authentication of the visited website and protection of the privacy and integrity of the exchanged data. HTTPS typically provides authentication of the website and associated web server with which one is communicating, which protects against man-in-the-middle attacks. Additionally, it provides bidirectional encryption of communications between a client and server, which protects against eavesdropping and tampering with or forging the contents of the communication. In practice, this provides a reasonable guarantee that one is communicating with precisely the website that one intended to communicate with (as opposed to an impostor), as well as ensuring that the contents of communications between the user and site cannot be read or forged by any third party.

[0033] The HTTPS Uniform Resource Identifier (URI) scheme has identical syntax to the standard HTTP scheme, aside from its scheme token. However, HTTPS signals the browser to use an added encryption layer of SSL / TLS to protect the traffic. SSL / TLS is especially suited for HTTP, since it can provide some protection even if only one side of the communication is authenticated. This is the case with HTTP transactions over the Internet, where typically only the server is authenticated (by the client examining the server's certificate). HTTPS creates a secure channel over an insecure network, hence ensuring reasonable protection from eavesdroppers and man-in-the-middle attacks, provided that adequate cipher suites are used and that the server certificate is verified and trusted. Because HTTPS piggybacks HTTP entirely on top of TLS, the entirety of the underlying HTTP protocol can be encrypted. This includes the request URL (which particular web-page was requested), query parameters, headers, and cookies (which often contain identity information about the user). However, because host (website) addresses and port numbers are necessarily part of the underlying TCP / IP protocols, HTTPS cannot protect their disclosure. In practice this means that even on a correctly configured web server, eavesdroppers can infer the IP address and port number of the web server (sometimes even the domain name e.g., www.example.org, but not the rest of the URL) that one is communicating with, as well as the amount (data transferred) and duration (length of session) of the communication, though not the content of the communication. A ‘domain’ or a ‘network domain’ is an administrative grouping of multiple private computer networks or local hosts within the same infrastructure. Domains can be identified using a domain name; domains which need to be accessible from the public Internet can be assigned a globally unique name within the Domain Name System (DNS).

[0034] Deploying HTTPS also allows the use of HTTP / 2 (or its predecessor, the now-deprecated protocol SPDY), that are new generations of HTTP, designed to reduce page load times and latency. HTTP Strict Transport Security (HSTS) is typically used with HTTPS to protect users from man-in- the-middle attacks, especially SSL stripping. While HTTPS URLs begin with "https: / / " and use port 443 by default, or alternatively 8443, the HTTP URLs begin with "http: / / " and use port 80 by default, and HTTP is not encrypted and is thus vulnerable to man-in-the-middle and eavesdropping attacks, which can let attackers gain access to website accounts and sensitive information, and modify webpages to inject malware or advertisements. HTTPS is designed to withstand such attacks and is considered secure against them (with the exception of older, deprecated versions of SSL).

[0035] IETF RFC 2818 by E. Rescorla entitled: “HTTP Over TLS' published May 2000, which is incorporated in its entirety for all purposes as if fully set forth herein, describes how to use TLS to secure HTTP connections over the Internet. Current practice is to layer HTTP over SSL (the predecessor to TLS), distinguishing secured traffic from insecure traffic by the use of a different server port. This document documents that practice using TLS. A companion document describes a method for using HTTP / TLS over the same port as normal HTTP [RFC2817].

[0036] HTTP / 2. HTTP / 2 is a major revision of the HTTP network protocol used by the World Wide Web. It was derived from the earlier experimental SPDY protocol, originally developed by Google, and was developed by the HTTP Working of the Internet Engineering Task Force (IETF). The HTTP / 2 specification was published as IETF RFC 7540 on May 14, 2015, is entitled: “Hypertext Transfer Protocol Version 2 (HTTP / 2 )” and is incorporated in its entirety for all purposes as if fully set forth herein. The RFC 7540 describes an optimized expression of the semantics of the Hypertext Transfer Protocol (HTTP), referred to as HTTP version 2 (HTTP / 2). HTTP / 2 enables a more efficient use of network resources and a reduced perception of latency by introducing header field compression and allowing multiple concurrent exchanges on the same connection. It also introduces unsolicited push of representations from servers to clients.

[0037] HTTP / 3. HTTP / 3 is the third major version of the Hypertext Transfer Protocol used to exchange information on the World Wide Web, alongside HTTP / 1.1 and HTTP / 2. HTTP / 3 always runs over QUIC relying on UDP (as opposed to TCP used by earlier revisions of HTTP), and uses the same semantics as the earlier revisions, including the same request methods, status codes, and message fields, but encodes them differently and maintains session state differently. HTTP semantics are consistent across versions: the same request methods, status codes, and message fields are typically applicable to all versions. The differences are in the mapping of these semantics to underlying transports. Both HTTP / 1.1 and HTTP / 2 use TCP as their transport. HTTP / 3 uses QUIC, a transport layer network protocol which uses user space congestion control over the User Datagram Protocol (UDP). The switch to QUIC aims to fix a major problem of HTTP / 2 called "head-of-line blocking": because the parallel nature of HTTP / 2's multiplexing is not visible to TCP's loss recovery mechanisms, a lost or reordered packet causes all active transactions to experience a stall regardless of whether that transaction was impacted by the lost packet. Because QUIC provides native multiplexing, lost packets only impact the streams where data has been lost.

[0038] HTTP / 3 is described in IETF RFC 9114 entitled: “HTTP / 3” published June 2022, which is incorporated in its entirety for all purposes as if fully set forth herein. The QUIC transport protocol has several features that are desirable in a transport for HTTP, such as stream multiplexing, per-stream flow control, and low-latency connection establishment. The RFC 9114 document describes a mapping of HTTP semantics over QUIC, and also identifies HTTP / 2 features that are subsumed by QUIC and describes how HTTP / 2 extensions can be ported to HTTP / 3.

[0039] HTTP Status codes. The Hypertext Transfer Protocol (HTTP) is a stateless applicationlevel protocol for distributed, collaborative, hypertext information systems. The semantics of HTTP / 1.1 messages, as expressed by request methods, request header fields, response status codes, and response header fields, along with the payload of messages (metadata and body content) and mechanisms for content, are described in IETF RFC 7231, entitled: “Hypertext Transfer Protocol (HTTP / 1.1 ): Semantics and Content” (June 2014), which is incorporated in its entirety for all purposes as if fully set forth herein. Status codes are typically issued by a server in response to a client request made to the server. The first digit of the status code specifies one of five standard classes of responses. The message phrases shown are typical, but any human- readable alternative may be provided. A server device (in server / client architecture) typically offers information resources, services, and applications to clients, and is using a server dedicated or oriented operating system. Current popular server operating systems are based on Microsoft Windows (by Microsoft Corporation, headquartered in Redmond, Washington, U.S.A.), Unix, and Linux-based solutions, such as the ‘Windows Server 2012’ server operating system is part of the Microsoft ‘Windows Server’ OS family, that was released by Microsoft on 2012, providing enterprise-class datacenter and hybrid cloud solutions that are simple to deploy, cost-effective, application-focused, and usercentric, and is described in Microsoft publication entitled: “ Inside-Out Windows Server 2012”, by William R. Stanek, published 2013 by Microsoft Press, which is incorporated in its entirety for all purposes as if fully set forth herein.

[0040] Unix (trademarked as ‘UNIX’) operating systems are widely used in servers, and is a multitasking, multiuser computer operating system that exists in many variants and is characterized by a modular design that is sometimes called the "Unix philosophy," meaning the OS provides a set of simple tools that each perform a limited, well-defined function, with a unified filesystem as the main means of communication, and a shell scripting and command language to combine the tools to perform complex workflows. The Unix was designed to be portable, multitasking and multi-user in a time-sharing configuration, and the Unix systems are characterized by various concepts: the use of plain text for storing data; a hierarchical file system; treating devices and certain types of Inter-Process Communication (IPC) as files; and the use of a large number of software tools, small programs that can be strung together through a command line interpreter using pipes, as opposed to using a single monolithic program that includes all of the same functionality. Under Unix, the operating system consists of many utilities along with the master control program, a kernel. The kernel provides services to start and stop programs, handles the file system and other common "low level" tasks that most programs share, and schedules access to avoid conflicts when programs try to access the same resource or device simultaneously. To mediate such access, the kernel has special rights, reflected in the division between user-space and kernel-space. The Unix is described in a publication entitled: “UNIX Tutorial” by tutorialspoint.com, downloaded on July 2014, which is incorporated in its entirety for all purposes as if fully set forth herein.

[0041] A client device (in server / client architecture) typically receives information resources, services, and applications from servers, and is using a client dedicated or oriented operating system. Current popular server operating systems are based on Microsoft Windows (by Microsoft Corporation, headquartered in Redmond, Washington, U.S.A.), which is a series of graphical interface operating systems developed, marketed, and sold by Microsoft. Microsoft Windows is described in Microsoft publications entitled: "Windows Internals - Part 7” and "Windows Internals - Part 2”, by Mark Russinovich, David A. Solomon, and Alex loescu, published by Microsoft Press in 2012, which are both incorporated in their entirety for all purposes as if fully set forth herein. Windows 8 is a personal computer operating system developed by Microsoft as part of the Windows NT family of operating systems, that was released for general availability on October 2012, and is described in Microsoft Press 2012 publication entitled: "Introducing Windows 8 An Overview for IT Professionals ' by Jerry Honeycutt, which is incorporated in its entirety for all purposes as if fully set forth herein.

[0042] Chrome OS is a Linux kernel-based operating system designed by Google Inc. out of Mountain View, California, U.S.A., to work primarily with web applications. The user interface takes a minimalist approach and consists almost entirely of just the Google Chrome web browser; since the operating system is aimed at users who spend most of their computer time on the Web, the only "native" applications on Chrome OS are a browser, media player and file manager, and hence the Chrome OS is almost a pure web thin client OS.

[0043] The Chrome OS is described as including a three-tier architecture: firmware, browser and window manager, and system-level software and userland services. The firmware contributes to fast boot time by not probing for hardware, such as floppy disk drives, that are no longer common on computers, especially netbooks. The firmware also contributes to security by verifying each step in the boot process and incorporating system recovery. The system-level software includes the Linux kernel that has been patched to improve boot performance. The userland software has been trimmed to essentials, with management by Upstart, which can launch services in parallel, re-spawn crashed jobs, and defer services in the interest of faster booting. The Chrome OS user guide is described in the Samsung Electronics Co., Ltd. presentation entitled: "Google™ Chrome OS USER GUIDE" published 2011, which is incorporated in its entirety for all purposes as if fully set forth herein.

[0044] RTOS. A Real-Time Operating System (RTOS) is an Operating System (OS) intended to serve real-time applications that process data as it comes in, typically without buffer delays. The processing time requirements (including any OS delay) are typically measured in tenths of seconds or shorter increments of time, and is a time bound system which has well defined fixed time constraints. The processing is commonly to be done within the defined constraints, or the system will fail. They either are event driven or time sharing, where event driven systems switch between tasks based on their priorities while time sharing systems switch the task based on clock interrupts. A key characteristic of the RTOS is the level of its consistency concerning the amount of time it takes to accept and complete an application's task; the variability is jitter. A hard real-time operating system has less jitter than a soft real-time operating system. The chief design goal is not high throughput, but rather a guarantee of a soft or hard performance category. An RTOS that can usually or generally meet a deadline is a soft real-time OS, but if it can meet a deadline deterministically it is a hard real-time OS. The RTOS has an advanced algorithm for scheduling, and includes a scheduler flexibility that enables a wider, computer-system orchestration of process priorities. Key factors in a real-time OS are minimal interrupt latency and minimal thread switching latency; a real-time OS is valued more for how quickly or how predictably it can respond than for the amount of work it can perform in a given period of time.

[0045] Common designs of RTOS include event-driven, where tasks are switched only when an event of higher priority needs servicing; called preemptive priority, or priority scheduling, and time-sharing, where tasks are switched on a regular clocked intermpt, and on events; called round robin. The timesharing design switches tasks more often than strictly needed, but give smoother multitasking, giving the illusion that a process or user has sole use of a machine. In typical designs, a task has three states: Running (executing on the CPU); Ready (ready to be executed); and Blocked (waiting for an event, I / O for example). Most tasks are blocked or ready most of the time because generally only one task can run at a time per CPU. The number of items in the ready queue can vary greatly, depending on the number of tasks the system needs to perform and the type of scheduler that the system uses. On simpler non-preemptive but still multitasking systems, a task has to give up its time on the CPU to other tasks, which can cause the ready queue to have a greater number of overall tasks in the ready to be executed state (resource starvation).

[0046] RTOS concepts and implementations are described in an Application Note No. RES05B00008-0100 / Rec. 1.00 published January 2010 by Renesas Technology Corp, entitled: “R8C Family - General RTOS Concepts”, in JAJA Technology Review article published February 2007 [ 1535-5535 / S32.00] by The Association for Laboratory Automation [doi:10.1016 / j.jala.2006.10.016] entitled: “An Overview of Real-Time Operating Systems”, and in Chapter 2 entitled: “ Basic Concepts of Real Time Operating Systems” of a book published 2009 [ISBN - 978-1-4020-9435-4] by Springer Science + Business Media B.V. entitled: “ Hardware- Dependent Software - Principles and Practice”, which are all incorporated in their entirety for all purposes as if fully set forth herein.

[0047] QNX. One example of RTOS is QNX, which is a commercial Unix-like real-time operating system, aimed primarily at the embedded systems market. QNX was one of the first commercially successful microkernel operating systems and is used in a variety of devices including cars and mobile phones. As a microkernel-based OS, QNX is based on the idea of running most of the operating system kernel in the form of a number of small tasks, known as Resource Managers. In the case of QNX, the use of a microkernel allows users (developers) to turn off any functionality they do not require without having to change the OS itself; instead, those services will simply not run.

[0048] FreeRTOS. FreeRTOS™ is a free and open-source Real-Time Operating system developed by Real Time Engineers Ltd., designed to fit on small embedded systems and implements only a very minimalist set of functions: very basic handle of tasks and memory management, and just sufficient API concerning synchronization. Its features include characteristics such as preemptive tasks, support for multiple microcontroller architectures, a small footprint (4.3Kbytes on an ARM7 after compilation), written in C, and compiled with various C compilers. It also allows an unlimited number of tasks to run at the same time, and no limitation about their priorities as long as used hardware can afford it.

[0049] FreeRTOS™ provides methods for multiple threads or tasks, mutexes, semaphores and software timers. A tick-less mode is provided for low power applications, and thread priorities are supported. Four schemes of memory allocation are provided: allocate only; allocate and free with a very simple, fast, algorithm; a more complex but fast allocate and free algorithm with memory coalescence; and C library allocate and free with some mutual exclusion protection. While the emphasis is on compactness and speed of execution, a command line interface and POSIX-like IO abstraction add-ons are supported. FreeRTOS™ implements multiple threads by having the host program call a thread tick method at regular short intervals.

[0050] The thread tick method switches tasks depending on priority and a round-robin scheduling scheme. The usual interval is 1 / 1000 of a second to 1 / 100 of a second, via an interrupt from a hardware timer, but this interval is often changed to suit a particular application. FreeRTOS™ is described in a paper by Nicolas Melot (downloaded 7 / 2015) entitled: “ Study of an operating system: FreeRTOS - Operating systems for embedded devices”, in a paper (dated September 23, 2013) by Dr. Richard Wall entitled: "Carebol PIC32 MX7ck implementation of Free RTOS FreeRTOS™ modules are described in the web-pages entitled: “ FreeRTOS™ Modules” published in the www, freertos.org web-site dated 26.11.2006, and FreeRTOS kernel is described in a paper published 1 April 07 by Rich Goyette of Carleton University as part of ‘SYSC5701: Operating System Methods for Real-Time Applications’, entitled: “An Analysis and Description of the Inner Workings of the FreeRTOS Kernel”, which are all incorporated in their entirety for all purposes as if fully set forth herein.

[0051] SafeRTOS. SafeRTOS was constructed as a complementary offering to FreeRTOS, with common functionality but with a uniquely designed safety-critical implementation. When the FreeRTOS functional model was subjected to a full HAZOP, weaknesses with respect to user misuse and hardware failure within the functional model and API were identified and resolved. Both SafeRTOS and FreeRTOS share the same scheduling algorithm, have similar APIs, and are otherwise very similar, but they were developed with differing objectives. The SafeRTOS was developed solely in the C language to meet requirements for certification to IEC61508. SafeRTOS is known for its ability to reside solely in the on-chip read only memory of a microcontroller for standards compliance. When implemented in hardware memory, SafeRTOS code can only be utilized in its original configuration, so certification testing of systems using this OS need not re-test this portion of their designs during the functional safety certification process.

[0052] VxWorks. VxWorks is an RTOS developed as proprietary software and designed for use in embedded systems requiring real-time, deterministic performance and, in many cases, safety and security certification, for industries, such as aerospace and defense, medical devices, industrial equipment, robotics, energy, transportation, network infrastructure, automotive, and consumer electronics. The VxWorks supports Intel architecture, POWER architecture, and ARM architectures, and may be used in multicore asymmetric multiprocessing (AMP), symmetric multiprocessing (SMP), and mixed modes and multi-OS (via Type 1 hypervisor) designs on 32- and 64-bit processors. The VxWorks comes with the kernel, middleware, board support packages, Wind River Workbench development suite and complementary third-party software and hardware technologies. In its latest release, VxWorks 7, the RTOS has been re-engineered for modularity and upgradeability so the OS kernel is separate from middleware, applications and other packages. Scalability, security, safety, connectivity, and graphics have been improved to address Internet of Things (loT) needs. pC / OS. Micro-Controller Operating Systems (MicroC / OS, stylized as pC / OS) is a realtime operating system (RTOS) that is a priority-based preemptive real-time kernel for microprocessors, written mostly in the programming language C, and is intended for use in embedded systems. The MicroC / OS allows defining several functions in C, each of which can execute as an independent thread or task. Each task runs at a different priority, and runs as if it owns the central processing unit (CPU). Lower priority tasks can be preempted by higher priority tasks at any time. Higher priority tasks use operating system (OS) services (such as a delay or event) to allow lower priority tasks to execute. OS services are provided for managing tasks and memory, communicating between tasks, and timing.

[0053] Operating System (OS). An Operating System (OS) is software that manages computer hardware resources and provides common services for computer programs. The operating system is an essential component of any system software in a computer system, and most application programs usually require the operating system to function. For hardware functions such as input and output and memory allocation, the operating system acts as an intermediary between programs and the computer hardware, although the application code is usually executed directly by the hardware and will frequently make a system call to an OS function or be interrupted by it. Common features typically supported by operating systems include process management, interrupts handling, memory management, file system, device drivers, networking (such as TCP / IP and UDP), and Input / Output (I / O) handling. Examples of popular modem operating systems include Android, BSD, iOS, Linux, OS X, QNX, Microsoft Windows, Windows Phone, and IBM z / OS.

[0054] Process management. The operating system provides an interface between an application program and the computer hardware, so that an application program can interact with the hardware only by obeying rules and procedures programmed into the operating system. The operating system is also a set of services which simplify the development and execution of application programs. Executing an application program involves the creation of a process by the operating system kernel which assigns memory space and other resources, establishes a priority for the process in multi-tasking systems, loads program binary code into memory, and initiates execution of the application program which then interacts with the user and with hardware devices. The OS must allocate resources to processes, enable processes to share and exchange information, protect the resources of each process from other processes, and enable synchronization among processes. The OS maintains the data structure for each process, which describes the state and resource ownership of that process and enables the OS to exert control over each process.

[0055] In many modem operating systems, there can be more than one instance of a program loaded in memory at the same time; for example, more than one user could be executing the same program, each user having separate copies of the program loaded into memory. With some programs, known as re-entrant type, it is possible to have one copy loaded into memory, while several users have shared access to it so that they each can execute the same program-code. The processor at any instant can only be executing one instruction from one program but several processes can be sustained over a period of time by assigning each process to the processor at intervals while the remainder becomes temporarily inactive. A number of processes being executed over a period of time instead of at the same time is called concurrent execution. A multiprogramming or multitasking OS is a system executing many processes concurrently. A multiprogramming requires that the processor be allocated to each process for a period of time, and de-allocated at an appropriate moment. If the processor is de-allocated during the execution of a process, it must be done in such a way that it can be restarted later as easily as possible. There are two typical ways for an OS to regain control of the processor during a program’ s execution in order for the OS to perform de-allocation or allocation: The process issues a system call (sometimes called a software interrupt); for example, an I / O request occurs requesting to access a file on a hard disk. Alternatively, a hardware interrupt occurs; for example, a key was pressed on the keyboard, or a timer runs out (used in pre-emptive multitasking). The stopping of one process and starting (or restarting) of another process is called a context switch or context change. In many modem operating systems, processes can consist of many sub-processes., known as the concept of a thread, that may be viewed as a sub-process; that is, a separate, independent sequence of execution within the code of one process. The threads are becoming increasingly important in the design of distributed and client-server systems and in software run on multiprocessor systems.

[0056] Modes. Many contemporary processors incorporate a mode bit to define the execution capability of a program in the processor. This bit can be set to a kernel-mode or a user mode. The kernel-mode is also commonly referred to as supervisor mode, monitor mode, or ring 0, in which the processor can execute every instruction in its hardware repertoire, whereas in user mode, it can only execute a subset of the instructions. Instructions that can be executed only in kernel mode are called kernel, privileged or protected instructions to distinguish them from the user mode instructions. For example, I / O instructions are privileged. So, if an application program executes in user mode, it cannot perform its own I / O, and must request the OS to perform I / O on its behalf. The system may logically extend the mode bit to define areas of memory to be used when the processor is in kernel mode versus user mode. If the mode bit is set to kernel mode, the process executing in the processor can access either the kernel or user partition of the memory. However, if user mode is set, the process can reference only the user memory space, hence two classes of memory are defined, the user space and the system space (or kernel, supervisor, or protected space). In general, the mode bit extends the operating system's protection rights, and is set by the user-mode trap instruction, also called a supervisor call instruction. This instruction sets the mode bit, and branches to a fixed location in the system space. Since only the system code is loaded in the system space, only the system code can be invoked via a trap. When the OS has completed the supervisor call, it resets the mode bit to user mode prior to the return.

[0057] Computer operating systems provide different levels of access to resources, and these hierarchical protection domains are often referred to as ‘protection rings’, and are used to protect data and functionality from faults (by improving fault tolerance) and malicious behavior (by providing computer security). A protection ring is one of two or more hierarchical levels or layers of privilege within the architecture of the computer system. These levels may be hardware- enforced by some CPU architectures that provide different CPU modes at the hardware or microcode level. The rings are arranged in a hierarchy from most privileged (most trusted, usually numbered zero) to least privileged (least trusted, usually with the highest ring number). On most operating systems, kernel mode or ‘Ring 0’ is the level with the most privileges and interacts most directly with the physical hardware such as the CPU and memory. Special gates between rings are provided to allow an outer ring to access an inner ring's resources in a predefined manner, as opposed to allowing arbitrary usage. Correctly gating access between rings can improve security by preventing programs from one ring or privilege level from misusing resources intended for programs in another. For example, spyware running as a user program in Ring 3 should be prevented from turning on a web camera without informing the user, since hardware access should be a Ring 1 function reserved for device drivers. Programs such as web browsers running in higher numbered rings must request access to the network, a resource restricted to a lower numbered ring.

[0058] Kernel. With the aid of the firmware and the device drivers, the kernel provides most basic level of control over all of the computer's hardware devices. It manages memory access for programs in the RAM, it determines which programs get access to which hardware resources, it sets up or resets the CPU's operating states for optimal operation at all times, and it organizes the data for long-term non-volatile storage with file systems on such media as disks, tapes, flash memory, etc. The part of the system executing in the kernel supervisor state is called the kernel, or nucleus, of the operating system. The kernel operates as trusted software, meaning that when it was designed and implemented, it was intended to implement protection mechanisms that could not be covertly changed through the actions of untrusted software executing in user space. Extensions to the OS execute in user mode, so the OS does not rely on the correctness of those parts of the system software for the correct operation of the OS. Hence, a fundamental design decision for any function to be incorporated into the OS is whether it needs to be implemented in the kernel. If it is implemented in the kernel, it will execute in kernel (supervisor) space, and have access to other parts of the kernel. It will also be trusted software by the other parts of the kernel. If the function is implemented to execute in user mode, it will have no access to kernel data structures.

[0059] There are two techniques by which a program executing in user mode can request the kernel's services, namely ‘System call’ and ‘Message passing’. Operating systems are typically with one or the other of these two facilities, but commonly not both. Assuming that a user process wishes to invoke a particular target system function, in the system call approach, the user process uses the trap instruction, so the system call should appear to be an ordinary procedure call to the application program; the OS provides a library of user functions with names corresponding to each actual system call. Each of these stub functions contains a trap to the OS function, and when the application program calls the stub, it executes the trap instruction, which switches the CPU to kernel mode, and then branches (indirectly through an OS table), to the entry point of the function which is to be invoked. When the function completes, it switches the processor to user mode and then returns control to the user process; thus, simulating a normal procedure return. In the message passing approach, the user process constructs a message, that describes the desired service, and then it uses a trusted send function to pass the message to a trusted OS process. The send function serves the same purpose as the trap; that is, it carefully checks the message, switches the processor to kernel mode, and then delivers the message to a process that implements the target functions. Meanwhile, the user process waits for the result of the service request with a message receive operation. When the OS process completes the operation, it sends a message back to the user process.

[0060] Interrupts handling. Interrupts are central to any operating system, as they provide an efficient way for the operating system to interact with and react to its environment. The interrupts are typically handled by the operating system's kernel, and provide a computer with a way of automatically saving local register contexts, and running specific code in response to events. When an interrupt is received, the computer's hardware automatically suspends whatever program is currently running, saves its status, and runs computer code previously associated with the interrupt. When a hardware device triggers an interrupt, the operating system's kernel decides how to deal with this event, generally by running some processing code. The amount of code being run depends on the priority of the intermpt, and the processing of hardware intermpts is executed by a device driver, which may be either part of the operating system's kernel, part of another program, or both. The device drivers may then relay information to a mnning program by various means. A program may also trigger an intermpt to the operating system. For example, if a program wishes to access a hardware (such as a peripheral), it may intermpt the operating system's kernel, which causes control to be passed back to the kernel. The kernel will then process the request. If a program wishes additional resources (or wishes to shed resources) such as memory, it will trigger an intermpt to get the kernel's attention. Each intermpt has its own intermpt handler. The number of hardware intermpts is limited by the number of intermpt request (IRQ) lines to the processor, but there may be hundreds of different software intermpts. Interrupts are a commonly used technique for computer multitasking, especially in real-time computing systems, which are commonly referred to as intermpt-driven systems. Memory management. A multiprogramming operating system kernel is responsible for managing all system memory which is currently in use by programs, ensuring that a program does not interfere with memory already in use by another program. Since programs time share, each program must have independent access to memory. Memory protection enables the kernel to limit a process' access to the computer's memory. Various methods of memory protection exist, including memory segmentation and paging. In both segmentation and paging, certain protected mode registers specify to the CPU what memory address it should allow a running program to access. Attempts to access other addresses will trigger an interrupt which will cause the CPU to re-enter supervisor mode, placing the kernel in charge. This is called a segmentation violation (or Seg-V), and the kernel will generally resort to terminating the offending program, and will report the error.

[0061] Memory management further provides ways to dynamically allocate portions of memory to programs at their request, and free it for reuse when no longer needed. This is critical for any advanced computer system where more than a single process might be underway at any time. Several methods have been devised that increase the effectiveness of memory management. Virtual memory systems separate the memory addresses used by a process from actual physical addresses, allowing separation of processes and increasing the effectively available amount of RAM using paging or swapping to secondary storage. The quality of the virtual memory manager can have an extensive effect on overall system performance.

[0062] File system. Commonly a file system (or filesystem) is used to control how data is stored and retrieved. By separating the data into individual pieces, and giving each piece a name, the information is easily separated and identified, where each piece of data is called a "file". The structure and logic rules used to manage the groups of information and their names is called a "file system". There are many different kinds of file systems. Each one has a different structure and logic, properties of speed, flexibility, security, size, and more. Some file systems have been designed to be used for specific applications. For example, the ISO 9660 file system is designed specifically for optical discs. The file systems can be used on many different kinds of storage devices. Some file systems are used on local data storage devices; others provide file access via a network protocol (for example, NFS, SMB, or 9P clients). Some file systems are "virtual", in that the "files" supplied are computed on request (e.g., procfs) or are merely a mapping into a different file system used as a backing store. The file system manages access to both the content of files and the metadata about those files. It is responsible for arranging storage space, reliability, efficiency, and tuning with regard to the physical storage medium are important design considerations. A disk file system takes advantages of the ability of disk storage media to randomly address data in a short amount of time. Additional considerations include the speed of accessing data following that was initially requested and the anticipation that the following data may also be requested. This permits multiple users (or processes) access to various data on the disk without regard to the sequential location of the data. Examples include FAT (FAT 12, FAT 16, FAT32), exFAT, NTFS, HFS and HFS+, HPFS, UFS, ext2, ext3, ext4, XFS, btrfs, ISO 9660, Files-11, Veritas File System, VMFS, ZFS, ReiserFS and UDF. Some disk file systems are journaling file systems or versioning file systems.

[0063] TMPFS. TMPFS (or tmpfs) is a common name for a temporary file storage facility on many Unix-like operating systems. While intended to appear as a mounted file system, it is stored in volatile memory instead of a non-volatile storage device. A similar construction is a RAM disk, which appears as a virtual disk drive and hosts a disk file system. The tmpfs is typically a file system based on SunOS virtual memory resources, which does not use traditional non-volatile media to store file data; instead, the tmpfs files exist solely in virtual memory maintained by the UNIX kernel. Because the tmpfs file systems do not use dedicated physical memory for file data, but instead use VM system resources and facilities, they can take advantage of kernel resource management policies. The tmpfs is designed primarily as a performance enhancement to allow short-lived files to be written and accessed without generating disk or network RO. Tmpfs maximizes file manipulation speed while preserving UNIX file semantics. It does not require dedicated disk space for files and has no negative performance impact. The tmpfs is described in a Sun Microsystem Inc. paper entitled: “tmpfs: A Virtual Memory File System” by Peter Snyder, downloaded on 7 / 2014, which is incorporated in its entirety for all purposes as if fully set forth herein.

[0064] Device drivers. A device driver is a specific type of computer software developed to allow interaction with hardware devices. Typically, this constitutes an interface for communicating with the device, through the specific computer bus or communications subsystem that the hardware is connected to, providing commands to and / or receiving data from the device, and on the other end, the requisite interfaces to the operating system and software applications. It is a specialized hardware-dependent computer program which is also operating system specific that enables another program, typically an operating system or applications software package or computer program running under the operating system kernel, to interact transparently with a hardware device, and usually provides the requisite interrupt handling necessary for any necessary asynchronous time-dependent hardware interfacing needs. Networking. Most operating systems support a variety of networking protocols, hardware, and applications for using them, allowing computers running dissimilar operating systems to participate in a common network, for sharing resources such as computing, files, printers, and scanners, using either wired or wireless connections. Networking can essentially allow a computer's operating system to access the resources of a remote computer, to support the same functions as it could if those resources were connected directly to the local computer. This includes everything from simple communication, to using networked file systems, or sharing another computer's graphics or sound hardware. Some network services allow the resources of a computer to be accessed transparently, such as SSH, which allows networked users direct access to a computer's command line interface. A client / server networking allows a program on a computer, called a client, to connect via a network to another computer, called a server. Servers offer (or host) various services to other network computers and users. These services are usually provided through ports or numbered access points beyond the server's network address. Each port number is usually associated with a maximum of one running program, which is responsible for handling requests to that port. A daemon, being a user program, can in turn access the local hardware resources of that computer by passing requests to the operating system kernel.

[0065] Input / Output (I / O) handling. An input / output (or I / O) is the communication between an information processing system (such as a computer) and the outside world, possibly a human or other information processing system. The inputs are typically the signals or data received by the system, and the outputs are the signals or data sent from it. The I / O devices may be used by a person (or other system) to communicate with a computer. For instance, a keyboard or a mouse may be an input device for a computer, while monitors and printers are considered output devices for a computer. The devices for communication between computers, such as modems and network cards, typically serve for both input and output.

[0066] User interface. Every computer that is to be operated by a human being requires a user interface, usually referred to as a ‘shell’, and is essential if human interaction is to be supported. The user interface views the directory structure and requests services from the operating system that will acquire data from input hardware devices, such as a keyboard, mouse or credit card reader, and requests operating system services to display prompts, status messages and such on output hardware devices, such as a video monitor or printer. The two most common forms of a user interface have historically been the command-line interface, where computer commands are typed out line-by-line, and the Graphical User Interface (GUI), where a visual environment (most commonly a WIMP) is present. Typically the GUI is integrated into the kernel, allowing the GUI to be more responsive by reducing the number of context switches required for the GUI to perform its output functions.

[0067] WDM. The Windows Driver Model (WDM), also known as the Win32 Driver Model, is a standard model defining a framework for device drivers specified by Microsoft, providing unified driver models. The WDM model is based on WDM drivers that are layered in a complex hierarchy and communicate with each other via I / O Request Packets (IRPs). The WDM was introduced with Windows 98 and Windows 2000 to replace VxD which was used on older versions of Windows such as Windows 95 and Windows 3.1, as well as the Windows NT Driver Model, and WDM drivers are usable on all of Microsoft’s operating systems of Windows 95 and later. The WDM is described in the publication entitled: “ Microsoft Windows Driver Model (WDM)”, by Mohamad (Hani) Atassy, submitted to Dr. Dennis R. Hafermann dated January 28, 2002, and in a publication entitled: “A Comparison of the Linux and Windows Device Driver Architecture”, by Melekam Tsegaye and Ricahrd Foss, both from Rhodes University, South- Africa, downloaded from the Internet on 7 / 2014, both are incorporated in their entirety for all purposes as if fully set forth herein.

[0068] A general schematic view of the WDM architecture 930 is shown in FIG. 3. In the example shown, three applications designated as application #1 931a, application #2931b, and application #3 931c, are accessing three peripheral hardware devices, designated as peripheral #1 939a, peripheral #2 939b, and peripheral #3 939c. The model involves three layers. The lower layer is the hardware layer 930c, which includes the hardware devices and peripherals, accessed by a processor (such as a processor 27) via a hardware bus 930d, which may correspond to an internal bus 13 shown in FIG. 1. The highest layer is a ‘user space’ layer 930a, corresponding to the user mode and to the higher ‘ring’ layers such as Ring 3, and is relating to the space is the memory area where application software and some drivers execute. The kernel of the operating system provides the services as part of a ‘kernel space’ layer 930b, serving as an intermediate layer between the user space layer 930a and the hardware layer 930c. The kernel space 930b operates in a highly privileged hierarchical protection domain, and is strictly reserved for running privileged kernel, kernel extensions, and most device drivers, and is typically corresponding to the kernel mode and to the ‘ring-0’ layer (in x86 processors). The kernel mode may be supported by the processor hardware, or may be supported by a code segment level.

[0069] The user mode applications (such as application #1 931a, application #2 931b, and application #3 931c) access the kernel space 930b by the invoking of system calls respectively denoted as connections 932a, 932b and 932c. Typically, such system calls are processed via an intermediating entity known as Windows API, such as a Win32 API 933, which may access the kernel space 930b via a standard messaging 934. The Win32 API 933 is an example of a Windows API (informally WinAPI), which is Microsoft's core set of Application Programming Interfaces (APIs) available in the Microsoft Windows operating systems. Almost all Windows programs interact with the Windows API; on the Windows NT line of operating systems, a small number (such as programs started early in the Windows startup process) uses the Native API. Supporting for developers is in the form of the Windows Software Development Kit (SDK), providing documentation and tools necessary to build software based upon the Windows API and associated Windows interfaces. The Win32 API 933 is the 32-bit API for modem versions of Windows, and consists of functions implemented, as with Winl6, in system DLLs. The core DLLs of the Win32 include the kemel32.dll, user32.dll, and gdi32.dll. The Win32 API is described in the tutorial entitled: “Welcome to Version 2.0 of the Win32 API Tutorial” by Prof. M. Saeed, published by Brook Miles, downloaded from the Internet on 7 / 2014, which is incorporated in its entirety for all purposes as if fully set forth herein.

[0070] System calls provide an essential interface between a process and the operating system. A system call is how a program requests a service from an operating system's kernel. This may include hardware related services (e.g., accessing the hard disk), creating and executing new processes, and communicating with integral kernel services (such as scheduling). A system call is typically processed in the kernel mode, which is accomplished by changing the processor execution mode to a more privileged one. The hardware sees the world in terms of the execution mode according to the processor status register, and processes are an abstraction provided by the operating system. A system call does not require a context switch to another process, it is processed in the context of whichever process invoked it. The system calls are often executed via traps or intermpts, that automatically puts the CPU into some required privilege level, and then pass control to the kernel, which determines whether the calling program should be granted the requested service. If the service is granted, the kernel executes a specific set of instmctions over which the calling program has no direct control, returns the privilege level to that of the calling program, and then returns control to the calling program. Implementing system calls requires a control transfer, which involves some sort of architecture- specific feature.

[0071] System calls can be roughly grouped into five major categories: Process control, such as load, execute, create / terminate process, get / set process attributes, wait for time, wait event, and signal event; file management, such as request / release device, create / delete file, open / close file, read / write / reposition file, and get / set file attributes; device management, such as read / write / reposition device, get / set device attributes, and logically attach / detach devices; information maintenance, such as get / set time or date, get / set system data, and get / set process, file, or device attributes; and communication such as create, delete communication connection, transfer status information, and attach or detach remote devices.

[0072] The system calls are commonly handled by the I / O manager 935b, which allows devices to communicate with user-mode subsystems. It translates user-mode read and write commands into a read or write IRPs which it passes to the device drivers. It accepts file system I / O requests and translates them into device specific calls, and can incorporate low-level device drivers that directly manipulate the hardware to either read input or write output. It also includes a cache manager to improve disk performance by caching read requests and write to the disk in the background. The I / O manager 935b may interface with a power manager 935c, which deals with power events (power-off, stand-by, hibernate, etc.) and notifies affected drivers with special IRPs (Power IRPs).

[0073] A PnP manager 935a handles ‘Plug and Play’ and supports device detection and installation at boot time. It also has the responsibility to stop and start devices on demand, which can happen when a bus (such as USB or FireWire) gains a new device and needs to have a device driver loaded to support it. The PnP manager 935a may be partially implemented in user mode, in the Plug and Play Service, which handles the often-complex tasks of installing the appropriate drivers, notifying services and applications of the arrival of new devices, and displaying GUI to the user.

[0074] The I / O Request Packets (IRPs) are kernel mode structures that are used to communicate with each other and with the operating system. They are data structures that describe the I / O requests, to a driver, all of these parameters (such as buffer address, buffer size, I / O function type, etc.) are passed via a single pointer to this persistent data structure. The IRPs with all of its parameters can be put on a queue if the I / O request cannot be performed immediately. The I / O completion is reported back to the I / O manager by passing its address to a routine for that purpose, ‘I / O Complete Request’. The IRPs may be repurposed as a special kernel APC object if such is required to report the completion of the I / O to the requesting thread. The IRPs are typically created by the I / O Manager in response to I / O requests from user mode. However, IRPs are sometimes created by the plug-and-play manager, power manager, and other system components, and can also be created by drivers and then passed to other drivers.

[0075] The WDM uses kernel-mode device drivers to enable it to interact with hardware devices, where each of the drivers has well defined system routines and internal routines that it exports to the rest of the operating system. DriverEntry is the first routine called after a driver is loaded, and is responsible for initializing the driver. All devices are seen by user mode code as a file object in the RO manager, though to the RO manager itself the devices are seen as device objects, which it defines as either file, device, or driver objects. The drivers may be aggregated as a drivers stack 936, including kernel mode drivers in three levels: highest level drivers 936a, intermediate drivers 936b, and low-level drivers 936c. The highest level drivers 936a, such as file system drivers for FAT and NTFS, rely on the intermediate drivers 936b, which consist of function drivers or main drivers for a device, that are optionally sandwiched between lower and higher level filter drivers. The highest-level drivers 936a typically know how files are represented on disk, but not the details of how to actually fetch the data, the intermediate level drivers process the requests from the highest-level driver by breaking down a large request into a series of small chunks. The function driver commonly possesses the details relating to how the hardware of the peripheral works, and typically relies on a bus driver, or a driver that services a bus controller, adapter, or bridge, which can have an optional bus filter driver that sits between itself and the function driver. For example, a PCI bus driver detects the PCI-slot plugged card or hardware, and determines the I / O-mappcd or the memory-mapped connection with the host. Intermediate drivers 936b rely on the low-level drivers 936c to function. The low-level drivers 936c are either legacy device drivers that control a device directly, or can be a PnP hardware bus. These lower-level drivers 936c directly control hardware and do not rely on any other drivers. The I / O manager 935b communicate with the high- level driver 936a using IRP 937a, the high-level driver 936a communicates with the intermediate level driver 936b using IRP 937b, the intermediate level driver 936b communicates with the low- level driver 936c using IRP 937c, and the low-level driver 936c communicates with a HAL 938 using IRP 937d.

[0076] WDM drivers can be classified into the following types and sub-types: Device function drivers, bus drivers, and filter drivers. A function driver is the main driver for a device. A function driver is typically written by the device vendor and is required (unless the device is being used in raw mode). The function driver can service one or more devices. Miniport drivers are a type of function drivers for interfaces such as USB, audio, SCSI and network adapters. They are hardware specific, but the control access to the hardware is through a specific bus class driver. Class drivers are a type of function drivers and can be thought of as built-in framework drivers that miniport and other class drivers can be built on top of. The class drivers provide interfaces between different levels of the WDM architecture. Common functionality between different classes of drivers can be written into the class driver and used by other class and miniport drivers. The lower edge of the class driver will have its interface exposed to the miniport driver, while the upper edge of toplevel class drivers is operating system specific. Class drivers can be dynamically loaded and unloaded at will. They can do class specific functions that are not hardware or bus-specific (with the exception of bus-type class drivers) and in fact sometimes only do class specific functions such as enumeration.

[0077] A bus driver services a bus controller, adapter, or bridge. Microsoft provides the bus drivers for most common buses, such as Advanced Configuration and Power Interface (ACPI), Peripheral Component Interconnect (PCI), PnPISA, SCSI, Universal Serial Bus (USB), and FireWire. The bus driver can service more than one bus if there is more than one bus of the same type on the machine. The ACPI bus driver interacts with the ACPI BIOS to enumerate the devices in the system and control their power use, the PCI bus driver (such as pci.sys) enumerates and configures devices connected via the PCI bus, the FireWire and the USB bus driver respectively enumerates and controls devices connected via the IEEE 1394 high speed bus and the USB. The stream class driver provides a basic processing supporting high bandwidth, time critical, and video and audio data related hardware, and uses minidrivers for interfacing the actual hardware, and hard-disk, floppies, CDs, and DVDs are interfaces using SCSI and CDROM / DVD class driver. The Human Input Device (HID) provides an abstract view of input devices, and the Still Image Architecture (SIA) class driver is used to obtain content from a scanner and a still camera, using minidrivers. For example, accessing the hard disk (such as the HDD 25c) involves a file system driver as high-level driver, a volume manager driver as an intermediate level driver, and a disk driver as a low -level driver.

[0078] The filter drivers are optional drivers that add value to or modify the behavior of a device and may be non-device drivers, and can also serve as one or more devices. Upper-level filter drivers sit above the primary driver for the device (the function driver), while lower-level filter drivers sit below the function driver and above the bus driver. The driver service is a type of kernel-level filter driver implemented as a Windows service that enables applications to work with devices.

[0079] The Hardware Abstraction Layer 938, or HAL, is a layer between the physical hardware layer 930c of the computer and the rest of the operating system. It was designed to hide differences in hardware and therefore provide a consistent platform on which the kernel is run. The HAL 938 includes hardware-specific code that controls I / O interfaces, interrupt controllers, and multiple processors. Typically, the particular hardware abstraction does not involve abstracting the instruction set, which generally falls under the wider concept of portability. Abstracting the instruction set, when necessary (such as for handling the several revisions to the x86 instruction set, or emulating a missing math coprocessor), is performed by the kernel, or via platform virtualization. Linux is a Unix-like and mostly POSIX-compliant computer operating system assembled under the model of free and open source software development and distribution. The defining component of Linux is the Linux kernel, an operating system kernel first released on 5 October 1991 by Linus Torvalds. Linux was originally developed as a free operating system for Intel x86- based personal computers, but has since been ported to more computer hardware platforms than any other operating system. Linux also runs on embedded systems such as mobile phones, tablet computers, network routers, facility automation controls, televisions, and video game consoles. Android, which is a widely used operating system for mobile devices, is built on top of the Linux kernel. Typically, Linux is packaged in a format known as a Linux distribution for desktop and server use.

[0080] Linux distributions include the Linux kernel, supporting utilities and libraries, and usually a large amount of application software to fulfill the distribution's intended use. A Linux-based system is a modular Unix-like operating system, that uses a monolithic kernel, the Linux kernel, which handles process control, networking, and peripheral and file system access. The device drivers are either integrated directly with the kernel or added as modules loaded while the system is running. Some components of an installed Linux system are a bootloader, for example, GNU GRUB or LILO, which is executed by the computer when it is first turned on, and loads the Linux kernel into memory; an initialization program, which is the first process launched by the Linux kernel, and is at the root of the process tree, and starts processes such as system services and login prompts (whether graphical or in terminal mode); Software libraries which contain code which can be used by running processes; and user interface programs such as command shells or windowing environments. A version of Linux is described, for example, in IBM Corporation (headquartered in Armonk, New-York, U.S.A.) publication No. SC34-2597-03 entitled: “Device Drivers, Features, and Commands on Red Hat Exterprise Linux 6.3”, downloaded from the Internet on 7 / 2014, which is incorporated in its entirety for all purposes as if fully set forth herein.

[0081] The general schematic Linux driver architecture 950 is shown in FIG. 3 a, and the Linux kernel is further described in Wiley Publishing, Inc. publication entitled: “Professional Linux Kernel Architecture” , by Wofgang Mauerer published 2008, and Linux programming is described in the book entitled: “The Linux Kernel Module Programming Guide” ver. 2.6.4 by Peter Jay Salzman, Michael Burian, and Ori Pomerantz, dated May 18, 2007, and in the publication entitled: “A Comparison of the Linux and Windows Device Driver Architecture” , by Melekam Tsegaye and Richard Foss, both from Rhodes University, South-Africa, downloaded from the Internet on 7 / 2014, which are all incorporated in their entirety for all purposes as if fully set forth herein. Similar to the WDM 930 shown in FIG. 3, the Linux kernel involves a ‘System Call Interface’ 953, receiving system calls 952a, 952b, and 952c from the respective applications such as an application #1 931a, an application #2 931b, and an application #3 931c, and serves as the denomination for the entirety of all implemented and available system calls in a kernel. The Linux kernel is based on a layered modules stack 954, which may include three levels of modules, such as module #1 954a, module #2 954b, and module #3 954c, where the module #1 954a communicate over connection 955a with the system call interface 953, the module #2 954b communicates with the module #1954a over connection 955b, the module #3954c communicates over the connection 955c with the module #2 954b and over a connection 955d with the HAL 938.

[0082] Similar to the WDM 930 shown in FIG. 3, the Linux kernel shown as the arrangement 950 in FIG. 3a, is using the concept of layered architecture of a modules stack 954, which may comprise module #1 954a, module #2 954b, and module #3 954c, communicating using messaging mechanism, such as a connection 955a between the system call interface 953 and the module #1 954a, a connection 955b between the module #1 954a and the module #2 954b, a connection 955c between the module #2 954b and the module #3 954c, and a connection 955d between the module #3 954c and the HAL 938.

[0083] The modules in the modules stack 954, typically referred to as Loadable Kernel Modules (LKMs), are object files that contain code to extend the running Linux kernel, or so-called base kernel. The LKMs are typically used to add support for new hardware and / or filesystems, or for adding system calls. When the functionality provided by the LKM is no longer required, it can be unloaded in order to free memory and other resources. The loadable kernel modules in Linux are located in Zlib / modulcs and have had the extension ‘.ko’ ("kernel object") since version 2.6 (previous versions used the .o extension), and are loaded (and unloaded) by the modprobe command. The Ismod command lists the loaded kernel modules. In emergency cases, when the system fails to boot (due to e.g., broken modules), specific modules can be enabled or disabled by modifying the kernel boot parameters list (for example, if using GRUB, by pressing 'e' in the GRUB start menu, then editing the kernel parameter line). Linux allows disabling module loading via sysctl option / proc / sys / kemel / modules_disabled. An initramfs system may load specific modules needed for a machine at boot and then disable module loading.

[0084] Multicasting. A multitasking is a method where multiple tasks (also known as processes or programs) are performed during the same period of time, and executed concurrently (in overlapping time periods, new tasks starting before others have ended) instead of sequentially (one completing before the next starts). The tasks share common processing resources, such as a CPU and main memory. Multitasking does not necessarily mean that multiple tasks are being executed, exactly at the same instant. In other words, multitasking does not imply parallelism, but it does mean that more than one task can be part-way through execution at the same time, and more than one task is advancing over a given period of time.

[0085] In the case of a computer with a single CPU, only one task is said to be running at any point in time, meaning that the CPU is actively executing instructions for that task. Multitasking solves the problem by scheduling which task may be the one running at any given time, and when another waiting task gets its turn. The act of reassigning a CPU from one task to another one is called a context switch. When context switches occur frequently enough, the illusion of parallelism is achieved. Even on computers with more than one CPU (called multiprocessor machines) or more than one core in a given CPU (called multicore machines), where more than one task can be executed at a given instant (one per CPU or core), multitasking allows many more tasks to be run than the number of available CPUs.

[0086] Operating systems may adopt one of many different scheduling strategies. In multiprogramming systems, the running task keeps running until it performs an operation that requires waiting for an external event (e.g., reading from a tape) or until the computer's scheduler forcibly swaps the running task out of the CPU. Multiprogramming systems are designed to maximize CPU usage. In time-sharing systems, the running task is required to relinquish the CPU, either voluntarily or by an external event such as a hardware interrupt. Time sharing systems are designed to allow several programs to execute simultaneously. In real-time systems, some waiting tasks are guaranteed to the CPU when an external event occurs. Real time systems are designed to control mechanical devices such as industrial robots, which require timely processing.

[0087] Multiprocessing. Multiprocessing is the use of two or more processors or Central Processing Units (CPUs) within a single computer system, typically combined with the ability to allocate tasks between them. In order to process programs simultaneously, the multiple processors commonly share the main memory and peripherals. In a multiprocessing system, all CPUs may be equal, or some may be reserved for special purposes. Any combination of hardware and operating system software design considerations determine the symmetry (or lack thereof) in a given system. For example, hardware or software considerations may require that only one particular CPU respond to all hardware interrupts, whereas all other work in the system may be distributed equally among CPUs; or execution of kernel-mode code may be restricted to only one particular CPU, whereas user-mode code may be executed in any combination of processors. Systems that treat all CPUs equally are called symmetric multiprocessing (SMP) systems. In systems where all CPUs are not equal, system resources may be divided in a number of ways, including Asymmetric Multiprocessing (ASMP), Non-Uniform Memory Access (NUMA) multiprocessing, and clustered multiprocessing.

[0088] In multiprocessing, the processors are typically used to execute a single sequence of instructions in multiple contexts (single-instruction, multiple-data or SIMD, often used in vector processing), multiple sequences of instructions in a single context (multiple-instruction, singledata or MISD, used for redundancy in fail-safe systems and sometimes applied to describe pipelined processors or hyper- threading), or multiple sequences of instructions in multiple contexts (multiple-instruction, multiple-data or MIMD). Tightly coupled multiprocessor systems contain multiple CPUs that are connected at the bus level, and may have access to a central shared memory (SMP or UMA), or may participate in a memory hierarchy with both local and shared memory (NUMA). Chip multiprocessors, also known as multi-core computing, involves more than one processor placed on a single chip and can be thought of as the most extreme form of tightly-coupled multiprocessing. Loosely coupled multiprocessor systems (often referred to as clusters) are based on multiple standalone single, or dual processor commodity computers interconnected via a high-speed communication system (Gigabit Ethernet is common). Tightly- coupled systems perform better and are physically smaller than loosely-coupled systems, but have historically required greater initial investments and may depreciate rapidly. Nodes in a loosely- coupled system are usually inexpensive commodity computers and can be recycled as independent machines upon retirement from the cluster.

[0089] Filter driver. A filter driver is a Microsoft Windows compatible driver that extends or modifies the function of peripheral devices, or supports a specialized device in a personal computer, and commonly relates to a driver, program, or module that is inserted into the existing driver stack to perform some specific function, while not affecting the normal working of the existing driver stack in any major way. Any number of filter drivers can be added to Windows, where upper-level filter drivers sit above the primary driver for the device (the function driver), while lower level filter drivers sit below the function driver and above a bus driver. Filter drivers may work on a certain brand of devices such as a mouse or keyboard, or they may perform some operation on a class of devices, such as any mouse or any keyboard. The filter driver may be developed using the guide entitled: “ Filter Driver Development Guide'' Version 1 ,0a by Microsoft Corporation, dated 2004, which is incorporated in its entirety for all purposes as if fully set forth herein.

[0090] Hook. A hook (also known as a hook procedure or hook function) is a mechanism by which an application can intercept events, such as messages, mouse actions, and keystrokes, and generally refers to a function provided by a software application that receives certain data before the normal or intended recipient of the data. The hook function can thus examine or modify certain data before passing on the data. The hook function allows a software application to examine, or modify data before the data is passed to the intended recipient. A function that intercepts a particular type of event is known as a hook procedure. The hook procedure can act on each event it receives, and then modify or discard the event. The term ‘hooking’ is used herein to include, but not limited to, a range of techniques used to alter or augment the behavior of an operating system, applications, or other software components by intercepting function calls, messages, or events passed between software components. A code that handles such intercepted function calls, events or messages is called a "hook". The hooking is used for many purposes, including debugging and extending functionality.

[0091] Examples may include intercepting keyboard or mouse event messages before they reach an application, or intercepting operating system calls in order to monitor behavior, or modifying the function of an application or another component. It is also widely used in benchmarking programs, for example frame rate measuring in 3D games, where the output and input are done through hooking. Hooking is described in the presentations by High-Tech Bridge SA and titled: “ Userland Hooking in Windows” dated August 2011, and “ Inline Hooking in Windows” dated September 2011, both by Brian Mariani, and both incorporated in their entirety for all purposes as if fully set forth herein.

[0092] Physical modification. A hooking may be achieved by physically modifying an executable or library before an application is run through techniques of reverse engineering. This is typically used to intercept function calls to either monitor or replace them entirely. For example, by using a disassembler, the entry point of a function within a module can be found. It can then be altered to dynamically load some other library module and then have it execute desired methods within that loaded library. If applicable, altering an import table of an executable is another related approach by which hooking can be achieved. This table can be modified to load any additional library modules as well as changing what external code is invoked when a function is called by an application. An alternate method for achieving the function of hooking is by intercepting function calls through a wrapper library. When creating a wrapper, you make your own version of a library that an application loads, with all the same functionality of the original library that it will replace, so all the functions that are accessible, are essentially the same between the original and the replacement. This wrapper library can be designed to call any of the functionality from the original library, or replace it with an entirely new set of logic.

[0093] Runtime modification. Operating systems and software may provide the means to easily insert event hooks at runtime, as long as the process of inserting the hook is granted enough permission to do so. Microsoft Windows allows inserting hooks that can be used to process or modify system events and application events for dialogs, scrollbars, and menus, as well as other items. It also allows a hook to insert, remove, process, or modify keyboard and mouse events. Linux provides another example where hooks can be used in a similar manner to process network events within the kernel through NetFilter. When such functionality is not provided, a special form of hooking employs intercepting library function calls that are made by a process. Function hooking is implemented by changing the very first few code instructions of the target function to jump to an injected code. Alternatively, on systems using the shared library concept, the interrupt vector table or the import descriptor table can be modified in memory.

[0094] A hook chain is a list of pointers to special, application-defined callback functions called hook procedures. When a message occurs that is associated with a particular type of hook, the operating system passes the message to each hook procedure referenced in the hook chain, one after the other. The action of a hook procedure can depend on the type of hook involved. For example, the hook procedures for some types of hooks can only monitor messages, while others can modify the messages, or stop their progress through the chain, restricting them from reaching the next hook procedure, or a destination window.

[0095] Plug-in. A plug-in (or ‘plugin’, ‘extension’, or ‘add-on’ / ‘addon’) is a software component that adds a specific feature to an existing software application, such as enabling customization. The common examples are the plug-ins used in web browsers to add new features such as searchengines or virus scanners, or the ability to utilize a new file type such as a new video format. An ‘Add-on’ (or ‘addon’) is the general term for what enhances an application, and comprises snap- in, plug-in, theme, and skin. An extension add-on tailors the core features of an application by adding an optional module, whereas a plug-in add-on would tailor the outer layers of an application to personalize functionality. A theme or a skin add-on is a preset package containing additional or changed graphical appearance details, achieved by the use of a Graphical User Interface (GUI) that can be applied to a specific software and websites to suit the purpose, topic, or tastes of different users to customize the look and feel of a piece of computer software or an operating system front-end GUI (and window managers).

[0096] Typically, the host application provides services which the plug-in can use, including a way for plug-ins to register themselves with the host application, and a protocol for the exchange of data with plug-ins. Plug-ins depend on the services provided by the host application and do not usually work by themselves. Conversely, the host application operates independently of the plugins, making it possible for end-users to add and update plug-ins dynamically without needing to make changes to the host application. The term ‘plug-in’ is used herein to include, but not limited to, a software extension, which is software that serves to extend the capabilities of, or data available to existing software applications; it becomes included in the program. Therefore, after integration, extensions can be seen as part of the browser itself, tailored from a set of optional modules.

[0097] IPC. An Inter-Process Communication (IPC) (also be referred to as inter-thread communication and inter-application communication) is a set of methods for the exchange of data between multiple threads, in one or more processes. IPC methods may use message passing, synchronization, shared memory, and Remote Procedure Calls (RPC). It provides an environment that allows process cooperation, and may be used for providing information sharing, computational speedup, modularity, convenience, and privileged separation. In the Windows operating system environment, the IPC provides mechanisms for facilitating communications and data sharing between processes or applications.

[0098] Common IPC methods include file sharing, where a record (or any other information) stored on disk (or any other memory) can be accessed by name by any process; a signal which is an asynchronous notification sent to a process, or to a specific thread within the same process in order to notify it of an event that occurred; a socket which is a data stream sent over a network interface, either to a different process on the same computer or on another computer, such as Internet sockets; a pipe (or pipeline) which is a two-way data stream interfaced through standard input and output and is read character by character, commonly used in Unix-like computer operating systems; message queues which are anonymous data stream similar to the pipe that stores and retrieves information in packets, providing an asynchronous communications protocol; a semaphore which is a variable or abstract data type that is used for controlling access to a common resource; a shared memory which is a memory that may be simultaneously accessed by multiple programs with an intent to provide communication among them, or avoid redundant copies, such as where one process creates an area in RAM which other processes can access; and memory mapped file, where a file that is physically present on-disk, but can also be a device, shared memory object, or other resource that the operating system can reference through a file descriptor. Few IPC mechanisms are described in Chapter 9 of the Marko Vuskovic publication ‘Operating Systems’, entitled: “ INTERPROCESS COMMUNICATION" , which is incorporated in its entirety for all purposes as if fully set forth herein.

[0099] The Windows operating system supports IPC mechanisms such as a clipboard, where the clipboard acts as a central depository for data sharing among applications, so when a user performs a cut or copy operation in an application, the application puts the selected data on the clipboard in one or more standard, or application-defined formats, and any other application can then retrieve the data from the clipboard, choosing from the available formats that it understands; using Component Object Model (COM), where applications that use Object Linking and Embedding (OLE) manage compound documents can be used to call on other applications for data editing; Using Data Copy enabling an application to send information to another application using the WM_COPYDATA message; DDE protocol that enables applications to exchange data in a variety of formats; and mailslots providing one-way communication where processes write messages to their mailslot.

[0100] Browser extension. A browser extension is a computer program that extends the functionality of a web browser in some way. Extensions can be created through the use of web technologies such as HTML, JavaScript, and CSS. Browser extensions can also improve the user interface of the web browser without directly affecting the viewable content of a web-page, which can be achieved through a variety of add-ons, such as toolbars and plug-ins. The syntax for extensions may differ from browser to browser, or at least enough difference is that an extension working on a browser does not work on another one.

[0101] Plug-ins add specific abilities into browsers using Application Programming Interfaces (APIs) allowing third parties to create plug-ins that interact with the browser. The original API was NPAPI, but subsequently, Google introduced the PPAPI interface in Chrome. In addition, plug-ins allow browser extensions to perform tasks such as blocking ads, creating a secure online connection, and adding applications to a browser. Common browser plug-ins include the Adobe Flash Player, the QuickTime Player, and the Java plug-in, which can launch a user-activated Java applet on a web-page, and the applet is then executed within a Java Virtual Machine (JVM) in a process separate from the web browser itself.

[0102] Sockets. A socket (a.k.a. ‘network socket’) is an endpoint of an IPC flow across a computer network. In the case the communication is based on IP (Internet Protocol), the network sockets are referred to as Internet sockets. A socket API is an application programming interface (API), usually provided by the operating system that allows application programs to control and use network sockets. Internet socket APIs are usually based on the Berkeley sockets standard. The socket address is the combination of an IP address and a port number, similar to one end of a telephone connection in the combination of a phone number and a particular extension. Based on this address, internet sockets deliver incoming data packets to the appropriate application process or thread. The sockets are further described in a University of Toronto, Department of Computer Science presentation entitled: “Tutorial on Socket Programming" by Amin Tootoonchian, downloaded on August 2014, and in the SAS Institute Inc. SHARE Session 5958 tutorial ‘C Socket Programming Tutorial’ entitled: “Writing Client / Server Programs in C Using Sockets (A Tutorial) Part F, by Greg Granger, dated February of 1998, which are both incorporated in their entirety for all purposes as if fully set forth herein.

[0103] The Internet socket is characterized by a unique combination of a Local socket address (Local IP address and port number), remote socket address (used for established TCP sockets), and the used Protocol, typically a transport protocol (e.g., TCP, UDP, raw IP, or others). Within the operating system and the application that created a socket, a socket is referred to by a unique integer value called a socket descriptor. The operating system forwards the payload of incoming IP packets to the corresponding application by extracting the socket address information from the IP and transport protocol headers, and stripping the headers from the application data.

[0104] Several Internet socket types are available, such as Datagram sockets, also known as connectionless sockets, which use User Datagram Protocol (UDP), Stream sockets, also known as connection-oriented sockets, which use Transmission Control Protocol (TCP) or Stream Control Transmission Protocol (SCTP), and Raw sockets (or Raw IP sockets), typically available in routers and other network equipment. Here the transport layer is bypassed, and the packet headers are made accessible to the application. Other socket types are implemented over other transport protocols, such as Systems Network Architecture (SNA). Communicating local and remote sockets are called socket pairs. Each socket pair is described by a unique 4-tuple consisting of source and destination IP addresses and port numbers, i.e., of local and remote socket addresses. In the TCP case, each unique socket pair 4-tuple is assigned a socket number, while in the UDP case each unique local socket address is assigned a socket number.

[0105] The socket is primarily a concept used in the Transport Layer of the Internet model. Networking equipment such as routers and switches, do not require implementations of the Transport Layer, as they operate on the Link Layer level (switches) or at the Internet Layer (routers). However, stateful network firewalls, network address translators, and proxy servers keep track of active socket pairs. Also in fair queuing, layer 3 switching and quality of service (QoS) support in routers, packet flows may be identified by extracting information about the socket pairs. Raw sockets are typically available in network equipment and are used for routing protocols such as IGRP and OSPF, and in Internet Control Message Protocol (ICMP).

[0106] Web browser. A web browser (commonly referred to as a browser) is a software application for retrieving, presenting, and traversing information resources on the World Wide Web (WWW). An information resource is identified by a Uniform Resource Identifier (URI / URL) and may be part of a web-page, a whole web-page, an image, a video, or any other piece of content. Hyperlinks present in resources enable users easily to navigate their browsers to related resources. Although browsers are primarily intended to use the World Wide Web, they can also be used to access information provided by web servers in private networks or files in file systems. The primary purpose of the web browser is to bring information resources to the user ("retrieval" or "fetching"), allowing them to view the information ("display", "rendering"), and then access other information ("navigation", "following links"). Currently the major web browsers are known as Firefox, Internet Explorer, Google Chrome, Opera, and Safari.

[0107] The process begins when the user inputs a Uniform Resource Locator (URL), for example ‘http: / / en.wikipedia.org / ’, into the browser. The prefix of the URL, the Uniform Resource Identifier or URI, determines how the URL will be interpreted. The most commonly used kind of URI starts with http: and identifies a resource to be retrieved over the Hypertext Transfer Protocol (HTTP). Many browsers also support a variety of other prefixes, such as https: for HTTPS, ftp: for the File Transfer Protocol, and file: for local files. Prefixes that the web browser cannot directly handle are often handed off to another application entirely. For example, ‘mailto: URIs’ are usually passed to the user's default e-mail application, and ‘news: URIs’ are passed to the user's default newsgroup reader. In the case of http, https, file, and others, once the resource has been retrieved the web browser will display it. HTML and associated content (image files, formatting information such as CSS, etc.) are passed to the browser's layout engine to be transformed from markup to an interactive document, a process known as "rendering". Aside from HTML, web browsers can generally display any kind of content that can be part of the web-page. Most of the browsers can display images, audio, video, and XML files, and often have plug-ins to support Flash applications and Java applets. Upon encountering a file of an unsupported type or a file that is set up to be downloaded rather than displayed, the browser prompts the user to save the file to disk. Information resources may contain hyperlinks to other information resources. Each link contains the URI of a resource to go to, and when a link is clicked, the browser navigates to the resource indicated by the link's target URI, and the process of bringing content to the user begins again. The architecture of a web browser is described in the publication entitled: “Architecture and evolution of the modern web browser" by Alan Grosskurth and Michael W. Godfrey of the University of Waterloo in Canada, dated June 20, 2006, which is incorporated in its entirety for all purposes as if fully set forth herein.

[0108] A currently popular web browser is the Internet Explorer (formerly Microsoft Internet Explorer and Windows Internet Explorer, commonly abbreviated IE or MSIE) from Microsoft Corporation, headquartered in Redmond, Washington, U.S.A., which is a series of graphical web browsers developed by Microsoft and included as part of the Microsoft Windows line of operating systems. The Internet Explorer 8 is described, for example, in Microsoft 2009 publication entitled: “Step by Step Tutorials for Microsoft Internet Explorer 8 Accessibility Options '. which is incorporated in its entirety for all purposes as if fully set forth herein. Another popular web browser is the Google Chrome which is a freeware web browser developed by Google, headquartered in Googleplex, Mountain View, California, U.S.A. Google Chrome aims to be secure, fast, simple, and stable, providing strong application performance and JavaScript processing speed.

[0109] A mobile browser, also called a microbrowser, minibrowser, or Wireless Internet Browser (WIB), is a web browser designed for use on a mobile device such as a mobile phone or PDA. Mobile browsers are optimized so as to display web content most effectively for small screens on portable devices. The mobile browser software must be small and efficient to accommodate the low memory capacity and low-bandwidth of wireless handheld devices. Some mobile browsers can handle more recent technologies like CSS 2.1, JavaScript, and Ajax. Websites designed for access from these browsers are referred to as wireless portals or collectively as the Mobile Web, and may automatically create "mobile" versions of each page.

[0110] The mobile browser typically connects via a cellular network, via Wireless LAN, or via other wireless networks, and are using standard HTTP over TCP / IP, and displays the web-pages written in HTML, XHTML Mobile Profile (WAP 2.0), or WML (which evolved from HDML). WML and HDML are stripped-down formats suitable for transmission across limited bandwidth, and wireless data connection called WAP. WAP 2.0 specifies XHTML Mobile Profile plus WAP CSS, subsets of the W3C's standard XHTML and CSS with minor mobile extensions. Some mobile browsers are full- featured Web browsers capable of HTML, CSS, ECMAScript, as well as mobile technologies such as WML, i-mode HTML, or cHTML. To accommodate small screens, some mobile browsers use Post- WIMP interfaces. An example of a mobile browser is Safari, which is a mobile web browser developed by Apple Inc. (headquartered in Apple Campus, Cupertino, California, U.S.A), included with the OS X and iOS operating systems, and described in Apple publication entitled: “Safari Web Content Guide”, dated March 2014, which is incorporated in its entirety for all purposes as if fully set forth herein.

[0111] Headless browser. Headless browser refers to a web browser without a graphical user interface, that includes software that accesses web pages without showing them to any human being, but rather used to provide the content of web pages to other programs. The ability to manipulate the browser directly, by writing and running code, allows for much faster automated testing of websites and web applications. Typically, headless browsers provide automated control of a web-page in an environment similar to popular web browsers, but they are executed via a command-line interface or using network communication. They are particularly useful for testing web pages as they are able to render and understand HTML the same way a browser would, including styling elements such as page layout, colour, font selection, and execution of JavaScript and Ajax, which are usually not available when using other testing methods. In a headless testing environment, the code scripts can be written and executed for the following tasks: Testing basic and alternative flows; Simulating clicks on links and buttons; Automating form filling and submission; Testing SSL performance; Experimenting with various server loads; Generating reports on page response times; Scraping useful website code; and Taking screenshots of results. Some of the popular Headless Browsers for web testing includes Firefox headless mode, Headless Chrome, PhantomJS, Zombie.js, HtmlUnit, and Splash.

[0112] Systems and methods for media streaming using a headless browser are disclosed in U.S. Patent No. 10,554,706 to Charles F. Good, entitled "Media streaming using a headless browser", which is incorporated in its entirety for all purposes as if fully set forth herein. To enhance playback, prior to transmission of the encoded media stream, a hardware encoder utilizes a headless browser to add additional content (e.g., social media interactions, a title, a webpage, a background, etc.) to the encoded media stream. Since the headless browser is executed independent from the encoding operations of the hardware encoder, latency is improved in scenarios where the headless browser experiences sub-optimal performance (e.g., stalls, crashes, etc.). Method and system for enabling read and write access to secured data by a mobile device that executes a “native” mobile application and a headless browser are disclosed in U.S. Patent Publication No. 2018 / 0262910 to Charles Eric Smith, et al., entitled "Secured data access from a mobile device executing a native mobile application and a headless browser", which is incorporated in its entirety for all purposes as if fully set forth herein.

[0113] A technique for hardening the entry of user credentials in web sites is disclosed in U.S. Patent No. 9,979,717 to Greg Whiteside, et al., entitled "Algorithm hardening in background context and external from the browser to prevent malicious intervention with the browser", which is incorporated in its entirety for all purposes as if fully set forth herein. A headless web browser is provided for authenticating the user to a target web site with credentials previously stored in a secure database, and generating a session cookie. The headless browser provides the session cookie to the user's web browser, allowing the user to continue the session established by the headless browser.

[0114] A system for flexible and scalable automated end-to-end chat-based contact center testing, having a test case management platform, a chat cruncher, a contact center manager, a chat classifier, a desktop automation engine, and headless browser-based virtual agents and customers. Is disclosed in European Patent EP 3226515 to Alok Kulkami et al. entitled "System and method for automated end-to-end web interaction testing", which is incorporated in its entirety for all purposes as if fully set forth herein. The test case management platform allows a user to configure the operation of the system. The chat cruncher operates a plurality of virtual customers. The contact center manager operates a plurality of virtual agents to participate in chat session with virtual customers.

[0115] A web application architecture 960 that includes a software stack is shown in FIG. 3e. In this architecture 960, a set of applications 961 operates through one or more APIs 962 with a wrapper application 963 which runs on a web browser 965 through one or more APIs 964. In one example, the web browser 965 in turn runs through one or more APIs 966 on a preemptive multitasking operating system 967. Alternatively, the multitasking operating system 967 may be replaced by other known operating systems which are not preemptive or not multitasking. All the software shown in the software stack 960 operate on any data processing system (such as a client device), and in particular on the hardware of the data processing system 968.

[0116] The set of applications 961 may be web applications or web services applications, such as web email applications, web calendar applications, web contact or address book applications, web document applications (e.g., access to iWork documents), map applications such as applications for navigation or applications for finding a device, such as finding a smart phone, and other applications which can be implemented as a web application through a web browser which is in communication with one or more web servers to exchange data between the web application and the one or more web servers. The user data, such as emails, calendar data, contact data, etc. can be stored on one or more web servers and can be accessed and used through a web browser on a client device. These applications in the set of applications can operate on one or client devices that may comprise the data processing system hardware 968, and may be a desktop computer, a laptop computer, a tablet system, a smartphone, or a gaming device such as a game console or other consumer electronic devices.

[0117] The one or more APIs 962 may provide a variety of calls for functions or operations between the set of applications 961 and the wrapper application 963. The term ‘transfer’ or ‘transferring’ herein in connection with a call or API includes one of issuing or initiating or invoking or receiving a call or software message through the API. In one example, each of the applications in the set of applications can be written in part or entirely in JavaScript, and in another example, each of the applications can execute, in one embodiment, inside an iframe which runs in the wrapper application 963 which itself can be written at least in part in JavaScript and which runs on the web browser 965.

[0118] The wrapper application 963 may provide a virtual machine environment for the set of applications 961 and may run on the web browser 965 and can transfer calls between the wrapper application on and the web browser through the API 964. In one example, the wrapper application 963 owns the URL text entry field in the web browser and uses calls to the web browser to control the URL field and uses calls to the web browser to control the title bar; for example, the wrapper application may, through calls between the wrapper application and the web browser, change the name in the title bar to reflect the currently front most application. The wrapper application 963 may provide for life cycle management for each application in the set of applications, such as launching and quitting each of the applications. Furthermore, the wrapper application 963 can provide other features and functions and operations, including switching between applications, and handling errors of an application (e.g., tearing down a misbehaving or crashed application and offering to relaunch the application for a user). Further, in one embodiment the wrapper application can force a shutdown of an inactive or crashed or badly behaving application. Further, the wrapper application 963 can also provide a single log in and single log out point for the user and for all the applications in the set of applications. Further, the wrapper application 963 may not include certain features of a traditional operating system, such as a kernel, and memory handling, and scheduling of the operations of processes and threads, although in another example, the wrapper application 963 may include these functions or features or a portion of these functions or features of a traditional operating system.

[0119] In one example, the wrapper application 963 may further provide for push notification to one or more of the web applications in the set of applications 961, and may further allow a push notification to be presented for an application which is not front most through a user interface on the application that is front most in the set of applications 961. In one example, the wrapper application 963 and the set of applications 961 operate in a memory space which is defined by the memory space of the web browser 965 and operate within a thread or process which is defined by the web browser's window in which the wrapper application 963 and the set of applications 961 are running.

[0120] The web browser 965 may be a software application program that processes a web-page encoded in a markup language, such as HTML; the web page is retrieved by the web browser through one or more URLs (Uniform Resource Locator). The web browser 965 may be configured to process, using a layout engine in the web browser 965, the markup language of the web page into a DOM (Document Object Model) of the web page, and further the web browser 965 may be configured to process a cascading style sheet associated with the web page to present the web page. Furthermore, the web browser 965 may use one or more APIs 966 to interact with the operating system 967, and these APIs can support calls to the operating system for windowing and networking functions, such as TCP / IP, etc. as is known in the art. API. An API is an interface implemented by a program code component or hardware component (hereinafter “API-implementing component”) that allows a different program code component or hardware component (hereinafter “API-calling component”) to access and use one or more functions, methods, procedures, data structures, classes, and / or other services provided by the API-implementing component. An API may define one or more parameters that are passed between the API-calling component and the API-implementing component. An API allows a developer of an API-calling component (which may be a third-party developer) to leverage specified features provided by an API-implementing component. There may be one API-calling component or there may be more than one such component. An API may be a source code interface that a computer system or program library provides in order to support requests for services from an application. An Operating System (OS) may have multiple APIs to allow applications running on the OS to call one or more of those APIs, and a service (such as a program library) may have multiple APIs to allow an application that uses the service to call one or more of those APIs. An API can be specified in terms of a programming language that may be interpreted or compiled when an application is built.

[0121] In some examples the API-implementing component may provide more than one API, each providing a different view of or with different aspects that access different aspects of the functionality implemented by the API-implementing component. For example, one API of an API-implementing component may provide a first set of functions and may be exposed to third party developers, and another API of the API-implementing component can be hidden (not exposed) and provide a subset of the first set of functions and in addition provide another set of functions, such as testing or debugging functions which are not in the first set of functions. In other examples the API-implementing component may itself call one or more other components via an underlying API and thus be both an API-calling component and the API-implementing component.

[0122] The API typically defines the language and parameters that API-calling components use when accessing and using specified features of the API-implementing component. For example, an API-calling component accesses the specified features of the API-implementing component through one or more API calls or invocations (embodied for example by function or method calls) exposed by the API and passes data and control information using parameters via the API calls or invocations. The API-implementing component may return a value through the API in response to an API call from an API-calling component. While the API defines the syntax and result of an API call (e.g., how to invoke the API call and what the API call does), the API may not reveal how the API call accomplishes the function specified by the API call. Various API calls are transferred via the one or more application programming interfaces between the calling (API- calling component) and the API-implementing component. Transferring the API calls may include issuing, initiating, invoking, calling, receiving, returning, or responding to the function calls or messages; in other words, transferring can describe actions by either of the API-calling component or the API-implementing component. The function calls or other invocations of the API may send or receive one or more parameters through a parameter list or other structure. A parameter can be a constant, key, data structure, object, object class, variable, data type, pointer, array, list or a pointer to a function or method or another way to reference a data or other item to be passed via the API. Furthermore, data types or classes may be provided by the API and implemented by the API-implementing component. Thus, the API-calling component may declare variables, use pointers to, use or instantiate constant values of such types or classes by using definitions provided in the API.

[0123] Generally, an API can be used to access a service or data provided by the Al-implementing component or to initiate the performance of an operation or computation provided by the API- implementing component. By way of example, the API-implementing component and the API- calling component may each be any one of an operating system, a library, a device driver, an API, an application program, or other module (the API-implementing component and the API-calling component may be the same, or different type of module from each other). API-implementing components may in some cases be embodied at least in part in firmware, microcode, or other hardware logic. In some examples, the API may allow a client program to use the services provided by a Software Development Kit (SDK) library. In other examples an application or other client program may use the API provided by an Application Framework. In these embodiments the application or client program may incorporate calls to functions or methods provided by the SDK and provided by the API or use data types or objects defined in the SDK and provided by the API. An Application Framework may in these examples may provide a main event loop for a program that responds to various events defined by the Framework. The API allows the application to specify the events and the responses to the events using the Application Framework. In some examples, an API call can report to an application the capabilities or state of a hardware device, including those related to aspects such as input capabilities and state, output capabilities and state, processing capability, power state, storage capacity and state, communications capability, etc., and the API may be implemented in part by firmware, microcode, or other low- level logic that executes in part on the hardware component.

[0124] The API-calling component may be a local component (i.e., on the same data processing system as the API-implementing component) a component (i.e., on a different data processing system from API-implementing component) that communicates with the API-implementing component through the API over a network. It should be understood that the API-implementing component may also act as an API-calling component (i.e., it may make API calls to an API exposed by a different API-implementing component) and the API-calling component may also act as an API-implementing component by implementing an API that is exposed to a different API-calling component. The API may allow multiple API-calling components written in different programming languages to communicate with the API-implementing component (thus the API may include features for translating calls and returns between the API-implementing component and the API-calling component), however, the API may be implemented in terms of a specific programming language. An API-calling component may call APIs from different providers such as a set of APIs from an OS provider and another set of APIs from a plug-in provider and another set of APIs from another provider (e.g., the provider of a software library) or creator of the another set of APIs.

[0125] A block diagram illustrating an exemplary API architecture 970 is shown in FIG. 3f and includes an API-implementing component 973 (e.g., an operating system, a library, a device driver, an API, an application program, software, or other modules) that implements an API 972. The API 972 specifies one or more functions, methods, classes, objects, protocols, data structures, formats and / or other features of the API-implementing component that may be used by an API- calling component 971. The API 972 can specify at least one calling convention that specifies how a function in the API-implementing component receives parameters from the API-calling component and how the function returns a result to the API-calling component. The API-calling component 971 (e.g., an operating system, a library, a device driver, an API, an application program, software, or other modules), makes API calls through the API 972 to access and use the features of the API-implementing component 973 that are specified by the API 972. The API- implementing component 973 may return a value through the API 972 to the API-calling component 971 in response to an API call.

[0126] It will be appreciated that the API-implementing component 973 may include additional functions, methods, classes, data structures, and / or other features that are not specified through the API 972 and are not available to the API-calling component 971. It should be understood that the API-calling component 971 may be on the same system as the API-implementing component 973 or may be located remotely and accesses the API-implementing component 973 using the API 972 over a network. While a single API-calling component 971 interacting with the API 972 is shown in FIG. 3f, other API-calling components may equally be used, which may be written in different languages (or the same language) than the API-calling component 971, may use the API 972.

[0127] The API-implementing component 973, the API 972, and the API-calling component 971 may be stored in a machine-readable non-transitory storage medium, which includes any mechanism for storing information in a form readable by a machine (e.g., a computer or other data processing system). For example, a machine-readable medium includes magnetic disks, optical disks, random access memory; read only memory, flash memory devices, etc. and can be a local storage medium or a storage medium on a remote device that is coupled to a client device by one or more networks.

[0128] Hardware. Hardware generally refers to computer-related hardware, that comprises the physical parts of a computer and related or connected devices, that are typically interconnected electronic components, which perform analog or logic operations on received and locally stored information to produce as output, or store resulting new information or to provide control for output actuator mechanisms. Internal hardware devices may include motherboards, hard drives, and RAM, and external hardware devices include monitors, keyboards, mice, printers, and scanners.

[0129] Electronic hardware can range from individual chips / circuits to distributed information processing systems. All the physical parts of a computer, such as the case, Central Processing Unit (CPU), Random Access Memory (RAM), monitor, mouse, keyboard, computer data storage, graphics card, sound card, speakers and motherboard, are considered as hardware. Accordingly, as used herein, the term “hardware” should be understood to encompass any tangible entity, be that an entity that is physically constructed, permanently configured (e.g., hardwired), or temporarily configured (e.g., programmed) to operate in a certain manner or to perform certain operations described herein. Further, hardware refers to single, multiple, or collection of tangible entities, as well as the arrangement of such interconnected tangible entities, such as any arrangement for delivering or sharing power or data.

[0130] The term “peripheral device” (or “peripheral”) is used herein to include, but not limited to, any auxiliary stand-alone device that is external to, connectable to, works with, used to interact with, or sends data to, a host computer in some way, and a peripheral device may be an input or an output device. Input devices include a pointing device (e.g., computer mouse), a keyboard, a graphic tablet, a touchscreen, a barcode reader, an image scanner, a microphone, or a digital camera (e.g., webcam). An output device, which provides output from the host computer to a user or to another device, may be a display device, an image projector, a graphical output device, a loudspeaker, or a printer. The peripheral may be used to connect the host computer to an external network, such as a modem or a Network Interface Card (NIC). Further, the peripheral may be in part, or in full, integrated with the host computer. While exampled above regarding a general computer system, any device embedding firmware or software may equally be used, and in particular, any communication related devices such as a router or a firewall.

[0131] Smartphone. A mobile phone (also known as a cellular phone, cell phone, smartphone, or hand phone) is a device which can make and receive telephone calls over a radio link whilst moving around a wide geographic area, by connecting to a cellular network provided by a mobile network operator. The calls are to and from the public telephone network, which includes other mobiles and fixed-line phones across the world. The Smartphones are typically hand-held and may combine the functions of a personal digital assistant (PDA), and may serve as portable media players and camera phones with high-resolution touch- screens, web browsers that can access, and properly display, standard web-pages rather than just mobile-optimized sites, GPS navigation, WiFi, and mobile broadband access. In addition to telephony, the smartphones may support a wide variety of other services such as text messaging, MMS, email, Internet access, short-range wireless communications (infrared, Bluetooth), business applications, gaming, and photography.

[0132] An example of a contemporary smartphone is a model iPhone 6 available from Apple Inc., headquartered in Cupertino, California, U.S.A., and described in iPhone 6 technical specification (retrieved 10 / 2015 from www.apple.com / iphone-6 / specs / ), and in a User Guide dated 2015 (019- 00155 / 2015-06) by Apple Inc. entitled: “iPhone User Guide For iOS 8.4 Software”, which are both incorporated in their entirety for all purposes as if fully set forth herein. Another example of a smartphone is Samsung Galaxy S6 available from Samsung Electronics headquartered in Suwon, South-Korea, described in the user manual numbered English (EU), 03 / 2015 (Rev. 1.0) entitled: "SM-G925F SM-G925FQ SM-G925I User Manual” and having features and specification described in “Galaxy S6 Edge - Technical Specification” (retrieved 10 / 2015 from www.samsung.com / us / explore / galaxy-s-6-features-and-specs), which are both incorporated in their entirety for all purposes as if fully set forth herein.

[0133] A mobile operating system (also referred to as mobile OS), is an operating system that operates a smartphone, tablet, PDA, or other mobile device. Modem mobile operating systems combine the features of a personal computer operating system with other features, including a touchscreen, cellular, Bluetooth, Wi-Fi, GPS mobile navigation, camera, video camera, speech recognition, voice recorder, music player, near field communication and infrared blaster. Currently, the popular mobile operating systems are Android, Symbian, Apple iOS, BlackBerry, MeeGo, Windows Phone, and Bada. Mobile devices with mobile communications capabilities (e.g., smartphones) typically contain two mobile operating systems - the main user-facing software platform is supplemented by a second low-level proprietary real-time operating system which operates the radio and other hardware.

[0134] Android is an open source and Linux -based mobile operating system (OS) based on the Linux kernel that is currently offered by Google. With a user interface based on direct manipulation, Android is designed primarily for touchscreen mobile devices such as smartphones and tablet computers, with specialized user interfaces for televisions (Android TV), cars (Android Auto), and wrist watches (Android Wear). The OS uses touch inputs that loosely correspond to real-world actions, such as swiping, tapping, pinching, and reverse pinching to manipulate onscreen objects, and a virtual keyboard. Despite being primarily designed for touchscreen input, it also has been used in game consoles, digital cameras, and other electronics. The response to user input is designed to be immediate and provides a fluid touch interface, often using the vibration capabilities of the device to provide haptic feedback to the user. Internal hardware such as accelerometers, gyroscopes, and proximity sensors are used by some applications to respond to additional user actions, for example, adjusting the screen from portrait to landscape depending on how the device is oriented, or allowing the user to steer a vehicle in a racing game by rotating the device, simulating control of a steering wheel.

[0135] Android devices typically boot to the home-screen, the primary navigation and information point on the device, which is similar to the desktop found on PCs. The Android homescreens are typically made up of app icons and widgets; app icons launch the associated app, whereas widgets display live, auto-updating content such as the weather forecast, the user's email inbox, or a news ticker directly on the homescreen. The homescreen may be made up of several pages that the user can swipe back and forth between, though Android's home-screen interface is heavily customizable, allowing the user to adjust the look and feel of the device to their tastes. Third-party apps available on Google Play and other app stores can extensively re-theme the homescreen, and even mimic the look of other operating systems, such as Windows Phone. The Android OS is described in a publication entitled: “Android Tutorial”, downloaded from tutorialspoint.com on July 2014, which is incorporated in its entirety for all purposes as if fully set forth herein. iOS (previously iPhone OS) from Apple Inc. (headquartered in Cupertino, California, U.S.A.) is a mobile operating system distributed exclusively for Apple hardware. The user interface of the iOS is based on the concept of direct manipulation, using multi-touch gestures. Interface control elements consist of sliders, switches, and buttons. Interaction with the OS includes gestures such as swipe, tap, pinch, and reverse pinch, all of which have specific definitions within the context of the iOS operating system and its multi-touch interface. Internal accelerometers are used by some applications to respond to shaking the device (one common result is the undo command) or rotating it in three dimensions (one common result is switching from portrait to landscape mode). The iOS is described in the publication entitled: “IOS Tutorial”, downloaded from tutorialspoint.com on July 2014, which is incorporated in its entirety for all purposes as if fully set forth herein.

[0136] Geolocation. IP-based geolocation (commonly known as geolocation) is a mapping of an IP address (or MAC address) to the real-world geographic location of a computing device or a mobile device connected to the Internet. The IP address based location data may include information such as country, region, city, postal / zip code, latitude, longitude, or Time-zone. Deeper data sets can determine other parameters such as domain name, connection speed, ISP, Language, proxies, company name, US DMA / MSA, NAICS codes, and home / business classification. The geolocation is further described in the publication entitled: “Towards Street- Level Client-Independent IP Geolocation" by Yong Wang et al., downloaded from the Internet on July 2014, and in an Information Systems Audit and Control Association (ISACA) 2011 white paper entitled: “Geolocation: Risk, Issues and Strategies”, which are both incorporated in their entirety for all purposes as if fully set forth herein. There are a number of commercially available geolocation databases, such as a web-site http: / / www.ip21ocation.com operated by Ip21ocation.com headquartered in Penang, Malaysia, offering IP geolocation software applications, and geolocation databases may be obtained from IpInfoDB operating web-site http: / / ipinfodb.com, and by Max Mind, Inc., based in Waltham, Massachusetts, U.S.A, operating the web-site www.maxmind.com / en / home.

[0137] Further, the W3C Geolocation API is an effort by the World Wide Web Consortium (W3C) to standardize an interface to retrieve the geographical location information for a clientside device. It defines a set of objects, ECMA Script standard compliant, executing in the client application, give the client's device location through the consulting of Location Information Servers, which are transparent for the Application Programming Interface (API). The most common sources of location information are IP address, Wi-Fi and Bluetooth MAC address, radio-frequency identification (RFID), Wi-Fi connection location, or device Global Positioning System (GPS) and GSM / CDMA cell IDs. The location is returned with a given accuracy depending on the best location information source available. The W3C Recommendation for the geolocation API specifications draft dated October 24, 2013, is available from the web-site http: / / www.w3.org / TR / 2013 / REC-geolocation-API-20131024. Geolocation-based addressing is described in U.S. Patent No. 7,929,535 to Chen et al., entitled: “Geolocation-based Addressing Method for IPv6 Addresses” , and in U.S. Patent No. 6,236,652 to Preston et al., entitled: “Geo- spacial Internet Protocol Addressing", and in U.S. Patent Application Publication No. 2005 / 0018645 to Mustonen et al., entitled: “ Utilization of Geographic Location Information in IP Addressing' , which are all incorporated in their entirety for all purposes as if fully set forth herein.

[0138] Virtualization. The term virtualization typically refers to the technology that allows for the creation of software-based virtual machines that can run multiple operating systems from a single physical machine. In one example, virtual machines can be used to consolidate the workloads of several under-utilized servers to fewer machines, perhaps a single machine (server consolidation), providing benefits (perceived or real, but often cited by vendors) such as savings on hardware, environmental costs, management, and administration of the server infrastructure. Virtualization scheme allows for the creation of substitutes for real resources, that is, substitutes that have the same functions and external interfaces as their counterparts, but that differ in attributes, such as size, performance, and cost. These substitutes are called virtual resources, and their users are typically unaware of the substitution.

[0139] Virtualization is commonly applied to physical hardware resources by combining multiple physical resources into shared pools from which users receive virtual resources. With virtualization, you can make one physical resource look like multiple virtual resources. Virtual resources can have functions or features that are not available in their underlying physical resources. Virtualization can provide the benefits of consolidation to reduce hardware cost, such as to efficiently accessing and manage resources to reduce operations and systems management costs while maintaining needed capacity, and having a single server function as multiple virtual servers. In addition, virtualization can provide optimization of workloads, such as responding dynamically to the application needs of its users, and increasing the use of existing resources by enabling dynamic sharing of resource pools. Further, virtualization may be used for IT flexibility and responsiveness, such as by having a single, consolidated view of, and easy access to, all available resources in the network, regardless of location, and reducing the management of your environment by providing emulation for compatibility and improved interoperability.

[0140] Virtual machine (VM). Virtual machine is a representation of a real machine using software that provides an operating environment which can run or host a guest operating system. In one example, the virtual machine may include a self-contained software emulation of a machine, which does not physically exist, but shares resources of an underlying physical machine. Like a physical computer, a virtual machine runs an operating system and applications. Multiple virtual machines can operate concurrently on a single host system. There are different kinds of virtual machines, each with different functions: System virtual machines (also termed full virtualization VMs) provide a substitute for a real machine, and provide the functionality needed to execute entire operating systems. A hypervisor uses native execution to share and manage hardware, allowing for multiple environments which are isolated from one another, yet exist on the same physical machine. Modem hypervisors use hardware-assisted virtualization, virtualization-specific hardware, primarily from the host CPUs. Process virtual machines are designed to execute computer programs in a platform-independent environment. Some virtual machines, such as QEMU, are designed to also emulate different architectures and allow the execution of software applications and operating systems written for another CPU or architecture. Operating-system-level virtualization allows the resources of a computer to be partitioned via the kernel's support for multiple isolated user space instances, which are usually called containers and may look and feel like real machines to the end users.

[0141] Guest Operating System. A guest operating system is an operating system running in a virtual machine environment that would otherwise run directly on a separate physical system. Operating-system-level virtualization, also known as containerization, refers to an operating system feature in which the kernel allows the existence of multiple isolated user-space instances. Such instances, called containers, partitions, Virtualization Engines (VEs) or jails (FreeBSD jail or chroot jail), may look like real computers from the point of view of programs running in them. A computer program running on an ordinary operating system can see all resources (connected devices, files and folders, network shares, CPU power, quantifiable hardware capabilities) of that computer. However, programs running inside a container can only see the container's contents and devices assigned to the container. In addition to isolation mechanisms, the kernel often provides resource-management features to limit the impact of one container's activities on other containers. With operating-system-virtualization, or containerization, it is possible to run programs within containers, to which only parts of these resources are allocated. A program expecting to see the whole computer, once run inside a container, can only see the allocated resources and believes them to be all that is available. Several containers can be created on each operating system, to each of which a subset of the computer's resources is allocated. Each container may contain any number of computer programs. These programs may run concurrently or separately, even interact with each other.

[0142] Hypervisor. Hypervisor commonly refers to a thin layer of software that generally provides virtual partitioning capabilities and runs directly on the hardware, but underneath higher- level virtualization services. The hypervisor typically manages virtual machines, allowing them to interact directly with the underlying hardware. System virtualization creates many virtual systems within a single physical system. The virtual systems are independent operating environments that use virtual resources. The system virtualization can be approached through hardware partitioning or hypervisor technology. The hardware partitioning subdivides a physical server into fractions, each of which can run an operating system. These fractions are typically created with coarse units of allocation, such as whole processors or physical boards. This type of virtualization allows for hardware consolidation, but does not have the full benefits of resource sharing and emulation offered by hypervisors. Hypervisors use the thin layer of code in software or firmware to achieve fine-grained, dynamic resource sharing. Because hypervisors provide the greatest level of flexibility in how virtual resources are defined and managed, they are the primary technology for system virtualization.

[0143] Virtual Machine Monitor. A Virtual Machine Monitor (VMM) is computer software, firmware or hardware that creates and runs virtual machines. The computer on which the hypervisor runs one or more virtual machines is called a host machine, and each virtual machine is called a guest machine. The hypervisor presents the guest operating systems with a virtual operating platform and manages the execution of the guest operating systems. Multiple instances of a variety of operating systems may share the virtualized hardware resources: for example, Linux, Windows, and macOS instances can all run on a single physical x86 machine. This contrasts with operating-system-level virtualization, where all instances (usually called containers) must share a single kernel, though the guest operating systems can differ in user space, such as different Linux distributions with the same kernel. Typically, a VMM refers to a software that runs in a layer between the hypervisor or host operating system and one or more virtual machines, and provides the virtual machines abstraction to the guest operating systems. With full virtualization, the VMM exports a virtual machine abstraction identical to the physical machine, so the standard operating system can run just as they would on physical hardware.

[0144] Hardware virtualization or platform virtualization refers to the creation of a virtual machine that acts like a real computer with an operating system. Software executed on these virtual machines is separated from the underlying hardware resources. In hardware virtualization, the host machine is the actual machine on which the virtualization takes place, and the guest machine is the virtual machine. The words host and guest are used to distinguishing the software that runs on the physical machine from the software that runs on the virtual machine. The software or firmware that creates a virtual machine on the host hardware is called a hypervisor or Virtual Machine Manager. Different types of hardware virtualization include full-virtualization, where almost complete simulation of the actual hardware allows software, which typically consists of a guest operating system, to run unmodified, and Para-virtualization, where a hardware environment is not simulated; however, the guest programs are executed in their own isolated domains, as if they are running on a separate system. Guest programs need to be specifically modified to run in this environment.

[0145] Hardware-assisted virtualization is a way of improving the overall efficiency of virtualization. It involves CPUs that provide support for virtualization in hardware, and other hardware components that help improve the performance of a guest environment. Hardware virtualization can be viewed as part of an overall trend in enterprise IT that includes autonomic computing, a scenario in which the IT environment will be able to manage itself based on perceived activity, and utility computing, in which computer processing power is seen as a utility that clients can pay for only as needed. The usual goal of virtualization is to centralize administrative tasks while improving scalability and overall hardware-resource utilization. With virtualization, several operating systems can be run in parallel on a single central processing unit (CPU). This parallelism tends to reduce overhead costs and differs from multitasking, which involves running several programs on the same OS. Using virtualization, an enterprise can better manage updates and rapid changes to the operating system and applications without disrupting the user.

[0146] Server Virtualization. Server virtualization is a virtualization technique that involves partitioning a physical server into a number of small, virtual servers with the help of virtualization software. In server virtualization, each virtual server runs multiple operating system instances at the same time. A Virtual Private Server (VPS) is a virtual machine sold as a service by an Internet hosting service, that runs its own copy of an Operating System (OS), and customers may have superuser-level access to that operating system instance, so they can install almost any software that runs on that OS. For many purposes, they are functionally equivalent to a dedicated physical server, and being software-defined, are able to be much more easily created and configured. They are typically priced much lower than an equivalent physical server. However, as they share the underlying physical hardware with other VPS's, performance may be lower, depending on the workload of any other executing virtual machines. Dedicated Servers may also be more efficient with CPU dependent processes such as hashing algorithms.

[0147] Application Virtualization. Application virtualization is software technology that encapsulates computer programs from the underlying operating system on which it is executed. A fully virtualized application is not installed in the traditional sense, although it is still executed as if it were. The application behaves at runtime like it is directly interfacing with the original operating system and all the resources managed by it, but can be isolated or sandboxed to varying degrees. The application virtualization is layered on top of other virtualization technologies, allowing computing resources to be distributed dynamically in real-time. In this context, the term "virtualization" commonly refers to the artifact being encapsulated (application), which is quite different from its meaning in hardware virtualization, where it refers to the artifact being abstracted (physical hardware).

[0148] Network Virtualization. Network Virtualization refers to the process of combining hardware and software network resources to create a single pool of resources that make up a virtual network that can be accessed without regard to the physical component. The network virtualization typically involves combining hardware and software network resources and network functionality into a single, software-based administrative entity, a virtual network. Further, network virtualization involves platform virtualization, often combined with resource virtualization. The network virtualization is categorized as either external virtualization, combining many networks or parts of networks into a virtual unit, or internal virtualization, providing network-like functionality to software containers on a single network server.

[0149] Storage Virtualization. Storage virtualization refers to the process of consolidating the physical storage from multiple network storage devices so that it appears to be a single storage unit. Within the context of a storage system, there are two primary types of virtualization that can occur: Block virtualization used in this context refers to the abstraction (separation) of logical storage (partition) from physical storage so that it may be accessed without regard to physical storage or heterogeneous structure. This separation allows the administrators of the storage system greater flexibility in how they manage storage for end users. File virtualization addresses the NAS challenges by eliminating the dependencies between the data accessed at the file level and the location where the files are physically stored. This provides opportunities to optimize storage use and server consolidation and to perform non-disruptive file migrations.

[0150] Desktop Virtualization. Desktop virtualization refers to a process of virtualizing desktop computers using virtualization software, such that the desktop computer and the associated operating system and applications are separated from the physical client device that is used to access it. The desktop virtualization is software technology that separates the desktop environment and associated application software from the physical client device that is used to access it.

[0151] Further, the desktop virtualization can be used in conjunction with application virtualization and user profile management systems, now termed "user virtualization," to provide a comprehensive desktop environment management system. In this mode, all the components of the desktop are virtualized, which allows for a highly flexible and much more secure desktop delivery model. In addition, this approach supports a more complete desktop disaster recovery strategy as all components are essentially saved in the data center and backed up through traditional redundant maintenance systems. If a user's device or hardware is lost, the restore is straightforward and simple, because the components will be present at login from another device. In addition, because no data is saved to the user's device, if that device is lost, there is much less chance that any critical data can be retrieved and compromised. Virtual Desktop Infrastructure (VDI) - The practice of hosting a desktop environment within a virtual machine that runs on a centralized or remote server.

[0152] An example of a virtualization architecture 900 is shown in FIG. 3b, where three virtual machines are exemplified. A Virtual Machine (VM) #1 910a provides virtualization for the application 901a that uses the guest OS 902a, which in turn interfaces with the virtual hardware 903a that emulates the actual hardware. Similarly, a Virtual Machine (VM) #2 910b provides virtualization for the application 901b that uses the guest OS 902b, which in turn interfaces with the virtual hardware 903b that emulates the associated actual hardware, and a Virtual Machine (VM) #3 910c provides virtualization for the application 901c that uses the guest OS 902c, which in turn interfaces with the virtual hardware 903c that emulates the associated actual hardware. The abstraction layer is provided by VMM 904, allowing of hardware-independence of operating systems and applications, provisioning on any single physical system, and managing the applications and the OSs as a single encapsulated unit.

[0153] A hosted architecture 900a for virtualization is shown in FIG. 3c, where a wide range of actual host hardware 906 may be used by implementing a host operating system 905 layer between the actual hardware 906 and the VMM 904. Such configuration relies on the host OS 905 for device support and physical resource management. In contrast, a bare-metal architecture 900b is shown in FIG. 3d, where a hypervisor layer (in addition to, or as part of, the VMM 904) is used as the first layer, allowing the VMM 904 to have direct access to the hardware resources, hence providing more efficient, and greater scalability, robustness, and performance.

[0154] Cloud. The term “Cloud” or "Cloud computing" as used herein is defined as a technology infrastructure facilitating supplement, consumption, and delivery of IT services, and generally refers to any group of networked computers capable of delivering computing services (such as computations, applications, data access, and data management and storage resources) to end users. This disclosure does not limit the type (such as public or private) of the cloud, as well as the underlying system architecture used by the cloud. The IT services are internet based and may involve elastic provisioning of dynamically scalable and time virtualized resources. Although such virtualization environments can be privately deployed and used within a local area or wide area networks owned by an enterprise, a number of “cloud service providers” host virtualization environments accessible through the public internet (the “public cloud”) that is generally open to anyone, or through private IP or other type of network accessible only by entities given access to it (a “private cloud ”). Using a cloud-based control server or using the system above may allow for reduced capital or operational expenditures. The users may further access the system using a web browser regardless of their location or what device they are using, and the virtualization technology allows servers and storage devices to be shared and utilization to be increased. Examples of public cloud providers include Amazon AWS, Microsoft Azure and Google GCP. The comparison of service features such as computation, storage, and infrastructure of the three cloud service providers (AWS, Microsoft Azure, and GCP) is disclosed in an article entitled: “ Highlight the Features of AWS, GCP and Microsoft Azure that Have an Impact when Choosing a Cloud Service Provider" by Muhammad Ayoub Kamal, Hafiz Wahab Raza, Muhammad Mansoor Alam, and Mazliham Mohd Su’ud, published January 2020 in ‘International Journal of Recent Technology and Engineering (URTE)’ ISSN: 2277-3878, Volume-8by Blue Eyes Intelligence Engineering & Sciences Publication [DGI:10.35940 / ijrte.D8573.018520], which is incorporated in its entirety for all purposes as if fully set forth herein.

[0155] The term "Software as a Service (SaaS)" as used herein in this application, is defined as a model of software deployment whereby a provider licenses a Software Application (SA) to customers for use as a service on demand. Similarly, an “Infrastructure as a Service” (laaS) allows enterprises to access virtualized computing systems through the public Internet. The term "customer" as used herein in this application, is defined as a business entity that is served by an SA, provided on the SaaS platform. A customer may be a person or an organization and may be represented by a user that responsible for the administration of the application in aspects of permissions configuration, user related configuration, and data security policy. The service is supplied and consumed over the Internet, thus eliminating requirements to install and run applications locally on a site of a customer as well as simplifying maintenance and support. Particularly, it is advantageous in massive business applications. Licensing is a common form of billing for the service and it is paid periodically. SaaS is becoming ever more common as a form of SA delivery over the Internet and is being facilitated in a technology infrastructure called "Cloud Computing". In this form of SA delivery, where the SA is controlled by a service provider, a customer may experience stability and data security issues. In many cases, the customer is a business organization that is using the SaaS for business purposes such as business software; hence, stability and data security are primary requirements. As part of a cloud service arrangement, any computer system may also be emulated using software running on a hardware computer system. This virtualization allows for multiple instances of a computer system, each referred to as a virtual machine, to run on a single machine. Each virtual machine behaves like a computer system running directly on hardware. It is isolated from the other virtual machines, as would two hardware computers. Each virtual machine comprises an instance of an operating system (the “guest operating system”). There is a host operating system running directly on the hardware that supports the software that emulates the hardware, and the emulation software is commonly referred to as a hypervisor.

[0156] The term “cloud-based” generally refers to a hosted service that is remotely located from a data source and configured to receive, store and process data delivered by the data source over a network. The cloud-based systems may be configured to operate as a public cloud-based service, a private cloud-based service or a hybrid cloud-based service. A “public cloud-based service” may include a third-party provider that supplies one or more servers to host multi-tenant services. Examples of a public cloud-based service include Amazon Web Services® (AWS®), Microsoft® Azure™, and Google® Compute Engine™ (GCP) as examples. In contrast, a “private” cloud-based service may include one or more servers that host services provided to a single subscriber (enterprise) and a hybrid cloud-based service may be any combination of certain functionality from a public cloud-based service and a private cloud-based service.

[0157] Cloud computing and virtualization are described in a book entitled “ Cloud Computing and Virtualization" authored by Dac-Nhuong Le (Faculty of Information Technology, Haiphong University, Haiphong, Vietnam), Raghvendra Kumar (Department of Computer Science and Engineering, LNCT, Jabalpur, India), Gia Nhu Nguyen (Graduate School, Duy Tan University, Da Nang, Vietnam), and Jyotir Moy Chatterjee (Department of Computer Science and Engineering at GD-RCET, Bhilai, India), and published 2018 by John Wiley & Sons, Inc. [ISBN 978-1-119-48790-6], which is incorporated in its entirety for all purposes as if fully set forth herein. The book describes the adoption of virtualization in data centers creates the need for a new class of networks designed to support elasticity of resource allocation, increasing mobile workloads and the shift to production of virtual workloads, requiring maximum availability. Building a network that spans both physical servers and virtual machines with consistent capabilities demands a new architectural approach to designing and building the IT infrastructure. Performance, elasticity, and logical addressing structures must be considered as well as the management of the physical and virtual networking infrastructure. Once deployed, a network that is virtualization-ready can offer many revolutionary services over a common shared infrastructure. Virtualization technologies from VMware, Citrix and Microsoft encapsulate existing applications and extract them from the physical hardware. Unlike physical machines, virtual machines are represented by a portable software image, which can be instantiated on physical hardware at a moment’s notice. With virtualization, comes elasticity where computer capacity can be scaled up or down on demand by adjusting the number of virtual machines actively executing on a given physical server. Additionally, virtual machines can be migrated while in service from one physical server to another.

[0158] Extending this further, virtualization creates “location freedom” enabling virtual machines to become portable across an ever-increasing geographical distance. As cloud architectures and multi-tenancy capabilities continue to develop and mature, there is an economy of scale that can be realized by aggregating resources across applications, business units, and separate corporations to a common shared, yet segmented, infrastructure. Elasticity, mobility, automation, and density of virtual machines demand new network architectures focusing on high performance, addressing portability, and the innate understanding of the virtual machine as the new building block of the data center. Consistent network- supported and virtualization-driven policy and controls are necessary for visibility to virtual machines’ state and location as they are created and moved across a virtualized infrastructure.

[0159] Virtualization technologies in data center environments are described in an eBook authored by Gustavo Alessandro Andrade Santana and published 2014 by Cisco Systems, Inc. (Cisco Press) [ISBN-13: 978-1-58714-324-3] entitled: “Data Center Virtualization Fundamentals” , which is incorporated in its entirety for all purposes as if fully set forth herein. PowerVM technology for virtualization is described in IBM RedBook entitled: “IBM PowerVM Virtualization - Introduction and Configuration” published by IBM Corporation June 2013, and virtualization basics is described in a paper by IBM Corporation published 2009 entitled: “Power Systems - Introduction to virtualization”, which are both incorporated in their entirety for all purposes as if fully set forth herein.

[0160] FIG. 1 shows a block diagram that illustrates a system 10 including a computer system 11 and an associated Internet 113 connection. Such configuration is typically used for computers (hosts) connected to the Internet 113 and executing a server or a client (or any combination thereof) software. The system 11 may be used as a portable electronic device such as a notebook / laptop computer, a media player (e.g., MP3 based or video player), a desktop computer, a laptop computer, a cellular phone, a Personal Digital Assistant (PDA), an image processing device (e.g., a digital camera or video recorder), and / or any other handheld or fixed location computing devices, or any combination of any of these devices. Note that while FIG. 1 illustrates various components of a computer system, it is not intended to represent any particular architecture or manner of interconnecting the components; as such details are not germane. It will also be appreciated that network computers, handheld computers, cell phones, and other data processing systems which have fewer components or perhaps more components may also be used. The computer system of FIG. 1 may, for example, be an Apple Macintosh computer or Power Book, or an IBM compatible PC.

[0161] The computer system 11 includes a bus 13, an interconnect, or other communication mechanism for communicating information, and a processor 27, commonly in the form of an integrated circuit, coupled to the bus 13 for processing information and for executing the computer executable instructions. The computer system 11 also includes a main memory 25a, such as a Random Access Memory (RAM) or other dynamic storage device, coupled to the bus 13 for storing information and instructions to be executed by the processor 27. The main memory 25a also may be used for storing temporary variables or other intermediate information during execution of instructions to be executed by processor 27. The computer system 11 further includes a Read Only Memory (ROM) 25b (or other non-volatile memory) or other static storage device coupled to the bus 13 for storing static information and instructions for the processor 27. A storage device 25c, such as a magnetic disk or optical disk, a Hard Disk Drive (HDD) for reading from and writing to the hard disk, a magnetic disk drive for reading from and writing to a magnetic disk, and / or an optical disk drive (such as DVD) for reading from and writing to a removable optical disk, is coupled to the bus 13 for storing information and instructions. The hard disk drive, magnetic disk drive, and optical disk drive may be connected to the system bus by the hard disk drive interface, a magnetic disk drive interface, and an optical disk drive interface, respectively. The drives and their associated computer-readable media provide non-volatile storage of computer readable instructions, data structures, program modules, and other data for the general-purpose computing devices. Typically, the computer system 11 includes an Operating System (OS) stored in a non-volatile storage for managing the computer resources and provides the applications and programs with an access to the computer resources and interfaces. An operating system commonly processes system data and user input, and responds by allocating and managing tasks and internal systems resources, such as controlling and allocating memory, prioritizing system requests, controlling input and output devices, facilitating networking, and managing files. Non-limiting examples of operating systems are Microsoft Windows, Mac OS X, and Linux.

[0162] The term "processor" is used herein to include, but not limited to, any integrated circuit or other electronic device (or collection of devices) capable of performing an operation on at least one instruction, including, without limitation, Reduced Instruction Set Core (RISC) processors, CISC microprocessors, Microcontroller Units (MCUs), CISC-based Central Processing Units (CPUs), and Digital Signal Processors (DSPs). The hardware of such devices may be integrated onto a single substrate (e.g., silicon "die"), or distributed among two or more substrates. Furthermore, various functional aspects of the processor may be implemented solely as software or firmware associated with the processor.

[0163] The computer system 11 may be coupled via the bus 13 to a display 17, such as a Cathode Ray Tube (CRT), a Liquid Crystal Display (LCD), a flat screen monitor, a touch screen monitor, or similar means for displaying text and graphical data to a user. The display may be connected via a video adapter for supporting the display. The display 17 allows a user to view, enter, and / or edit the information that is relevant to the operation of the system. An input device 18, including alphanumeric and other keys, is coupled to the bus 13 for communicating information and command selections to the processor 27. Another type of user input device is a cursor control 19, such as a mouse, a trackball, or cursor direction keys for communicating direction information and command selections to the processor 27 and for controlling cursor movement on the display 17. This input device 18 typically has two degrees of freedom in two axes, a first axis (e.g., ‘x’) and a second axis (e.g., ‘y’), that allows the device to specify positions in a plane.

[0164] A touch- screen may be used as a combination of a display 17 and input device 18. A computing device with a touch screen display, and a computer-implemented method for use in conjunction with the computing device with a touch screen display, is disclosed in U.S. Patent No. 7,479,949 to Jobs el al., entitled "Touch screen device, method, and graphical user interface for determining commands by applying heuristics”, which is incorporated in its entirety for all purposes as if fully set forth herein. The method comprises detecting one or more finger contacts with the touch screen display, applying one or more heuristics to the one or more finger contacts to determine a command for the device, and processing the command. The one or more heuristics comprise a heuristic for determining that the one or more finger contacts correspond to a onedimensional vertical screen scrolling command, a heuristic for determining that the one or more finger contacts correspond to a two-dimensional screen translation command, and a heuristic for determining that the one or more finger contacts correspond to a command to transition from displaying a respective item in a set of items to displaying a next item in the set of items.

[0165] The computer system 11 may be used for implementing the methods and techniques described herein. According to one embodiment, those methods and techniques are performed by the computer system 11 in response to the processor 27 executing one or more sequences of one or more instructions contained in a main memory 25a. Such instructions may be read into the main memory 25a from another computer-readable medium, such as the storage device 25c. Execution of the sequences of instructions contained in the main memory 25a causes the processor 27 to perform the process steps described herein. In alternative embodiments, hard-wired circuitry may be used in place of or in combination with software instructions to implement the arrangement. Thus, examples herein are not limited to any specific combination of hardware circuitry and software.

[0166] The term "computer-readable medium" (or "machine-readable medium") is used herein to include, but not limited to, any medium or any memory, that participates in providing instructions to a processor, (such as the processor 27) for execution, or any mechanism for storing or transmitting information in a form readable by a machine (e.g., a computer). Such a medium may store computer-executable instructions to be executed by a processing element and / or control logic, and data which is manipulated by a processing element and / or control logic, and may take many forms, including but not limited to, non-volatile medium, volatile medium, and transmission medium. Transmission media includes coaxial cables, copper wire and fiber optics, including the wires that comprise the bus 13. Transmission media can also take the form of acoustic or light waves, such as those generated during radio-wave and infrared data communications, or other form of propagating signals (e.g., carrier waves, infrared signals, digital signals, etc.). Common forms of computer-readable media include, for example, a floppy disk, a flexible disk, hard disk, magnetic tape, or any other magnetic medium, a CD-ROM, any other optical medium, punchcards, paper-tape, any other physical medium with patterns of holes, a RAM, a PROM, and EPROM, a FLASH-EPROM, any other memory chip or cartridge, a carrier wave as described hereinafter, or any other medium from which a computer can read.

[0167] Various forms of computer-readable media may be involved in carrying one or more sequences of one or more instructions to the processor 27 for execution. For example, the instructions may initially be carried on a magnetic disk of a remote computer. The remote computer can load the instructions into its dynamic memory and send the instructions over a telephone line using a modem. A modem local to the computer system 11 can receive the data on the telephone line and use an infrared transmitter to convert the data to an infrared signal. An infrared detector can receive the data carried in the infrared signal and appropriate circuitry can place the data on the bus 13. The bus 13 carries the data to the main memory 25a, from which the processor 27 retrieves and executes the instructions. The instructions received by the main memory 25a may optionally be stored on the storage device 25c either before or after execution by the processor 27.

[0168] The computer system 11 commonly includes a communication interface 29 coupled to the bus 13. The communication interface 29 provides a two-way data communication coupling to a network link 28 that is connected to a local network 14. For example, the communication interface 29 may be an Integrated Services Digital Network (ISDN) card or a modem to provide a data communication connection to a corresponding type of telephone line. As another non-limiting example, the communication interface 29 may be a local area network (LAN) card to provide a data communication connection to a compatible LAN. For example, Ethernet based connection based on IEEE802.3 standard may be used, such as 10 / 100BaseT, lOOOBaseT (gigabit Ethernet), 10 gigabit Ethernet (10GE or lOGbE or 10 GigE per IEEE Std. 802.3ae-2002as standard), 40 Gigabit Ethernet (40GbE), or 100 Gigabit Ethernet (lOOGbE as per Ethernet standard IEEE P802.3ba). These technologies are described in Cisco Systems, Inc. Publication number 1- 587005-001-3 (6 / 99), "Internetworking Technologies Handbook", Chapter 7: "Ethernet Technologies" , pages 7-1 to 7-38, which is incorporated in its entirety for all purposes as if fully set forth herein. In such a case, the communication interface 29 typically includes a LAN transceiver or a modem, such as Standard Microsystems Corporation (SMSC) LAN91C111 10 / 100 Ethernet transceiver, described in a Standard Microsystems Corporation (SMSC) datasheet “LAN91C111 10 / 100 Non-PCI Ethernet Single Chip MAC + PHY” Data-Sheet, Rev. 15 (02-20-04), which is incorporated in its entirety for all purposes as if fully set forth herein.

[0169] The Internet 113 is a global system of interconnected computer networks that use the standardized Internet Protocol Suite (TCP / IP), including Transmission Control Protocol (TCP) and the Internet Protocol (IP), to serve billions of users worldwide. It is a network of networks that consists of millions of private, public, academic, business, and government networks, of local to global scope, that are linked by a broad array of electronic and optical networking technologies. The Internet carries a vast range of information resources and services, such as the interlinked hypertext documents on the World Wide Web (WWW) and the infrastructure to support electronic mail. The Internet backbone refers to the principal data routes between large, strategically interconnected networks and core routers on the Internet. These data routes are hosted by commercial, government, academic and other high-capacity network centers, the Internet exchange points and network access points that interchange Internet traffic between the countries, continents and across the oceans of the world. Traffic interchange between Internet service providers (often Tier 1 networks) participating in the Internet backbone exchange traffic by privately negotiated interconnection agreements, primarily governed by the principle of settlement-free peering.

[0170] An Internet Service Provider (ISP) 12 is an organization that provides services for accessing, using, or participating in the Internet 113. Internet Service Providers may be organized in various forms, such as commercial, community-owned, non-profit, or otherwise privately owned. Internet services typically provided by ISPs include Internet access, Internet transit, domain name registration, web hosting, and colocation. Various ISP Structures are described in Chapter 2: “Structural Overview of ISP Networks” of the book entitled: “Guide to Reliable Internet Services and Applications”, by Robert D. Doverspike, K.K. Ramakrishnan, and Chris Chase, published 2010 (ISBN: 978-1-84882-827-8), which is incorporated in its entirety for all purposes as if fully set forth herein.

[0171] A mailbox provider is an organization that provides services for hosting electronic mail domains with access to storage for mailboxes. It provides email servers to send, receive, accept, and store email for end users or other organizations. Internet hosting services provide email, webhosting, or online storage services. Other services include virtual server, cloud services, or physical server operation. A virtual ISP (VISP) is an operation that purchases services from another ISP, sometimes called a wholesale ISP in this context, which allows the VISP's customers to access the Internet using services and infrastructure owned and operated by the wholesale ISP. It is akin to mobile virtual network operators and competitive local exchange carriers for voice communications. A Wireless Internet Service Provider (WISP) is an Internet service provider with a network based on wireless networking. Technology may include commonplace Wi-Fi wireless mesh networking, or proprietary equipment designed to operate over open 900 MHz, 2.4 GHz, 4.9, 5.2, 5.4, 5.7, and 5.8 GHz bands or licensed frequencies in the UHF band (including the MMDS frequency band) and LMDS.

[0172] ISPs may engage in peering, where multiple ISPs interconnect at peering points or Internet exchange points (IXs), allowing routing of data between each network, without charging one another for the data transmitted — data that would otherwise have passed through a third upstream ISP, incurring charges from the upstream ISP. ISPs requiring no upstream and having only customers (end customers and / or peer ISPs), are referred to as Tier 1 ISPs.

[0173] A multitasking is a method where multiple tasks (also known as processes or programs) are performed during the same period of time - they are executed concurrently (in overlapping time periods, new tasks starting before others have ended) instead of sequentially (one completing before the next starts). The tasks share common processing resources, such as a CPU and main memory. Multitasking does not necessarily mean that multiple tasks are executing at exactly the same instant. In other words, multitasking does not imply parallelism, but it does mean that more than one task can be part-way through execution at the same time, and more than one task is advancing over a given period of time.

[0174] In the case of a computer with a single CPU, only one task is running at any point in time, meaning that the CPU is actively executing instructions for that task. Multitasking solves the problem by scheduling which task may be the one running at any given time, and when another waiting task gets a turn. The act of reassigning a CPU from one task to another one is called a context switch. When context switches occur frequently enough, the illusion of parallelism is achieved. Even on computers with more than one CPU (called multiprocessor machines) or more than one core in a given CPU (called multicore machines), where more than one task can be executed at a given instant (one per CPU or core), multitasking allows many more tasks to be run than there are CPUs.

[0175] Operating systems may adopt one of many different scheduling strategies. In multiprogramming systems, the running task keeps running until it performs an operation that requires waiting for an external event (e.g., reading from a tape) or until the computer's scheduler forcibly swaps the running task out of the CPU. Multiprogramming systems are designed to maximize CPU usage. In time-sharing systems, the running task is required to relinquish the CPU, either voluntarily or by an external event such as a hardware interrupt. Time sharing systems are designed to allow several programs to execute apparently simultaneously. In real-time systems, some waiting tasks are guaranteed to be given the CPU when an external event occurs. Real-time systems are designed to control mechanical devices such as industrial robots, which require timely processing.

[0176] Encryption based mechanisms are commonly end-to-end processes involving only the sender and the receiver, where the sender encrypts the plain text message by transforming it using an algorithm, making it unreadable to anyone, except the receiver which possesses special knowledge. The data is then sent to the receiver over a network such as the Internet, and when received the special knowledge enables the receiver to reverse the process (decrypt) to make the information readable as in the original message. The encryption process commonly involves computing resources such as processing power, storage space and requires time for executing the encryption / decryption algorithm, which may delay the delivery of the message.

[0177] Transport Layer Security (TLS) and its predecessor Secure Sockets Layer (SSL) are nonlimiting examples of end-to-end cryptographic protocols, providing secured communication above the OSI Transport Layer, using keyed message authentication code and symmetric cryptography. In client / server applications, the TLS client and server negotiate a stateful connection by using a handshake procedure, during which various parameters are agreed upon, allowing a communication in a way designed to prevent eavesdropping and tampering. The TLS 1.2 is defined in RFC 5246, and several versions of the protocol are in widespread use in applications such as web browsing, electronic mail, Internet faxing, instant messaging, and Voice- over-IP (VoIP). In application design, TLS is usually implemented on top of any of the Transport Layer protocols, encapsulating the application-specific protocols such as HTTP, FTP, SMTP, NNTP, and XMPP. It has been used primarily with reliable transport protocols such as the Transmission Control Protocol (TCP). However, it has also been implemented with datagram- oriented transport protocols, such as the User Datagram Protocol (UDP) and the Datagram Congestion Control Protocol (DCCP), a usage which has been standardized independently using the term Datagram Transport Layer Security (DTLS). A prominent use of TLS is for securing World Wide Web traffic carried by HTTP to form HTTPS. Notable applications are electronic commerce and asset management. Increasingly, the Simple Mail Transfer Protocol (SMTP) is also protected by TLS (RFC 3207). These applications use public key certificates to verify the identity of endpoints. Another Layer 4 (Transport Layer) and upper layers encryption-based communication protocols include SSH (Secure Shell) and SSL (Secure Socket Layer).

[0178] To provide the server name, RFC 4366 Transport Layer Security (TLS) Extensions allow clients to include a Server Name Indication extension (SNI) in the extended ClientHello message. This extension hints to the server immediately which name the client wishes to connect to, so the server can select the appropriate certificate to send to the clients.

[0179] Layer 3 (Network Layer) and lower layer encryption-based protocols include an IPsec, L2TP (Layer 2 Tunneling Protocol) over IPsec, and Ethernet over IPsec. The IPsec is a protocol suite for securing IP communication by encrypting and authenticating each IP packet of a communication session. The IPsec standard is currently based on RFC 4301 and RFC 4309, and was originally described in RFCs 1825-1829, which are now obsolete, and uses the Security Parameter Index (SPI, as per RFC 2401) as an identification tag added to the header while using IPsec for tunneling the IP traffic. The IPsec overview is provided in Cisco Systems, Inc. document entitled: "An Introduction to IP Security (IPSec) Encryption", which is incorporated in its entirety for all purposes as if fully set forth herein.

[0180] Two common approaches to cryptography are found in U.S. Patent No. 3,962,539 to Ehrsam et al., entitled "Product Block Cipher System for Data Security", and in U.S. Patent No. 4,405,829 to Rivest et al., entitled "Cryptographic Communications System and Method", which are both incorporated in their entirety for all purposes as if fully set forth herein. The Ehrsam patent discloses what is commonly known as the Data Encryption Standard (DES), while the Rivest patent discloses what is commonly known as the RSA algorithm (which stands for Rivest, Shamir, and Adleman who first publicly described it), which is widely used in electronic commerce protocols. The RSA involves using a public key and a private key. DES is based upon secret-key cryptography, also referred to as symmetric cryptography, and relies upon a 56-bit key for encryption. In this form of cryptography, the sender and receiver of cipher text both possess identical secret keys, which are, in an ideal world, completely unique and unknown to the world outside of the sender and receiver. By encoding plain text into cipher text using the secret key, the sender may send the cipher text to the receiver using any available public or otherwise insecure communication system. The receiver, having received the cipher text, decrypts it using the secret key to arrive at the plain text.

[0181] SNI. Server Name Indication (SNI) is an extension to the TLS computer networking protocol by which a client indicates which hostname it is attempting to connect to at the start of the handshaking process. This allows a server to present multiple certificates on the same IP address and TCP port number and hence allows multiple secure (HTTPS) websites (or any other Service over TLS) to be served by the same IP address without requiring all those sites to use the same certificate. It is the conceptual equivalent to HTTP / 1.1 name-based virtual hosting, but for HTTPS. The desired hostname is not encrypted, so an eavesdropper can see which site is being requested.

[0182] SNI addresses this issue by having the client sends the name of the virtual domain as part of the TLS negotiation. This enables the server to select the correct virtual domain early and present the browser with the certificate containing the correct name. Therefore, with clients and servers that implement SNI, a server with a single IP address can serve a group of domain names for which it is impractical to get a common certificate. SNI was added to the lETF's Internet RFCs in June 2003 through RFC 3546, Transport Layer Security (TLS) Extensions. The latest version of the standard is RFC 6066. For an application program to implement SNI, the TLS library it uses must implement it and the application must pass the hostname to the TLS library. Further, the TLS library may either be included in the application program or be a component of the underlying operating system.

[0183] Proxy. According to IETF RFC 2616, a ‘proxy’ is an intermediary program which acts as both a server and a client for the purpose of making requests on behalf of other clients. Requests are serviced internally or by passing them on, with possible translation, to other servers. A proxy MUST implement both the client and server requirements of this specification. A “transparent proxy” is a proxy that does not modify the request or response beyond what is required for proxy authentication and identification. A “non-transparent proxy” is a proxy that modifies the request or response in order to provide some added service to the user agent, such as group annotation services, media type transformation, protocol reduction, or anonymity filtering. Except where either transparent or non-transparent behavior is explicitly stated, the HTTP proxy requirements apply to both types of proxies.

[0184] Proxy server. A proxy server is a server (a computer system or an application) that acts as an intermediary for requests from clients seeking resources from other servers. The client connects to the proxy server, requesting some service, such as a file, connection, web page, or other resource, available from a different server and the proxy server evaluates the request as a way to simplify and control its complexity. Proxies may be used to add structure and encapsulation to distributed systems. Today, most proxies are web proxies, facilitating access to content on the World Wide Web and providing anonymity. A proxy server may reside on the user's local computer, or at various points between the user's computer and destination servers on the Internet. A proxy server that passes requests and responses unmodified is usually called a gateway or sometimes a tunneling proxy. A forward proxy is an Internet-facing proxy used to retrieve from a wide range of sources (in most cases anywhere on the Internet). Forward proxies are proxies in which the client server names the target server to connect to, and are able to retrieve from a wide range of sources (in most cases anywhere on the Internet). An open proxy is a forwarding proxy server that is accessible by any Internet user, while browsing the Web or using other Internet services. There are varying degrees of anonymity, however, as well as a number of methods of 'tricking' the client into revealing itself regardless of the proxy being used. The proxy server is further described in IETF RFC 1919 (March 1996) “Classical versus Transparent IP Proxies ' and in IETF RFC 3143 (March 1996) “Known HTTP Proxy / Caching Problems ' (June 2001), which are both incorporated in their entirety for all purposes as if fully set forth herein.

[0185] A reverse proxy (or surrogate) is a proxy server that appears to clients to be an ordinary server. Requests are forwarded to one or more proxy servers which handle the request. The response from the proxy server is returned as if it came directly from the original server, leaving the client no knowledge of the origin servers. Reverse proxies are installed in the neighborhood of one or more web servers. All traffic coming from the Internet and with a destination of one of the neighborhood's web servers goes through the proxy server. The use of "reverse" originates in its counterpart "forward proxy" since the reverse proxy sits closer to the web server and serves only a restricted set of websites.

[0186] FIG. 5 shows a system 50 including two client devices, a client device #1 31a and a client device #2 31b, that may access the web servers (data servers) 22a and 22b. These network elements communicate with each other using the Internet 113. An illustrative example of direct fetching or content without any use of any intermediary device (such as a proxy server) is shown in a schematic messaging flow diagram 50a in FIG. 5a. As part of executing a web server application in the client device #1 31a, a request for content from the data server #1 22a, typically by means of an URL request is identified. As a result, the client device #1 31a sends a ‘Content Request’ message 55a over the Internet 113 (typically as an HTTP request) to the data server #1 22a. The IP packets that form the ‘Content Request’ message 55a include the IP of the data server #1 22a in the ‘Destination IP Address’ field 16c, and the IP address of the requesting client device #1 31a is included in the ‘Source IP Address’ field 16d. As a result, the data server #1 22a responds to the received request by sending the requested content (such as a web page) as a ‘ Send Content’ message 55b over the Internet 113 (typically as an HTTP request) to the requesting client device #1 31a. The IP packets that form the ‘Send Content’ message 55b include the IP address of the data server #1 22a in the ‘Source IP Address’ field 16d, and the IP address of the requesting client device #1 31a is included in the ‘Destination IP Address’ field 16c.

[0187] Since the IP address of the requesting client device #1 31a is included in the packets that are received by the data server #1 22a as part of the HTTP request in the ‘Content Request’ message 55a over the Internet 113, the data server #1 22a is aware of the identity of the requesting client #1 31a, revealing its identity, and no anonymity is obtained.

[0188] An illustrative example of using a proxy server is shown in a schematic messaging flow diagram 50b in FIG. 5b. A ‘Content Request’ message 54a is first sent from the client device #1 31a to a proxy server 53, which responds by forwarding the request to the data server #1 22a using a ‘Content Request’ message 54b. In turn the data server #1 22a replies and sends the content in a ‘ Send Content’ message 54c to the requesting proxy server 53, which in turn forward the fetched content to the asking client device #1 31a using a ‘Send Content’ message 54d. Hence, the client device #1 31a received the requested content in response to the sent ‘Content Request’ message 54a.

[0189] The main benefit of using the proxy server 53 relates to the anonymity obtained. While the ‘Content Request’ message 54a typically includes the IP address of the sending requesting client device #1 31a (in the ‘Source IP Address’ field 16d), the request message that arrives as part of the ‘Content Request’ message 54b includes the IP address of the proxy server 53 in the ‘ Source IP Address’ field 16d of the packets that form the ‘Content Request’ message 54b. Hence, the data server #1 22a is only aware of the identity of the proxy server 53 as the requesting device, and the anonymity of the actual requesting client #1 31a is reserved, while properly fetching the requested content.

[0190] A 'transparent proxy' is a proxy that does not modify the request or response beyond what is required for proxy authentication and identification. The transparent proxy, also known as an intercepting proxy, inline proxy, or forced proxy, is a proxy that intercepts normal communication at the network layer without requiring any special client configuration. Clients need not be aware of the existence of the proxy. The transparent proxy is normally located between the client and the Internet, with the proxy performing some of the functions of a gateway or router. A 'nontransparent proxy' is a proxy that modifies the request or response in order to provide some added service to the user agent, such as group annotation services, media type transformation, protocol reduction, or anonymity filtering. TCP Intercept is a traffic filtering security feature that protects TCP servers from TCP SYN flood attacks, which are a type of denial-of- service attack. TCP Intercept is available for IP traffic only. Intercepting proxies are commonly used in businesses to enforce acceptable use policy, and to ease administrative overheads, since no client browser configuration is required. This second reason however is mitigated by features such as Active Directory group policy, or DHCP and automatic proxy detection. Intercepting proxies are also commonly used by ISPs in some countries to save upstream bandwidth and improve customer response times by caching.

[0191] An ‘open proxy’ is used for forwarding requests from and to anywhere on the Internet, and is a forwarding proxy server that is accessible by any Internet user. An ‘anonymous proxy’ reveals its identity as a proxy server, but does not disclose the originating IP address of the client. While this type of server may be easily discovered, it may be beneficial for some users for hiding their originating IP address. A ‘transparent proxy’ does not only identify itself as a proxy server, but with the support of HTTP header fields such as X-Forwarded-For, the originating IP address may be retrieved as well. The main benefit of using this type of server is its ability to cache a website for faster retrieval.

[0192] A ‘reverse proxy’ is taking requests from the Internet and forwarding them to servers in an internal network, while those making requests connect to the proxy and may not be aware of the internal network. The reverse proxy (or surrogate) is a proxy server that appears to clients to be an ordinary server. Reverse-proxies forward requests to one or more ordinary servers which handle the request. The response from the proxy server is returned as if it came directly from the original server, leaving the client with no knowledge of the original server. The reverse proxies are installed in the neighborhood of one or more web servers. All traffic coming from the Internet and with a destination of one of the neighborhood's web servers goes through the proxy server. The use of "reverse" originates in its counterpart "forward proxy" since the reverse proxy sits closer to the web server and serves only a restricted set of websites. Reverse proxy servers typically support or provide Encryption / SSL acceleration - when secure web sites are created, the Secure Sockets Layer (SSL) encryption is often not done by the web server itself, but by a reverse proxy that is equipped with SSL acceleration hardware. Furthermore, a host can provide a single "SSL proxy" to provide SSL encryption for an arbitrary number of hosts; removing the need for a separate SSL Server Certificate for each host, with the downside that all hosts behind the SSL proxy have to share a common DNS name or IP address for SSL connections. Further, reverse proxy servers typically support or provide load balancing - the reverse proxy can distribute the load to several web servers, each web server serving its own application area. In such a case, the reverse proxy may need to rewrite the URLs in each of the web-page (translation from externally known URLs to the internal locations), and serve / cache static content - the reverse proxy can offload the web servers by caching static content like pictures and other static graphical content. Further, the proxy server can optimize and compress the content to speed up the load time, and may further support or provides Spoon feeding, where reduced resource usage is caused by slow clients on the web servers by caching the content the web server sent and slowly "spoon feeding" it to the client, which benefits dynamically generated pages. Further, reverse proxy servers typically support or provide security, where the proxy server is an additional layer of defense and can protect against some OS and Web Server specific attacks, and Extranet Publishing - where a reverse proxy server facing the Internet can be used to communicate to a firewall server internal to an organization, providing extranet access to some functions while keeping the servers behind the firewalls. If used in this way, security measures should be considered to protect the rest of your infrastructure in case this server is compromised, as its web application is exposed to attack from the Internet.

[0193] A ‘translation proxy’ is a proxy server that is used to localize a website experience for different markets. Traffic from global audience is routed through the translation proxy to the source website, and as visitors browse the proxied site, requests go back to the source site where pages are rendered. The original language content in the response is replaced by the translated content as it passes back through the proxy. The translations used in the translation proxy can be either machine translation, human translation, or any combination of machine and human translation. Different translation proxy implementations have different capabilities. Some allow further customization of the source site for local audience such as excluding the source content or substituting the source content with the original local content. A ‘SOCKS proxy’ forwards arbitrary data after a connection phase, and is similar to HTTP CONNECT in web proxies.

[0194] A ‘CGI web proxy’ accepts target URLs using a Web form in the user's browser window, processes the request, and returns the results to the user's browser. Consequently, it can be used on a device or network that does not allow "true" proxy settings to be changed. Typically CGI proxies are powered by one of CGIProxy (written in the Perl language), Glype (written in the PHP language), or PHProxy (written in the PHP language). Some CGI proxies were set up for purposes such as making websites more accessible to disabled people, but have since been shut down due to excessive traffic, usually caused by a third party advertising the service as a means to bypass local filtering. Since many of these users do not care about the collateral damage they are causing, it became necessary for organizations to hide their proxies, disclosing the URLs only to those who take the trouble to contact the organization and demonstrate a genuine need.

[0195] A ‘suffix proxy’ allows a user to access web content by appending the name of the proxy server to the URL of the requested content (e.g., "en.wikipedia.org.SuffixProxy.com"). The suffix proxy servers are easier to use than regular proxy servers but they do not offer high levels of anonymity and their primary use is for bypassing web filters.

[0196] An ‘I2P anonymous proxy’ is part of the I2P anonymous network ('I2P'), that is a proxy network aiming at online anonymity. It implements garlic routing, which is an enhancement of Tor's onion routing. I2P is fully distributed and works by encrypting all communications in various layers and relaying them through a network of routers run by volunteers in various locations. By keeping the source of the information hidden, I2P offers censorship resistance. The goals of I2P are to protect users' personal freedom, privacy, and ability to conduct confidential business. Each user of I2P runs an I2P router on their computer (node). The I2P router takes care of finding other peers and building anonymizing tunnels through them. I2P provides proxies for all protocols, such as HTTP, IRC, and SOCKS. The Onion Router (Tor or TOR) is a system intended to provide online anonymity. Tor client software routes Internet traffic through a worldwide volunteer network of servers for concealing a user computer location or usage from someone conducting network surveillance or traffic analysis. Using Tor makes tracing Internet activity more difficult, and is intended to protect users' personal freedom, privacy. "Onion routing" refers to the layered nature of the encryption service: the original data are encrypted and re-encrypted multiple times, then sent through successive Tor relays, each one of which decrypts a "layer" of encryption before passing the data on to the next relay and ultimately the destination. This reduces the possibility of the original data being unscrambled or understood in transit. A ‘DNS proxy server’ takes DNS queries from a (usually local) network and forwards them to an Internet Domain Name Server. It may also cache DNS records.

[0197] Squid is an open source caching proxy for the Web, allowing for using less bandwidth on your Internet connection when surfing the Web, reducing the amount of time web-pages take to load, protecting the hosts on your internal network by proxying their web traffic, collecting statistics about web traffic on your network, preventing users from visiting inappropriate web sites at work or school, ensuring that only authorized users can surf the Internet, enhancing your user’s privacy by filtering sensitive information from web requests, reducing the load on your own web server(s), and converting encrypted (HTTPS) requests on one side, to unencrypted (HTTP). Squid’s job is to be both a proxy and a cache. As a proxy, Squid is an intermediary in a web transaction. It accepts a request from a client, processes that request, and then forwards the request to the origin server. The request may be logged, rejected, and even modified before forwarding. As a cache, Squid stores recently retrieved web content for possible reuse later. Subsequent requests for the same content may be served from the cache, rather than contacting the origin server again. You can disable the caching part of Squid if you like, but the proxying part is essential. Squid is described in a book by Duane Wessels entitled: “ Squid: The Definitive Guide” published by O’Reilly Media; 1st Ed. [ISBN-10: 9780596001629, ISBN-13: 978-0596001629, (January 1, 2004)], which is incorporated in its entirety for all purposes as if fully set forth herein.

[0198] Squid improves network performance by reducing the amount of bandwidth used when surfing the Web. It makes web-pages load faster and can even reduce the load on your web server. By caching and reusing popular web content, Squid allows you to get by with smaller network connections. It also protects the host on your internal network by acting as a firewall and proxying your internal web traffic. You can use Squid to collect statistics about the traffic on your network, prevent users from visiting inappropriate web sites at work or school, ensure that only authorized users can surf the Internet, and enhance your privacy by filtering sensitive information from web requests. Companies, schools, libraries, and organizations that use web-caching proxies can look forward to a multitude of benefits. The book “ Squid: The Definitive Guide” helps to configure and tune Squid for your particular situation. Newcomers to Squid will learn how to download, compile, and install code. The later chapters tackle advanced topics such as high-performance storage options, rewriting requests, HTTP server acceleration, monitoring, debugging, and troubleshooting Squid. Topics covered include: compiling and installing Squid, Running Squid, using Squid's sophisticated access controls, tuning disk storage for optimal performance, Configuring the operating system for HTTP interception, forwarding Requests to other web caches, using redirectors to rewrite user requests, monitoring Squid with the cache manager and SNMP, using Squid to accelerate and protect HTTP servers, managing bandwidth consumption with Delay Pools.

[0199] The structure and functionality of the Internet cache protocol (ICP) and its implementation in the Squid web caching software is described in an article entitled: “ICP and the Squid web cache” published April 1998 in ‘IEEE Journal on Selected Areas in Communications’ (Volume: 16, Issue: 3, Apr 1998) [DOI: 10.1109 / 49.669043], which is incorporated in its entirety for all purposes as if fully set forth herein. ICP is a lightweight message format used for communication among Web caches. Caches exchange ICP queries and replies to gather information to use in selecting the most appropriate location from which to retrieve an object. The history of ICP is presented, and issues in ICP deployment are discussed, such as efficiency, security, and interaction with other aspects of Web traffic behavior. The article catalogs successes, failures, and lessons learned from using ICP to deploy a global Web cache hierarchy.

[0200] Web proxy servers are described in a book by Luotonen entitled: “Web Proxy Servers” published by Prentice Hall; 1st Ed. [ISBN-10: 0136806120, ISBN-13: 978-0136806127, (December 30, 1997)], which is incorporated in its entirety for all purposes as if fully set forth herein. An overview of proxies and reports their status is provided in a paper by Luotonen et al. entitled: “World-Wide Web proxies”, published Computer Networks and ISDN Systems 27, 147- 154 (Elsevier Science B.V.) (1994), which is incorporated in its entirety for all purposes as if fully set forth herein. A WWW proxy server, proxy for short, provides access to the Web for people on closed subnets who can only access the Internet through a firewall machine. The hypertext server developed at CERN, cem_httpd, is capable of running as a proxy, providing seamless external access to HTTP, Gopher, WAIS and FTP. ccm_httpd has had gateway features for a long time, but only this spring they were extended to support all the methods in the HTTP protocol used by WWW clients. Clients do not lose any functionality by going through a proxy, except special processing they may have done for non-native Web protocols such as Gopher and FTP. A feature of caching is performed by the proxy, resulting in shorter response times after the first document fetch. This makes proxies useful even to the people who do have full Internet access and do not really need the proxy just to get out of their local subnet.

[0201] An example of an open proxy is ProxyList.net, a web site that maintained a list of links to open proxies, as described in ProxyList.net and as captured by the Wayback Machine (web.archive.org), on July 17, 2011, which is incorporated in its entirety for all purposes as if fully set forth herein. VIP72 is a website that sells its registered users access to anonymizing proxies, that is described in a printout that comprises a numbered sequence the representing approximately second-by- second screen dumps of the video of VIP72 YouTube web-page bearing a publication date of Sep. 22, 2011, at https: / / www.youtube.com / watch?v=L0Hct2kSnn4, retrieved Nov. 21, 2019, and further described in VIP72 Scene Images extracted from VIP72.com / nvpnnet, MPEG- 4 video recording of "nVPN.net | Double your Safety and use Socks5 +nVpn", accessed from https: / / www.youtube.com / watch?v=L0Hct2kSnn4, published September 11, 2011, as well as VIP72.com home page as of 2013 from Wayback Machine, which are all incorporated in their entirety for all purposes as if fully set forth herein.

[0202] Distributing transmission of requests across multiple IP addresses of a proxy server is described in U.S. Patent Application Publication No. 2013 / 0080575 to Prince et al. entitled: “Distributing transmission of requests across multiple ip addresses of a proxy server in a cloudbased proxy service”, which is incorporated in its entirety for all purposes as if fully set forth herein. A first packet is received at a proxy server from a client and includes a first incoming request for an action to be performed on an identified resource. The first packet is received at the proxy server as a result of a DNS request for a domain corresponding to the identified resource resolving to an IP address of the proxy server. The proxy server selects, based on at least in part on a set of parameters associated with the first packet, one of the multiple IP addresses for use as a source IP address for a second packet that carries an outgoing request and transmits the second packet. The proxy server receives a third packet that includes an incoming response from the destination origin server in response to the outgoing request and transmits a fourth packet to the client that includes an outgoing response based on the incoming response.

[0203] Data Center (DC) Proxy server. While the arrangement 50b that is shown in FIG. 5b provides some level of anonymity, such anonymity may be limited. The data server #1 22a may identify that the IP address corresponding to the received requests as part of the ‘Content Request’ 54b from the proxy server 53 belongs to a server or a proxy server, and may block this IP address, obviating the access of the proxy server 53 to serve as an intermediate device for the client device #1 31a. Further, particularly if used frequently and by multiple client devices, the data server #1 22a may detect the excessive load of requests from the proxy server 53, and may conclude that the IP address corresponding to the received requests as part of the ‘Content Request’ 54b from the proxy server 53 does not identify a client device but rather an intermediate device, and may then block this IP address, and will not respond to requests for content originating by this IP address.

[0204] An improved arrangement 50c is shown in FIG. 5c, using a Data Center (DC) proxy server 56. The DC proxy server 56 stores, or has access to, a list of IP addresses, such as the IP addresses list 59. The exemplary IP addresses list 58 is exampled to include 6 IP addresses, shown as IP#1 58a, IP#2 58b, IP#3 58c, IP#4 58d, IP#5 58e, and IP#6 58f. While exampled regarding 6 IP addresses, any number of IP addresses may be equally used. The IP addresses in the list 58 serves as IP addresses ‘bank’, and upon receiving a request for a content (such as a URL) from a client device, the DC proxy server 56 selects one of the IP addresses (such as randomly or any other load balancing technique), and use the selected IP address for requesting the content from the web server. Since many IP addresses are used, the web server, such as the data server #1 22a, cannot easily identify the request’ s origin to be a single device, and the traffic seems to be originated from a legitimate pool of client devices.

[0205] For example, upon receiving the ‘Content Request’ message 54a from the client device #1 31a by the DC proxy server 56, it responds by selecting an IP address from the list 58, such as the IP#3 58c, and then forwarding the request to the data server #1 22a using the IP#3 58c as the originating IP address source 16d as part of the ‘Content Request’ message 54b. In turn the data server #1 22a replies and sends the content in the ‘Send Content’ message 54c to the requesting DC proxy server 56, which in turn forward the fetched content to the asking client device #1 31a using the ‘Send Content’ message 54d. Hence, the client device #1 31a received the requested content in response to the sent ‘Content Request’ message 54a, however the data server #1 22a is only aware of the IP#3 58c identity, and is not aware of the client device #1 31a identity (IP address).

[0206] In a case where the client device #1 31a requests another content from the data server #1 22a, it sends another ‘Content Request’ message 57a to the DC proxy server 56. Upon receiving the ‘Content Request’ message 57a from the client device #1 31a by the DC proxy server 56, it responds by selecting another IP address from the list 58, such as the IP#658f, and then forwarding the request to the data server #1 22a using the IP#6 58f as the originating IP address source 16d as part of another ‘Content Request’ message 57b. In turn the data server #1 22a replies and sends the content in the ‘Send Content’ message 57c to the requesting DC proxy server 56, which in turn forward the fetched content to the asking client device #1 31a using another ‘Send Content’ message 57d. Hence, the client device #1 31a received the additional requested content in response to the sent ‘Content Request’ message 57a, however, the data server #1 22a is only aware of the IP#658f identity, and is not aware of the client device #1 31a identity (IP address). Further, the data server #1 22a receives the requests from two different IP addresses IP#3 58c and IP#6 58f, and is not aware that both requests were sent from the same originating device.

[0207] Typically, DC proxy servers are offered as a service by various corporations, and not by an ISP. When you visit a website, the web server will detect the credentials of the DC proxy instead of your actual information. DC proxy server services are typically a cheap, fast, and stable way to provide anonymity, and prevent blocking by a web server. Typical DC proxy server service provides high performance and bandwidth up lOOOMB / s speed, the proxy IP addresses used may be static or dynamically changed, and have a presence in multiple countries worldwide. Using DC proxies are typically used to hide user real identity or IP from the internet. Comparison of performance of various commercially available DC proxy server services (referred to as VPN services) is described in a test report of a test commissioned by AnchorFree and performed by AV-TEST GmbH (dated June 15, 2018), entitled: “VPN Comparative Test'1'1., which is incorporated in its entirety for all purposes as if fully set forth herein. The report presents an evaluation assesses AnchorFree’ s Hotspot Shield Elite, Avast SecureLine, Avira Phantom VPN Pro, Cisco VPN, ExpressVPN, F-Secure FREEDOMS VPN, KeepSolid‘s VPN Unlimited, London Trust Media’s Private Internet Access, NordVPN, Pulse VPN, Symantec’s Norton WiFi Privacy and Tunnel Bear. The evaluation was based on usability, privacy and security, performance, and functionality.

[0208] Random. Randomness is commonly implemented by using random numbers, defined as a sequence of numbers or symbols that lack any pattern and thus appear random and that are commonly generated by a random number generator. Randomness for security is also described in IETF RFC 1750 "Randomness Recommendations for Security" (12 / 1994), which is incorporated in its entirety for all purposes as if fully set forth herein. A random number generator (having either analog or digital output) can be hardware based, using a physical process such as thermal noise, shot noise, nuclear decaying radiation, photoelectric effect, or other quantum phenomena. Alternatively, or in addition, the generation of the random numbers can be software based, using a processor executing an algorithm for generating pseudo-random numbers which approximate the properties of random numbers.

[0209] The term ‘random’ herein is intended to cover not only pure random, non- deterministically, and non-predicted generated signals, but also pseudo-random, deterministic signals such as the output of a shift-register arrangement provided with a feedback circuit as used to generate pseudo-random binary signals or as scramblers, and chaotic signals, and where a randomness factor may be used.

[0210] A digital random signal generator (known as a random number generator) wherein numbers in binary form replaces the analog voltage value output may be used for any randomness. One approach to random number generation is based on using linear feedback shift registers. An example of random number generators is disclosed in U.S. Patent 7,124,157 to Ikake entitled: “Random Number Generator", in U.S. Patent 4,905,176 to Schulz entitled: “Random Number Generator Circuit", in U.S. Patent 4,853,884 to Brown et al. entitled: “Random Number Generator with Digital Feedback" and in U.S. Patent 7,145,933 to Szajnowski entitled: “Method and Apparatus for generating Random signals", which are incorporated in its entirety for all purposes as if fully set forth herein.

[0211] A digital random signal generator may be based on ‘True Random Number Generation IC RPG100 / RPG100B’ available from FDK Corporation and described in the data sheet "Physical Random number generator RPG100.RPG100B" REV. 08 publication number HM-RAE106- 0812, which is incorporated in its entirety for all purposes as if fully set forth herein. The digital random signal generator can be hardware based, generating random numbers from a natural physical process or phenomenon, such as the thermal noise of a semiconductor which has no periodicity. Typically, such hardware random number generators are based on microscopic phenomena such as thermal noise, shot noise, nuclear decaying radiation, photoelectric effect or other quantum phenomena, and typically contain a transducer to convert some aspect of the physical phenomenon to an electrical signal, an amplifier and other electronic to bring the output into a signal that can be converted into a digital representation by an analog to digital converter. In the case where digitized serial random number signals are generated, the output is converted to parallel, such as 8 bits data, with 256 values of random numbers (values from 0 to 255). Alternatively or in addition, the digital random signal generator may be software (or firmware) based, such as pseudo-random number generators. Such generators include a processor for executing software that includes an algorithm for generating numbers, which approximates the properties of random numbers. The random signal generator (either analog or digital) may output a signal having uniform distribution, in which there is a substantially or purely equal probability of a signal falling between two defined limits, having no appearance outside these limits. However, Gaussian and other distribution may be equally used.

[0212] Computer network attacks. Denial-of- service attacks and attacks that deface opposition websites can produce the same result as other blocking techniques, preventing or limiting access to certain websites or other online services, although only for a limited period of time. This technique might be used during the lead up to an election or some other sensitive period. It is more frequently used by non-state actors seeking to disrupt services.

[0213] Tunneling. Computer networks may use a tunneling protocol where one network protocol (the delivery protocol) encapsulates a different payload protocol. The tunneling enables the encapsulation of a packet from one type of protocol within the datagram of a different protocol. For example, VPN uses PPTP to encapsulate IP packets over a public network, such as the Internet. A VPN solution based on Point-to-Point Tunneling Protocol (PPTP), Layer Two Tunneling Protocol (L2TP), or Secure Socket Tunneling Protocol (SSTP) can be configured. By using the tunneling, a payload may be carried over an incompatible delivery-network, or provide a secure path through an untrusted network. Typically, the delivery protocol operates at an equal or higher OSI layer than does the payload protocol. In one example of a network layer over a network layer, Generic Routing Encapsulation (GRE), a protocol running over IP (IP Protocol Number 47), often serves to carry IP packets, with RFC 1918 private addresses, over the Internet using delivery packets with public IP addresses. In this case, the delivery and payload protocols are compatible, but the payload addresses are incompatible with those of the delivery network. In contrast, an IP payload might believe it sees a data link layer delivery when it is carried inside the Layer 2 Tunneling Protocol (L2TP), which appears to the payload mechanism as a protocol of the data link layer. L2TP, however, actually runs over the transport layer using User Datagram Protocol (UDP) over IP. The IP in the delivery protocol could run over any data-link protocol from IEEE 802.2 over IEEE 802.3 (i.e., standards-based Ethernet) to the Point-to-Point Protocol (PPP) over a dialup modem link.

[0214] Tunneling protocols may use data encryption to transport insecure payload protocols over a public network (such as the Internet), thereby providing VPN functionality. IPsec has an end- to-end Transport Mode, but can also operate in a tunneling mode through a trusted security gateway. HTTP tunneling is a technique by which communications performed using various network protocols are encapsulated using the HTTP protocol, the network protocols in question usually belong to the TCP / IP family of protocols. The HTTP protocol, therefore, acts as a wrapper for a channel that the network protocol being tunneled uses to communicate. An HTTP stream with its covert channel is termed an HTTP tunnel. The HTTP tunnel software consists of clientserver HTTP tunneling applications that integrate with existing application software, permitting them to be used in conditions of restricted network connectivity including firewalled networks, networks behind proxy servers, and network address translation.

[0215] Virtual Private Networks (VPNs) are point-to-point connections across a private or public network, such as the Internet. The VPN client typically uses special TCP / IP-based protocols, called tunneling protocols, to make a virtual call to a virtual port on a VPN server. In a typical VPN deployment, a client initiates a virtual point-to-point connection to a remote access server over the Internet, then the remote access server answers the call, authenticates the caller, and transfers data between the VPN client and the organization’s private network. To emulate a point- to-point link, data is encapsulated, or wrapped, with a header. The header provides routing information that enables the data to traverse the shared or public network to reach its endpoint. To emulate a private link, the data being sent is encrypted for confidentiality. Packets that are intercepted on the shared or public network are indecipherable without the encryption keys. The link in which the private data is encapsulated and encrypted is known as a VPN connection. Commonly two types of VPN connections are used, referred to as Remote Access VPN and Site- to-Site VPN. Popular VPN connections use PPTP, L2TP / IPsec, or SSTP protocols. The RFC 4026 provides ‘Provider Provisioned Virtual Private Network (VPN) Terminology’, and RFC 2547 provides a VPN method based on MPLS (Multiprotocol Label Switching) and BGP (Border Gateway Protocol).

[0216] PPTP is described in IETF RFC 2637 entitled: “ Point-to- Point Tunneling Protocol (PPTP)”, L2TP is described in IETF RFC 2661 entitled: “Layer Two Tunneling Protocol "L2TP"”, which are both incorporated in their entirety for all purposes as if fully set forth herein. VPN and VPN uses are described in Cisco Systems, Inc. 2001 publication entitled: “IP Tunneling and VPNs’", and in Cisco Systems, Inc. 2001 handbook ‘Internetworking Technologies Handbook’ [No. 1-58705-001-3] chapter 18 entitled: “Virtual Private Networks'”, and in IBM Corporation Redbook series publications entitled: “A Comprehensive Guide to Virtual Private Networks” including “Vol. I: IBM Firewall, Server and Client Solutions” [SG24-5201-00, June 1998], “Vol II: IBM Nways Router Solutions” [SG24-5234-01, November 1999], and “Vol III: Cross-Platform Key and Policy Management” [SG24-5309-00, November 1999], which are all incorporated in their entirety for all purposes as if fully set forth herein. VPN and its uses are further described in the IETF RFC 4026 entitled: “Provider Provisioned Virtual Private Network (VPN) Terminology” that describes provider provisioned Virtual Private Network (VPN), in the IETF RFC 2764 entitled: “A Framework for IP Based Virtual Private Networks” that describes a framework for Virtual Private Networks (VPNs) running across IP backbones, in the IETF RFC 3931 entitled: “Layer Two Tunneling Protocol - Version 3 (L2TPv3)”, and in the IETF RFC 2547 entitled: “BGP / MPLS VPNs” that provides a VPN method based on MPLS (Multiprotocol Label Switching) and BGP (Border Gateway Protocol), which are all incorporated in their entirety for all purposes as if fully set forth herein.

[0217] Remote access VPN connections enable users working at home or on the road to access a server on a private network using the infrastructure provided by a public network, such as the Internet. From the user’s perspective, the VPN is a point-to-point connection between the computer (the VPN client) and an organization’s server. The exact infrastructure of the shared or public network is irrelevant because it appears logically as if the data is sent over a dedicated private link.

[0218] Site-to-site VPN connections (also known as router-to-router VPN connections) enable organizations to have routed connections between separate offices or with other organizations over a public network while helping to maintain secure communications. A routed VPN connection across the Internet logically operates as a dedicated wide area network (WAN) link. When networks are connected over the Internet, a router forwards packets to another router across a VPN connection. To the routers, the VPN connection operates as a data-link layer link. A site- to-site VPN connection connects two portions of a private network. The VPN server provides a routed connection to the network to which the VPN server is attached. The calling router (the VPN client) authenticates itself to the answering router (the VPN server), and, for mutual authentication, the answering router authenticates itself to the calling router. In the site-to site VPN connection, the packets sent from either router across the VPN connection typically do not originate at the routers.

[0219] There is a growing widespread use of the Internet for carrying multimedia, such as a video and audio. Various audio services include Internet-radio stations and VoIP (Voice-over-IP). Video services over the Internet include video conferencing and IPTV (IP Television). In most cases, the multimedia service is a real-time (or near real-time) application, and thus sensitive to delays over the Internet. In particular, two-way services such as VoIP or other telephony services and videoconferencing are delay sensitive. In some cases, the delays induced by the encryption process, as well as the hardware / software costs associated with the encryption, render encryption as non- practical. Therefore, it is not easy to secure enough capacity of the Internet accessible by users to endure real-time communication applications such as Internet games, chatting, VoIP, and MoIP (Multimedia-over-IP), so there may be a data loss, delay or severe jitter in the course of communication due to the property of an Internet protocol, thereby causing inappropriate realtime video communication. The following chapters of the publication number 1-587005-001-3 by Cisco Systems, Inc. (7 / 99), entitled: "Internetworking Technologies Handbook" , relate to multimedia carried over the Internet, and are all incorporated in their entirety for all purposes as if fully set forth herein: Chapter 18: "Multiservice Access Technologies" (pages 18-1 to 18-10), and Chapter 19: "Voice / Data Integration Technologies" (pages 19-1 to 19-30).

[0220] VoIP systems in widespread use today fall into three groups: systems using the ITU-T H.323 protocol, systems using the SIP protocol, and systems that use proprietary protocols. H.323 is a standard for teleconferencing that was developed by the International Telecommunications Union (ITU). It supports full multimedia, audio, video, and data transmission between groups of two or more participants, and it is designed to support large networks. H.323 is networkindependent: it can be used over networks using transport protocols other than TCP / IP. H.323 is still a very important protocol, but it has fallen out of use for consumer VoIP products due to the fact that it is difficult to make it work through firewalls that are designed to protect computers running many different applications. It is a system best suited to large organizations that possess the technical skills to overcome these problems.

[0221] Session Initiation Protocol (SIP) is an Internet Engineering Task Force (IETF) standard signaling protocol for teleconferencing, telephony, presence and event notification, and instant messaging. It provides a mechanism for setting up and managing connections, but not for transporting the audio or video data. It is probably now the most widely used protocol for managing Internet telephony. Similar to the IETF protocols, SIP is defined in a number of RFCs, principally RFC 3261. A SIP-based VoIP implementation may send the encoded voice data over the network in a number of ways. Most implementations use a Real-time Transport Protocol (RTP), which is defined in RFC 3550. Both SIP and RTP are implemented on UDP, which, as a connectionless protocol, can cause difficulties with certain types of routers and firewalls. Usable SIP phones therefore also need to use Simple Traversal of UDP over NAT (STUN), a protocol defined in RFC 3489 that allows a client behind a NAT router to find out its external IP address and the type of NAT device.

[0222] FIG. 2 shows an arrangement 20 of devices communicating over the Internet. Various devices such as a client #1 24a, a client #2 24b, a client #3 24c, a client #4 24d, and a client #5 24e, may communicate over the Internet 113 for obtaining data from a data server #1 22a and a data server #2 22b. It is noted that the terms ‘Data Server’ and ‘Web server’ are used herein interchangeably. In one example, the servers are HTTP servers, sometimes known as web servers. A method describing a more efficient communication over the Internet is described in U.S. Patent No. 8,560,604 to Shribman et al., entitled: “System and Method for Providing Faster and More Efficient Data Communication" (hereinafter the “ ‘604 Patent’ ”), which is incorporated in its entirety for all purposes as if fully set forth herein. The method described in the ‘604 Patent uses an acceleration server 23 for managing the traffic in the network, as shown in FIG. 2. A splitting of a message or a content into slices, and transferring each of the slices over a distinct data path is described in U.S. Patent Application No. 2012 / 0166582 to Binder entitled: “System and Method for Routing-Based Internet Security", which is incorporated in its entirety for all purposes as if fully set forth herein.

[0223] The amount of data transferred in a given period in commonly referred to as ‘bandwidth’ (BW) or ‘bit-rate’, which is the number of bits that are conveyed or processed per unit of time. The bit rate is quantified using the bits per second unit (symbol bit / s or b / s), often in conjunction with an SI prefix such as kilo- (1 Kbit / s = 1000 bit / s), mega- (1 Mbit / s = 1000 Kbit / s), giga- (1 Gbit / s = 1000 Mbit / s) or tera- (1 Tbit / s = 1000 Gbit / s). The non-standard abbreviation bps is often used to replace the standard symbol bit / s, so that, for example, "1 Mbps" (or IMb / s) is used to mean one million bits per second. One byte per second (1 B / s) corresponds to 8 bit / s.

[0224] Latency. Latency is typically defined as a time interval between the stimulation and the response, or, from a more general point of view, as a time delay between the cause and the effect of some physical change in the system being observed. Network-related latency, such as in a packet- switched network, is measured either one-way (the time from the source sending a packet to the destination receiving it), or Round-Trip delay Time (RTT), referring to the one-way latency from source to destination plus the one-way latency from the destination back to the source, plus any delays at the destination, such as processing or other delays. Round-trip latency can be measured from a single point. Latency limits total bandwidth in reliable two-way communication systems as described by the bandwidth-delay product, which refers to the product of a data link's capacity (in bits per second) and its end-to-end delay (in seconds). The result, an amount of data measured in bits (or bytes), is equivalent to the maximum amount of data on the network circuit at any given time, i.e., data that has been transmitted but not yet acknowledged. Sometimes it is calculated as the data link's capacity multiplied by its round trip time. A network with a large bandwidth-delay product is commonly known as a Long Fat Network (LFN). As defined in IETF RFC 1072, a network is considered an LFN if its bandwidth-delay product is significantly larger than 105 bits (12500 bytes).

[0225] RTT. The Round-trip Delay Time (RTD) or Round-Trip Time (RTT) is the length of time it takes for a signal to be sent and to be received and processed at the destination node, plus the length of time it takes for an acknowledgment of that signal to be received. This time delay, therefore, includes the propagation times between the two points of a signal. The signal is generally a data packet, and the RTT is also known as the ping time, and an Internet user can determine the RTT by using the ping command. Network links with both a high bandwidth and a high RTT can have a very large amount of data (the bandwidth-delay product) "in flight" at any given time. Such "long fat pipes" require a special protocol design. One example is the TCP window scale option. The RTT was originally estimated in TCP by: RTT = (a • Old RTT) + ((1 - a) • New_Round_Trip_Sample), where a is a constant weighting factor (0 < a < 1). Choosing a value a close to 1 makes the weighted average immune to changes that last a short time (e.g., a single segment that encounters long delay). Choosing a value for a close to 0 makes the weighted average response to changes in delay very quickly. Once a new RTT is calculated, it is entered into the above equation to obtain an average RTT for that connection, and the procedure continues for every new calculation. The RTT may be measured as described in IETF 1323, and may be estimated by using a method described in IETF RFC 6323, which are both incorporated in their entirety for all purposes as if fully set forth herein.

[0226] In networking, Round-trip Time (RTT) is the time it takes to get a response after you initiate a network request. RTT is the total time it takes for the request to travel over the network and for the response to travel back. You can typically measure RTT in milliseconds. A lower RTT improves the experience of using an application and makes the application more responsive. RTT usually stands for the time, in total, from sending a first packet by the sender to receiving the first packet by the receiver, sending a potential second packet in response to the first packet through the receiver of the first packet goes to receive this second packet by the sender of the first packet. In some networks it is possible to measure a current RTT with special protocols. In IPv4-based networks, this is often done with the help of a PING command, which sends ICMP packets ("Internet Control Message Protocol" - RFC (Request for Comments) 792) and waits for corresponding ICMP response packets from the other side. The round-trip time (RTT) metric may be used a metric for network latency.

[0227] A Round-Trip Time (RTT) may be measured by using various network diagnostic tools, such as ‘ping’ or ‘traceroute’. Such tools send Internet Control Message Protocol (ICMP) echo request packets to the intended destination. They then report how long the ICMP data packets take to reach the destination. The measured RTT may vary depending on network conditions and the specific tools used to measure it. In general, a good round-trip time (RTT) should be below 100 milliseconds for optimal performance. An RTT of 100-200 milliseconds typically means that the performance is likely affected, but users may still able to access the service. An RTT of 200 milliseconds or more commonly means that the performance is degraded and your users experience long wait or page load times. Typically, an RTT of more than 375 milliseconds commonly results in a connection being terminated. The term RTT is generally accepted as the amount of cumulative time it takes for a network packet to: (1) travel from a local endpoint (e.g., an employee computer PC) to a remote endpoint (e.g., a company server); (2) be processed by the remote endpoint; and (3) travel from the remote endpoint back to the local endpoint.

[0228] The RTT is generally influenced by the physical distance since the further away the host is from the source, the longer it takes to receive a response. The RTT may be generally further affected by the connection speed, commonly impacted by the transmission medium. For example, optical-fiber connections generally deliver data faster than copper connections, while wireless frequency connections behave differently than satellite communication. Further, the RTT may be generally further affected by the number of hops, since as the number of network hops increases, the RTT also increases, due to the fact that every node takes some time to process the packet before forwarding it, adding to time delays. Furthermore, RTT increases due to high traffic volumes. When a network is overloaded, the number of nodes on the network grows, causing the traffic to slow and user requests to be delayed. In addition, a server response time directly impacts RTT. Further, when the server receives a request, it may need to communicate with other servers, like a database server, or external APIs to process the request. Too many requests may cause delays as the server may end up placing new requests in a queue while it resolves older ones.

[0229] An estimation of RTT for messages using TCP may use Kam's Algorithm, described by Kam Phil and Craig Partridge in ACM SIGCOMM '87 - Computer Communication Review publication, entitled: "Improving Round-Trip Time Estimates in Reliable Transport Protocols" , which is incorporated in its entirety for all purposes as if fully set forth herein. The round-trip time is estimated as the difference between the time that a segment was sent and the time that its acknowledgment was returned to the sender, but when packets are re-transmitted there is an ambiguity: the acknowledgment may be a response to the first transmission of the segment or to a subsequent re-transmission. Kam's Algorithm ignores re-transmitted segments when updating the round-trip time estimate. Round trip time estimation is based only on unambiguous acknowledgments, which are acknowledgments for segments that were sent only once.

[0230] A metric for round-trip delay of packets across Internet paths is disclosed in IETF EFC 2681 dated September 1999 entitled “A Round-trip Delay Metric for 1PPM' which is incorporated in its entirety for all purposes as if fully set forth herein. It builds on notions introduced and discussed in the IPPM Framework document, and follows closely the corresponding metric for One-way Delay. The document introduces a 'singleton' analytic metric, called Type-P-Round-trip-Delay to measure a single observation of round-trip delay. Using this singleton metric, a 'sample', called Type-P-Round-trip-Delay-Poisson-Stream, is introduced to measure a sequence of singleton delays measured at times taken from a Poisson process. Using this sample, several 'statistics' of the sample will be defined and discussed.

[0231] A round-trip time (RTT) estimation algorithm used for TFRC (TCP-Friendly Rate Control) congestion control by the Datagram Congestion Control Protocol (DCCP) is described in IETF RFC 6323 dated July 2011 [ISSN: 2070-1721] entitled: “Sender RTT Estimate Optionfor the Datagram Congestion Control Protocol (DCCP)", which is incorporated in its entirety for all purposes as if fully set forth herein. The document updates specifications for the CCID-3 and CCID-4 Congestion Control IDs of DCCP, and addresses parameter-estimation problems occurring with TFRC -based DCCP congestion control. The document uses a recommendation made in the original TFRC specification to avoid the inherent problems of receiver-based RTT sampling, by utilizing higher-accuracy RTT samples already available at the sender, and it is integrated into the feature set of DCCP as an end-to-end negotiable extension.

[0232] A mechanism for an endpoint to measure the path characteristics fractional loss and RTT using Session Traversal Utilities for NAT (STUN) messages is described in IETF RFC 7982 dated September 2016 [ISSN: 2070-1721] entitled: “Measurement of Round-Trip Time and Fractional Loss Using Session Traversal Utilities for NAT (STUN)”, which is incorporated in its entirety for all purposes as if fully set forth herein. A host with multiple interfaces needs to choose the best interface for communication. Oftentimes, this decision is based on a static configuration and does not consider the path characteristics, which may affect the user experience.

[0233] An RTT measuring may use, may be based on, or may be according to, an one-way delay of packets across Internet paths, such as described in IETF RFC 7670 published January 2016 [ISSN: 2070-1721] entitled: “A One-Way Delay Metric for IP Performance Metrics (IPPM)”, which is incorporated in its entirety for all purposes as if fully set forth herein.

[0234] A method of performing Round Trip Time (RTT) measurement in a data packet receiver using a Transmission Control Protocol (TCP) for communication via a network with a sender is described in U.S. Patent No. 7,330,426 to Berzosa et al. entitled: “Receiver-based RTT measurement in TCP”, which is incorporated in its entirety for all purposes as if fully set forth herein. The method comprising the steps of sending an acknowledgement for a currently received data packet to the sender, measuring a first time instant when sending the acknowledgement, triggering at the sender the transmission of an expected data-packet, measuring a second time instant when the expected data packet is received, and calculating the round-trip time based on the measured first and second time instants. Transmission of excess segments to a network that can be effectively inhibited is described in U.S. Patent No. 8,279,756 to Yamazaki et al. entitled: “Communication terminal, communication control method, and communication control program”, which is incorporated in its entirety for all purposes as if fully set forth herein. A received byte calculation section 14 calculates, at a sending side, the number of bytes of segments which arrive at a receiving side within a period of a minimum value of RTT measured by a minimum time measurement section 13, a target calculation section 15 calculates a target used for controlling segment transmission based on the number of bytes of the received segments calculated by the received byte calculation section 14, and a send segment control section 16 which controls segment transmission based on the target calculated by the target calculation section 15.

[0235] Many software platforms provide a service called ‘ping’ that can be used to measure round-trip latency. Ping performs no packet processing; it merely sends a response back when it receives a packet (i.e., performs a no-op), thus it is a first rough way of measuring latency. Ping operates by sending Internet Control Message Protocol (ICMP) echo requesting packets to the target host, and waiting for an ICMP response. During this process, it measures the time from transmission to reception (round-trip time) and records any packet loss. The results of the test are printed in a form of a statistical summary of the response packets received, including the minimum, maximum, and the mean round-trip times, and sometimes the standard deviation of the mean.

[0236] The Transmission Control Protocol / Intemet Protocol (TCP / IP) suite normally used on the Internet has included an Internet Message Control Protocol (ICMP) that is commonly used in echo testing or ping and trace route applications. In general, the Internet standard ‘ping’ or ‘ICMP echo’ has a request / response format, wherein one device sends an ICMP echo request and another device responds to a received ICMP echo request with a transmitted ICMP echo response. Normally, IP devices are expected to implement the ICMP as part of the support for IP, to be able to use ICMP for testing. IETF RFC 792, entitled “Internet Control Message Protocol: DARPA Internet Program Protocol Specification” , which is incorporated in its entirety for all purposes as if fully set forth herein, at least partially describes the behavior of ICMP. The ICMP echo message has a type field, a code field, a checksum field, an identifier field, a sequence number field, and a data field. According to RFC 79: “The data received in the echo message must be returned in the echo reply message”. Thus, an RFC compliant ping responder, or an ICMP echo reply message responder, are supposed to copy the received data field in an echo request message directly into the data field of the transmitted echo response message. A newer version of ICMP known as ICMP version 6 or ICMPv6 as described at least partially in RFCs 1885 and 2463, which are both entitled “Internet Control Message Protocol (ICMPv6) for the Internet Protocol Version 6 (IPv6) Specification” , which are both incorporated in their entirety for all purposes as if fully set forth herein. According to RFC 2463, “Every [IPv6] node MUST implement an ICMPv6 Echo responder function that receives Echo Requests and sends corresponding Echo Replies. An IPv6 node SHOULD also implement an application-layer interface for sending Echo Requests and receiving Echo Replies, for diagnostic purposes ”. Thus, responding to ICMP echo requests normally is a necessary function in supporting IPv4 and / or IPv6 standards. The ICMPv6 RFCs 1885 and 2464 goes on to specify that the data field of an ICMP echo response contains the “data from the invoking Echo Request message.” Therefore, both ICMP and ICMP v6 associated with IPv4 and IPv6, respectively, specify that the data field in an ICMP echo reply message is to essentially contain a copy of the data received in the corresponding ICMP echo request message.

[0237] Moreover, the ICMP echo protocol is basically a two-way echo in which one initiating device and / or process starts the communication by transmitting an echo request message, which may be then received by an echo responder process. The echo responder process, generally located on another device, receives the echo request message and responds with an echo reply back to the initiating process. Once the initiating device and / or process receives the response or times out waiting on the response, the two-way echo exchange of messages is complete. Although the echo request and echo response normally are performed between processes on two different devices, one skilled in the art will be aware that a device can ping its own IP address implying that the echo request and echo responder reply processes are on the same device. In addition, the loopback address of network 127.0.0.0 in IPv4 can be used to allow a device to the loopback outbound echo request messages back into the device’s own incoming echo request responder processes. IPv6 has a loopback functionality as well.

[0238] This copying of data exactly in the ICMP echo response is somewhat wasteful because the responder generally does not convey that much (if any) information back to the ICMP echo request initiating device. Arguably the initiating device could compute bit error rate (BER) statistics on the transmitted versus the received data field in ICMP echo packets. However, such physical layer issues as BER statistics normally are not as relevant for network layer IP datagrams that already include various error control code mechanisms. Arguably the device running the responding process can communicate information to the device running the initiating process by having the device running the original responding process initiate its own echo request and wait for an echo response from the original initiating device. Such a solution results in four packets, with a first echo request from a local device responded to by a first echo response from a remote device, and with a second echo request from the remote device responded to by a second echo response from the local device.

[0239] An identifier and / or sequence number in ping packets generally has allowed the ping to be used by a device to determine the round-trip delay from the time an ICMP echo request packet is sent to the time corresponding to when an associated received ICMP echo request is received back at an initiating device. Furthermore, ping packets generally convey little or no information about the type of the device that initiated the ping. Moreover, although IPv4 has Type of Service (ToS) fields in the IP datagram, these fields have become more important as the services used over the Internet and networks using Internet technology have grown from basic computer data communication to also include real-time applications such as voice and / or video. Various Type of Service (ToS) in IPv4 and IPv6 have been used in implementing various (Quality of Service) QoS characteristics that are defined for different classes of service and / or Service Level Agreements (SLAs).

[0240] SDK. As used herein, the term Software Development Kit (SDK) refers to a specific software package, software framework, hardware platform, or a set of development tools and the like at the time of the establishment of the operating system software. Typically, an SDK includes a programming package that enables a programmer to develop applications for a specific platform, and may include one or more APIs, programming tools, and documentation. It may be as simple as the implementation of one or more Application Programming Interfaces (APIs) in the form of some libraries to interface to a particular programming language or to include sophisticated hardware that can communicate with a particular embedded system. Common tools include debugging facilities and other utilities, often presented in an Integrated Development Environment (IDE). The SDKs also frequently include sample code and supporting technical notes or other supporting documentation to help clarify points made by the primary reference material. Some SDKs may have attached licenses that make them unsuitable for building software intended to be developed under an incompatible license. For example, a proprietary SDK will probably be incompatible with free software development, while a GPL-licensed SDK could be incompatible with proprietary software development. LGPL SDKs are typically safe for proprietary development.

[0241] A software engineer typically receives the SDK from the target system developer. Often the SDK can be downloaded directly via the Internet or via SDKs marketplaces. Many SDKs are provided for free to encourage developers to use the system or language. Sometimes this is used as a marketing tool. Freely offered SDKs may still be able to monetize, based on user data taken from the apps, which may serve the interests of big players in the ecosystem, for example the operating system. A SDK for an operating system add-on (for instance, QuickTime for classic Mac OS) may include the add-on software itself to be used for development purposes, albeit not necessarily for redistribution together with the developed product.

[0242] Users in the Internet may desire anonymity in order not to be identified as a publisher (sender), or reader (receiver), of information. Common reasons include censorship at the local, organizational, or national level, personal privacy preferences such as preventing tracking or data mining activities, the material or its distribution is considered illegal or incriminating by possible eavesdroppers, the material may be legal but socially deplored, embarrassing, or problematic in the individual's social world, and fear of retribution (against whistleblowers, unofficial leaks, and activists who do not believe in restrictions on information nor knowledge). Full anonymity on the Internet, however, is not guaranteed since IP addresses can be tracked, allowing to identify the computer from which a certain post was made, albeit not the actual user. Anonymizing services, such as I2P - ‘The Anonymous Network’ or Tor, address the issue of IP tracking, as their distributed technology approach may grant a higher degree of security than centralized anonymizing services where a central point exists that could disclose one's identity. An anonymous web browsing refers to browsing the World Wide Web while hiding the user's IP address and any other personally identifiable information from the websites that one is visiting. There are many ways of accomplishing anonymous web browsing. Anonymous web browsing is generally useful to internet users who want to ensure that their sessions cannot be monitored. For instance, it is used to circumvent traffic monitoring by organizations that want to find out or control which web sites employees visit. Further, since some web-sites respond differently when approached from mobile devices, anonymity may allow for accessing such a web-site from a non- mobile device, posing as a mobile device.

[0243] WiFi. A device herein (such as the computer system 11) may consist of, be part of, or include, a Personal Computer (PC), a desktop computer, a mobile computer, a laptop computer, a notebook computer, a tablet computer, a server computer, a handheld computer, a handheld device, a Personal Digital Assistant (PDA) device, or a cellular handset. Alternatively or in addition, a device may consist of, be part of, or include, a handheld PDA device, an on-board device, an off-board device, a hybrid device, a vehicular device, a non-vehicular device, a mobile device, or a portable device. A network herein (such as the LAN 14), may consist of, be part of, or include, a wired or wireless network, a Local Area Network (LAN), a Wireless LAN (WLAN), a Metropolitan Area Network (MAN), a Wireless MAN (WMAN), a Wide Area Network (W AN), a Wireless WAN (WWAN), a Personal Area Network (PAN), or a Wireless PAN (WPAN). Alternatively or in addition, a network herein may be operating substantially in accordance with existing Institute of Electrical and Electronics Engineers (IEEE) IEEE 802.11, 802.11a, 802.11b, 802.11g, 802.11k, 802. lln, 802.11r, 802.16, 802.16d, 802.16e, 802.20, 802.21 standards and / or future versions and / or derivatives of the above standards. Further, a network element (or a device) herein may consist of, be part of, or include, a cellular radio-telephone communication system, a cellular telephone, a wireless telephone, a Personal Communication Systems (PCS) device, a PDA device which incorporates a wireless communication device, or a mobile / portable Global Positioning System (GPS) device. The communication interface 29 may consist of, be part of, or include, a transceiver or modem for communication with the network, such as LAN 14. In the case of wired networks, the communication interface 29 connects to the network via a port 28 that may include a connector, and in the case of wireless network, the communication interface 29 connects to the network via the port 28 that may include an antenna.

[0244] The LAN 14 may be a Wireless LAN (WLAN) such as according to, or based on, Institute of Electrical and Electronics Engineers (IEEE) IEEE 802.11-2012, and the WLAN port may be a WLAN antenna and the WLAN transceiver may be a WLAN modem. The WLAN may be according to, or based on, IEEE 802.11a, IEEE 802.11b, IEEE 802.11g, IEEE 802.1 In, or IEEE 802.1 lac. Commonly referred to as Wireless Local Area Network (WLAN), such communication makes use of the Industrial, Scientific and Medical (ISM) frequency spectrum. In the US, three of the bands within the ISM spectrum are the A-Band, 902-928 MHz; the B-Band, 2.4-2.484 GHz (a.k.a. 2.4 GHz); and the C-Band, 5.725-5.875 GHz (a.k.a. 5 GHz). Overlapping and / or similar bands are used in different regions such as Europe and Japan. In order to allow interoperability between equipment manufactured by different vendors, few WLAN standards have evolved, as part of the IEEE 802.11 standard group, branded as WiFi (www.wi-fi.org). The IEEE 802.11b standard describes a communication using the 2.4GHz frequency band and supporting a communication rate of UMb / s, IEEE 802.11a uses the 5GHz frequency band to carry 54MB / s, and IEEE 802.11g uses the 2.4 GHz band to support 54Mb / s. The WiFi technology is further described in a publication entitled: “WiFi Technology '' by Telecom Regulatory Authority, published on July 2003, which is incorporated in its entirety for all purposes as if fully set forth herein. The IEEE 802 defines an ad-hoc connection between two or more devices without using a wireless access point: the devices communicate directly when in range. An ad hoc network offers peer-to-peer layout and is commonly used in situations such as a quick data exchange or a multiplayer LAN game, because the setup is easy and an access point is not required.

[0245] Image / video. Any content herein may consist of, be part of, or include, an image or a video content. The video content may be in a digital video format that may be based on one out of: TIFF (Tagged Image File Format), RAW format, AVI, DV, MOV, WMV, MP4, DCF (Design Rule for Camera Format), ITU-T H.261, ITU-T H.263, ITU-T H.264, ITU-T CCIR 601, ASF, Exif (Exchangeable Image File Format), and DPOF (Digital Print Order Format) standards. A intraframe or interframe compression may be used, and the compression may a lossy or a non- lossy (lossless) compression, that may be based on a standard compression algorithm, which may be one or more out of JPEG (Joint Photographic Experts Group) and MPEG (Moving Picture Experts Group), ITU-T H.261, ITU-T H.263, ITU-T H.264 and ITU-T CCIR 601.

[0246] DHCP. The Dynamic Host Configuration Protocol (DHCP) is a standardized networking protocol used on Internet Protocol (IP) networks for dynamically distributing network configuration parameters, such as IP addresses for interfaces and services. With DHCP, network elements request IP addresses and networking parameters automatically from a DHCP server, reducing the need for a network administrator or a user to configure these settings manually.

[0247] DHCP is typically used by network elements for requesting Internet Protocol parameters, such as an IP address from a network server, and is based on the client-server model. When a network element connects to a network, its DHCP client software in the operating system sends a broadcast query requesting the necessary information. Any DHCP server on the network may service the request. The DHCP server manages a pool of IP addresses and information about client configuration parameters such as default gateway, domain name, the name servers, and time servers. On receiving a request, the server may respond with specific information for each client, as previously configured by an administrator, or with a specific address and any other information valid for the entire network, and the time period for which the allocation (lease) is valid. A host typically queries for this information immediately after booting, and periodically thereafter before the expiration of the information. When an assignment is refreshed by the client computer, it initially requests the same parameter values, and may be assigned a new address from the server, based on the assignment policies set by administrators.

[0248] Depending on the implementation, the DHCP server may have three methods of allocating IP-addresses: (a) Dynamic allocation, where a network administrator reserves a range of IP addresses for DHCP, and each client computer on the LAN is configured to request an IP address from the DHCP server during network initialization. The request-and-grant process uses a lease concept with a controllable time period, allowing the DHCP server to reclaim (and then reallocate) IP addresses that are not renewed, (b) Automatic allocation, where the DHCP server permanently assigns an IP address to a requesting client from the range defined by the administrator. This is similar to dynamic allocation, but the DHCP server keeps a table of past IP address assignments, so that it can preferentially assign to a client the same IP address that the client previously had. (c) Static allocation, where the DHCP server allocates an IP address based on a preconfigured mapping to each client's MAC address.

[0249] DHCP used for Internet Protocol version 4 (IPv4) is described in IETF RFC 2131, entitled “Dynamic Host Configuration Protocol''1, and DHCP for IPv6 is described IETF RFC 3315, entitled: “Dynamic Host Configuration Protocol for IPv6 (DHCP\'6)", both incorporated in their entirety for all purposes as if fully set forth herein. While both versions serve the same purpose, the details of the protocol for IPv4 and IPv6 are sufficiently different that they may be considered separate protocols. For IPv6 operation, devices may alternatively use stateless address autoconfiguration. IPv4 hosts may also use link-local addressing to achieve operations restricted to the local network link.

[0250] A Dynamic Host Configuration Protocol version 4 (DHCPv4) server is the authoritative source of IP addresses that it has provided to DHCPv4 clients, and is described in IETF RFC 4388 entitled: “Dynamic Host Configuration Protocol (DHCP) Leasequery” published February 2006, which is incorporated in its entirety for all purposes as if fully set forth herein. Other processes and devices that already make use of DHCPv4 may need to access this information. The leasequery protocol provides these processes and devices a lightweight way to access IP address information.

[0251] The DHCP protocol employs a connectionless service model, using the User Datagram Protocol (UDP). It is implemented with two UDP port numbers for its operations, which are the same as for the BOOTP protocol. The UDP port number 67 is the destination port of a server, and the UDP port number 68 is used by the client. DHCP operations fall into four phases: Server discovery, IP lease offer, IP request, and IP lease acknowledgment. These stages are often abbreviated as DORA for discovery, offer, request, and acknowledgment. The DHCP protocol operation begins with clients broadcasting a request. If the client and server are on different subnets, a DHCP Helper or DHCP Relay Agent may be used. Clients requesting renewal of an existing lease may communicate directly via an UDP unicast, since the client already has an established IP address at that point.

[0252] Router. A router is a Layer-3 (IP) networking device which forwards data packets to the appropriate parts of a computer network or that forwards data packets between computer networks. Routers perform the traffic directing functions on the Internet. The router is typically connected to two or more data connection from different IP networks by using the Layer-3 (IP) network address information in the packet header to determine the ultimate destination, using information in its routing table or routing policy. The main purpose of a router is to connect multiple networks and forward packets destined either for directly attached networks or more remote networks. A router is considered a layer-3 device because its primary forwarding decision is based on the information in the layer-3 IP packet, specifically the destination IP address. When a router receives a packet, it searches its routing table to find the best match between the destination IP address of the packet and one of the addresses in the routing table. Once a match is found, the packet is encapsulated in the layer-2 data link frame for the outgoing interface indicated in the table entry. A router typically does not look into the packet payload, but only at the layer-3 addresses to make a forwarding decision, plus optionally other information in the header for hints on, for example, quality of service (QoS). For pure IP forwarding, a router is designed to minimize the state information associated with individual packets. Once a packet is forwarded, the router does not retain any historical information about the packet.

[0253] Commonly a router supports OSI Layer 3 (the Network Layer), but may also support bridging functionality at OSI Layer 2 (the Link Layer). The router commonly uses headers and forwarding tables to determine the best path for forwarding the data packets, and they also use protocols such as ICMP to communicate with each other and configure the best route between any two hosts. The router may also support NAT (Network Address Translation), allowing multiple devices to share a single IP address on the Internet. Internet connection sharing routers may also support an SPI firewall and may serve as a DHCP Server. The wireless router may also provide features relevant to wireless security such as WiFi Protected Access (WPA) and wireless MAC address filtering. Additionally, the wireless router may be configured for "invisible mode" so that the internal wireless network cannot be scanned by outside wireless clients.

[0254] The routing table itself can contain information derived from a variety of sources, such as a default or static routes that are configured manually, or dynamic entries from routing protocols where the router learns routes from other routers. A default route is one that is used to route all traffic whose destination does not otherwise appear in the routing table; it is common - even necessary - in small networks, such as a home or small business where the default route simply sends all non-local traffic to the Internet service provider. The default route can be manually configured (as a static route); learned by dynamic routing protocols; or be obtained by DHCP.

[0255] Gateway. The term ‘gateway’ is used herein to include, but not limited to, a network element (or node) that is equipped for interfacing between networks that uses different protocols. The gateway converts information, data or other communications from one protocol or format to another, and typically contains components such as protocol translators, impedance matching devices, rate converters, fault isolators, or signal translators, as necessary to provide networking interoperability. A gateway may be a router or a proxy server that routes between networks, and may operate at any network layer. In a network for an enterprise, a computer server acting as a gateway node is often also acting as a proxy server and a firewall server. A gateway is often associated with both a router, which knows where to direct a given packet of data that arrives at the gateway, and a switch, which furnishes the actual path in and out of the gateway for a given packet.

[0256] A subnet mask is a mask used to determine what subnet belongs to an IP address. An IP address has two components, the network address and the host address. For example, consider the IP address 150.215.017.009. Assuming this is part of a Class B network, the first two numbers (150.215) represent the Class B network address, and the second two numbers (017.009) identify a particular host on this network. A subnetting enables the network administrator to further divide the host part of the address into two or more subnets. In this case, a part of the host address is reserved to identify the particular subnet. On an IP network, clients should automatically send IP packets with a destination outside a given subnet mask to a network gateway. A subnet mask defines the IP range of a private network. For example, if a private network has a base IP address of 192.168.0.0 and has a subnet mask of 255.255.255.0, then any data going to an IP address outside of 192.168.0.X will be sent to that network gateway. While forwarding an IP packet to another network, the gateway might or might not perform Network Address Translation (NAT).

[0257] Residential Gateway. A residential gateway is a small consumer-grade gateway which bridges network access between connected local area network (LAN) hosts to a wide area network (WAN) (such as the Internet) via a modem, or directly connects to a WAN (as in EttH), while routing. The WAN is a larger computer network, generally operated by an Internet service provider. Multiple devices have been described as "residential gateways", such as Cable modem, DSL modem, FTTx modem, IP-DECT telephone (base station), Network switch, Smart home hub, TV / VoD Set-top box, Voice over Internet protocol (VoIP) analog telephone adapter, Wired router, Wireless access point, Wireless router, or certain combinations of the above. For example, the residential gateway and the related functionalities may be as described in U.S. Patent Application No. 2007 / 0112939 to Wilson et al., entitled: "System and Method for Home Automation" , and in U.S. Patent No.7,213,061 to Hite et al., entitled: "Internet Control System and Method", which are both incorporated in their entirety for all purposes as if fully set forth herein. Further, a gateway may be according to, or based on, the white paper entitled: "Home Gateway" by Wipro Technologies, or may be according to, or based on, the Home Gateway Initiative (HGI) documents entitled: "Home Gateway Technical Requirements: Residential Profile", Version 1.0, HGI guideline paper entitled: "Remote Access" Version 1.01, and HGI document entitled: " Requirements for an energy efficient home gateway" HGLRD009-R3, which are all incorporated in their entirety for all purposes as if fully set forth herein. A modem (e.g., DSL modem, Cable modem) by itself provides none of the functions of a router. It merely allows ATM or PPP or PPPoE traffic to be transmitted across telephone lines, cable wires, optical fibers, wireless radio frequencies, or other physical layers. On the receiving end is another modem that re-converts the transmission format back into digital data packets. This allows network bridging using telephone, cable, optical, and radio connection methods. The modem also provides handshake protocols, so that the devices on each end of the connection are able to recognize each other. However, a modem generally provides few other network functions. It may also provide other functions such as Dynamic DNS, and converged "triple play" services such as TV and telephony.

[0258] A residential gateway typically provides configuration via a web interface, or app on mobile device, routing between the home network and the Internet, connectivity within the home network like a network switch, hub, or WLAN base station, network address translation (NAT), DHCP for IPv4 and IPv6, and firewall functions.

[0259] Firewall. Network firewalls are security devices used to stop or mitigate unauthorized access to private networks connected to the Internet, especially intranets. The only traffic allowed on the network is defined via firewall policies - any other traffic attempting to access the network is blocked. Network firewalls sit at the front line of a network, acting as a communications liaison between internal and external devices. A network firewall can be configured so that any data entering or exiting the network has to pass through it - it accomplishes this by examining each incoming message and rejecting those that fail to meet the defined security criteria. When properly configured, a firewall allows users to access any of the resources they need while simultaneously keeping out unwanted users, hackers, viruses, worms or other malicious programs trying to access the protected network.

[0260] As used herein, the term ‘firewall’ is a device that inspects network traffic passing through it, and may perform actions, such as denying or permitting passage of the traffic based on a set of rules. Firewalls may be implemented as stand-alone network devices or, in some cases, integrated with a single network device, such as a router or switch that performs other functions. For instance, a network switch may perform firewall related functions as well as switching functions. The firewall may be implemented using a hardware and / or software-based, and may include all necessary subsystems that may control incoming and outgoing network traffic based on an applied rule set. Further, the firewall may be used to establish a barrier between a trusted, secure internal network and another network, such as the Internet, that may not be secure and trusted. Firewalls exist both as software to run on general-purpose hardware and as a hardware appliance. Many hardware-based firewall environments also offer other functionalities to the internal network that the firewall environments protect.

[0261] Domain Name System (DNS) is a hierarchical distributed naming system for computers, services, or any resource connected to the Internet or a private network. It associates various information with domain names assigned to each of the participating entities, and translates easily memorized domain names to the numerical IP addresses needed for the purpose of locating computer services and devices worldwide. The DNS is described, for example, in the IETF RFC 3467 entitled: “Role of the Domain Name System (DNS)'' in the IETF RFC 6195 entitled: “Domain Name System (DNS) IANA Considerations”, and in the IETF RFC 1591 entitled: “Domain Name System Structure and Delegation” , which are incorporated in their entirety for all purposes as if fully set forth herein.

[0262] Tunnel. As used herein, the term ‘tunnel’ includes an intermediary program which is acting as a blind relay between two connections. Once active, a tunnel is not considered a party to the HTTP communication, though the tunnel may have been initiated by an HTTP request. The tunnel ceases to exist when both ends of the relayed connections are closed.

[0263] Proxy. As used herein, the term ‘proxy’ includes an intermediary program which acts as both a server and a client for the purpose of making requests on behalf of other clients. Requests are serviced internally or by passing them on, with possible translation, to other servers. The proxy MUST implement both the client and server requirements of this specification. A "transparent proxy" is a proxy that does not modify the request or response beyond what is required for proxy authentication and identification. A "non-transparent proxy" is a proxy that modifies the request or response in order to provide some added service to the user agent, such as group annotation services, media type transformation, protocol reduction, or anonymity filtering. Except where either transparent or non-transparent behavior is explicitly stated, HTTP proxy requirements apply to both types of proxies, and is described in IETF RFC 2616, entitled: “Hypertext Transfer Protocol - HTTP / 1.1”.

[0264] HTTP tunneling. HTTP tunneling is a technique by which communications performed using various network protocols are encapsulated using the HTTP protocol, the network protocols in question usually belong to the TCP / IP family of protocols. The HTTP protocol therefore acts as a wrapper for a channel that the network protocol being tunneled uses to communicate. The HTTP stream with its covert channel is termed an HTTP tunnel, and an HTTP tunnel software consists of client-server HTTP tunneling applications that integrate with existing application software, permitting them to be used in conditions of restricted network connectivity including firewalled networks, networks behind proxy servers, and network address translation. The HTTP tunnel is used most often as a means for communication from network locations with restricted connectivity - most often behind NATs, firewalls, or proxy servers, and most often with applications that lack native support for communication in such conditions of restricted connectivity. Restricted connectivity in the form of blocked TCP / IP ports, blocking traffic initiated from outside the network, or blocking of all network protocols except a few is a commonly used method to lock down a network to secure it against internal and external threats.

[0265] HTTP CONNECT tunneling. A variation of HTTP tunneling when behind an HTTP proxy server is to use the "CONNECT" HTTP method. In this mechanism, the client asks an HTTP proxy server to forward the TCP connection to the desired destination. The server then proceeds to make the connection on behalf of the client. Once the connection has been established by the server, the proxy server continues to proxy the TCP stream to and from the client. Note that only the initial connection request is HTTP - after that, the server simply proxies the established TCP connection. This mechanism is how a client behind an HTTP proxy can access websites using SSL or TLS (i.e., HTTPS). Not all HTTP proxy servers support this feature, and even those that do may limit the behavior (for example only allowing connections to the default HTTPS port 443, or blocking traffic which doesn't appear to be SSL).

[0266] HTTP tunneling without using CONNECT. In some networks, the use of CONNECT method is restricted to some trusted sites. In such cases, an HTTP tunnel can still be implemented using only the usual HTTP methods as POST, GET, PUT and DELETE. This is similar to the approach used in Bidirectional-streams Over Synchronous HTTP (BOSH). In this proof-of-concept program, the server runs outside the protected network and acts as a special HTTP server. The client program is run on a computer inside the protected network. Whenever any network traffic is passed from the client, the client repackages the traffic data as an HTTP request and relays the data to the outside server, which extracts and executes the original network request for the client. The response to the request, sent to the server, is then repackaged as an HTTP response and relayed back to the client. Since all traffic is encapsulated inside normal GET and POST requests and responses, this approach works through most proxies and firewalls.

[0267] SOCKS. Socket Secure (SOCKS) is an Internet protocol that performs at Layer 5 of the OSI model (the session layer, an intermediate layer between the presentation layer and the transport layer) that exchanges network packets between a client and server through a proxy server. SOCKS5 additionally provides authentication so only authorized users may access a server. Practically, a SOCKS server proxies TCP connections to an arbitrary IP address, and provides a means for UDP packets to be forwarded. SOCKS server accepts incoming client connection on TCP port 1080. SOCKS is a de facto standard for circuit-level gateways, and is also used as a circumvention tool, allowing traffic to bypass Internet filtering to access content otherwise blocked, e.g., by governments, workplaces, schools, and country- specific web services. Client software must have native SOCKS support in order to connect through SOCKS.

[0268] Further, the SOCKS protocol provides a framework for client-server applications in both the TCP and UDP domains to conveniently and securely use the services of a network firewall. The protocol is conceptually a "shim-layer" between the application layer and the transport layer, and as such does not provide network-layer gateway services, such as forwarding of ICMP messages. The SOCKS protocol typically relays TCP sessions at a firewall host to allow application users transparent access across the firewall. Because the protocol is independent of application protocols, it can be (and has been) used for many different services, such as telnet, ftp, finger, whois, gopher, WWW, etc. Access control can be applied at the beginning of each TCP session; thereafter the server simply relays the data between the client and the application server, incurring minimum processing overhead. Since SOCKS never has to know anything about the application protocol, it should also be easy for it to accommodate applications which use encryption to protect their traffic from nosey snoopers.

[0269] SOCKS operates at a lower level than HTTP proxying: SOCKS uses a handshake protocol to inform the proxy software about the connection that the client is trying to make, and then acts as transparently as possible, whereas a regular proxy may interpret and rewrite headers (say, to employ another underlying protocol, such as FTP; however, an HTTP proxy simply forwards an HTTP request to the desired HTTP server). Though HTTP proxying has a different usage model in mind, the CONNECT method allows for forwarding TCP connections; however, SOCKS proxies can also forward UDP traffic and work in reverse, while HTTP proxies cannot. HTTP proxies are traditionally more aware of the HTTP protocol, performing higher-level filtering (though that usually only applies to GET and POST methods, not the CONNECT method). SOCKS4a extends the SOCKS4 protocol to allow a client to specify a destination domain name rather than an IP address; this is useful when the client itself cannot resolve the destination host's domain name to an IP address.

[0270] The SOCKS5 protocol is defined in RFC 1928 dated March 1996 and entitled: “ SOCKS Protocol Version 5", which is incorporated in its entirety for all purposes as if fully set forth herein. It is an extension of the SOCKS4 protocol; it offers more choices for authentication and adds support for IPv6 and UDP, the latter of which can be used for DNS lookups. The protocol specification for SOCKS Version 5 RFC 1929 dated March 1996 and entitled: “Username / Password Authentication for SOCKS V5”, which is incorporated in its entirety for all purposes as if fully set forth herein, specifies a generalized framework for the use of arbitrary authentication protocols in the initial SOCKS connection setup, and describes one of those protocols, as it fits into the SOCKS Version 5. RFC 1961 dated June 1996 entitled: “GSS-API Authentication Method for SOCKS Version 5”, which is incorporated in its entirety for all purposes as if fully set forth herein, provides the specification for the SOCKS V5 GSS-API authentication protocol, and defines a GSS -API-based encapsulation for provision of integrity, authentication, and optional confidentiality. RFC 3089 dated April 2001 entitled: “A SOCKS-based IPv6 / IPv4 Gateway Mechanisin ' , which is incorporated in its entirety for all purposes as if fully set forth herein, describes a SOCKS-based IPv6 / IPv4 gateway mechanism that enables smooth heterogeneous communications between the IPv6 nodes and IPv4 nodes.

[0271] WebSocket. WebSocket is a computer communications protocol, providing full-duplex communication channels over a single TCP connection. The WebSocket Protocol enables two- way communication between a client that runs untrusted code in a controlled environment to a remote host that has opted-in to communications from that code. The security model used for this is the origin-based security model commonly used by web browsers. The protocol consists of an opening handshake followed by basic message framing, layered over TCP. The goal of this technology is to provide a mechanism for browser-based applications that need two-way communication with servers that do not rely on opening multiple HTTP connections (e.g., using XMLHttpRequest or <iframe>s and long polling). The WebSocket protocol is defined in RFC 6455 dated December 2011 and entitled: “77ze W’ebSockel Protocol ', which is incorporated in its entirety for all purposes as if fully set forth herein.

[0272] While both WebSocket and HTTP protocols are located at layer 7 in the OSI model and, as such, depend on TCP at layer 4, and while WebSocket is designed to work over HTTP ports 80 and 443 as well as to support HTTP proxies and intermediaries, the protocols are different. Unlike HTTP, WebSocket provides full-duplex communication, and in addition, WebSocket enables streams of messages on top of TCP. TCP alone deals with streams of bytes with no inherent concept of a message. To achieve compatibility, the WebSocket handshake uses the HTTP Upgrade header to change from the HTTP protocol to the WebSocket protocol. The WebSocket protocol enables interaction between a web client (e.g., a browser) and a web server with lower overheads, facilitating real-time data transfer from and to the server. This is made possible by providing a standardized way for the server to send content to the client without being first requested by the client, and allowing for messages to be passed back and forth while keeping the connection open. In this way, a two-way (bi-directional) ongoing conversation can take place between the client and the server. The communications are done over TCP port number 80 (or 443 in the case of TLS -encrypted connections), which is of benefit for those environments which block non-web Internet connections using a firewall.

[0273] The WebSocket protocol specification defines ws (or WS) (WebSocket) and wss (or WSS) (WebSocket Secure) as two new Uniform Resource Identifier (URI) schemes that are used for unencrypted and encrypted connect...

Claims

CLAIMS:

1. A method for reducing a work-load of a web server that stores at least first and second groups of content items that are each identified by a respective content item identifier, the method comprising: identifying, by or at a first device, a first sequence of requests for the first group of the content items, each of the requests comprises a respective content item identifier of the first group of content items; sending, by the first device to the web server over the Internet, the first sequence of requests, in response to the identifying of the first sequence; receiving, by the first device from the web server over the Internet, the first group of content items, in response to the sending of the first sequence of requests; monitoring, by the first device, at least part of the sending of the first sequence, at least part of the receiving of the first group of content items, or any combination thereof; obtaining, by the first device, a first value, in response to the monitoring; comparing, the first value to a threshold value; identifying, a second sequence of requests for the second group of the content items, each of the requests comprises a respective content item identifier of the second group of content items; sending, to the web server over the Internet, the second sequence of requests, in response to the identifying of the second sequence and in response to the first value being below the threshold; and sending, to the web server over the Internet, the second sequence of requests, while blocking at least part of the requests in the second sequence, in response to the identifying of the second sequence and in response to the first value being above the threshold.

2. The method according to claim 1, wherein the monitoring is performed by the first device.

3. The method according to claim 1, wherein the comparing is performed by the first device.

4. The method according to claim 1, wherein the identifying of the second sequence of requests is performed by the first device.

5. The method according to claim 1, wherein the sending of the second sequence is performed by the first device.

6. The method according to claim 1, further comprising receiving, by the first device from the web server over the Internet, at least part of or all of, the second group of content items, in response to the sending of the second sequence of requests.

7. The method according to claim 1, for use with a second device, the method further comprising sending, by the first device to the second device over the Internet, the obtained first value andreceiving, by the second device from the first device over the Internet, the sent obtained first value, wherein the comparing in performed by the second device.

8. The method according to claim 7, wherein the identifying of the second sequence of requests is performed at the second device.

9. The method according to claim 8, wherein the sending of the second sequence of requests is performed by the second device.

10. The method according to claim 1, further comprising sending, by the device that perform the comparing, to the first device over the Internet, a comparison result.

11. The method according to claim 1 , for use with a second device, the method further comprising sending, by the device that perform the comparing, to the second device over the Internet, the comparison result.

12. The method according to claim 11, wherein the identifying of the second sequence of requests is performed at the second device.

13. The method according to claim 12, wherein the sending of the second sequence of requests is performed by the second device.

14. The method according to claim 1, further for use with a second device, the method further comprising receiving, by the first device from the second device over the Internet, a first sequence of content item identifiers of the first group of content items.

15. The method according to claim 14, wherein the identifying of the first sequence of requests is in response to the receiving of the first sequence of content item identifiers of the first group of content items.

16. The method according to claim 15, wherein the identifying of the first sequence of requests comprises generating, by the first device, the first sequence of requests, and wherein the generated first sequence of requests comprises the received first sequence of content item identifiers of the first group of content items.

17. The method according to claim 14, wherein the receiving of the first sequence of content item identifiers comprises receiving of a third sequence of requests that comprises the first sequence of content item identifiers of the first group of content items.

18. The method according to claim 17, wherein the first sequence of requests is identical to, similar to, or based on, the third sequence of requests.

19. The method according to claim 18, wherein the first sequence of requests is identical to the third sequence of requests except for a source IP address value being the IP address of the first device.

20. The method according to claim 14, further comprising sending, by the first device to the second device over the Internet, the received first group of content items, in response to the receiving, by the first device, of the first group of content items.

21. The method according to claim 20, wherein the monitoring further comprises monitoring at least part of the receiving of the first sequence of content item identifiers, at least part of the sending of the received first group of content items, or any combination thereof.

22. The method according to claim 14, further comprising receiving, by the first device from the second device over the Internet, a second sequence of content item identifiers of the second group of content items.

23. The method according to claim 22, wherein the identifying of the second sequence of requests is in response to the receiving of the second sequence of content item identifiers of the second group of content items.

24. The method according to claim 23, wherein the identifying of the second sequence of requests comprises generating, by the first device, the second sequence of requests, and wherein the generated second sequence of requests comprises the received second sequence of content item identifiers of the second group of content items.

25. The method according to claim 22, wherein the receiving of the second sequence of content item identifiers comprises receiving of a third sequence of requests that comprises the second sequence of content item identifiers of the second group of content items.

26. The method according to claim 25, wherein the second sequence of requests is identical to, similar to, or based on, the third sequence of requests.

27. The method according to claim 26, wherein the second sequence of requests is identical to the third sequence of requests except for the source IP address value being the IP address of the first device.

28. The method according to claim 26, wherein the first device consists of, includes, is part of, or is integrated with, a proxy server.

29. The method according to claim 28, wherein the proxy server consists of, includes, is part of, or is integrated with, an HTTP proxy server, a web-proxy server, a caching proxy, an open-source caching proxy server, a cloud-based proxy server, an open proxy server, a forwarding proxy server, a reverse proxy server, a transparent proxy server, a non-transparent proxy server, an anonymous proxy server, a translation proxy server, a SOCKS proxy server, a CGI web proxy server, a suffix proxy server, an I2P anonymous proxy server, a DNS proxy server, or any combination thereof.

30. The method according to claim 14, for use with a list of multiple IP addresses, wherein the method further comprising selecting an IP address from the list, and wherein at least part of the first sequence of requests include the selected IP address as a source address.

31. The method according to claim 30, wherein the selected IP address is the IP address of the first device.

32. The method according to claim 30, wherein the selection of the IP address from the list is based on, or uses, load balancing.

33. The method according to claim 32, wherein the selection is based on, or uses, random selection.

34. The method according to claim 33, wherein random selection uses, or is based on, one or more random numbers generated by a random number generator.

35. The method according to claim 34, wherein the random number generator is hardware based.

36. The method according to claim 35, wherein the random number generator is using thermal noise, shot noise, nuclear decaying radiation, photoelectric effect, or quantum phenomena.

37. The method according to claim 34, wherein the random number generator is software based.

38. The method according to claim 37, wherein the random number generator is based on executing an algorithm for generating pseudo-random numbers.

39. The method according to claim 30, wherein the selection is based on, or uses, an estimated geographical location of the first device or of the web server.

40. The method according to claim 39, further comprising estimating the geographical location of the first device or of the web server using geolocation.

41. The method according to claim 40, wherein the geolocation is based on IP geolocation.

42. The method according to claim 41, wherein the geolocation is based on W3C Geolocation Application Programming Interface (API).

43. The method according to claim 41, wherein the IP address is selected based on estimated as being in the same area as the first device or the web server.

44. The method according to claim 43, wherein the IP address is selected based on estimated as being in the same continent, country, state, region, city, postal / zip code, latitude, longitude, or Timezone as the first device or the web server.

45. The method according to claim 41, wherein the IP address is selected based on being a recent one to be selected, or based on being the least recent to be selected.

46. The method according to claim 41, wherein the IP address is manually selected by a user.

47. The method according to claim 46, further comprising displaying to the user the multiple IP addresses, and selecting, by the user, the selected IP address from the group.

48. The method according to claim 1, further comprising receiving, by the first device from the web server over the Internet, at least part of or all of, the second group of content items, in response to the sending of the second sequence of requests, and sending, by the first device to a second device over the Internet, at least part of the received second group of content items, in response to the receiving, by the first device, the at least part of the second group of content items.

49. The method according to claim 1, wherein the steps are repeated for at least additional first and second groups of content items and using an additional first and second sequence of requests.

50. The method according to claim 49, wherein the steps are immediately repeated.

51. The method according to claim 49, wherein the steps are repeated at least 2, 3, 4, 5, 10, 15, 20, 100, 120, 150, 200, 500, or 1000 times.

52. The method according to claim 49, wherein the steps are repeated after a wait time.

53. The method according to claim 52, wherein the wait time is at least 1, 2, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, or 10,000 milliseconds, seconds, minutes, hours or days.

54. The method according to claim 52, wherein the wait time is less than 2, 3, 4, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, 10,000 or 20,000 milliseconds, seconds, minutes, hours, or days.

55. The method according to claim 52, wherein the blocking comprises blocking of the requests or packets in the second sequence during a first time-interval, and wherein the wait time is at least 0.001, 0.002, 0.003, 0.005, 0.008, 0.01, 0.02, 0.03, 0.05, 0.07, 0.1, 0.2, 0.3, 0.5, 0.7, 1, 2, 3, 5, 7, 10, 20, 30, 50, 70, 100, 200, 300, 500, 700, or 1000 times the first time-interval.

56. The method according to claim 52, wherein the blocking comprises blocking of the requests or packets in the second sequence during a first time-interval, and wherein the wait time is less than 0.001, 0.002, 0.003, 0.005, 0.008, 0.01, 0.02, 0.03, 0.05, 0.07, 0.1, 0.2, 0.3, 0.5, 0.7, 1, 2, 3, 5, 7, 10, 20, 30, 50, 70, 100, 200, 300, 500, 700, or 1000 times the first time-interval.

57. The method according to claim 1 , further for use with at least third and fourth groups of content items that are each identified by a respective content item identifier and that are each stored in the web server, the method further comprising: identifying, at the first device, a third sequence of requests for the third group of the content items, each of the requests comprises a respective content item identifier of the third group of content items; sending, by the first device to the web server over the Internet, the third sequence of requests, in response to the identifying of the third sequence;receiving, by the first device from the web server over the Internet, the third group of content items, in response to the sending of the third sequence of requests; monitoring the sending of the third sequence, the receiving of the third group of content items, or any combination thereof; obtaining a second value in response to the monitoring; comparing, the second value to the threshold value; identifying, at the first device, a fourth sequence of requests for the fourth group of the content items, each of the requests comprises a respective content item identifier of the fourth group of content items; sending, by the first device to the web server over the Internet, the fourth sequence of requests, in response to the identifying and in response to the second value being below the threshold; and blocking, by the first device to the web server over the Internet, at least part of the requests of the second sequence, in response to the identifying of the second sequence and in response to the second value being above the threshold.

58. The method according to claim 57, wherein the identifying of the third sequence is performed after the blocking of at least part of the requests of the second sequence.

59. The method according to claim 58, wherein the identifying of the third sequence is performed immediately after the blocking of at least part of the requests of the second sequence.

60. The method according to claim 58, wherein the identifying of the third sequence is performed after a wait time.

61. The method according to claim 60, wherein the wait time is at least 1, 2, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, or 10,000 milliseconds, seconds, minutes, hours or days.

62. The method according to claim 60, wherein the wait time is less than 2, 3, 4, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, 10,000 or 20,000 milliseconds, seconds, minutes, hours, or days.

63. The method according to claim 60, wherein the blocking comprises blocking of the requests or packets in the second sequence during a first time-interval, and wherein the wait time is at least 0.001, 0.002, 0.003, 0.005, 0.008, 0.01, 0.02, 0.03, 0.05, 0.07, 0.1, 0.2, 0.3, 0.5, 0.7, 1, 2, 3, 5, 7, 10, 20, 30, 50, 70, 100, 200, 300, 500, 700, or 1000 times the first time-interval.

64. The method according to claim 60, wherein the blocking comprises blocking of the requests or packets in the second sequence during a first time-interval, and wherein the wait time is lessthan 0.001, 0.002, 0.003, 0.005, 0.008, 0.01, 0.02, 0.03, 0.05, 0.07, 0.1, 0.2, 0.3, 0.5, 0.7, 1, 2, 3, 5, 7, 10, 20, 30, 50, 70, 100, 200, 300, 500, 700, or 1000 times the first time-interval.

65. The method according to claim 1, wherein the monitoring comprises metering, measuring, calculating, counting, estimating, or any other mechanism of quantifying a feature or characteristic of an actually received or sent data during a first time-interval.

66. The method according to claim 65, wherein the first time-interval is at least 1, 2, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, or 10,000 milliseconds, wherein the first time-interval is at least 1, 2, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, or 10,000 seconds, or wherein the first time-interval is at least 1, 2, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, or 10,000 minutes or hours.

67. The method according to claim 65, wherein the first time-interval is less than 2, 3, 4, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, 10,000 or 20,000 milliseconds, wherein the first time-interval is less than 2, 3, 4, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, 10,000 or 20,000 seconds, or wherein the first timeinterval is less than 2, 3, 4, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, 10,000 or 20,000 minutes or hours.

68. The method according to claim 65, wherein the monitoring comprises monitoring that relates to Open Systems Interconnection (OSI) model physical layer.

69. The method according to claim 68, wherein the first value comprises a count of all of, or a part of, bits, bytes, or words.

70. The method according to claim 68, wherein the first value comprises monitoring of an OSI application-level throughput of a communication, a goodput, or excluding protocol headers or overhead bits.

71. The method according to claim 68, wherein the first value comprises a count of a number of bits or bytes, and wherein the first value divided by the first time-interval duration is at least 1, 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, or 1,000,000 Megabit-per- second (Mb / s) or Megabyte-per- second (GB / s), or wherein the first value divided by the first time -interval duration is at least 1, 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, or 1,000,000 Gigabit-per- second (Gb / s) or Gigabyte-per- second (GB / s).

72. The method according to claim 68, wherein the first value comprises a count of a number of bits or bytes, and wherein the first value divided by the first time-interval duration is less than 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000,200,000, 500,000, 1,000,000 or 2,000,000 Megabit-per- second (Mb / s) or Megab yte-per-second (GB / s), or wherein the first value divided by the first time-interval duration is less than 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, 1,000,000, or 2,000,000 Gigabit-per- second (Gb / s) or Gigabyte-per- second (GB / s).

73. The method according to claim 68, wherein the first value comprises a count of a number of bits and an equivalent bit data rate of the threshold value is at least 1, 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, or 1,000,000 Megabit-per- second (Mb / s) or Megabyte-per- second (GB / s), or wherein the first value divided by the first time-interval duration is at least 1, 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, or 1,000,000 Gigabit- per-second (Gb / s), or Gigabyte-per- second (GB / s).

74. The method according to claim 68, wherein the first value comprises a count of a number of bits and an equivalent bit data rate of the threshold value is less than 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, 1,000,000 or 2,000,000 Megabit-per- second (Mb / s) or Megabyte-per- second (GB / s), or wherein an equivalent bit data rate of the threshold value is less than 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, 1,000,000, or 2,000,000 Gigabit-per- second (Gb / s), or Gigabyte-per- second (GB / s).

75. The method according to claim 65, wherein the monitoring comprises monitoring that relates to Open Systems Interconnection (OSI) model OSI data link layer.

76. The method according to claim 75, wherein the first value comprises a count of all of, or a part of, frames or other protocol data units.

77. The method according to claim 76, wherein the first value comprises a count of all of, or a part of, Ethernet frames or Point-to-Point Protocol (PPP) frames.

78. The method according to claim 76, wherein the first value comprises a count of frames, and wherein the first value divided by the first time -interval duration is at least 1, 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, or 1,000,000 Mega frames per second, or wherein the first value comprises a count of frames, or wherein the first value divided by the first time-interval duration is at least 1, 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, or 1,000,000 Giga frames per second.

79. The method according to claim 76, wherein the first value comprises a count of frames, and wherein the first value divided by the first time-interval duration is less than 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000,500,000, 1,000,000, or 2,000,000 Mega frames per second, or wherein the first value comprises a count of frames, or wherein the first value divided by the first time-interval duration is at least 1, 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, or 1,000,000 Giga frames per second.

80. The method according to claim 76, wherein the first value comprises a count of frames, and wherein an equivalent frame rate of the threshold value is at least 1, 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, or 1,000,000 Mega frames per second, or wherein the first value comprises a count of frames, and wherein the equivalent frame rate of the threshold value is at least 1, 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, or 1,000,000 Giga frames per second.

81. The method according to claim 65, wherein the monitoring comprises monitoring that relates to Open Systems Interconnection (OSI) model network layer.

82. The method according to claim 81, wherein the first value comprises a count of all of, or a part of, packets or IP packets.

83. The method according to claim 82, wherein the first value comprises a count of packets, and wherein the first value divided by the first time -interval duration is at least 1, 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, or 1,000,000 Mega packets per second, or wherein the first value comprises a count of packets, or wherein the first value divided by the first time -interval duration is at least 1, 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, or 1,000,000 Giga packets per second.

84. The method according to claim 82, wherein the first value comprises a count of packets, and wherein the first value divided by the first time-interval duration is less than 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, 1,000,000, or 2,000,000 Mega packets per second, or wherein the first value comprises a count of packets, or wherein the first value divided by the first time-interval duration is at least 1, 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, or 1,000,000 Giga packets per second.

85. The method according to claim 82, wherein the first value comprises a count of packets, and wherein an equivalent packets rate of the threshold value is at least is at least 1, 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, or 1,000,000 Mega packets per second, or wherein the first value comprises a count of frames, and wherein the equivalent packets rate of the threshold value is at least 1, 2, 3, 5, 10, 20,30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, or 1,000,000 Giga packets per second.

86. The method according to claim 82, wherein the first value comprises a count of packets, and wherein an equivalent packets rate of the threshold value is less than 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, or 1,000,000 or 2,000,000 Mega packets per second, or wherein the first value comprises a count of packets, and wherein the equivalent bit data rate of the threshold value is less than 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, 1,000,000, or 2,000,000 Giga packets per second.

87. The method according to claim 65, wherein the monitoring comprises monitoring that relates to Open Systems Interconnection (OSI) model transport layer.

88. The method according to claim 87, wherein the first value comprises a count of all of, or a part of, existing or used Transmission Control Protocol (TCP), opened TCP connections, or any combination thereof.

89. The method according to claim 88, wherein the first value comprises a count of connections, and wherein the first value is at least 1, 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, or 1,000,000 connections.

90. The method according to claim 88, wherein the first value comprises a count of connections, and wherein the first value is less than 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, 1,000,000, or 2,000,000 connections.

91. The method according to claim 88, wherein the first value comprises a count of connections, and wherein the threshold value is at least 1, 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, or 1,000,000 connections.

92. The method according to claim 88, wherein the first value comprises a count of connections, and wherein the threshold value is less than 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, 1,000,000, or 2,000,000 connections.

93. The method according to claim 65, wherein the monitoring comprises monitoring that relates to Open Systems Interconnection (OSI) model application layer.

94. The method according to claim 93, wherein the first value comprises a count of all of, or a part of, Hypertext Transfer Protocol (HTTP) requests, Hypertext Transfer Protocol Secure (HTTPS) requests, replies to HTTP requests, replies to HTTPS request, or any combination thereof.

95. The method according to claim 94, wherein the first value comprises a count of HTTP requests, HTTPS requests, replies to HTTP requests, replies to HTTPS request, or anycombination thereof, and wherein the first value is at least 1, 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, or 1,000,000 HTTP requests, HTTPS requests, replies to HTTP requests, replies to HTTPS request, or any combination thereof.

96. The method according to claim 94, wherein the first value comprises a count of HTTP requests, HTTPS requests, replies to HTTP requests, replies to HTTPS request, or any combination thereof, and wherein the first value is less than 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, 1,000,000, or 2,000,000 HTTP requests, HTTPS requests, replies to HTTP requests, replies to HTTPS request, or any combination thereof.

97. The method according to claim 94, wherein the first value comprises a count of HTTP requests, HTTPS requests, replies to HTTP requests, replies to HTTPS request, or any combination thereof, and wherein the threshold value is at least 1, 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, or 1,000,000 HTTP requests, HTTPS requests, replies to HTTP requests, replies to HTTPS request, or any combination thereof.

98. The method according to claim 94, wherein the first value comprises a count of HTTP requests, HTTPS requests, replies to HTTP requests, replies to HTTPS request, or any combination thereof, and wherein the threshold value is less than 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, 1,000,000, or 2,000,000 HTTP requests, HTTPS requests, replies to HTTP requests, replies to HTTPS request, or any combination thereof.

99. The method according to claim 1, wherein the monitoring comprises monitoring that relates to Open Systems Interconnection (OSI) model Layer-2 feature or property, OSI Layer-3 feature or property, OSI Application Layer feature or property, OSI Session Layer feature or property, or any combination thereof.

100. The method according to claim 1, further comprising smoothing the first value.

101. The method according to claim 100, wherein the smoothing is based on, uses, or is according to, a moving average technique, that is based on, uses, or is according to, a Simple Moving Average (SMA), a Cumulative Average (CA), a Weighted Moving Average (WMA), or any combination thereof.

102. The method according to claim 100, wherein the smoothing is based on, uses, or is according to, an exponential smoothing, that is based on, uses, or is according to, an Exponential MovingAverage (EMA), a Double exponential smoothing, a Triple exponential smoothing, or any combination thereof.

103. The method according to claim 1, wherein the monitoring comprises monitoring only of the sending of the first sequence.

104. The method according to claim 103, wherein the monitoring further comprises monitoring only of the receiving of the first group of content items.

105. The method according to claim 1, wherein the monitoring comprises monitoring only of the receiving of the first group of content items.

106. The method according to claim 1, wherein the blocking comprises blocking, delaying, discarding, or dropping of the requests or packets in the second sequence during a first timeinterval.

107. The method according to claim 106, wherein the blocking comprises blocking, discarding, delaying, or dropping of all the requests or packets in the second sequence during the first timeinterval.

108. The method according to claim 106, wherein the first time-interval is at least 1, 2, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, or 10,000 milliseconds or wherein the first time-interval is less than 2, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, 10,000, or 20,000 milliseconds.

109. The method according to claim 106, wherein the first time-interval is at least 1, 2, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, or 10,000 seconds or minutes.

110. The method according to claim 106, wherein the first time-interval is less than 2, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, 10,000, or 20,000 seconds or minutes.

111. The method according to claim 106, wherein the monitoring comprises monitoring during a second time-interval.

112. The method according to claim 111, wherein the first time-interval is at least 0.001, 0.002, 0.003, 0.005, 0.008, 0.01, 0.02, 0.03, 0.05, 0.07, 0.1, 0.2, 0.3, 0.5, 0.7, 1, 2, 3, 5, 7, 10, 20, 30, 50, 70, 100, 200, 300, 500, 700, or 1000 times of the second time-interval.

113. The method according to claim 111, wherein the first time-interval is less than 0.002, 0.003, 0.005, 0.008, 0.01, 0.02, 0.03, 0.05, 0.07, 0.1, 0.2, 0.3, 0.5, 0.7, 1, 2, 3, 5, 7, 10, 20, 30, 50, 70, 100, 200, 300, 500, 700, 1000, or 2000 times of the second time-interval.

114. The method according to claim 106, wherein the blocking comprises blocking of part of the requests or packets in the second sequence during the first time-interval, and sending, by the firstdevice to the web server over the Internet, the requests or packets in the second sequence that are not blocked or dropped.

115. The method according to claim 114, wherein the blocking is deterministic -based.

116. The method according to claim 115, wherein the blocking comprises blocking of every Nth packet or request in the second sequence.

117. The method according to claim 116, wherein N is more than, or equal to, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 15, 18, 20, 22, 25, 30, 35, 40, 45, 50, 55, 60, 65, 70, 75, 80, 85, 90, 95, or 100, or wherein N is less than, or equal to, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 15, 18, 20, 22, 25, 30, 35, 40, 45, 50, 55, 60, 65, 70, 75, 80, 85, 90, 95, 100, 150, or 200.

118. The method according to claim 114, wherein the blocking comprises blocking above 0.01%, 0.02%, 0.03%, 0.05%, 0.07%, 0.1%, 0.2%, 0.3%, 0.5%, 1%, 2%, 3%, 5%, 7%, 10%, 12%, 15%, 20%, 25%, 30%, 35%, 40%, 45%, 50%, 55%, 60%, 65%, 70%, 75%, 80%, 85%, 90%, or 95% of the packets or requests in the second sequence.

119. The method according to claim 114, wherein the blocking comprises blocking less than 0.02%, 0.03%, 0.05%, 0.07%, 0.1%, 0.2%, 0.3%, 0.5%, 1%, 2%, 3%, 5%, 7%, 10%, 12%, 15%, 20%, 25%, 30%, 35%, 40%, 45%, 50%, 55%, 60%, 65%, 70%, 75%, 80%, 85%, 90%, 95%, or 99% of the packets or requests in the second sequence.

120. The method according to claim 114, wherein the blocking is random-based.

121. The method according to claim 120, further comprising generating, using a random number generator, a random number in a range, for each of the packets or requests in the second sequence.

122. The method according to claim 121, for use with a value in the range, and wherein each of the packs or requests is blocked, discarded, or dropped in response to the associated random number being above or below the value.

123. The method according to claim 121, wherein the random number is generated using, or based on, a random or quazi-random process.

124. The method according to claim 121, wherein the random number generator is hardwarebased that uses, or is based on, thermal noise, shot noise, nuclear decaying radiation, photoelectric effect, or quantum phenomena.

125. The method according to claim 121, wherein the random number generator is software-based that uses, or is based on, executing an algorithm for generating pseudo-random numbers.

126. The method according to claim 114, wherein the number of blocked, discarded, or dropped packets or requests is based on, uses, is a function of, or is responsive to, the threshold value.

127. The method according to claim 126, wherein the number of blocked, discarded, or dropped packets or requests is configured so that when the monitoring is performed on the sent second sequence, the obtained first value is less than the threshold value.

128. The method according to claim 126, wherein the number of blocked, discarded, or dropped packets or requests is based on, uses, is a function of, or is responsive to, a difference between the threshold value and the first value.

129. The method according to claim 114, wherein the web server is associated with an additional threshold value, and wherein the number of blocked, discarded, or dropped packets or requests is based on, uses, is a function of, or is responsive to, the additional threshold value.

130. The method according to claim 114, wherein the number of blocked, discarded, or dropped packets is configured so that the web server does not detect the first device as a hostile device or as a Denial-of-Service (DoS) or Distributed- Denial-of-Service (DDoS) attacking device.

131. The method according to claim 106, wherein the blocked, discarded, or dropped requests or packets in the second sequence are detected and re-transmitted as part of a protocol.

132. The method according to claim 106, wherein the blocked, discarded, or dropped packets in the second sequence are detected and re-transmitted as part of a Transmission Control Protocol (TCP).

133. The method according to claim 1, wherein at least one request, or all of the requests, in the first or second sequence, comprise, or consist of, a Hypertext Transfer Protocol (HTTP) request.

134. The method according to claim 133, wherein at least one HTTP request, or all of the HTTP requests, comprise, or consist of, a Hypertext Transfer Protocol Secure (HTTPS) request.

135. The method according to claim 133, wherein at least one HTTP request, or all of the HTTP requests, are based on, or use, HTTP / 1.1, HTTPS, HTTP / 2, HTTP / 3, or any combination thereof.

136. The method according to claim 1, wherein one of, few of, or all of, the content items in the first and second groups comprises, or consists of, a HyperText Markup Language (HTML) object, a web-page, a web-site, or any combination thereof.

137. The method according to claim 1, wherein one of, few of, or all of, the content items in the first and second groups comprises, or consists of, a part or whole of a program or data file, text data, audio data, voice data, multimedia data, video data, an image, music data, or any combination thereof.

138. The method according to claim 1, wherein one of, few of, or all of, the content item identifiers comprise, or consist of, a Uniform Resource Locator (URL), a Uniform Resource Identifier (URI), an IP address, a domain name, a website name, or any combination thereof.

139. The method according to claim 1, further comprising executing, storing, operating, or using, by the first device, a web browser.

140. The method according to claim 139, wherein the executing of the web browser is in response to the identifying of the first or second sequence of requests.

141. The method according to claim 139, further comprising launching or initiating of the web browser in response to the identifying of the first or second sequence of requests.

142. The method according to claim 139, further comprising launching or initiating of the web browser in response to powering up of the first device or in response to a connecting to the Internet by the first device.

143. The method according to claim 139, wherein the identifying of the first or second sequence of requests is performed as part of the executing of the web browser.

144. The method according to claim 139, wherein the sending of first or second sequence of requests is performed as part of the executing of the web browser.

145. The method according to claim 139, wherein the web browser consists of, comprises, or is based on, Microsoft Internet Explorer, Google Chrome, Opera™, or Mozilla Firefox®.

146. The method according to claim 145, wherein the web browser is a mobile web browser.

147. The method according to claim 146, wherein the mobile web browser consists of, comprises, or is based on, Safari, Opera Mini™, or Android web browser.

148. The method according to claim 139, wherein the web browser comprises a headless browser.

149. The method according to claim 139, wherein at least one of the steps is performed as part of a plug-in or an extension integrated with the web browser.

150. The method according to claim 149, wherein at least one of the steps performed by the first device is integrated with the web browser in a form of a plug-in or an extension.

151. The method according to claim 149, wherein the identifying of the first or second sequence of requests uses a plug-in or an extension to the web browser.

152. The method according to claim 149, wherein the integration is by hooking to the web browser, wherein the integration is in a filter driver form, or, wherein the web browser and the steps are communicating using an Inter-Process Communication (IPC).

153. The method according to claim 152, wherein the identifying of the first or second sequence of requests uses hooking to the web browser, a filter driver form, or using an Inter-Process Communication (IPC).

154. The method according to claim 152, wherein the IPC is using a file sharing, a signal, a socket, a pipe, a message queue, a shared memory, a semaphore, or memory mapped file.

155. The method according to claim 152, wherein the IPC is using a clipboard, a Component Object Model (COM), a data copy, a DDE protocol, or mailslots.

156. The method according to claim 152, wherein the monitoring of the first sequence of requests uses hooking to the web browser, a filter driver form, or using an Inter-Process Communication (IPC).

157. The method according to claim 156, wherein the IPC is using a file sharing, a signal, a socket, a pipe, a message queue, a shared memory, a semaphore, or memory mapped file.

158. The method according to claim 156, wherein the IPC is using a clipboard, a Component Object Model (COM), a data copy, a DDE protocol, or mailslots.

159. The method according to claim 152, wherein the blocking uses hooking to the web browser, a filter driver form, or using an Inter-Process Communication (IPC).

160. The method according to claim 159, wherein the IPC is using a file sharing, a signal, a socket, a pipe, a message queue, a shared memory, a semaphore, or memory mapped file.

161. The method according to claim 159, wherein the IPC is using a clipboard, a Component Object Model (COM), a data copy, a DDE protocol, or mailslots.

162. The method according to claim 1, wherein the identifying of the first sequence, the monitoring, the obtaining, the comparing, the identifying of the second sequence, the sending of the second sequence, the blocking, or any combination thereof, is performed by a device that consists of, comprises, is integrated with, or is part of, a wearable device that is wearable on a person.

163. The method according to claim 162, wherein the wearable device is wearable on an organ of the person head.

164. The method according to claim 163, wherein the organ is an eye, ear, face, cheek, nose, mouth, lip, forehead, or chin.

165. The method according to claim 162, wherein the wearable device is constructed to have a form substantially similar to, is constructed to have a shape allowing mounting or wearing identical or similar to, or is constructed to have a form to at least in part substitute for, headwear, eyewear, or earpiece.

166. The method according to claim 165, wherein the headwear consists of, structured as, or comprises, a bonnet, a cap, a crown, a fillet, a hair cover, a hat, a helmet, a hood, a mask, a turban, a veil, or a wig.

167. The method according to claim 165, wherein the eyewear consists of, structured as, or comprises, glasses, sunglasses, a contact lens, a blindfold, or a goggle.

168. The method according to claim 165, wherein the earpiece consists of, structured as, or comprises, a hearing aid, a headphone, a headset, or an earplug.

169. The method according to claim 162, wherein the wearable device is shaped for permanently or releasably being attachable to, or be part of, a clothing piece of a person.

170. The method according to claim 169, wherein the attaching uses taping, gluing, pinning, enclosing, encapsulating, a pin, or a latch and hook clip.

171. The method according to claim 169, wherein the clothing piece is a top, bottom, or full-body underwear, or a headwear, a footwear, an accessory, an outwear, a suit, a dress, a skirt, or a top.

172. The method according to claim 162, wherein the wearable device further comprises an annular member defining an aperture therethrough that is sized for receipt therein of a part of a human body.

173. The method according to claim 1, wherein the identifying of the first sequence, the monitoring, the obtaining, the comparing, the identifying of the second sequence, the sending of the second sequence, the blocking, or any combination thereof, is performed by a device that consists of, comprises, is integrated in part or entirely with, or is part of, an appliance.

174. The method according to claim 173, wherein a primary functionality of the appliance is associated with food storage, handling, or preparation.

175. The method according to claim 174, wherein a primary function of the appliance is heating food, and wherein the appliance is a microwave oven, an electric mixer, a stove, an oven, or an induction cooker.

176. The method according to claim 174, wherein the appliance is a refrigerator, a freezer, a food processor, a dishwasher, a food blender, a beverage maker, a coffeemaker, or an iced-tea maker.

177. The method according to claim 173, wherein a primary function of the appliance is associated with environmental control, and the appliance consists of, or is part of, an HVAC system.

178. The method according to claim 177, wherein a primary function of the appliance is associated with temperature control, and wherein the appliance is an air conditioner or a heater.

179. The method according to claim 173, wherein a primary function of the appliance is associated with cleaning, wherein the primary function is associated with clothes cleaning, and the appliance is a washing machine or a clothes dryer, or wherein the appliance is a vacuum cleaner.

180. The method according to claim 173, wherein a primary function of the appliance is associated with water control or water heating.

181. The method according to claim 173, wherein the appliance is an answering machine, a telephone set, a home cinema method, a HiFi method, a CD or DVD player, an electric furnace, a trash compactor, a smoke detector, a light fixture, or a dehumidifier.

182. The method according to claim 173, wherein the appliance is a battery-operated portable electronic device, and the appliance is a notebook, a laptop computer, a media player, a cellular phone, a Personal Digital Assistant (PDA), an image processing device, a digital camera, a video recorder, or a handheld computing device.

183. The method according to claim 173, wherein the integration involves sharing a component.

184. The method according to claim 183, wherein the integration involves housing in same enclosure, sharing same processor, or mounting onto same surface.

185. The method according to claim 183, wherein the integration involves sharing a same connector.

186. The method according to claim 185, wherein the connector is a power connector for connecting to a power source, and wherein the integration involves sharing the same connector for being powered from same power source, or wherein the integration involves sharing same power supply.

187. The method according to claim 1, wherein the identifying of the first sequence, the monitoring, the obtaining, the comparing, the identifying of the second sequence, the sending of the second sequence, the blocking, or any combination thereof, is performed by a device that comprises, or is part of, a vehicular device that is mountable in a vehicle or configured to be used in a vehicle.

188. The method according to claim 187, wherein the vehicle comprises, is part of, or consists of, a ground vehicle adapted to travel on land.

189. The method according to claim 188, wherein the ground vehicle comprises, is part of, or consists of, a bicycle, a car, a motorcycle, a train, an electric scooter, a subway, a train, a trolleybus, a tram, or any combination thereof.

190. The method according to claim 187, wherein the vehicle comprises, is part of, or consists of, a buoyant or submerged watercraft adapted to travel on or in water.

191. The method according to claim 190, wherein the watercraft comprises, is part of, or consists of, a ship, a boat, a hovercraft, a sailboat, a yacht, a submarine, or any combination thereof.

192. The method according to claim 187, wherein the vehicle comprises, is part of, or consists of, an aircraft adapted to fly in air.

193. The method according to claim 192, wherein the aircraft comprises, is part of, or consists of, a fixed wing or a rotorcraft aircraft.

194. The method according to claim 192, wherein the aircraft comprises, is part of, or consists of an airplane, a spacecraft, a glider, a drone, an Unmanned Aerial Vehicle (UAV), or any combination thereof.

195. The method according to claim 187, wherein the vehicle communicates using, compatible with, or based on, a Dedicated Short-Range Communication (DSRC) or IEEE 802.1 Ip standard.

196. The method according to claim 1, further for use with a virtualization, wherein the first device consists of, comprises, is part of, or is integrated with, a server or client device that virtualizes a client device addressed by the selected IP address.

197. The method according to claim 196, wherein the client device virtualization executed as part of a Virtual Machine (VM).

198. The method according to claim 197, for use with a host computer that implement the VM, wherein the method further comprising executing, by the host computer, a hypervisor or a Virtual Machine Monitor (VMM).

199. The method according to claim 197, wherein the virtualization includes, is based on, or uses, full virtualization, para- virtualization, or hardware assisted virtualization.

200. The method according to claim 1, wherein the identifying of the first sequence, the monitoring, the obtaining, the comparing, the identifying of the second sequence, the sending of the second sequence, the blocking, or any combination thereof, is performed by a device that comprises, or is part of, comprises, or consists of, a client device.

201. The method according to claim 200, further comprising storing, operating, or using, by the client device, a client operating system.

202. The method according to claim 201, wherein the client operating system consists of, comprises, or is based on, Microsoft Windows 7, Microsoft Windows XP, Microsoft Windows 8, Microsoft Windows 8.1, Linux, or Google Chrome OS.

203. The method according to claim 201, wherein the client operating system is a Real-Time Operating System (RTOS).

204. The method according to claim 203, wherein the RTOS comprises FreeRTOS, SafeRTOS, QNX, VxWorks, or Micro-Controller Operating Systems (pC / OS).

205. The method according to claim 200, further comprising storing, operating, or using, by the client device, a web browser.

206. The method according to claim 205, wherein the web browser consists of, comprises, or is based on, Microsoft Internet Explorer, Google Chrome, Opera™, or Mozilla Firefox®.

207. The method according to claim 205, wherein the web browser is a mobile web browser.

208. The method according to claim 207, wherein the mobile web browser consists of, comprises, or is based on, Safari, Opera Mini™, or Android web browser.

209. The method according to claim 200, wherein the client device comprises, is part of, or consists of, a client device in a client / server architecture.

210. The method according to claim 200, wherein the client device is housed in a single enclosure that is a hand-held enclosure or a portable enclosure.

211. The method according to claim 200, wherein the client device consists of, comprises, is part of, or is integrated with, a notebook computer, a laptop computer, a media player, a Digital Still Camera (DSC), a Digital video Camera (DVC or digital camcorder), a Personal Digital Assistant (PDA), a cellular telephone, a digital camera, a video recorder, or a smartphone.

212. The method according to claim 200, wherein the client device consists of, comprises, is part of, or is integrated with, a smartphone that comprises, or is based on, an Apple iPhone 6 or a Samsung Galaxy S6.

213. The method according to claim 200, wherein the client device comprises, consists of, or is based on, a consumer computer that is owned, operated, or used, by a user for a personal, social, family, or household use.

214. The method according to claim 200, further comprising storing, operating, or using, by the client device, an operating system.

215. The method according to claim 214, wherein the operating system is a mobile operating system.

216. The method according to claim 215, wherein the mobile operating system comprises Android version 2.2 (Froyo), Android version 2.3 (Gingerbread), Android version 4.0 (Ice Cream Sandwich), Android Version 4.2 (Jelly Bean), Android version 4.4 (KitKat), Apple iOS version 3, Apple iOS version 4, Apple iOS version 5, Apple iOS version 6, Apple iOS version 7, Microsoft Windows® Phone version 7, MicrosoftWindows® Phone version 8, Microsoft Windows® Phone version 9, or Blackberry® operating system.

217. The method according to claim 1, wherein the identifying of the first sequence, the monitoring, the obtaining, the comparing, the identifying of the second sequence, the sending of the second sequence, the blocking, or any combination thereof, is performed by a device that comprises, or is part of, comprises, is integrated with, or consists of, a Layer-3 (Internet Protocol- IP) networking device that forwards Internet Protocol (IP) packets between its ports or connections.

218. The method according to claim 217, wherein the Layer-3 (Internet Protocol-IP) networking device comprises, is part of, or is integrated with, a router, a gateway, a residential gateway, a firewall, or any combination thereof.

219. The method according to claim 1, wherein the identifying of the first sequence, the monitoring, the obtaining, the comparing, the identifying of the second sequence, the sending ofthe second sequence, the blocking, or any combination thereof, is performed by a device that comprises, is part of, or consists of, a server device that is not a client device.

220. The method according to claim 219, wherein the server device is a dedicated device that manages network resoucres; is not a client device and is not a consumer device; is continuously online with greater availability and maximum up time to receive requests almost all of the time efficiently processes multiple requests from multiple client devices at the same time; generates various logs associated with the client devices and traffic from / to the client devices; primarily interfaces and responds to requests from client devices; has greater fault tolerance and higher reliability with lower failure rates; provides scalability for increasing resources to serve increasing client demands; or any combination thereof.

221. The method according to claim 219, wherein the server device is virtualized, wherein the virtualization is executed as part of a Virtual Machine (VM).

222. The method according to claim 221, for use with a host computer that implement the VM, wherein the method further comprising executing, by the host computer, a hypervisor or a Virtual Machine Monitor (VMM).

223. The method according to claim 221, wherein the virtualization includes, is based on, or uses, full virtualization, para- virtualization, or hardware assisted virtualization.

224. The method according to claim 219, wherein the server device consists of, includes, is part of, or is integrated with, a proxy server.

225. The method according to claim 224, wherein the proxy server consists of, includes, is part of, or is integrated with, a Data Center (DC) proxy server.

226. The method according to claim 224, wherein the proxy server consists of, includes, is part of, or is integrated with, an HTTP proxy server, a web-proxy server, a caching proxy, an open- source caching proxy server, a cloud-based proxy server, an open proxy server, a forwarding proxy server, a reverse proxy server, a transparent proxy server, a non-transparent proxy server, an anonymous proxy server, a translation proxy server, a SOCKS proxy server, a CGI web proxy server, a suffix proxy server, an I2P anonymous proxy server, a DNS proxy server, or any combination thereof.

227. The method according to claim 219, further comprising storing, operating, or using, by the server device, a server operating system.

228. The method according to claim 227, wherein the server operating system consists of, comprises, or based on, Microsoft Windows Server®, Linux, or UNIX.

229. The method according to claim 227, wherein the server operating system consists of, comprises, or based on, Microsoft Windows Server® 2003 R2, 2008, 2008 R2, 2012, or 2012 R2variant, Linux™ or GNU / Linux based Debian GNU / Linux, Debian GNU / kFreeBSD, Debian GNU / Hurd, Fedora™, Gentoo™, Linspire™, Mandriva, Red Hat® Linux, SuSE, Ubuntu®, UNIX® variant Solaris™, AIX®, Mac™ OS X, FreeBSD®, OpenBSD, or NetBSD®.

230. The method according to claim 219, wherein the server device is a cloud-based server that is implemented as an Infrastructure as a Service (laaS) or as a Software as a Service (SaaS) by a public cloud-based service.

231. The method according to claim 230, wherein the public cloud-based service is provided by Amazon Web Services® (AWS®), or Microsoft® Azure™.

232. The method according to claim 230, wherein the public cloud-based service is provided by Google® Compute Engine™ (GCP).

233. The method according to claim 1, wherein the identifying of the first or second sequence comprises identifying requests in a third sequence that are addressed to the web server.

234. The method according to claim 233, wherein the identifying comprises identifying requests that are addressed to, or comprises, a hostname of the web server, a domain name, an IP address of the web server, or a URL structure.

235. The method according to claim 233, wherein the identifying comprises obtaining an IP address of the web server using a Domain Name System (DNS) mechanism.

236. The method according to claim 233, wherein the identifying comprises identifying URLs having a specific structure.

237. A non-transitory computer readable medium containing computer instructions that, when executed by a computer processor, cause the processor to perform at least part of the steps of claim 1.

238. A non-transitory computer readable medium containing computer instructions that, when executed by a computer processor, cause the processor to perform all of the steps of claim 1.

239. The method according to claim 1, wherein at least part of steps of claim 1 are included in a Software Development Kit (SDK) that is provided as a non-transitory computer readable medium containing computer instructions, and wherein the method further comprising installing the SDK.

240. A method for reducing a work-load of a web server that stores a group of content items that are each identified by a respective content item identifier, for use with a first sequence of requests for content items in the group, each of the requests in the first sequence comprises a respective content item identifier, the method comprising: measuring a response time of the web server; comparing the measured response time a threshold value; responsive to the measured response time being lower than the threshold value, sending, by a first device to the web server over the Internet, the first sequence of requests; and responsive to the measured response time being higher than the threshold value, sending, by the first device to the web server over the Internet, the first sequence of requests, while blocking at least part of the requests in the first sequence of requests.

241. The method according to claim 240, wherein the measured response time is based on, represents, is in response to, or is a function of, a number of requests received by the web server per second, a latency response time of a connection or for a received request by the web server, a throughput of the web server for a file size for a cached content or for non-cached content, or any combination thereof.

242. The method according to claim 240, wherein the measured response time comprises, is based on, represents, is in response to, or is a function of, an amount of load in form of client requests, processing, and communications resources expected in a specified time period.

243. The method according to claim 240, further configured so that the web server does not detect the first device as a hostile device or as a Denial-of-Service (DoS) or Distributed- Denial-of- Service (DDoS) attacking device.

244. The method according to claim 240, wherein the measured response time is based on, represents, is in response to, or is a function of, a work load caused at the web server due to a receiving and a responding to a sequence of requests by the first device.

245. The method according to claim 240, further preceded by identifying, at the first device, the first sequence of requests for content items in the group.

246. The method according to claim 245, wherein the identifying comprises receiving, by the first device from a second device over the Internet, the first sequence of requests for content items in the group.

247. The method according to claim 246, further comprising sending, by the first device to the second device over the Internet, the received content items, in response to the receiving of the content items.

248. The method according to claim 246, wherein the second device comprises a client device.

249. The method according to claim 246, wherein the second device comprises a server device.

250. The method according to claim 249, wherein the second device comprises a Super Proxy server or a Tunnel bank server.

251. The method according to claim 240, wherein the first sequence comprises a series of requests in a chronological order.

252. The method according to claim 240, wherein the measuring of the response time comprises: sending, to the web server, a first request; receiving, from the web server, a first response to the sent first request; and measuring or metering a time difference between the sending of the first request and the receiving of the first response, wherein the response time is based on, uses, or is a function of, the measured or metered time difference.

253. The method according to claim 252, wherein the sending of the first request to the web server comprises sending, to the web server via a second device, of the first request, and wherein the receiving from the web server of the first response comprises receiving, from the web server via the second device, of the first response.

254. The method according to claim 253, further comprising selecting of the second device from a group of client devices.

255. The method according to claim 254, further comprising associating, for each of the client devices in the group, a geographical location, and wherein the selecting is based on, or according to, the geographical location associated with the selected second device.

256. The method according to claim 255, wherein the selecting is based on the geographical location being the same as an estimated location of the web server or of the first device.

257. The method according to claim 255, wherein the geographical location comprises a country, a state, a region, a city, a postal / zip code, a latitude, a longitude, a Timezone, or any combination thereof.

258. The method according to claim 255, wherein the associating is based on, or uses, IP geolocation.

259. The method according to claim 258, wherein the geolocation is based on W3C Geolocation Application Programming Interface (API).

260. The method according to claim 253, wherein the second device comprises a proxy server or a Data Center (DC)-based proxy server.

261. The method according to claim 260, wherein the proxy server or the Data Center (DC)-based proxy server, stores a list of IP addresses, and the method further comprises selecting an IP addressfrom the list, and using the selected IP address as a source address when sending the first request to the web server.

262. The method according to claim 261, further comprising associating, for each of the IP addresses in the list, a geographical location, and wherein the selecting is based on, or according to, the geographical location associated with the selected second device.

263. The method according to claim 262, wherein the selecting is based on the geographical location being the same as an estimated location of the web server or of the first device.

264. The method according to claim 262, wherein the geographical location comprises a country, a state, a region, a city, a postal / zip code, a latitude, a longitude, a Timezone, or any combination thereof.

265. The method according to claim 262, wherein the associating is based on, or uses, IP geolocation.

266. The method according to claim 265, wherein the geolocation is based on W3C Geolocation Application Programming Interface (API).

267. The method according to claim 252, wherein the measuring of the response time further comprises initiating a timer in response to, or during, the sending of the first request; and stopping the timer in response to, or during, the receiving of the first response.

268. The method according to claim 252, wherein the measuring of the response time further comprises a first timestamping in response to, or during, the sending of the first request; and a second timestamping in response to, or during, the receiving of the first response, wherein the response time is calculated based on, according to, or in response to, the time difference between the first and second timestampings.

269. The method according to claim 268, wherein the first or second timestamping is based on, or is according to, an Internet Engineering Task Force (IETF) Request for Comments (RFC) 9557 or ISO 8601-1:2019.

270. The method according to claim 252, wherein the measuring or metering of the time difference comprises measuring or metering of the time difference between a first bit, a first packet, a last bit, or a last packet of the sent first request, and a first bit, a first packet, a last bit, or a last packet of the received first response.

271. The method according to claim 252, wherein the web server comprises a first content that is identified by a Uniform Resource Eocator (URE) and that comprises a web page or a part thereof, or a HyperText Markup Language (HTML) object or a part thereof, wherein the request is a Hypertext Transfer Protocol (HTTP) or Hypertext Transfer Protocol Secure (HTTPS) request that comprises the URL, and wherein the first response comprises the first content or a part thereof.

272. The method according to claim 240, wherein the measuring of the response time is performed in whole or in part during, or in parallel with, the sending of the first sequence of requests, during a receiving of the content items, or any combination thereof.

273. The method according to claim 240, wherein the measuring of the response time comprises repeating the measuring N times, and calculating an average response time of the repeated measurings.

274. The method according to claim 273, wherein the number N is at least 2, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, or 200.

275. The method according to claim 273, wherein the number N is less than 3, 4, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, or 500.

276. The method according to claim 240, wherein the measuring of the response time is continuously performed.

277. The method according to claim 240, wherein the measuring of the response time comprises repetitively measuring of the response time.

278. The method according to claim 277, wherein the time period between any two consecutive measuring of the response time is at least 1, 2, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, or 10,000 milliseconds or seconds.

279. The method according to claim 277, wherein the time period between any two consecutive measuring of the response time is less than 2, 3, 4, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, 10,000 or 20,000 milliseconds or seconds.

280. The method according to claim 240, wherein the measuring of the response time comprises, is based on, or is a function of, measuring of a Round-Trip delay Time (RTT).

281. The method according to claim 280, wherein the measuring of the RTT uses, is based on, or is according to, a part of, or whole of, IETF RFC 2681, IETF RFC 6323, IETF RFC 7982, or any combination thereof.

282. The method according to claim 280, wherein the measuring of the RTT comprises, uses, is based on, or is according to, sending of a ‘Ping’ or of an Internet Control Message Protocol (ICMP) echo request.

283. The method according to claim 240, wherein the threshold value is at least 1, 2, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, or 5,000, milliseconds or seconds.

284. The method according to claim 240, wherein the threshold value is less than 2, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, or 10,000 milliseconds or seconds.

285. The method according to claim 240, further comprising smoothing the estimated measured response time.

286. The method according to claim 285, wherein the smoothing is based on, uses, or is according to, a moving average technique, that is based on, uses, or is according to, a Simple Moving Average (SMA), a Cumulative Average (CA), a Weighted Moving Average (WMA), or any combination thereof.

287. The method according to claim 285, wherein the smoothing is based on, uses, or is according to, an exponential smoothing, that is based on, uses, or is according to, an Exponential Moving Average (EMA), a Double exponential smoothing, a Triple exponential smoothing, or any combination thereof.

288. The method according to claim 240, wherein the steps are repeated for at least an additional sequence of requests for content items in the group, each of the requests in the additional sequence comprises a respective content item identifier.

289. The method according to claim 288, wherein the steps are immediately repeated.

290. The method according to claim 288, wherein the steps are repeated at least 2, 3, 4, 5, 10, 15, 20, 100, 120, 150, 200, 500, or 1000 times.

291. The method according to claim 288, wherein the steps are repeated after a wait time.

292. The method according to claim 291, wherein the wait time is at least 1, 2, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, or 10,000 milliseconds, seconds, minutes, hours, or days.

293. The method according to claim 264, wherein the wait time is less than 2, 3, 4, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, 10,000 or 20,000 milliseconds, seconds, minutes, hours, or days.

294. The method according to claim 291, wherein the blocking comprises blocking of the requests or packets in the first sequence during a first time-interval, and wherein the wait time is at least 0.001, 0.002, 0.003, 0.005, 0.008, 0.01, 0.02, 0.03, 0.05, 0.07, 0.1, 0.2, 0.3, 0.5, 0.7, 1, 2, 3, 5, 7, 10, 20, 30, 50, 70, 100, 200, 300, 500, 700, or 1000 times the first time-interval.

295. The method according to claim 291, wherein the blocking comprises blocking of the requests or packets in the first sequence during a first time-interval, and wherein the wait time is less than 0.001, 0.002, 0.003, 0.005, 0.008, 0.01, 0.02, 0.03, 0.05, 0.07, 0.1, 0.2, 0.3, 0.5, 0.7, 1, 2, 3, 5, 7, 10, 20, 30, 50, 70, 100, 200, 300, 500, 700, or 1000 times the first time-interval.

296. The method according to claim 240, further for use with a second sequence of requests for content items in the group, each of the requests in the second sequence comprises a respective content item identifier, the method further comprising:measuring an additional response time of the web server; comparing the measured additional response time to the threshold value; responsive to the estimated additional response time being lower than the threshold value, sending, by the first device to the web server over the Internet, the second sequence of requests; and responsive to the estimated additional response time being higher than the threshold value, sending, by the first device to the web server over the Internet, the first sequence of requests, while blocking at least part of the requests in the second sequence of requests.

297. The method according to claim 296, wherein the sending of the second sequence is performed after the sending or blocking of at least part of the requests of the first sequence.

298. The method according to claim 297, wherein the sending of the second sequence is performed immediately after the sending or blocking of at least part of the requests of the first sequence.

299. The method according to claim 297, wherein the sending of the second sequence is performed after a wait time after the sending or blocking of at least part of the requests of the first sequence.

300. The method according to claim 299, wherein the wait time is at least 1, 2, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, or 10,000 milliseconds, seconds, minutes, hours or days.

301. The method according to claim 299, wherein the wait time is less than 2, 3, 4, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, 10,000 or 20,000 milliseconds, seconds, minutes, hours, or days.

302. The method according to claim 299, wherein the blocking comprises blocking of the requests or packets in the second sequence during a first time-interval, and wherein the wait time is at least 0.001, 0.002, 0.003, 0.005, 0.008, 0.01, 0.02, 0.03, 0.05, 0.07, 0.1, 0.2, 0.3, 0.5, 0.7, 1, 2, 3, 5, 7, 10, 20, 30, 50, 70, 100, 200, 300, 500, 700, or 1000 times the first time-interval.

303. The method according to claim 299, wherein the blocking comprises blocking of the requests or packets in the second sequence during a first time-interval, and wherein the wait time is less than 0.001, 0.002, 0.003, 0.005, 0.008, 0.01, 0.02, 0.03, 0.05, 0.07, 0.1, 0.2, 0.3, 0.5, 0.7, 1, 2, 3, 5, 7, 10, 20, 30, 50, 70, 100, 200, 300, 500, 700, or 1000 times the first time-interval.

304. The method according to claim 240, wherein the blocking comprises blocking, delaying, discarding, or dropping of part of the requests or packets in the first sequence during a first timeinterval.

305. The method according to claim 304, wherein the blocked requests or packets in the first sequence are detected and re-transmitted as part of a protocol.

306. The method according to claim 304, wherein the blocked packets in the first sequence are detected and re-transmitted as part of a Transmission Control Protocol (TCP).

307. The method according to claim 304, wherein the blocking comprises blocking, delaying, discarding, or dropping of all the requests or packets in the first sequence during the first timeinterval.

308. The method according to claim 304, wherein the first time-interval is at least 1, 2, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, or 10,000 milliseconds.

309. The method according to claim 304, wherein the first time-interval is less than 2, 5, 8, 10, 12, 70, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, 10,000, or 20,000 milliseconds.

310. The method according to claim 304, wherein the first time-interval is at least 1, 2, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, or 10,000 seconds or minutes.

311. The method according to claim 304, wherein the first time-interval is less than 2, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, 10,000, or 20,000 seconds or minutes.

312. The method according to claim 304, wherein the blocking comprises blocking of a part of the requests or packets in the first sequence during the first time-interval, and sending, by the first device to the web server over the Internet, the requests or packets in the first sequence that are not blocked or dropped.

313. The method according to claim 312, wherein the blocking is deterministic -based.

314. The method according to claim 313, wherein the blocking comprises blocking of every Nth packet or request in the second part of the first sequence.

315. The method according to claim 314, wherein N is more than, or equal to, 2, 3, 4, 5, 6, 7, 8, 9,10, 11, 12, 15, 18, 20, 22, 25, 30, 35, 40, 45, 50, 55, 60, 65, 70, 75, 80, 85, 90, 95, or 100.

316. The method according to claim 314, wherein N is less than, or equal to, 3, 4, 5, 6, 7, 8, 9, 10,11, 12, 15, 18, 20, 22, 25, 30, 35, 40, 45, 50, 55, 60, 65, 70, 75, 80, 85, 90, 95, 100, 150, or 200.

317. The method according to claim 312, wherein the blocking comprises blocking above 0.01%, 0.02%, 0.03%, 0.05%, 0.07%, 0.1%, 0.2%, 0.3%, 0.5%, 1%, 2%, 3%, 5%, 7%, 10%, 12%, 15%, 20%, 25%, 30%, 35%, 40%, 45%, 50%, 55%, 60%, 65%, 70%, 75%, 80%, 85%, 90%, or 95% of the packets or requests in the second part of the first sequence.

318. The method according to claim 312, wherein the blocking comprises blocking less than 0.02%, 0.03%, 0.05%, 0.07%, 0.1%, 0.2%, 0.3%, 0.5%, 1%, 2%, 3%, 5%, 7%, 10%, 12%, 15%,20%, 25%, 30%, 35%, 40%, 45%, 50%, 55%, 60%, 65%, 70%, 75%, 80%, 85%, 90%, 95%, or 99% of the packets or requests in the second part of the first sequence.

319. The method according to claim 312, wherein the blocking is random-based.

320. The method according to claim 319, further comprising generating, using a random number generator, a random number in a range, for each of the packets or requests in the second part of the first sequence.

321. The method according to claim 320, for use with a value in the range, and wherein each of the packs or requests is blocked, discarded, or dropped in response to the associated random number being above or below the value.

322. The method according to claim 320, wherein the random number is generated using, or based on, a random or quazi-random process.

323. The method according to claim 320, wherein the random number generator is hardwarebased that uses, or is based on, thermal noise, shot noise, nuclear decaying radiation, photoelectric effect, or quantum phenomena.

324. The method according to claim 320, wherein the random number generator is software-based that uses, or is based on, executing an algorithm for generating pseudo-random numbers.

325. The method according to claim 312, wherein the number of blocked packets or requests is based on, uses, is a function of, or is responsive to, a threshold value.

326. The method according to claim 325, wherein the threshold value is based on, a function of, or in response to, the measured response time.

327. The method according to claim 326, wherein the number of blocked packets or requests is based on, uses, is a function of, or is responsive to, a difference between a threshold value and a monitored value.

328. The method according to claim 312, wherein the web server is associated with an additional threshold value, and wherein the number of blocked packets or requests is based on, uses, is a function of, or is responsive to, the additional threshold value.

329. The method according to claim 312, wherein the number of blocked, discarded, delayed, or dropped packets is configured so that the web server does not detect the first device as a hostile device or as a Denial-of-Service (DoS) or Distributed- Denial-of-Service (DDoS) attacking device.

330. The method according to claim 240, wherein at least one request, or all of the requests, in the first sequence, comprise, or consist of, a Hypertext Transfer Protocol (HTTP) request.

331. The method according to claim 330, wherein at least one HTTP request, or all of the HTTP requests, comprise, or consist of, a Hypertext Transfer Protocol Secure (HTTPS) request.

332. The method according to claim 330, wherein at least one HTTP request, or all of the HTTP requests, are based on, or use, HTTP / 1.1, HTTPS, HTTP / 2, HTTP / 3, or any combination thereof.

333. The method according to claim 240, wherein one of, few of, or all of, the content items in the group comprises, or consists of, a HyperText Markup Language (HTML) object, a web-page, a web-site, or any combination thereof.

334. The method according to claim 240, wherein one of, few of, or all of, the content items in the group comprises, or consists of, a part or whole of a program or data file, text data, audio data, voice data, multimedia data, video data, an image, music data, or any combination thereof.

335. The method according to claim 240, wherein one of, few of, or all of, the content item identifiers comprise, or consist of, a Uniform Resource Locator (URL), a Uniform Resource Identifier (URI), an IP address, a domain name, a website name, or any combination thereof.

336. The method according to claim 240, for use with a second sequence of requests for content items in the group, each of the requests in the second sequence comprises a respective content item identifier, the method further comprising: sending, by a second device to the web server over the Internet, the second sequence of requests, in response to the identifying of at least part of the second sequence; and receiving, by the second device from the web server over the Internet, content items, in response to the sending of the second sequence of requests.

337. The method according to claim 336, wherein the sending by the second device of the second sequence of requests is at least in part in parallel to the sending by the first device of the first sequence of requests.

338. The method according to claim 336, further preceded by identifying, at the second device, the second sequence of requests for content items in the group.

339. The method according to claim 338, wherein the identifying comprises receiving, by the second device over the Internet, the second sequence of requests for content items in the group.

340. The method according to claim 338, further comprising sending, by the second device over the Internet, the received content items, in response to the receiving of the content items.

341. The method according to claim 336, for use with a third sequence of requests that comprises the first and second sequences of requests, the method further comprising: identifying, by a third device, the third sequence of requests; identifying, by the third device, the first and second sequences of requests in the third sequence; sending, by the third device to the first device over the Internet, the first sequence; receiving, by the first device from the third device over the Internet, the sent first sequence;sending, by the third device to the second device over the Internet, the second sequence; and receiving, by the second device from the third device over the Internet, the sent second sequence, wherein the sending, by the first device of the first part of the first sequence of requests is in response to the receiving of the sent first sequence by the first device, and wherein the sending, by the second device of the first part of the second sequence of requests is in response to the receiving of the sent second sequence by the second device.

342. The method according to claim 341, wherein the identifying by the third device of the third sequence of requests comprises receiving, by the third device over the Internet, the third sequence of requests.

343. The method according to claim 341, wherein the blocking of at least part of the second part of the first sequence or a blocking of the second sequence is performed by the third device.

344. The method according to claim 341, wherein the identifying by the third device of the first and second sequences of requests in the third sequence comprises splitting or demultiplexing the third sequence into the first and second sequences by a multiplexer in the third device.

345. The method according to claim 344, wherein the splitting or demultiplexing is based on load balancing or wherein the first and second sequences are evenly split from the third sequence.

346. The method according to claim 341, wherein the comparing is performed by the third device.

347. The method according to claim 240, for use with multiple devices that comprises the first device and respective multiple distinct sequences of requests for content items in the group that comprises the first sequence, each of the requests in the multiple sequences comprises a respective content item identifier, the method by each of the multiple devices comprises: sending, by the respective device from the multiple devices to the web server over the Internet, the respective sequence of requests; and receiving, by the respective device from the multiple devices from the web server over the Internet, content items, in response to the respective sending of the respective sequence of requests.

348. The method according to claim 347, wherein the number of multiple devices is equal or higher than 1, 2, 4, 5, 10, 12, 15, 20, 30, 50, 80, 100, 120, 150, 200, 500, or 1,000.

349. The method according to claim 347, wherein the number of multiple devices is equal or less than 3, 4, 5, 10, 12, 15, 20, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, or 2,000.

350. The method according to claim 347, further preceded by identifying, at the third device, the multiple sequences of requests for content items in the group.

351. The method according to claim 350, wherein the identifying comprises receiving, by the third device over the Internet, the multiple sequences of requests for content items in the group.

352. The method according to claim 350, further comprising sending, by each of the multiple devices to the third device over the Internet, the received content items, in response to the receiving of the content items.

353. The method according to claim 240, wherein the measuring of the response time is performed by a second device that is distinct or different from the first device.

354. The method according to claim 353, further comprising sending, by the second device over the Internet, the measured response time.

355. The method according to claim 354, wherein the sending by the second device comprises sending to the first device.

356. The method according to claim 353, wherein the comparing is performed by the second device.

357. The method according to claim 356, further comprising sending, by the second device over the Internet, a first command responsive to the measured response time being lower than the threshold value.

358. The method according to claim 357, wherein the sending, by the first device to the web server over the Internet, the first sequence of requests, is in response to the sending of the first command.

359. The method according to claim 356, further comprising sending, by the second device over the Internet, a first command responsive to the measured response time being higher than the threshold value.

360. The method according to claim 359, wherein the sending, by the first device to the web server over the Internet, the first sequence of requests, while blocking at least part of the first sequence of requests, is in response to the sending of the first command.

361. The method according to claim 353, wherein the second device comprises a server device.

362. The method according to claim 361, wherein the server device is a cloud-based server that is implemented as an Infrastructure as a Service (laaS) or as a Software as a Service (SaaS) by a public cloud-based service.

363. The method according to claim 362, wherein the public cloud-based service is provided by Amazon Web Services® (AWS®), Microsoft® Azure™, or Google® Compute Engine™ (GCP).

364. The method according to claim 361, wherein the first device is storing, operating, or using, a server operating system.

365. The method according to claim 364, wherein the server operating system consists of, comprises, or based on, Microsoft Windows Server®, Linux, or UNIX.

366. The method according to claim 364, wherein the server operating system consists of, comprises, or based on, Microsoft Windows Server® 2003 R2, 2008, 2008 R2, 2012, or 2012 R2 variant, Linux™ or GNU / Linux based Debian GNU / Linux, Debian GNU / kFreeBSD, Debian GNU / Hurd, Fedora™, Gentoo™, Linspire™, Mandriva, Red Hat® Linux, SuSE, Ubuntu®, UNIX® variant Solaris™, AIX®, Mac™ OS X, FreeBSD®, OpenBSD, or NetBSD®.

367. The method according to claim 361, wherein the server device is virtualized virtualization executed as part of a Virtual Machine (VM).

368. The method according to claim 367, for use with a host computer that implements the VM, wherein the method further comprising executing, by the host computer, a hypervisor or a Virtual Machine Monitor (VMM).

369. The method according to claim 367, wherein the virtualization includes, is based on, or uses, full virtualization, para- virtualization, or hardware assisted virtualization.

370. The method according to claim 361, wherein the second device consists of, includes, is part of, or is integrated with, a proxy server.

371. The method according to claim 370, wherein the proxy server consists of, includes, is part of, or is integrated with, a Data Center (DC) proxy server.

372. The method according to claim 370, wherein the proxy server consists of, includes, is part of, or is integrated with, an HTTP proxy server, a web-proxy server, a caching proxy, an open- source caching proxy server, a cloud-based proxy server, an open proxy server, a forwarding proxy server, a reverse proxy server, a transparent proxy server, a non-transparent proxy server, an anonymous proxy server, a translation proxy server, a SOCKS proxy server, a CGI web proxy server, a suffix proxy server, an I2P anonymous proxy server, a DNS proxy server, or any combination thereof.

373. The method according to claim 240, wherein the comparing is performed by the first device.

374. The method according to claim 240, wherein the comparing is performed by a second device distinct from the first device.

375. The method according to claim 374, further comprising sending, by the second device to the first device over the Internet, a first command responsive to the measured response time being lower than the threshold value.

376. The method according to claim 375, wherein the sending, by the first device to the web server over the Internet, of the first sequence of requests, is in response to the sending of the first command.

377. The method according to claim 374, further comprising sending, by the second device to the first device over the Internet, a first command responsive to the measured response time being higher than the threshold value.

378. The method according to claim 377 , wherein the sending, by the first device to the web server over the Internet, of the first sequence of requests, while blocking at least part of the first sequence of requests, is in response to the sending of the first command.

379. The method according to claim 240, wherein the first device comprises, or consists of, a client device that is not a server device.

380. The method according to claim 379, further comprising storing, operating, or using, by the first device, a client operating system.

381. The method according to claim 380, wherein the client operating system consists of, comprises, or is based on, Microsoft Windows 130, Microsoft Windows XP, Microsoft Windows 8, Microsoft Windows 8.1, Linux, or Google Chrome OS.

382. The method according to claim 380, wherein the client operating system is a Real-Time Operating System (RTOS).

383. The method according to claim 382, wherein the RTOS comprises FreeRTOS, SafeRTOS, QNX, VxWorks, or Micro-Controller Operating Systems (pC / OS).

384. The method according to claim 379, further comprising storing, operating, or using, by the first device, a web browser.

385. The method according to claim 384, wherein the web browser consists of, comprises, or is based on, Microsoft Internet Explorer, Google Chrome, Opera™, or Mozilla Firefox®.

386. The method according to claim 384, wherein the web browser is a mobile web browser.

387. The method according to claim 386, wherein the mobile web browser consists of, comprises, or is based on, Safari, Opera Mini™, or Android web browser.

388. The method according to claim 379, wherein the client device comprises, is part of, or consists of, a client device in a client / server architecture.

389. The method according to claim 379, wherein the client device is housed in a single enclosure that is a hand-held enclosure or a portable enclosure.

390. The method according to claim 379, wherein the client device consists of, comprises, is part of, or is integrated with, a notebook computer, a laptop computer, a media player, a Digital Still Camera (DSC), a Digital video Camera (DVC or digital camcorder), a Personal Digital Assistant (PDA), a cellular telephone, a digital camera, a video recorder, or a smartphone.

391. The method according to claim 390, wherein the client device consists of, comprises, is part of, or is integrated with, a smartphone that comprises, or is based on, an Apple iPhone 6 or a Samsung Galaxy S6.

392. The method according to claim 240, wherein the sending, by the first device to the web server over the Internet, of the first sequence of requests, comprises sending, by the first device to the web server via a second device over the Internet, of the first sequence of requests, and wherein a receiving, by the first device from the web server over the Internet, of the content items, comprises receiving, by the first device from the web server via the second device over the Internet, of the content items.

393. The method according to claim 392, wherein the sending, by the first device to the web server over the Internet, of the first sequence of requests, comprises sending, by the first device to a second device over the Internet, of the first sequence of requests; and sending, by the second device to the web server over the Internet, of the first sequence of requests, and wherein the receiving, by the first device from the web server over the Internet, of the content items, comprises receiving, by the second device from the web server over the Internet, of the content items; and receiving, by the first device from the second device over the Internet, of the content items.

394. The method according to claim 392, wherein the comparing is performed by the second device.

395. The method according to claim 393, further comprising sending, by the second device over the Internet, a first command responsive to the measured response time being lower than the threshold value.

396. The method according to claim 395, wherein the sending, by the first device to the web server over the Internet, of the first sequence of requests, is in response to the sending of the first command.

397. The method according to claim 393, further comprising sending, by the second device over the Internet, a first command responsive to the measured response time being higher than the threshold value.

398. The method according to claim 397, wherein the sending, by the first device to the web server over the Internet, of the first sequence of requests, while blocking at least part of the first sequence of requests, is in response to the sending of the first command.

399. The method according to claim 240, wherein the measuring of the response time, the comparing, comprises, or any combination thereof, is performed by a device that consists of, comprises, is integrated with, or is part of, a wearable device that is wearable on a person.

400. The method according to claim 399, wherein the wearable device is wearable on an organ of the person head.

401. The method according to claim 400, wherein the organ is an eye, ear, face, cheek, nose, mouth, lip, forehead, or chin.

402. The method according to claim 399, wherein the wearable device is constructed to have a form substantially similar to, is constructed to have a shape allowing mounting or wearing identical or similar to, or is constructed to have a form to at least in part substitute for, headwear, eyewear, or earpiece.

403. The method according to claim 402, wherein the headwear consists of, structured as, or comprises, a bonnet, a cap, a crown, a fillet, a hair cover, a hat, a helmet, a hood, a mask, a turban, a veil, or a wig.

404. The method according to claim 402, wherein the eyewear consists of, structured as, or comprises, glasses, sunglasses, a contact lens, a blindfold, or a goggle.

405. The method according to claim 402, wherein the earpiece consists of, structured as, or comprises, a hearing aid, a headphone, a headset, or an earplug.

406. The method according to claim 399, wherein the wearable device is shaped for permanently or releasably being attachable to, or be part of, a clothing piece of a person.

407. The method according to claim 406, wherein the attaching uses taping, gluing, pinning, enclosing, encapsulating, a pin, or a latch and hook clip.

408. The method according to claim 407, wherein the clothing piece is a top, bottom, or full-body underwear, or a headwear, a footwear, an accessory, an outwear, a suit, a dress, a skirt, or a top.

409. The method according to claim 399, wherein the wearable device further comprises an annular member defining an aperture therethrough that is sized for receipt therein of a part of a human body.

410. The method according to claim 240, wherein the measuring of the response time, the comparing, comprises, or any combination thereof, is performed by a device that consists of, comprises, is integrated in part or entirely in with, or is part of, an appliance.

411. The method according to claim 410, wherein a primary functionality of the appliance is associated with food storage, handling, or preparation.

412. The method according to claim 411, wherein a primary function of the appliance is heating food, and wherein the appliance is a microwave oven, an electric mixer, a stove, an oven, or an induction cooker.

413. The method according to claim 411, wherein the appliance is a refrigerator, a freezer, a food processor, a dishwasher, a food blender, a beverage maker, a coffeemaker, or an iced-tea maker.

414. The method according to claim 410, wherein a primary function of the appliance is associated with environmental control, and the appliance consists of, or is part of, an HVAC system.

415. The method according to claim 414, wherein a primary function of the appliance is associated with temperature control, and wherein the appliance is an air conditioner or a heater.

416. The method according to claim 410, wherein a primary function of the appliance is associated with cleaning, wherein the primary function is associated with clothes cleaning, and the appliance is a washing machine or a clothes dryer, or wherein the appliance is a vacuum cleaner.

417. The method according to claim 410, wherein a primary function of the appliance is associated with water control or water heating.

418. The method according to claim 410, wherein the appliance is an answering machine, a telephone set, a home cinema method, a HiFi method, a CD or DVD player, an electric furnace, a trash compactor, a smoke detector, a light fixture, or a dehumidifier.

419. The method according to claim 410, wherein the appliance is a battery-operated portable electronic device, and the appliance is a notebook, a laptop computer, a media player, a cellular phone, a Personal Digital Assistant (PDA), an image processing device, a digital camera, a video recorder, or a handheld computing device.

420. The method according to claim 410, wherein the integration involves sharing a component.

421. The method according to claim 420, wherein the integration involves housing in same enclosure, sharing same processor, or mounting onto same surface.

422. The method according to claim 420, wherein the integration involves sharing a same connector.

423. The method according to claim 422, wherein the connector is a power connector for connecting to a power source, and wherein the integration involves sharing the same connector for being powered from same power source, or wherein the integration involves sharing same power supply.

424. The method according to claim 240, wherein the measuring of the response time, the comparing, comprises, or any combination thereof, is performed by a device that comprises, or is part of, a vehicular device that is mountable in a vehicle or configured to be used in a vehicle.

425. The method according to claim 424, wherein the vehicle comprises, is part of, or consists of, a ground vehicle adapted to travel on land.

426. The method according to claim 425, wherein the ground vehicle comprises, is part of, or consists of, a bicycle, a car, a motorcycle, a train, an electric scooter, a subway, a train, a trolleybus, a tram, or any combination thereof.

427. The method according to claim 424, wherein the vehicle comprises, is part of, or consists of, a buoyant or submerged watercraft adapted to travel on or in water.

428. The method according to claim 427, wherein the watercraft comprises, is part of, or consists of, a ship, a boat, a hovercraft, a sailboat, a yacht, a submarine, or any combination thereof.

429. The method according to claim 424, wherein the vehicle comprises, is part of, or consists of, an aircraft adapted to fly in air.

430. The method according to claim 429, wherein the aircraft comprises, is part of, or consists of, a fixed wing or a rotorcraft aircraft.

431. The method according to claim 429, wherein the aircraft comprises, is part of, or consists of an airplane, a spacecraft, a glider, a drone, an Unmanned Aerial Vehicle (UAV), or any combination thereof.

432. The method according to claim 424, wherein the vehicle communicates using, compatible with, or based on, a Dedicated Short-Range Communication (DSRC) or IEEE 802.1 Ip standard.

433. The method according to claim 240, wherein the measuring of the response time, the comparing, comprises, or any combination thereof, is performed by a device that comprises, or is part of, comprises, or consists of, a client device.

434. The method according to claim 433, further comprising storing, operating, or using, by the client device, a client operating system.

435. The method according to claim 434, wherein the client operating system consists of, comprises, or is based on, Microsoft Windows 7, Microsoft Windows XP, Microsoft Windows 8, Microsoft Windows 8.1, Linux, or Google Chrome OS.

436. The method according to claim 434, wherein the client operating system is a Real-Time Operating System (RTOS).

437. The method according to claim 436, wherein the RTOS comprises FreeRTOS, SafeRTOS, QNX, VxWorks, or Micro-Controller Operating Systems (pC / OS).

438. The method according to claim 433, further comprising storing, operating, or using, by the client device, a web browser.

439. The method according to claim 438, wherein the web browser consists of, comprises, or is based on, Microsoft Internet Explorer, Google Chrome, Opera™, or Mozilla Firefox®.

440. The method according to claim 438, wherein the web browser is a mobile web browser.

441. The method according to claim 440, wherein the mobile web browser consists of, comprises, or is based on, Safari, Opera Mini™, or Android web browser.

442. The method according to claim 433, wherein the client device comprises, is part of, or consists of, a client device in a client / server architecture.

443. The method according to claim 433, wherein the client device is housed in a single enclosure that is a hand-held enclosure or a portable enclosure.

444. The method according to claim 433, wherein the client device consists of, comprises, is part of, or is integrated with, a notebook computer, a laptop computer, a media player, a Digital Still Camera (DSC), a Digital video Camera (DVC or digital camcorder), a Personal Digital Assistant (PDA), a cellular telephone, a digital camera, a video recorder, or a smartphone.

445. The method according to claim 433, wherein the client device consists of, comprises, is part of, or is integrated with, a smartphone that comprises, or is based on, an Apple iPhone 6 or a Samsung Galaxy S6.

446. The method according to claim 433, wherein the client device comprises, consists of, or is based on, a consumer computer that is owned, operated, or used, by a user for a personal, social, family, or household use.

447. The method according to claim 240, wherein the measuring of the response time, the comparing, comprises, or any combination thereof, is performed by a device that comprises, or is part of, comprises, is integrated with, or consists of, a Layer-3 (Internet Protocol-IP) networking device that forwards Internet Protocol (IP) packets between its ports or connections.

448. The method according to claim 447, wherein the Layer-3 (Internet Protocol-IP) networking device comprises, is part of, or is integrated with, a router, a gateway, a residential gateway, a firewall, or any combination thereof.

449. The method according to claim 240, wherein the measuring of the response time, the comparing, comprises, or any combination thereof, is performed by a device that comprises, is part of, or consists of, a server device that is not a client device.

450. The method according to claim 448, wherein the server device is a dedicated device that manages network resoucres; is not a client device and is not a consumer device; is continuously online with greater availability and maximum up time to receive requests almost all of the time efficiently processes multiple requests from multiple client devices at the same time; generates various logs associated with the client devices and traffic from / to the client devices; primarily interfaces and responds to requests from client devices; has greater fault tolerance and higher reliability with lower failure rates; provides scalability for increasing resources to serve increasing client demands; or any combination thereof.

451. The method according to claim 448, wherein the server device is virtualized, wherein the virtualization is executed as part of a Virtual Machine (VM).

452. The method according to claim 451, for use with a host computer that implement the VM, wherein the method further comprising executing, by the host computer, a hypervisor or a Virtual Machine Monitor (VMM).

453. The method according to claim 451, wherein the virtualization includes, is based on, or uses, full virtualization, para- virtualization, or hardware assisted virtualization.

454. The method according to claim 448, wherein the server device consists of, includes, is part of, or is integrated with, a proxy server.

455. The method according to claim 454, wherein the proxy server consists of, includes, is part of, or is integrated with, a Data Center (DC) proxy server.

456. The method according to claim 454, wherein the proxy server consists of, includes, is part of, or is integrated with, an HTTP proxy server, a web-proxy server, a caching proxy, an open- source caching proxy server, a cloud-based proxy server, an open proxy server, a forwarding proxy server, a reverse proxy server, a transparent proxy server, a non-transparent proxy server, an anonymous proxy server, a translation proxy server, a SOCKS proxy server, a CGI web proxy server, a suffix proxy server, an I2P anonymous proxy server, a DNS proxy server, or any combination thereof.

457. The method according to claim 448, further comprising storing, operating, or using, by the server device, a server operating system.

458. The method according to claim 457, wherein the server operating system consists of, comprises, or based on, Microsoft Windows Server®, Linux, or UNIX.

459. The method according to claim 457, wherein the server operating system consists of, comprises, or based on, Microsoft Windows Server® 2003 R2, 2008, 2008 R2, 2012, or 2012 R2 variant, Linux™ or GNU / Linux based Debian GNU / Linux, Debian GNU / kFreeBSD, Debian GNU / Hurd, Fedora™, Gentoo™, Linspire™, Mandriva, Red Hat® Linux, SuSE, Ubuntu®, UNIX® variant Solaris™, AIX®, Mac™ OS X, FreeBSD®, OpenBSD, or NetBSD®.

460. The method according to claim 240, further comprising identifying the first sequence in a second sequence that are addressed to the web server.

461. The method according to claim 460, wherein the identifying comprises identifying requests that are addressed to, or comprises, a hostname of the web server, a domain name, an IP address of the web server, or a URL structure.

462. The method according to claim 460, wherein the identifying comprises obtaining an IP address of the web server using a Domain Name System (DNS) mechanism.

463. The method according to claim 460, wherein the identifying comprises identifying URLs having a specific structure.

464. A non-transitory computer readable medium containing computer instructions that, when executed by a computer processor, cause the processor to perform at least part of the steps of claim 240.

465. A non-transitory computer readable medium containing computer instructions that, when e executed by a computer processor, cause the processor to perform all of the steps of claim 240.

466. The method according to claim 240, wherein at least part of steps of claim 240 are included in a Software Development Kit (SDK) that is provided as a non-transitory computer readable medium containing computer instructions, and wherein the method further comprising installing the SDK.

467. A method for reducing a work-load of a web server that stores a group of content items that are each identified by a respective content item identifier, for use with a first sequence of requests for content items in the group, each of the requests in the first sequence comprises a respective content item identifier, the first sequence comprises a first part of the first sequence followed by a second part of the first sequence, the method comprising: sending, by a first device to the web server over the Internet, the first part of the first sequence of requests; receiving, by the first device from the web server over the Internet, content items, in response to the sending of the first part of the first sequence of requests; estimating, a first work load of the web server using, or based on, monitoring at least part of the sending of the first part of the first sequence, at least part of the receiving of the content items, or any combination thereof; estimating, a second work load of the web server, based on, using, or in response to, measuring a response time of the web server; estimating, a correlation value between the estimated first and second work-loads; comparing the estimated correlation value to a correlation threshold value; responsive to the estimated correlation value being lower than the correlation threshold value, sending, by the first device to the web server over the Internet, the second part of the first sequence of requests; and responsive to the estimated correlation value being higher than the correlation threshold value, sending, by the first device to the web server over the Internet, the second part of the first sequence of requests, while blocking at least part of the second part of the first sequence of requests.

468. The method according to claim 467, wherein the first or second work load comprises, is based on, represents, or is a function of, a number of requests received by the web server per second, a latency response time a connection or for a received request by the web server, a throughput of the web server for a file size, for a cached content, or non-cached content, or any combination thereof.

469. The method according to claim 467, wherein the first or second work load comprises, is based on, represents, or is a function of, an amount of load in form of client requests, processing, and communications resources expected in a specified time period.

470. The method according to claim 467, further configured so that the web server does not detect the first device as a hostile device or as a Denial-of-Service (DoS) or Distributed- Denial-of- Service (DDoS) attacking device.

471. The method according to claim 467, wherein the first work load comprises, represents, or is in response to, a work load caused at the web server due to the receiving and responding to the first part of the first sequence of requests.

472. The method according to claim 467, further preceded by identifying, at the first device, the first sequence of requests for content items in the group.

473. The method according to claim 472, wherein the identifying comprises receiving, by the first device from a second device over the Internet, the first sequence of requests for content items in the group.

474. The method according to claim 473, further comprising sending, by the first device to the second device over the Internet, the received content items, in response to the receiving of the content items.

475. The method according to claim 473, wherein the second device comprises a client device, or wherein the second device comprises a server device that is a Super Proxy server or a Tunnel bank server.

476. The method according to claim 467, wherein the comparing comprises determining whether the estimated correlation value is lower than, or higher than, the correlation threshold value.

477. The method according to claim 467, wherein the first sequence comprises a series of requests in a chronological order.

478. The method according to claim 467, wherein the first work load is a function of the monitoring of the first part of the first sequence, or wherein the second work load is a function of the measured response time.

479. The method according to claim 478, wherein the function is based on, uses, or comprises, a discrete, continuous, monotonic, non-monotonic, elementary, algebraic, linear, polynomial, quadratic, Cubic, Nth-root based, exponential, transcendental, quintic, quartic, logarithmic, hyperbolic, or trigonometric function.

480. The method according to claim 467, wherein the measuring of the response time comprises: sending, to the web server, a first request; receiving, from the web server, a first response to the sent first request; and measuring or metering a time difference between the sending of the first request and the receiving of the first response,wherein the response time is based on, uses, or is a function of, the measured or metered time difference.

481. The method according to claim 480, wherein the sending of the first request to the web server comprises sending, to the web server via a second device, of the first request, and wherein the receiving from the web server of the first response comprises receiving, from the web server via the second device, of the first response.

482. The method according to claim 481, further comprising selecting of the second device from a group of client devices.

483. The method according to claim 482, further comprising associating, for each of the client devices in the group, a geographical location, and wherein the selecting is based on, or according to, the geographical location associated with the selected second device.

484. The method according to claim 483, wherein the selecting is based on the geographical location being the same as an estimated location of the web server or of the first device.

485. The method according to claim 483, wherein the geographical location comprises a country, a state, a region, a city, a postal / zip code, a latitude, a longitude, a Timezone, or any combination thereof.

486. The method according to claim 483, wherein the associating is based on, or uses, IP geolocation.

487. The method according to claim 486, wherein the geolocation is based on W3C Geolocation Application Programming Interface (API).

488. The method according to claim 481, wherein the second device comprises a proxy server or a Data Center (DC)-based proxy server.

489. The method according to claim 488, wherein the proxy server or the Data Center (DC)-based proxy server stores a list of IP addresses, and the method further comprises selecting an IP address from the list, and using the selected IP address as a source address when sending the first request to the web server.

490. The method according to claim 489, further comprising associating, for each of the IP addresses in the list, a geographical location, and wherein the selecting is based on, or according to, the geographical location associated with the selected second device.

491. The method according to claim 490, wherein the selecting is based on the geographical location being the same as an estimated location of the web server or of the first device.

492. The method according to claim 490, wherein the geographical location comprises a country, a state, a region, a city, a postal / zip code, a latitude, a longitude, a Timezone, or any combination thereof.

493. The method according to claim 490, wherein the associating is based on, or uses, IP geolocation.

494. The method according to claim 493, wherein the geolocation is based on W3C Geolocation Application Programming Interface (API).

495. The method according to claim 480, wherein the measuring of the response time further comprises initiating a timer in response to, or during, the sending of the first request; and stopping the timer in response to, or during, the receiving of the first response.

496. The method according to claim 480, wherein the measuring of the response time further comprises a first timestamping in response to, or during, the sending of the first request; and a second timestamping in response to, or during, the receiving of the first response, wherein the response time is calculated based on, according to, or in response to, the time difference between the first and second timestampings.

497. The method according to claim 496, wherein the first or second timestamping is based on, or is according to, an Internet Engineering Task Force (IETF) Request for Comments (RFC) 9557 or ISO 8601-1:2019.

498. The method according to claim 480, wherein the measuring or metering of the time difference comprises measuring or metering of the time difference between a first bit, a first packet, a last bit, or a last packet of the sent first request, and a first bit, a first packet, a last bit, or a last packet of the received first response.

499. The method according to claim 480, wherein the web server comprises a first content that is identified by a Uniform Resource Eocator (URE) and that comprises a web page or a part thereof, or a HyperText Markup Language (HTML) object or a part thereof, wherein the request is a Hypertext Transfer Protocol (HTTP) or Hypertext Transfer Protocol Secure (HTTPS) request that comprises the URL, and wherein the first response comprises the first content or a part thereof.

500. The method according to claim 467, wherein the estimating of the second work load or the measuring of the response time is performed in whole or in part during, or in parallel with, the sending of the first part of the first sequence of requests, during the receiving of the content items, or any combination thereof.

501. The method according to claim 467, wherein the estimating of the second work load or the measuring of the response time is performed in whole or in part during, or in parallel with, the estimating of the first work load.

502. The method according to claim 467, wherein the measuring of the response time comprises repeating the measuring N times, and calculating an average response time of the repeated measurings.

503. The method according to claim 502, wherein the number N is at least 2, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, or 200.

504. The method according to claim 502, wherein the number N is less than 3, 4, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, or 500.

505. The method according to claim 467, wherein the estimating of the second work load or the measuring of the response time is continuously performed.

506. The method according to claim 467, wherein the measuring of the response time comprises repetitively measuring of the response time.

507. The method according to claim 506, wherein a time period between any two consecutive measuring of the response time is at least 1, 2, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, or 10,000 milliseconds or seconds.

508. The method according to claim 506, wherein the time period between any two consecutive measuring of the response time is less than 2, 3, 4, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, 10,000 or 20,000 milliseconds or seconds.

509. The method according to claim 467, wherein the measuring of the response time comprises, is based on, or is a function of, measuring of a Round-Trip delay Time (RTT).

510. The method according to claim 509, wherein the measuring of the RTT uses, is based on, or is according to, a part of, or whole of, IETF RFC 2681, IETF RFC 6323, IETF RFC 7982, or any combination thereof.

511. The method according to claim 509, wherein the measuring of the RTT comprises, uses, is based on, or is according to, sending of a ‘Ping’ or of an Internet Control Message Protocol (ICMP) echo request.

512. The method according to claim 467, further comprising smoothing the estimated second work load or the measured response time.

513. The method according to claim 512, wherein the smoothing is based on, uses, or is according to, a moving average technique, that is based on, uses, or is according to, a Simple Moving Average (SMA), a Cumulative Average (CA), a Weighted Moving Average (WMA), or any combination thereof.

514. The method according to claim 512, wherein the smoothing is based on, uses, or is according to, an exponential smoothing, that is based on, uses, or is according to, an Exponential Moving Average (EMA), a Double exponential smoothing, a Triple exponential smoothing, or any combination thereof.

515. The method according to claim 467, wherein the estimating of the correlation value comprises, or is based on, calculating a correlation coefficient value that corresponds to, orrepresents, a degree of mutual relationship, similarity, or connection, between the estimated first and second work-loads, or any function thereof.

516. The method according to claim 515, wherein the estimating of the correlation value comprises, or is based on, calculating a correlation coefficient value between an increase or increasing rate of the estimated first and second work-loads, or any function thereof.

517. The method according to claim 515, wherein the estimating of the first work load comprises generating a first sequence of first work load estimation values, wherein the estimating of the second work load comprises generating a second sequence of second work load or response time estimation values, and wherein the estimating of the correlation value comprises, or is based on, calculating the correlation coefficient value between the first and second values sequences.

518. The method according to claim 517, wherein the number of values in the first or second sequence is equal to, or higher than, 2, 4, 5, 10, 12, 15, 20, 30, 50, 80, 100, 120, 150, 200, 500, or 1,000 values.

519. The method according to claim 517, wherein the number of values in the first or second sequence is equal to, or less than, 3, 4, 5, 10, 12, 15, 20, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, or 2,000 values.

520. The method according to claim 517, wherein the first or second sequence comprises values estimated or calculated at least 1, 2, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, or 10,000 milliseconds, seconds, or minutes, before the estimating of the correlation value.

521. The method according to claim 517, wherein the first or second sequence comprises values estimated or calculated less than 2, 3, 4, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, 10,000 or 20,000 milliseconds, seconds, or minutes, before the estimating of the correlation value.

522. The method according to claim 515, wherein the correlation coefficient value comprises, is based on, or is a function of, the Pearson Correlation Coefficient (PCC).

523. The method according to claim 515, wherein the correlation coefficient value comprises, is based on, or is a function of, a rank correlation.

524. The method according to claim 523, wherein the correlation coefficient value comprises, is based on, or is a function of, the Spearman's rank correlation coefficient, the Kendall tau rank correlation coefficient, the Goodman and Kruskal's gamma, or any combination thereof.

525. The method according to claim 515, wherein the correlation coefficient value or an absolute function thereof is limited to possible values between 0 and 1, where 0 represents no correlation and 1 represents a perfect positive or negative correlation.

526. The method according to claim 515, wherein the correlation threshold value is equal or higher than 0.2, 0.3, 0.4, 0.5, 0.55, 0.6, 0.65, 0.7, 0.75, 0.8, 0.85, 0.9, or 0.95.

527. The method according to claim 515, wherein the correlation threshold value is equal or less than 0.3, 0.4, 0.5, 0.55, 0.6, 0.65, 0.7, 0.75, 0.8, 0.85, 0.9, 0.95, or 0.97.

528. The method according to claim 515, further comprising normalizing the values of the estimated first and second work-loads by dividing the respective values by a maximum value in a time-interval or in a respective sequence of values, wherein the correlation coefficient value comprises, is based on, or is a function of, the average differences of the normalized values being subtracted from 1.

529. The method according to claim 467, wherein the steps are repeated for at least an additional sequence of requests for content items in the group, each of the requests in the additional sequence comprises a respective content item identifier, the additional sequence comprises a first part of the additional sequence followed by a second part of the additional sequence.

530. The method according to claim 529, wherein the steps are immediately repeated.

531. The method according to claim 529, wherein the steps are repeated at least 2, 3, 4, 5, 10, 15,20, 100, 120, 150, 200, 500, or 1000 times.

532. The method according to claim 529, wherein the steps are repeated after a wait time.

533. The method according to claim 532, wherein the wait time is at least 1, 2, 5, 8, 10, 12, 15,20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, or 10,000 milliseconds, seconds, minutes, hours or days.

534. The method according to claim 532, wherein the wait time is less than 2, 3, 4, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, 10,000 or 20,000 milliseconds, seconds, minutes, hours, or days.

535. The method according to claim 532, wherein the blocking comprises blocking of the requests or packets in the second sequence during a first time-interval, and wherein the wait time is at least 0.001, 0.002, 0.003, 0.005, 0.008, 0.01, 0.02, 0.03, 0.05, 0.07, 0.1, 0.2, 0.3, 0.5, 0.7, 1, 2, 3, 5, 7, 10, 20, 30, 50, 70, 100, 200, 300, 500, 700, or 1000 times the first time-interval.

536. The method according to claim 532, wherein the blocking comprises blocking of the requests or packets in the second sequence during a first time-interval, and wherein the wait time is less than 0.001, 0.002, 0.003, 0.005, 0.008, 0.01, 0.02, 0.03, 0.05, 0.07, 0.1, 0.2, 0.3, 0.5, 0.7, 1, 2, 3, 5, 7, 10, 20, 30, 50, 70, 100, 200, 300, 500, 700, or 1000 times the first time-interval.

537. The method according to claim 467, further for use with a second sequence of requests for content items in the group, each of the requests in the second sequence comprises a respectivecontent item identifier, the second sequence comprises a first part of the second sequence followed by a second part of the second sequence, the method further comprising: sending, by the first device to the web server over the Internet, the first part of the second sequence of requests; receiving, by the first device from the web server over the Internet, content items, in response to the sending of the first part of the second sequence of requests; estimating, an additional first work load of the web server using, or based on, monitoring at least part of the sending of the first part second sequence, at least part of the receiving of the content items, or any combination thereof; estimating, an additional second work load of the web server, based on, using, or in response to, measuring an additional response time of the web server; estimating, an additional correlation value between the estimated additional first and second work-loads; comparing the estimated additional correlation value to the correlation threshold value; responsive to the estimated additional correlation value being lower than the correlation threshold value, sending, by the first device to the web server over the Internet, the second part of the second sequence of requests; and responsive to the estimated additional correlation value being higher than the correlation threshold value, sending, by the first device to the web server over the Internet, the second part of the first sequence of requests, while blocking at least part of the second part of the second sequence of requests.

538. The method according to claim 537, wherein the sending of the first part of the second sequence is performed after the sending or blocking of at least part of the requests of the first sequence.

539. The method according to claim 538, wherein the sending of the first part of the second sequence is performed immediately after the sending or blocking of at least part of the requests of the first sequence.

540. The method according to claim 538, wherein the sending of the first part of the second sequence is performed after a wait time after the sending or blocking of at least part of the requests of the first sequence.

541. The method according to claim 540, wherein the wait time is at least 1, 2, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, or 10,000 milliseconds, seconds, minutes, hours or days.

542. The method according to claim 540, wherein the wait time is less than 2, 3, 4, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, 10,000 or 20,000 milliseconds, seconds, minutes, hours, or days.

543. The method according to claim 540, wherein the blocking comprises blocking of the requests or packets in the second part of the second sequence during a first time-interval, and wherein the wait time is at least 0.001, 0.002, 0.003, 0.005, 0.008, 0.01, 0.02, 0.03, 0.05, 0.07, 0.1, 0.2, 0.3, 0.5, 0.7, 1, 2, 3, 5, 7, 10, 20, 30, 50, 70, 100, 200, 300, 500, 700, or 1000 times the first timeinterval.

544. The method according to claim 540, wherein the blocking comprises blocking of the requests or packets in the second part of the second sequence during a first time-interval, and wherein the wait time is less than 0.001, 0.002, 0.003, 0.005, 0.008, 0.01, 0.02, 0.03, 0.05, 0.07, 0.1, 0.2, 0.3, 0.5, 0.7, 1, 2, 3, 5, 7, 10, 20, 30, 50, 70, 100, 200, 300, 500, 700, or 1000 times the first timeinterval.

545. The method according to claim 467, wherein the monitoring comprises metering, measuring, calculating, counting, estimating, quantifying, or any combination thereof, a feature or characteristic of the received or sent data during a first time-interval.

546. The method according to claim 545, wherein the first time-interval is at least 1, 2, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, or 10,000 milliseconds, wherein the first time-interval is at least 1, 2, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, or 10,000 seconds, or wherein the first time-interval is at least 1, 2, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, or 10,000 minutes or hours.

547. The method according to claim 545, wherein the first time-interval is less than 2, 3, 4, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, 10,000 or 20,000 milliseconds, wherein the first time-interval is less than 2, 3, 4, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, 10,000 or 20,000 seconds, or wherein the first timeinterval is less than 2, 3, 4, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, 10,000 or 20,000 minutes or hours.

548. The method according to claim 467, wherein the monitoring comprises monitoring that relates to Open Systems Interconnection (OSI) model physical layer.

549. The method according to claim 548, wherein the monitoring comprises a count of all of, or a part of, bits, bytes, or words.

550. The method according to claim 548, wherein the monitoring comprises monitoring of an OSI application-level throughput of a communication, a goodput, or excluding protocol headers or overhead bits.

551. The method according to claim 548, wherein the monitoring comprises a count of a number of bits or bytes, and wherein the first value divided by the first time-interval duration is at least 1, 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, or 1,000,000 Megabit-per- second (Mb / s) or Megabyte-per- second (GB / s), or wherein the first value divided by the first time-interval duration is at least 1, 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, or 1,000,000 Gigabit-per- second (Gb / s) or Gigabyte-per- second (GB / s).

552. The method according to claim 548, wherein the monitoring comprises a count of a number of bits or bytes, and wherein the first value divided by the first time-interval duration is less than 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, 1,000,000 or 2,000,000 Megabit-per- second (Mb / s) or Megab yte-per-second (GB / s), or wherein the monitoring comprises dividing by the first time-interval duration is less than 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, 1,000,000, or 2,000,000 Gigabit-per- second (Gb / s) or Gigabyte-per- second (GB / s).

553. The method according to claim 548, wherein the monitoring comprises a count of a number of bits and an equivalent bit data rate is at least 1, 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, or 1,000,000 Megabit- per-second (Mb / s) or Megabyte-per- second (GB / s), or wherein the monitoring comprises dividing by the first time-interval duration is at least 1, 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, or 1,000,000 Gigabit-per- second (Gb / s), or Gigabyte-per- second (GB / s).

554. The method according to claim 467, wherein the monitoring comprises monitoring that relates to Open Systems Interconnection (OSI) model data link layer, physical layer.

555. The method according to claim 554, wherein the monitoring comprises a count of all of, or a part of, frames or other protocol data units.

556. The method according to claim 555, wherein the monitoring comprises a count of all of, or a part of, Ethernet frames or Point-to-Point Protocol (PPP) frames.

557. The method according to claim 555, wherein the monitoring comprises a count of frames, and wherein the first value divided by the first time-interval duration is at least 1, 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000,500,000, or 1,000,000 Mega frames per second, or wherein the monitoring comprises counting of frames, or wherein the monitoring comprises dividing by the first time-interval duration is at least 1, 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, or 1,000,000 Giga frames per second.

558. The method according to claim 555, wherein the monitoring comprises a count of frames, and wherein the first value divided by the first time-interval duration is less than 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, 1,000,000, or 2,000,000 Mega frames per second, or wherein the monitoring comprises counting of frames, or wherein the monitoring comprises dividing by the first time-interval duration is at least 1, 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, or 1,000,000 Giga frames per second.

559. The method according to claim 555, wherein the monitoring comprises counting of frames, and wherein an equivalent frame rate is at least 1, 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, or 1,000,000 Mega frames per second, or wherein the monitoring comprises counting of frames, and wherein the equivalent frame rate is at least 1, 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, or 1,000,000 Giga frames per second.

560. The method according to claim 467, wherein the monitoring comprises monitoring that relates to Open Systems Interconnection (OSI) model network layer.

561. The method according to claim 560, wherein the monitoring comprises counting of all of, or a part of, packets or IP packets.

562. The method according to claim 561, wherein the monitoring comprises counting of packets, and wherein the monitoring comprises dividing by the first time-interval duration is at least 1, 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, or 1,000,000 Mega packets per second, or wherein the monitoring comprises counting of packets, or wherein the monitoring comprises dividing by the first time-interval duration is at least 1, 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, or 1,000,000 Giga packets per second.

563. The method according to claim 561, wherein the monitoring comprises counting of packets, and wherein the monitoring by the first time-interval duration is less than 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, 1,000,000, or 2,000,000 Mega packets per second, or wherein the monitoring comprises counting of packets, or wherein the monitoring comprises dividing by the first time-interval duration is atleast 1, 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, or 1,000,000 Giga packets per second.

564. The method according to claim 561, wherein the monitoring comprises counting of packets, and wherein an equivalent packets rate is at least 1, 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, or 1,000,000 Mega packets per second, or wherein the monitoring comprises counting of frames, and wherein the equivalent packets rate is at least 1, 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, or 1,000,000 Giga packets per second.

565. The method according to claim 561, wherein the monitoring comprises counting of packets, and wherein an equivalent packets rate is at least 1, 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, or 1,000,000 Mega packets per second, or wherein the monitoring comprises counting of packets, and wherein the equivalent bit data rate is at least 1, 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, or 1,000,000 Giga packets per second.

566. The method according to claim 467, wherein the monitoring comprises monitoring that relates to Open Systems Interconnection (OSI) model transport layer.

567. The method according to claim 566, wherein the monitoring comprises counting of all of, or a part of, existing or used Transmission Control Protocol (TCP), opened TCP connections, or any combination thereof.

568. The method according to claim 567, wherein the monitoring comprises counting of connections, and wherein the first value is at least 1, 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, or 1,000,000 connections.

569. The method according to claim 567, wherein the monitoring comprises counting of connections, and wherein the monitored value is less than 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, 1,000,000, or 2,000,000 connections.

570. The method according to claim 467, wherein the monitoring comprises monitoring that relates to Open Systems Interconnection (OSI) model application layer.

571. The method according to claim 570, wherein the monitoring comprises counting of all of, or a part of, Hypertext Transfer Protocol (HTTP) requests, Hypertext Transfer Protocol Secure(HTTPS) requests, replies to HTTP requests, replies to HTTPS request, or any combination thereof.

572. The method according to claim 571, wherein the monitoring comprises counting of HTTP requests, HTTPS requests, replies to HTTP requests, replies to HTTPS request, or any combination thereof, and wherein the monitored value is at least 1, 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, or 1,000,000 HTTP requests, HTTPS requests, replies to HTTP requests, replies to HTTPS request, or any combination thereof.

573. The method according to claim 571, wherein the monitoring comprises counting of HTTP requests, HTTPS requests, replies to HTTP requests, replies to HTTPS request, or any combination thereof, and wherein the monitored value is less than 2, 3, 5, 10, 20, 30, 50, 100, 200, 500, 1,000, 2,000, 5,000, 10,000, 20,000, 30,000, 50,000, 100,000, 200,000, 500,000, 1,000,000, or 2,000,000 HTTP requests, HTTPS requests, replies to HTTP requests, replies to HTTPS request, or any combination thereof.

574. The method according to claim 467, wherein the monitoring comprises monitoring that relates to Open Systems Interconnection (OSI) model Layer-2 feature or property, OSI Layer-3 feature or property, OSI Application Layer feature or property, OSI Session Layer feature or property, or any combination thereof.

575. The method according to claim 467, further comprising smoothing the estimated first work load or the monitored value.

576. The method according to claim 575, wherein the smoothing is based on, uses, or is according to, a moving average technique, that is based on, uses, or is according to, a Simple Moving Average (SMA), a Cumulative Average (CA), a Weighted Moving Average (WMA), or any combination thereof.

577. The method according to claim 575, wherein the smoothing is based on, uses, or is according to, an exponential smoothing, that is based on, uses, or is according to, an Exponential Moving Average (EMA), a Double exponential smoothing, a Triple exponential smoothing, or any combination thereof.

578. The method according to claim 467, wherein the estimating of the first work load of the web server uses, or is based on, monitoring the at least part of the sending of the first part first sequence.

579. The method according to claim 578, wherein the estimating of the first work load of the web server further uses, or is further based on, monitoring the at least part of the receiving of the content items.

580. The method according to claim 467, wherein the estimating of the first work load of the web server uses, or is further based on, monitoring the at least part of the receiving of the content items.

581. The method according to claim 467, wherein the blocking comprises blocking, delaying, discarding, or dropping of part of the requests or packets in the second part of the first sequence during a first time-interval.

582. The method according to claim 581, wherein the blocked requests or packets in the second part of the first sequence are detected and re-transmitted as part of a protocol.

583. The method according to claim 581, wherein the blocked packets in the second part of the first sequence are detected and re-transmitted as part of a Transmission Control Protocol (TCP).

584. The method according to claim 581, wherein the blocking comprises blocking, delaying, discarding, or dropping of all the requests or packets in the second part of the first sequence during the first time-interval.

585. The method according to claim 581, wherein the first time-interval is at least 1, 2, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, or 10,000 milliseconds.

586. The method according to claim 583, wherein the first time-interval is less than 2, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, 10,000, or 20,000 milliseconds.

587. The method according to claim 581, wherein the first time-interval is at least 1, 2, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, or 10,000 seconds or minutes.

588. The method according to claim 581, wherein the first time-interval is less than 2, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, 10,000, or 20,000 seconds or minutes.

589. The method according to claim 581, wherein the blocking comprises blocking of a part of the requests or packets in the second part of the first sequence during the first time-interval, and sending, by the first device to the web server over the Internet, the requests or packets in the second part of the first sequence that are not blocked or dropped.

590. The method according to claim 589, wherein the blocking is deterministic -based.

591. The method according to claim 590, wherein the blocking comprises blocking of every Nth packet or request in the second part of the first sequence.

592. The method according to claim 591, wherein N is more than, or equal to, 2, 3, 4, 5, 6, 7, 8, 9,10, 11, 12, 15, 18, 20, 22, 25, 30, 35, 40, 45, 50, 55, 60, 65, 70, 75, 80, 85, 90, 95, or 100.

593. The method according to claim 591, wherein N is less than, or equal to, 3, 4, 5, 6, 7, 8, 9, 10,11, 12, 15, 18, 20, 22, 25, 30, 35, 40, 45, 50, 55, 60, 65, 70, 75, 80, 85, 90, 95, 100, 150, or 200.

594. The method according to claim 589, wherein the blocking comprises blocking above 0.01%, 0.02%, 0.03%, 0.05%, 0.07%, 0.1%, 0.2%, 0.3%, 0.5%, 1%, 2%, 3%, 5%, 7%, 10%, 12%, 15%, 20%, 25%, 30%, 35%, 40%, 45%, 50%, 55%, 60%, 65%, 70%, 75%, 80%, 85%, 90%, or 95% of the packets or requests in the second part of the first sequence.

595. The method according to claim 589, wherein the blocking comprises blocking less than 0.02%, 0.03%, 0.05%, 0.07%, 0.1%, 0.2%, 0.3%, 0.5%, 1%, 2%, 3%, 5%, 7%, 10%, 12%, 15%, 20%, 25%, 30%, 35%, 40%, 45%, 50%, 55%, 60%, 65%, 70%, 75%, 80%, 85%, 90%, 95%, or 99% of the packets or requests in the second part of the first sequence.

596. The method according to claim 589, wherein the blocking is random-based.

597. The method according to claim 596, further comprising generating, using a random number generator, a random number in a range, for each of the packets or requests in the second part of the first sequence.

598. The method according to claim 597, for use with a value in the range, and wherein each of the packs or requests is blocked, discarded, or dropped in response to the associated random number being above or below the value.

599. The method according to claim 597, wherein the random number is generated using, or based on, a random or quazi-random process.

600. The method according to claim 597, wherein the random number generator is hardwarebased that uses, or is based on, thermal noise, shot noise, nuclear decaying radiation, photoelectric effect, or quantum phenomena.

601. The method according to claim 597, wherein the random number generator is software-based that uses, or is based on, executing an algorithm for generating pseudo-random numbers.

602. The method according to claim 589, wherein the number of blocked packets or requests is based on, uses, is a function of, or is responsive to, a threshold value.

603. The method according to claim 589, wherein the threshold value is based on, a function of, or in response to, the estimated second work load or the measured response time.

604. The method according to claim 589, wherein the number of blocked packets or requests is based on, uses, is a function of, or is responsive to, a difference between a threshold value and a monitored value.

605. The method according to claim 589, wherein the web server is associated with an additional threshold value, and wherein the number of blocked packets or requests is based on, uses, is a function of, or is responsive to, the additional threshold value.

606. The method according to claim 589, wherein the number of blocked, discarded, delayed, or dropped packets is configured so that the web server does not detect the first device as a hostiledevice or as a Denial-of-Service (DoS) or Distributed- Denial-of-Service (DDoS) attacking device.

607. The method according to claim 467, wherein at least one request, or all of the requests, in the first sequence, comprise, or consist of, a Hypertext Transfer Protocol (HTTP) request.

608. The method according to claim 607, wherein at least one HTTP request, or all of the HTTP requests, comprise, or consist of, a Hypertext Transfer Protocol Secure (HTTPS) request.

609. The method according to claim 607, wherein at least one HTTP request, or all of the HTTP requests, are based on, or use, HTTP / 1.1, HTTPS, HTTP / 2, HTTP / 3, or any combination thereof.

610. The method according to claim 467, wherein one of, few of, or all of, the content items in the group comprises, or consists of, a HyperText Markup Language (HTML) object, a web-page, a web-site, or any combination thereof.

611. The method according to claim 467, wherein one of, few of, or all of, the content items in the group comprises, or consists of, a part or whole of a program or data file, text data, audio data, voice data, multimedia data, video data, an image, music data, or any combination thereof.

612. The method according to claim 467, wherein one of, few of, or all of, the content item identifiers comprise, or consist of, a Uniform Resource Locator (URL), a Uniform Resource Identifier (URI), an IP address, a domain name, a website name, or any combination thereof.

613. The method according to claim 467, for use with a second sequence of requests for content items in the group, each of the requests in the second sequence comprises a respective content item identifier, the second sequence comprises a first part of the first sequence followed by a second part of the second sequence, the method further comprising: sending, by a second device to the web server over the Internet, the first part of the second sequence of requests, in response to the identifying of at least part of the second sequence; and receiving, by the second device from the web server over the Internet, content items, in response to the sending of the first part of the second sequence of requests.

614. The method according to claim 613, wherein the sending by the second device of the first part of the second sequence of requests is at least in part in parallel to the sending by the first device of the first part of the first sequence of requests.

615. The method according to claim 613, further preceded by identifying, at the second device, the second sequence of requests for content items in the group.

616. The method according to claim 615, wherein the identifying comprises receiving, by the second device over the Internet, the second sequence of requests for content items in the group.

617. The method according to claim 615, further comprising sending, by the second device over the Internet, the received content items, in response to the receiving of the content items.

618. The method according to claim 613, wherein the estimating of the first work load comprises monitoring at least part of the sending of the first part of the second sequence, at least part of the receiving of the content items that is in response to the sending of the first part of the second sequence, or any combination thereof.

619. The method according to claim 618, further comprising: responsive to the estimated correlation value being lower than the correlation threshold value, sending, by the second device to the web server over the Internet, the second part of the second sequence of requests; and responsive to the estimated correlation value being higher than the correlation threshold value, sending, by the second device to the web server over the Internet, the second part of the second sequence of requests, while blocking at least part of the second part of the second sequence of requests.

620. The method according to claim 613, for use with a third sequence of requests that comprises the first and second sequences of requests, the method further comprising: identifying, by a third device, the third sequence of requests; identifying, by the third device, the first and second sequences of requests in the third sequence; sending, by the third device to the first device over the Internet, the first sequence; receiving, by the first device from the third device over the Internet, the sent first sequence; sending, by the third device to the second device over the Internet, the second sequence; and receiving, by the second device from the third device over the Internet, the sent second sequence, wherein the sending, by the first device of the first part of the first sequence of requests is in response to the receiving of the sent first sequence by the first device, and wherein the sending, by the second device of the first part of the second sequence of requests is in response to the receiving of the sent second sequence by the second device.

621. The method according to claim 620, wherein the identifying by the third device of the third sequence of requests comprises receiving, by the third device over the Internet, the third sequence of requests.

622. The method according to claim 620, wherein the blocking of at least part of the second part of the first sequence or a blocking of the second part of the second sequence is performed by the third device.

623. The method according to claim 620, wherein the identifying by the third device of the first and second sequences of requests in the third sequence comprises splitting or demultiplexing the third sequence into the first and second sequences by a multiplexer in the third device.

624. The method according to claim 623, wherein the splitting or demultiplexing is based on load balancing or wherein the first and second sequences are evenly split from the third sequence.

625. The method according to claim 620, wherein the estimating of the first or second work load is performed by the third device.

626. The method according to claim 620, wherein the estimating of the correlation value is performed by the third device.

627. The method according to claim 620, wherein the comparing is performed by the third device.

628. The method according to claim 467, for use with multiple devices that comprises the first device and respective multiple distinct sequences of requests for content items in the group that comprises the first sequence, each of the requests in the multiple sequences comprises a respective content item identifier, each of the multiple sequences comprises a first part of the respective sequence followed by a second part of the respective sequence, the method by each of the multiple devices comprises: sending, by the respective device from the multiple devices to the web server over the Internet, the first part of the respective sequence of requests; and receiving, by the respective device from the multiple devices from the web server over the Internet, content items, in response to the respective sending of the first part of the respective sequence of requests.

629. The method according to claim 628, wherein the number of multiple devices is equal or higher than 1, 2, 4, 5, 10, 12, 15, 20, 30, 50, 80, 100, 120, 150, 200, 500, or 1,000.

630. The method according to claim 628, wherein the number of multiple devices is equal or less than 3, 4, 5, 10, 12, 15, 20, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, or 2,000.

631. The method according to claim 628, further preceded by identifying, at the third device, the multiple sequences of requests for content items in the group.

632. The method according to claim 631 , wherein the identifying comprises receiving, by the third device over the Internet, the multiple sequences of requests for content items in the group.

633. The method according to claim 631, further comprising sending, by each of the multiple devices to the third device over the Internet, the received content items, in response to the receiving of the content items.

634. The method according to claim 628, wherein the estimating of the first work load comprises monitoring the aggregation of responding to the first part of the multiple sequences of requests, the responding to the first part of the multiple sequences of requests, or any combination thereof.

635. The method according to claim 467, wherein the estimating of the second work load or the measuring of the response time is performed by a second device that is distinct or different from the first device.

636. The method according to claim 635, further comprising sending, by the second device over the Internet, the estimated second work load or the measured response time.

637. The method according to claim 636, wherein the sending by the second device comprises sending to the first device.

638. The method according to claim 635, wherein the estimating of the correlation value is performed by the second device.

639. The method according to claim 638, further comprising receiving, by the second device over the Internet, the estimated first work load.

640. The method according to claim 638, wherein the comparing is performed by the second device.

641. The method according to claim 640, further comprising sending, by the second device over the Internet, a first command responsive to the estimated correlation value being lower than the correlation threshold value.

642. The method according to claim 641, wherein the sending, by the first device to the web server over the Internet, of the second part of the first sequence of requests, is in response to the sending of the first command.

643. The method according to claim 640, further comprising sending, by the second device over the Internet, a first command responsive to the estimated correlation value being higher than the correlation threshold value.

644. The method according to claim 643, wherein the sending, by the first device to the web server over the Internet, of the second part of the first sequence of requests, while blocking at least part of the second part of the first sequence of requests, is in response to the sending of the first command.

645. The method according to claim 635, wherein the second device comprises a server device.

646. The method according to claim 645, wherein the server device is a cloud-based server that is implemented as an Infrastructure-as-a-Service (laaS) or as a Software-as-a-Service (SaaS) by a public cloud-based service.

647. The method according to claim 646, wherein the public cloud-based service is provided by Amazon Web Services® (AWS®), Microsoft® Azure™, or Google® Compute Engine™ (GCP).

648. The method according to claim 645, wherein the first device is storing, operating, or using, a server operating system.

649. The method according to claim 648, wherein the server operating system consists of, comprises, or based on, Microsoft Windows Server®, Linux, or UNIX.

650. The method according to claim 648, wherein the server operating system consists of, comprises, or based on, Microsoft Windows Server® 2003 R2, 2008, 2008 R2, 2012, or 2012 R2 variant, Linux™ or GNU / Linux based Debian GNU / Linux, Debian GNU / kFreeBSD, Debian GNU / Hurd, Fedora™, Gentoo™, Linspire™, Mandriva, Red Hat® Linux, SuSE, Ubuntu®, UNIX® variant Solaris™, AIX®, Mac™ OS X, FreeBSD®, OpenBSD, or NetBSD®.

651. The method according to claim 645, wherein the server device is virtualized virtualization executed as part of a Virtual Machine (VM).

652. The method according to claim 651, for use with a host computer that implements the VM, wherein the method further comprising executing, by the host computer, a hypervisor or a Virtual Machine Monitor (VMM).

653. The method according to claim 651, wherein the virtualization includes, is based on, or uses, full virtualization, para- virtualization, or hardware assisted virtualization.

654. The method according to claim 645, wherein the second device consists of, includes, is part of, or is integrated with, a proxy server.

655. The method according to claim 654, wherein the proxy server consists of, includes, is part of, or is integrated with, a Data Center (DC) proxy server.

656. The method according to claim 654, wherein the proxy server consists of, includes, is part of, or is integrated with, an HTTP proxy server, a web-proxy server, a caching proxy, an open- source caching proxy server, a cloud-based proxy server, an open proxy server, a forwarding proxy server, a reverse proxy server, a transparent proxy server, a non-transparent proxy server, an anonymous proxy server, a translation proxy server, a SOCKS proxy server, a CGI web proxy server, a suffix proxy server, an I2P anonymous proxy server, a DNS proxy server, or any combination thereof.

657. The method according to claim 467, wherein the estimating of the first work load or the monitoring is performed by the first device.

658. The method according to claim 657, further comprising sending, by the first device over the Internet, the estimated first work load or of a monitored value.

659. The method according to claim 657, wherein the estimating of the correlation value is performed by the first device.

660. The method according to claim 659, further comprising receiving, by the first device over the Internet, the estimated second work load or the measured response time.

661. The method according to claim 659, wherein the comparing is performed by the first device.

662. The method according to claim 467, wherein the comparing is performed by a second device distinct from the first device.

663. The method according to claim 662, further comprising sending, by the second device to the first device over the Internet, a first command responsive to the estimated correlation value being lower than the correlation threshold value.

664. The method according to claim 663, wherein the sending, by the first device to the web server over the Internet, of the second part of the first sequence of requests, is in response to the sending of the first command.

665. The method according to claim 662, further comprising sending, by the second device to the first device over the Internet, a first command responsive to the estimated correlation value being higher than the correlation threshold value.

666. The method according to claim 665, wherein the sending, by the first device to the web server over the Internet, of the second part of the first sequence of requests, while blocking at least part of the second part of the first sequence of requests, is in response to the sending of the first command.

667. The method according to claim 467, wherein the first device comprises, or consists of, a client device that is not a server device.

668. The method according to claim 667, further comprising storing, operating, or using, by the first device, a client operating system.

669. The method according to claim 668, wherein the client operating system consists of, comprises, or is based on, Microsoft Windows 203, Microsoft Windows XP, Microsoft Windows 8, Microsoft Windows 8.1, Linux, or Google Chrome OS.

670. The method according to claim 668, wherein the client operating system is a Real-Time Operating System (RTOS).

671. The method according to claim 670, wherein the RTOS comprises FreeRTOS, SafeRTOS, QNX, VxWorks, or Micro-Controller Operating Systems (pC / OS).

672. The method according to claim 667, further comprising storing, operating, or using, by the first device, a web browser.

673. The method according to claim 672, wherein the web browser consists of, comprises, or is based on, Microsoft Internet Explorer, Google Chrome, Opera™, or Mozilla Firefox®.

674. The method according to claim 672, wherein the web browser is a mobile web browser.

675. The method according to claim 674, wherein the mobile web browser consists of, comprises, or is based on, Safari, Opera Mini™, or Android web browser.

676. The method according to claim 667, wherein the client device comprises, is part of, or consists of, a client device in a client / server architecture.

677. The method according to claim 667, wherein the client device is housed in a single enclosure that is a hand-held enclosure or a portable enclosure.

678. The method according to claim 667, wherein the client device consists of, comprises, is part of, or is integrated with, a notebook computer, a laptop computer, a media player, a Digital Still Camera (DSC), a Digital video Camera (DVC or digital camcorder), a Personal Digital Assistant (PDA), a cellular telephone, a digital camera, a video recorder, or a smartphone.

679. The method according to claim 678, wherein the client device consists of, comprises, is part of, or is integrated with, a smartphone that comprises, or is based on, an Apple iPhone 6 or a Samsung Galaxy S6.

680. The method according to claim 467, wherein the estimating of the first work load, the monitoring, the estimating of the second work load, the measuring of the response time, the estimating of the correlation value, or the comparing, or any combination thereof, is performed by a device that consists of, comprises, is integrated with, or is part of, a wearable device that is wearable on a person.

681. The method according to claim 680, wherein the wearable device is wearable on an organ of the person head.

682. The method according to claim 681, wherein the organ is an eye, ear, face, cheek, nose, mouth, lip, forehead, or chin.

683. The method according to claim 680, wherein the wearable device is constructed to have a form substantially similar to, is constructed to have a shape allowing mounting or wearing identical or similar to, or is constructed to have a form to at least in part substitute for, headwear, eyewear, or earpiece.

684. The method according to claim 683, wherein the headwear consists of, structured as, or comprises, a bonnet, a cap, a crown, a fillet, a hair cover, a hat, a helmet, a hood, a mask, a turban, a veil, or a wig.

685. The method according to claim 683, wherein the eyewear consists of, structured as, or comprises, glasses, sunglasses, a contact lens, a blindfold, or a goggle.

686. The method according to claim 683, wherein the earpiece consists of, structured as, or comprises, a hearing aid, a headphone, a headset, or an earplug.

687. The method according to claim 680, wherein the wearable device is shaped for permanently or releasably being attachable to, or be part of, a clothing piece of a person.

688. The method according to claim 687, wherein the attaching uses taping, gluing, pinning, enclosing, encapsulating, a pin, or a latch and hook clip.

689. The method according to claim 688, wherein the clothing piece is a top, bottom, or full-body underwear, or a headwear, a footwear, an accessory, an outwear, a suit, a dress, a skirt, or a top.

690. The method according to claim 680, wherein the wearable device further comprises an annular member defining an aperture therethrough that is sized for receipt therein of a part of a human body.

691. The method according to claim 467, wherein the estimating of the first work load, the monitoring, the estimating of the second work load, the measuring of the response time, the estimating of the correlation value, or the comparing, or any combination thereof, is performed by a device that consists of, comprises, is integrated in part or entirely in with, or is part of, an appliance, or wherein the first device consists of, comprises, is integrated in part or entirely in with, or is part of, an appliance.

692. The method according to claim 691, wherein a primary functionality of the appliance is associated with food storage, handling, or preparation.

693. The method according to claim 692, wherein a primary function of the appliance is heating food, and wherein the appliance is a microwave oven, an electric mixer, a stove, an oven, or an induction cooker.

694. The method according to claim 692, wherein the appliance is a refrigerator, a freezer, a food processor, a dishwasher, a food blender, a beverage maker, a coffeemaker, or an iced-tea maker.

695. The method according to claim 691 , wherein a primary function of the appliance is associated with environmental control, and the appliance consists of, or is part of, an HVAC system.

696. The method according to claim 695, wherein a primary function of the appliance is associated with temperature control, and wherein the appliance is an air conditioner or a heater.

697. The method according to claim 691 , wherein a primary function of the appliance is associated with cleaning, wherein the primary function is associated with clothes cleaning, and the appliance is a washing machine or a clothes dryer, or wherein the appliance is a vacuum cleaner.

698. The method according to claim 691, wherein a primary function of the appliance is associated with water control or water heating.

699. The method according to claim 691, wherein the appliance is an answering machine, a telephone set, a home cinema method, a HiFi method, a CD or DVD player, an electric furnace, a trash compactor, a smoke detector, a light fixture, or a dehumidifier.

700. The method according to claim 691, wherein the appliance is a battery-operated portable electronic device, and the appliance is a notebook, a laptop computer, a media player, a cellular phone, a Personal Digital Assistant (PDA), an image processing device, a digital camera, a video recorder, or a handheld computing device.

701. The method according to claim 691, wherein the integration involves sharing a component.

702. The method according to claim 701, wherein the integration involves housing in same enclosure, sharing same processor, or mounting onto same surface.

703. The method according to claim 701, wherein the integration involves sharing a same connector.

704. The method according to claim 703, wherein the connector is a power connector for connecting to a power source, wherein the integration involves sharing the same connector for being powered from same power source, or wherein the integration involves sharing same power supply.

705. The method according to claim 467, wherein the estimating of the first work load, the monitoring, the estimating of the second work load, the measuring of the response time, the estimating of the correlation value, or the comparing, or any combination thereof, is performed by a device that comprises, or is part of, a vehicular device that is mountable in a vehicle or configured to be used in a vehicle, or wherein the first device comprises, or is part of, a vehicular device that is mountable in a vehicle or configured to be used in a vehicle.

706. The method according to claim 705, wherein the vehicle comprises, is part of, or consists of, a ground vehicle adapted to travel on land.

707. The method according to claim 706, wherein the ground vehicle comprises, is part of, or consists of, a bicycle, a car, a motorcycle, a train, an electric scooter, a subway, a train, a trolleybus, a tram, or any combination thereof.

708. The method according to claim 705, wherein the vehicle comprises, is part of, or consists of, a buoyant or submerged watercraft adapted to travel on or in water.

709. The method according to claim 708, wherein the watercraft comprises, is part of, or consists of, a ship, a boat, a hovercraft, a sailboat, a yacht, a submarine, or any combination thereof.

710. The method according to claim 705, wherein the vehicle comprises, is part of, or consists of, an aircraft adapted to fly in air.

711. The method according to claim 710, wherein the aircraft comprises, is part of, or consists of, a fixed wing or a rotorcraft aircraft.

712. The method according to claim 710, wherein the aircraft comprises, is part of, or consists of an airplane, a spacecraft, a glider, a drone, an Unmanned Aerial Vehicle (UAV), or any combination thereof.

713. The method according to claim 705, wherein the vehicle communicates using, compatible with, or based on, a Dedicated Short-Range Communication (DSRC) or IEEE 802.1 Ip standard.

714. The method according to claim 467, wherein the sending, by the first device to the web server over the Internet, of the first part of the first sequence of requests, comprises sending, by the first device to the web server via a second device over the Internet, of the first part of the first sequence of requests, and wherein the receiving, by the first device from the web server over the Internet, of the content items, comprises receiving, by the first device from the web server via the second device over the Internet, of the content items.

715. The method according to claim 714, wherein the sending, by the first device to the web server over the Internet, of the first part of the first sequence of requests, comprises sending, by the first device to a second device over the Internet, of the first part of the first sequence of requests; and sending, by the second device to the web server over the Internet, of the first part of the first sequence of requests, and wherein the receiving, by the first device from the web server over the Internet, of the content items, comprises receiving, by the second device from the web server over the Internet, of the content items; and receiving, by the first device from the second device over the Internet, of the content items.

716. The method according to claim 714, wherein the estimating of the first work load or the monitoring is performed by the second device.

717. The method according to claim 716, further comprising sending, by the second device over the Internet, the estimated first work load or a monitored vale.

718. The method according to claim 716, wherein the estimating of the correlation value is performed by the second device.

719. The method according to claim 718, further comprising receiving, by the second device over the Internet, the estimated second work load or the measured response time.

720. The method according to claim 718, wherein the comparing is performed by the second device.

721. The method according to claim 720, further comprising sending, by the second device over the Internet, a first command responsive to the estimated correlation value being lower than the correlation threshold value.

722. The method according to claim 721, wherein the sending, by the first device to the web server over the Internet, of the second part of the first sequence of requests, is in response to the sending of the first command.

723. The method according to claim 720, further comprising sending, by the second device over the Internet, a first command responsive to the estimated correlation value being higher than the correlation threshold value.

724. The method according to claim 723, wherein the sending, by the first device to the web server over the Internet, of the second part of the first sequence of requests, while blocking at least part of the second part of the first sequence of requests, is in response to the sending of the first command.

725. The method according to claim 467, wherein the estimating of the first work load, the monitoring, the estimating of the second work load, the measuring of the response time the estimating of the correlation value, or the comparing, or any combination thereof, is performed by a device that comprises, or is part of, comprises, or consists of, a client device, or wherein the first device comprises, or is part of, comprises, or consists of, a client device.

726. The method according to claim 725, further comprising storing, operating, or using, by the client device, a client operating system.

727. The method according to claim 726, wherein the client operating system consists of, comprises, or is based on, Microsoft Windows 7, Microsoft Windows XP, Microsoft Windows 8, Microsoft Windows 8.1, Linux, or Google Chrome OS.

728. The method according to claim 726, wherein the client operating system is a Real-Time Operating System (RTOS).

729. The method according to claim 728, wherein the RTOS comprises FreeRTOS, SafeRTOS, QNX, VxWorks, or Micro-Controller Operating Systems (pC / OS).

730. The method according to claim 725, further comprising storing, operating, or using, by the client device, a web browser.

731. The method according to claim 730, wherein the web browser consists of, comprises, or is based on, Microsoft Internet Explorer, Google Chrome, Opera™, or Mozilla Firefox®.

732. The method according to claim 730, wherein the web browser is a mobile web browser.

733. The method according to claim 732, wherein the mobile web browser consists of, comprises, or is based on, Safari, Opera Mini™, or Android web browser.

734. The method according to claim 725, wherein the client device comprises, is part of, or consists of, a client device in a client / server architecture.

735. The method according to claim 725, wherein the client device is housed in a single enclosure that is a hand-held enclosure or a portable enclosure.

736. The method according to claim 725, wherein the client device consists of, comprises, is part of, or is integrated with, a notebook computer, a laptop computer, a media player, a Digital Still Camera (DSC), a Digital video Camera (DVC or digital camcorder), a Personal Digital Assistant (PDA), a cellular telephone, a digital camera, a video recorder, or a smartphone.

737. The method according to claim 725, wherein the client device consists of, comprises, is part of, or is integrated with, a smartphone that comprises, or is based on, an Apple iPhone 6 or a Samsung Galaxy S6.

738. The method according to claim 725, wherein the client device comprises, consists of, or is based on, a consumer computer that is owned, operated, or used, by a user for a personal, social, family, or household use.

739. The method according to claim 467, wherein the estimating of the first work load, the monitoring, the estimating of the second work load, the measuring of the response times the estimating of the correlation value, or the comparing, or any combination thereof, is performed by a device that comprises, or is part of, is integrated with, or consists of, a Layer-3 (Internet Protocol- IP) networking device that forwards Internet Protocol (IP) packets between its ports or connections.

740. The method according to claim 739, wherein the Layer-3 (Internet Protocol-IP) networking device comprises, is part of, or is integrated with, a router, a gateway, a residential gateway, a firewall, or any combination thereof.

741. The method according to claim 467, wherein the estimating of the first work load, the monitoring, the estimating of the second work load, the measuring of the response time, the estimating of the correlation value, or the comparing, are performed by a device that comprises, or is part of, or consists of, a server device that is not a client device.

742. The method according to claim 741, wherein the server device is a dedicated device that manages network resoucres; is not a client device and is not a consumer device; is continuously online with greater availability and maximum up time to receive requests almost all of the time efficiently processes multiple requests from multiple client devices at the same time; generates various logs associated with the client devices and traffic from / to the client devices; primarily interfaces and responds to requests from client devices; has greater fault tolerance and higher reliability with lower failure rates; provides scalability for increasing resources to serve increasing client demands; or any combination thereof.

743. The method according to claim 741, wherein the server device is virtualized, wherein the virtualization is executed as part of a Virtual Machine (VM).

744. The method according to claim 743, for use with a host computer that implement the VM, wherein the method further comprising executing, by the host computer, a hypervisor or a Virtual Machine Monitor (VMM).

745. The method according to claim 743, wherein the virtualization includes, is based on, or uses, full virtualization, para- virtualization, or hardware assisted virtualization.

746. The method according to claim 741, wherein the server device consists of, includes, is part of, or is integrated with, a proxy server.

747. The method according to claim 746, wherein the proxy server consists of, includes, is part of, or is integrated with, a Data Center (DC) proxy server.

748. The method according to claim 746, wherein the proxy server consists of, includes, is part of, or is integrated with, an HTTP proxy server, a web-proxy server, a caching proxy, an open- source caching proxy server, a cloud-based proxy server, an open proxy server, a forwarding proxy server, a reverse proxy server, a transparent proxy server, a non-transparent proxy server, an anonymous proxy server, a translation proxy server, a SOCKS proxy server, a CGI web proxy server, a suffix proxy server, an I2P anonymous proxy server, a DNS proxy server, or any combination thereof.

749. The method according to claim 741, further comprising storing, operating, or using, by the server device, a server operating system.

750. The method according to claim 749, wherein the server operating system consists of, comprises, or based on, Microsoft Windows Server®, Linux, or UNIX.

751. The method according to claim 749, wherein the server operating system consists of, comprises, or based on, Microsoft Windows Server® 2003 R2, 2008, 2008 R2, 2012, or 2012 R2 variant, Linux™ or GNU / Linux based Debian GNU / Linux, Debian GNU / kFreeBSD, Debian GNU / Hurd, Fedora™, Gentoo™, Linspire™, Mandriva, Red Hat® Linux, SuSE, Ubuntu®, UNIX® variant Solaris™, AIX®, Mac™ OS X, FreeBSD®, OpenBSD, or NetBSD®.

752. The method according to claim 467, for use with a second device, the method further comprising sending, by the first device to the second device over the Internet, the obtained first value and receiving, by the second device from the first device over the Internet, the sent obtained first value, wherein the comparing in performed by the second device.

753. The method according to claim 752, wherein the identifying of the second sequence of requests is performed at the second device.

754. The method according to claim 753, wherein the sending of the second or third sequence of requests is performed by the second device.

755. The method according to claim 467, further comprising sending, by the device that perform the comparing, to the first device over the Internet, the comparison result.

756. The method according to claim 467, for use with a second device, the method further comprising sending, by the device that perform the comparing, to the second device over the Internet, the comparison result.

757. The method according to claim 756, wherein the identifying of the second sequence of requests is performed at the second device.

758. The method according to claim 757, wherein the sending of the second or third sequence of requests is performed by the second device.

759. The method according to claim 467, further for use with a second device, the method further comprising receiving, by the first device from the second device over the Internet, a first sequence of content item identifiers of the first group of content items.

760. The method according to claim 759, wherein the identifying of the first sequence of requests is in response to the receiving of the first sequence of content item identifiers of the first group of content items.

761. The method according to claim 760, wherein the identifying of the first sequence of requests comprises generating, by the first device, the first sequence of requests, and wherein the generated first sequence of requests comprises the received first sequence of content item identifiers of the first group of content items.

762. The method according to claim 759, wherein the receiving of the first sequence of content item identifiers comprises receiving of a fourth sequence of requests that comprises the first sequence of content item identifiers of the first group of content items.

763. The method according to claim 762, wherein the first sequence of requests is identical to, similar to, or based on, the fourth sequence of requests.

764. The method according to claim 763, wherein the first sequence of requests is identical to the fourth sequence of requests except for the source IP address value being the IP address of the first device.

765. The method according to claim 759, further comprising sending, by the first device to the second device over the Internet, the received first group of content items, in response to the receiving, by the first device, of the first group of content items.

766. The method according to claim 765, wherein the monitoring further comprises monitoring at least part of the receiving of the first sequence of content item identifiers, at least part of the sending of the received first group of content items, or any combination thereof.

767. The method according to claim 759, further comprising receiving, by the first device from the second device over the Internet, a second sequence of content item identifiers of the second group of content items.

768. The method according to claim 767, wherein the identifying of the second sequence of requests is in response to the receiving of the second sequence of content item identifiers of the second group of content items.

769. The method according to claim 768, wherein the identifying of the second sequence of requests comprises generating, by the first device, the second sequence of requests, and wherein the generated second sequence of requests comprises the received second sequence of content item identifiers of the second group of content items.

770. The method according to claim 767, wherein the receiving of the second sequence of content item identifiers comprises receiving of a fourth sequence of requests that comprises the second sequence of content item identifiers of the second group of content items.

771. The method according to claim 770, wherein the second sequence of requests is identical to, similar to, or based on, the fourth sequence of requests.

772. The method according to claim 771, wherein the second sequence of requests is identical to the fourth sequence of requests except for the source IP address value being the IP address of the first device.

773. The method according to claim 759, further comprising receiving, by the first device from the web server over the Internet, at least part of or all of, the second group of content items, in response to the sending of the second or third sequence of requests, and sending, by the first device to the second device over the Internet, at least part of the received second group of content items, in response to the receiving, by the first device, the at least part of the second group of content items.

774. The method according to claim 759, wherein the first device consists of, includes, is part of, or is integrated with, a proxy server.

775. The method according to claim 774, wherein the proxy server consists of, includes, is part of, or is integrated with, an HTTP proxy server, a web-proxy server, a caching proxy, an open- source caching proxy server, a cloud-based proxy server, an open proxy server, a forwarding proxy server, a reverse proxy server, a transparent proxy server, a non-transparent proxy server, an anonymous proxy server, a translation proxy server, a SOCKS proxy server, a CGI web proxyserver, a suffix proxy server, an I2P anonymous proxy server, a DNS proxy server, or any combination thereof.

776. The method according to claim 759, for use with a list of IP addresses, wherein the method further comprising selecting an IP address from the list, and wherein at least part of the first or third sequence of requests include the selected IP address as the source address.

777. The method according to claim 776, wherein the selected IP address is the IP address of the first device.

778. The method according to claim 776, wherein the selection of the IP address from the list is based on, or uses, load balancing.

779. The method according to claim 778, wherein the selection is based on, or uses, random selection.

780. The method according to claim 779, wherein random selection uses, or is based on, one or more random numbers generated by a random number generator.

781. The method according to claim 780, wherein the random number generator is hardware based.

782. The method according to claim 781, wherein the random number generator is using thermal noise, shot noise, nuclear decaying radiation, photoelectric effect, or quantum phenomena.

783. The method according to claim 780, wherein the random number generator is software based.

784. The method according to claim 783, wherein the random number generator is based on executing an algorithm for generating pseudo-random numbers.

785. The method according to claim 776, wherein the selection is based on, or uses, an estimated geographical location of the first device or of the web server.

786. The method according to claim 785, further comprising estimating the geographical location of the first device or of the web server using geolocation.

787. The method according to claim 786, wherein the geolocation is based on IP geolocation.

788. The method according to claim 497, wherein the geolocation is based on W3C Geolocation Application Programming Interface (API).

789. The method according to claim 776, wherein the IP address is selected based on estimated as being in the same area as the first device or the web server.

790. The method according to claim 789, wherein the IP address is selected based on estimated as being in the same continent, country, state, region, city, postal / zip code, latitude, longitude, or Timezone as the client device or the web server.

791. The method according to claim 776, wherein the IP address is selected based on being the recent one to be selected, or based on being the least recent to be selected.

792. The method according to claim 776, wherein the IP address is manually selected by a user.

793. The method according to claim 792, further comprising displaying to the user the multiple IP addresses, and selecting, by the user, the selected IP address from the group.

794. The method according to claim 467, wherein the steps are repeated for at least additional first and second groups of content items and using an additional first and second sequence of requests.

795. The method according to claim 794, wherein the steps are immediately repeated.

796. The method according to claim 794, wherein the steps are repeated at least 2, 3, 4, 5, 10, 15, 20, 100, 120, 150, 200, 500, or 1000 times.

797. The method according to claim 794, wherein the steps are repeated after a wait time.

798. The method according to claim 797, wherein the wait time is at least 1, 2, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, or 10,000 milliseconds, seconds, minutes, hours or days.

799. The method according to claim 797, wherein the wait time is less than 2, 3, 4, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, 10,000 or 20,000 milliseconds, seconds, minutes, hours, or days.

800. The method according to claim 797, wherein the blocking comprises blocking of the requests or packets in the second sequence during a first time-interval, and wherein the wait time is at least 0.001, 0.002, 0.003, 0.005, 0.008, 0.01, 0.02, 0.03, 0.05, 0.07, 0.1, 0.2, 0.3, 0.5, 0.7, 1, 2, 3, 5, 7, 10, 20, 30, 50, 70, 100, 200, 300, 500, 700, or 1000 times the first time-interval.

801. The method according to claim 797, wherein the blocking comprises blocking of the requests or packets in the second sequence during a first time-interval, and wherein the wait time is less than 0.001, 0.002, 0.003, 0.005, 0.008, 0.01, 0.02, 0.03, 0.05, 0.07, 0.1, 0.2, 0.3, 0.5, 0.7, 1, 2, 3, 5, 7, 10, 20, 30, 50, 70, 100, 200, 300, 500, 700, or 1000 times the first time-interval.

802. The method according to claim 467, further for use with at least third and fourth groups of content items that are each identified by a respective content item identifier and that are each stored in the web server, the method further comprising: identifying, at the first device, a third sequence of requests for the third group of the content items, each of the requests comprises a respective content item identifier of the third group of content items; sending, by the first device to the web server over the Internet, the third sequence of requests, in response to the identifying of the third sequence; receiving, by the first device from the web server over the Internet, the third group of content items, in response to the sending of the third sequence of requests;monitoring the sending of the third sequence, the receiving of the third group of content items, or any combination thereof; obtaining a second value in response to the monitoring; comparing, the second value to the threshold value; identifying, at the first device, a fourth sequence of requests for the fourth group of the content items, each of the requests comprises a respective content item identifier of the fourth group of content items; sending, by the first device to the web server over the Internet, the fourth sequence of requests, in response to the identifying and in response to the second value being below the threshold; and blocking, by the first device to the web server over the Internet, at least part of the requests of the second sequence, in response to the identifying of the second sequence and in response to the second value being above the threshold.

803. The method according to claim 802, wherein the identifying of the third sequence is performed after the blocking of at least part of the requests of the second sequence.

804. The method according to claim 803, wherein the identifying of the third sequence is performed immediately after the blocking of at least part of the requests of the second sequence.

805. The method according to claim 803, wherein the identifying of the third sequence is performed after a wait time.

806. The method according to claim 805, wherein the wait time is at least 1, 2, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, or 10,000 milliseconds, seconds, minutes, hours or days.

807. The method according to claim 805, wherein the wait time is less than 2, 3, 4, 5, 8, 10, 12, 15, 20, 25, 30, 50, 80, 100, 120, 150, 200, 500, 1,000, 2,000, 5,000, 10,000 or 20,000 milliseconds, seconds, minutes, hours, or days.

808. The method according to claim 805, wherein the blocking comprises blocking of the requests or packets in the second sequence during a first time-interval, and wherein the wait time is at least 0.001, 0.002, 0.003, 0.005, 0.008, 0.01, 0.02, 0.03, 0.05, 0.07, 0.1, 0.2, 0.3, 0.5, 0.7, 1, 2, 3, 5, 7, 10, 20, 30, 50, 70, 100, 200, 300, 500, 700, or 1000 times the first time-interval.

809. The method according to claim 805, wherein the blocking comprises blocking of the requests or packets in the second sequence during a first time-interval, and wherein the wait time is less than 0.001, 0.002, 0.003, 0.005, 0.008, 0.01, 0.02, 0.03, 0.05, 0.07, 0.1, 0.2, 0.3, 0.5, 0.7, 1, 2, 3, 5, 7, 10, 20, 30, 50, 70, 100, 200, 300, 500, 700, or 1000 times the first time-interval.

810. The method according to claim 467, wherein the monitoring comprises monitoring only of the sending of the first sequence.

811. The method according to claim 810, wherein the monitoring further comprises monitoring only of the receiving of the first group of content items.

812. The method according to claim 467, wherein the monitoring comprises monitoring only of the receiving of the first group of content items.

813. The method according to claim 467, wherein at least one of the steps is performed as part of a plug-in or an extension integrated with a web browser.

814. The method according to claim 813, wherein at least one of the steps performed by the client device is integrated with the web browser in a form of a plug-in or an extension.

815. The method according to claim 813, wherein the identifying of the first or second sequence of requests uses a plug-in or an extension to the web browser.

816. The method according to claim 813, wherein the integration is by hooking to the web browser, wherein the integration is in a filter driver form, or, wherein the web browser and the steps are communicating using an Inter-Process Communication (IPC).

817. The method according to claim 816, wherein the identifying of the first or second sequence of requests uses hooking to the web browser, a filter driver form, or using an Inter-Process Communication (IPC).

818. The method according to claim 816, wherein the IPC is using a file sharing, a signal, a socket, a pipe, a message queue, a shared memory, a semaphore, or memory mapped file.

819. The method according to claim 816, wherein the IPC is using a clipboard, a Component Object Model (COM), a data copy, a DDE protocol, or mailslots.

820. The method according to claim 816, wherein the monitoring of the first sequence of requests uses hooking to the web browser, a filter driver form, or using an Inter-Process Communication (IPC).

821. The method according to claim 820, wherein the IPC is using a file sharing, a signal, a socket, a pipe, a message queue, a shared memory, a semaphore, or memory mapped file.

822. The method according to claim 820, wherein the IPC is using a clipboard, a Component Object Model (COM), a data copy, a DDE protocol, or mailslots.

823. The method according to claim 816, wherein the blocking uses hooking to the web browser, a filter driver form, or using an Inter-Process Communication (IPC).

824. The method according to claim 823, wherein the IPC is using a file sharing, a signal, a socket, a pipe, a message queue, a shared memory, a semaphore, or memory mapped file, or wherein theIPC is using a clipboard, a Component Object Model (COM), a data copy, a DDE protocol, or mailslots.

825. The method according to claim 467, wherein the monitoring, the obtaining, the comparing, or any combination thereof, is performed by the first device.

826. The method according to claim 467, further for use with a virtualization, wherein the estimating of the first work load, the monitoring, the estimating of the second work load, the measuring of the response time, the estimating of the correlation value, or the comparing, or any combination thereof, is performed by a device that virtualize a client or server device, or wherein the first device consists of, comprises, is part of, or is integrated with, a server device that virtualize a client or server device.

827. The method according to claim 826, wherein the device virtualization executed as part of a Virtual Machine (VM).

828. The method according to claim 827, for use with a host computer that implement the VM, wherein the method further comprising executing, by the host computer, a hypervisor or a Virtual Machine Monitor (VMM).

829. The method according to claim 827, wherein the virtualization includes, is based on, or uses, full virtualization, para- virtualization, or hardware assisted virtualization.

830. The method according to claim 467, further comprising identifying the first sequence in a second sequence that are addressed to the web server.

831. The method according to claim 830, wherein the identifying comprises identifying requests that are addressed to, or comprises, a hostname of the web server, a domain name, an IP address of the web server, or a URL structure.

832. The method according to claim 830, wherein the identifying comprises obtaining an IP address of the web server using a Domain Name System (DNS) mechanism.

833. The method according to claim 830, wherein the identifying comprises identifying URLs having a specific structure.

834. A non-transitory computer readable medium containing computer instructions that, when executed by a computer processor, cause the processor to perform at least part of the steps of claim 467.

835. A non-transitory computer readable medium containing computer instructions that, when executed by a computer processor, cause the processor to perform all of the steps of claim 467.

836. The method according to claim 467, wherein at least part of steps of claim 467 are included in a Software Development Kit (SDK) that is provided as a non-transitory computer readablemedium containing computer instructions, and wherein the method further comprising installing the SDK.

837. The method according to claim 467, wherein the server device is a cloud-based server that is implemented as an Infrastructure-as-a-Service (laaS) or as a Software-as-a-Service (SaaS) by a public cloud-based service.

838. The method according to claim 837, wherein the public cloud-based service is provided by Amazon Web Services® (AWS®), Microsoft® Azure™, or Google® Compute Engine™ (GCP).

Images