Patent Description:
<CIT> relates to a method including receiving a communication from a client device and identifying a port number, a protocol and a destination associated with the communication. The method may also include identifying a first application being executed by the first client device based on the port number, the protocol and the destination associated with the first communication.

<CIT> relates to A data processing system, method, and computer readable medium are provided for providing centralized communication services to a plurality of client applications. A method includes caching one or more responses to a first plurality of requests received from a plurality of client applications. The method also includes mapping one or more of a second plurality of requests received from the plurality of client applications to one or more forward proxy servers. The method further includes sending two or more of the second plurality of requests to one of the one or more forward proxy servers via a single HTTP channel. The method also includes obtaining in the communication server responses to one or more authentication challenges received from the one or more forward proxy servers in response to one or more of the second plurality of requests.

Neither of these documents discloses at least a network device comprising one or more processors to: determine, based on an application-based policy associated with the web application, an access method to be used to transmit traffic associated with the web application; dynamically generate a proxy auto configuration "PAC" file based on network endpoint information, associated with the web application, identified in an application cache, using: the application signature associated with the web application, and the access method to be used to transmit the traffic associated with the web application; and provide the PAC file to a client device to permit the client device to transmit the traffic associated with the web application based on the PAC file.

Particular aspects are set out in the dependent claims.

According to some implementations, a network device according to claim <NUM> is provided.

According to some implementations, a computer-readable medium according to claim <NUM> is provided.

According to some implementations, a method according to claim <NUM> is provided.

In some cases, an entity (e.g., an organization) may manually generate a PAC file that is to be used to configure one or more client devices that communicatively connect to a network associated with the entity. For example, a network administrator, information technology (IT) personnel, and/or the like, associated with the entity, may select one or more access methods that are to be used to transmit and/or receive traffic associated with one or more server devices, may incorporate the one or more access methods into a PAC file, and may provide the PAC file to the one or more client devices. However, generating PAC files is a cumbersome process that is prone to error (e.g., a PAC file may be generated with an incorrect proxy server address, a PAC file may be generated such that particular types of traffic are associated with an incorrect access method, and/or the like). Moreover, some PAC files may be generated with inflexible rules that cause all or a majority of traffic, that is transmitted and/or received by a client device, to be transmitted and/or received via a proxy server device. As the quantity of client devices connected to the entity's network increases, the proxy server device may become a bottleneck for some web application traffic (e.g., such as traffic associated with a web application that requires low latency and/or high bandwidth), which may cause an increase in latency between the client device and an application platform associated with the web application, which in turn may result in a degraded user experience of the web application, degraded quality of service of the web application, periodic disconnects between the client device and the application platform, increased traffic processing times at the proxy server device, dropped packets at the proxy server device, and/or the like.

Some implementations described herein provide a network device that is capable of automatically generating application-based PAC files. In some implementations, the network device may identify an application signature associated with a web application, and may determine, based on an application-based policy associated with the web application, an access method to be used to transmit traffic associated with the web application. The network device may generate a PAC file that includes information specifying an association between the application signature associated with the web application and the access method to be used to transmit the traffic associated with the web application. The network device may provide the PAC file to a client device to permit the client device to transmit the traffic associated with the web application based on the PAC file.

In this way, the network device may generate a PAC file that configures a client device to use various access methods for transmitting traffic associated with a plurality of different web applications. In this way, the PAC file may configure the client device to transmit traffic associated with a particular web application such that the traffic is transmitted using a proxy server device, and may configure the client device to transmit traffic associated with another web application such that the traffic associated with the other application is transmitted without using a proxy server device or using a different proxy server device, which enables application-specific traffic handling. Moreover, for traffic that is to be transmitted to an application platform without using a proxy server device, this decreases latency between a client device that is to transmit the traffic and the destination, which in turn improves user experience associated with the client device and the web application associated with the traffic. Moreover, permitting traffic associated with some web applications to be transmitted without using a proxy server device decreases the quantity of packets that is to be processed by the proxy server device, which decreases processing, memory, and networking resource usage of the proxy server device, reduces the time it takes to process traffic at the proxy server device (e.g., because the processing queue at the proxy server device is reduced), and allows the proxy server device to use the processing and/or memory resources of the proxy server device, that would have otherwise been used to process the traffic, for other purposes. In addition, the PAC file may be configured such that traffic associated with a particular web application may be transmitted to different proxy server devices, which may provide different types of value-added services related to logging, forensic auditing, and/or the like, which enables web applications requiring detailed logging to be routed to a particular proxy server. Further, the PAC file may be configured such that cost savings are realized due lowering the traffic on expensive leased lines/MPLS links that may be in use between the proxy server device and client devices.

<FIG> are diagrams of an example implementation <NUM> described herein. As shown in <FIG>, implementation <NUM> may include various devices, such as one or more client devices, a network device, one or more data stores (e.g., an application signature store, a security policy store, an application cache, and/or the like), a proxy server device, an application platform, and/or the like. The quantity and configuration of devices illustrated in implementation <NUM> is an example, and greater, fewer, and/or different configurations of devices may be included in implementation <NUM>.

In some implementations, one or more components illustrated in implementation <NUM> may be included in one or more local networks. For example, the client device, network device, and data stores may be included in a first local network; the proxy server device, may be included in the first local network or a second local network, and/or the like. The one or more local networks may include various types of wired and/or wireless local area networks (LANs), such as a wired LAN, a wireless LAN (WLAN), a home network, an office network, a campus network, and/or the like. In some implementations, the one or more local networks may be associated with the same entity, such as an enterprise, corporation, government agency, educational institution, and/or the like. In some implementations, the one or more local networks may be associated with different offices, different locations, different networks, and/or the like, of the entity.

The network device may include various types of network devices that are capable of transmitting traffic to the application platform, capable of receiving traffic from the application platform, and/or the like. For example, the network device may receive traffic from the client device and may transmit the traffic to the application platform. As another example, the network device may receive traffic from the client device and may transmit the traffic to the application platform via the proxy server device.

The proxy server device may include various types of devices that are capable of functioning as an intermediary between the client device and the application platform. For example, the proxy server device may transmit, for the client device, traffic to the application platform, may transmit, for the application platform, traffic to the client device, and/or the like. In some implementations, the traffic may include web pages, electronic files, and/or any other type of electronic content. In some implementations, the traffic may include requests for electronic content, such as a hypertext transfer protocol (HTTP) request, a file transfer protocol (FTP) request, and/or the like, which may be further encapsulated using secure sockets layer (SSL) protocol, transport layer security (TLS) protocol, and/or the like, to provide secure transmission of the traffic.

In some implementations, the proxy server device may perform various security functions for traffic transmitted by, and traffic that is to be received by, the client device. For example, the proxy server device may include a threat detection and/or an intrusion detection proxy server device that analyzes traffic that is transmitted by the client device, and/or analyzes traffic that is to be received by the client device, to determine whether the client device exhibits malicious behavior, to determine whether another device to which the client device is communicating exhibits malicious behavior, and/or the like. As another example, the proxy server device may include a deep packet inspection proxy server device that performs deep packet inspection on traffic that is transmitted by the client device and/or traffic that is to be received by the client device. In this way, the proxy server device may apply and/or enforce network, data, and/or computer security policies on traffic that is transmitted by the client device and/or traffic that is to be received by the client device.

The data stores may store information associated with various web applications, such as a web-based productivity application (e.g., a word processing application, a spreadsheet application, an email application, etc.), a web-based client management application, a computer-aided design application, and/or the like. A web application may include a client-server application that exchanges data using web protocols such as HTTP/HTTP secure (HTTPS). The application platform may reside over the Internet/cloud and the client device may include a web browser or custom software that communicates with the application platform.

In some implementations, the application signature store may include information identifying an application signature associated with a web application (e.g., information that may be used by a network device to identify traffic that is associated with the web application). The application signature of a web application may include information identifying one or more host domains associated with the web application, one or more addresses associated with the web application (e.g., a source address associated with a device that originates traffic associated with the application, a destination address associated with a device that is the destination of the traffic associated with the application, a port identifier associated with the source and/or destination of the packets associated with the application, etc.), information identifying one or more communications protocols associated with the application (e.g., a communications protocol that the client device and/or the application platform may use to transmit and/or receive packets associated with the application), and/or the like. The application signature store may store an application signature, associated with a particular web application, in an electronic file (e.g., an extensible markup language (XML) file, a JavaScript Object Notation (JSON) file, etc.), in a database, and/or the like.

An example of an application signature is illustrated in <FIG>, where the application signature for Application <NUM> includes information identifying three rules by which traffic associated with Application <NUM> may be identified. According to rule <NUM>, traffic associated with Application <NUM> may be identified based on the traffic using HTTP and being destined for an application platform associated with the host domain xyz. According to rule <NUM>, traffic associated with Application <NUM> may be identified based on the traffic using a secure sockets layer (SSL) protocol and/or a transport layer security (TLS) protocol, and being destined for an application platform associated with the host domain secure. According to rule <NUM>, traffic associated with Application <NUM> may be identified based on the traffic using HTTP and being associated with a user agent sent by a client device identified in a HTTP header request.

Returning to <FIG>, in some implementations, the security policy store may store information identifying one or more application-based policies associated with a web application. For example, the one or more application-based policies may include a policy specifying an access method for traffic associated with the web application, a policy for quality of service (QoS) treatment of the traffic associated with the web application, a policy for inspection of the traffic associated with the application, a policy rule that specifies that the traffic associated with the application is to be rate limited, a policy rule that specifies that the traffic associated with the application is to be dropped, , and/or the like.

Once traffic has been identified as belonging to a particular web application based on a corresponding web application signature, the application cache stores network endpoint information, associated with the web application, so that signature rule matching for the traffic destined for the network endpoint may be avoided. In this way, since application signature matching may be a memory and/or processor intensive task, memory and/or processor resources of the network device may be conserved by reducing the amount of repetitive signature evaluation for traffic to same network endpoint.

In some implementations, the network endpoint information may include a destination Internet protocol (IP) address, a port name/number/identifier, a protocol used by the network endpoint, a virtual router identifier associated with the network endpoint, and/or a rule from the application signature store that identified web application. In some implementations, the application cache may have hundreds or thousands of entries for a particular web application. Each entry may have different destination IP address, port identifier, and/or the like, whereas the application signature store may include a single entry for the web application that associates the web application with rules to identify the web application.

Turning to <FIG>, the network device may use the information stored in the application signature store, the information stored in the security policy store, and/or the information stored in the application cache to automatically generate and update PAC files. For example, the network device may automatically generate a PAC file based on determining that information associated with a web application has been added to the application signature store, the security policy store, and/or the application cache, based on determining that information associated with a web application has been updated in the application signature store, the security policy store, and/or the application cache, and/or the like. In some implementations, the network device may generate and update PAC files based on receiving an instruction (e.g., via input from a user, from another network device, and/or the like) to generate a PAC file, based on receiving an instruction to update a PAC file, and/or the like.

As shown in <FIG>, and by reference number <NUM>, the network device may identify, based on the information stored in the application signature store, an application signature associated with a web application. For example, the network device may identify a database, an electronic file, and/or the like, stored in the application signature store, that includes the application signature associated with the web application. As explained above, the application signature, associated with the web application, may include information identifying a host domain associated with the web application, a protocol associated with the web application, a user agent associated with the web application, an address associated with the web application, and/or the like.

Turning to <FIG>, and as shown by reference number <NUM>, the network device may identify an access method for the web application. For example, the network device may identify the access method based on the information, associated with the web application, stored in the security policy store. The information associated with the web application and stored in the security policy store may include an application-based policy that specifies an access method that is to be used to transmit and/or receive traffic associated with the web application. For example, the access method for the web application may specify that traffic associated with the web application is to be transmitted to the application platform via the proxy server device, may specify that traffic associated with the web application is to be transmitted to the application platform via another proxy server device, may specify that traffic associated with the web application is to be transmitted directly to the application platform (e.g., without transmitting the traffic to a proxy server device), and/or the like.

In some implementations, the access method that is to be used for traffic associated with the web application may be automatically selected (e.g., by another network device, by the proxy server device, and/or the like) based on various factors. For example, another device may automatically select the access method based on the web application being a particular type of web application (e.g., a productivity web application, a social media web application, and/or the like), based on usage information associated with the web application (e.g., a quantity of users associated with the entity that use the application, traffic volume of the web application in the entity, peak session and usage times associated with the application in the entity, and/or the like), based on latency requirements for the web application, and/or the like. For example, another device may determine that the web application is a video conferencing application that requires low latency, and therefore may select an access method for the web application that specifies traffic associated with the application is to be transmitted directly to the application platform (e.g., without transmitting the traffic via the proxy server device) in order to decrease the latency associated with the web application. As another example, another device may determine that the web application has a particular peak usage time, and may select an access method for the web application that specifies that traffic associated with the web application is to be transmitted to the application platform via the proxy server device except during the peak usage time, where the traffic may be transmitted to the application platform without using the proxy server device.

As further shown in <FIG>, and by reference number <NUM>, the network device generates the PAC file. In some implementations, the PAC file may include information specifying an association between the application signature of the web application and the access method that is to be used for traffic associated with the web application, information specifying an association between the network endpoint information associated with the application in the application cache and the access method that is to be used for the traffic associated with the web application, and/or the like. In this way, the client device, when configured by the PAC file, may identify, based on the application signature included in the PAC file, traffic associated with the web application, and may identify the access method that is to be used for traffic associated with the web application.

In some implementations, the PAC file may include information associated with a plurality of web applications. For example, the PAC file may include information specifying an association between an application signature of a first web application and an access method for the first web application, may include information specifying an association between an application signature of a second web application and an access method for the second web application, and/or the like. In some implementations, the access methods for different web applications may be the same access method, may be different access methods, and/or the like. In some implementations, the PAC file may further include a default access method that is to be used for traffic that is not associated with any web application that is identified in the PAC file.

An example of a PAC file is illustrated in <FIG>. As shown in <FIG>, the example PAC file includes information specifying an association between an application signature of a first web application (e.g., Application <NUM>) and an access method for the first web application (e.g., an association that specifies that traffic associated with the host domains xyz. com and secure. com is to be transmitted directly to the application platform associated with Application <NUM>). Moreover, the example PAC file includes information specifying an association between an IP/pattern-based rule identified for the first web application in the application signature store, a network endpoint associated with the IP/pattern-based rule identified for the first web application that is identified in the application cache, and the access method for the first web application), which may by dynamically generated as patterns for the network endpoint are identified. Moreover, the example PAC file includes information specifying an association between an application signature (which may be structured similarly to the application signature illustrated in <FIG>) of a second web application (e.g., Application <NUM>) and an access method for the second web application (e.g., an association that specifies that traffic associated with the host domains abc. com and secure. com is to be transmitted to the application platform associated with Application <NUM> via a proxy server device), and includes information specifying a default access method (e.g., transmitting traffic that is not associated with Application <NUM> or Application <NUM> via another proxy server device).

Turning to <FIG>, and as shown by reference number <NUM>, the network device may provide the PAC file to the client device. In some implementations, the network device may automatically provide the PAC file to the client device based on generating the PAC file, based on updating the PAC file, and/or the like. In this way, the client device automatically receives the most up-to-date PAC files when new and/or updated PAC files become available. In some implementations, the network device may provide the PAC file to the client device based on receiving, from the client device, a request for the PAC file. For example, the network device may function as a PAC file server, and accordingly may associate the PAC file with an address (e.g., a uniform resource identifier (URI), a uniform resource locator (URL), and/or the like) and host the PAC file at the address. In this way, the client device may provide the request in the form of an HTTP request that identifies the address, an FTP request that identifies the address, and/or the like, and the network device may provide the PAC file to the client device based on receiving the request. In some implementations, the network device may provide the PAC file to another device that functions as a PAC file server, and the client device may request the PAC file from the other PAC file server.

Turning to <FIG>, and as shown by reference number <NUM>, the client device may receive the PAC file and may configure, based on the PAC file, the client device to transmit traffic to the application platform. For example, the client device may receive an instruction (e.g., via a web browser application on the client device) to transmit a request for a web page, a file, and/or the like, to the application platform, and the client device may determine, based on the information included in the PAC file, whether to transmit the request to the application platform via the proxy server device or to transmit the request directly to the application platform (e.g., without transmitting the request via the proxy server device). In this way, the client device may analyze the request to determine a host domain associated with the request, may determine an access method associated with the request based on an association of the host domain and the access method specified in the PAC file, and may transmit the request based on the access method.

In this way, the network device may generate and/or update a PAC file that configures the client device to use various access methods for transmitting traffic associated with a plurality of different web applications. In this way, the PAC file may configure the client device to transmit traffic associated with a particular web application such that the traffic is transmitted using a proxy server device, and may configure the client device to transmit traffic associated with another web application such that the traffic associated with the other application is transmitted without using a proxy server device, which increases the flexibility of generating PAC files. Moreover, for traffic that is to be transmitted to an application platform without using a proxy server device, this decreases latency between a client device that is to transmit the traffic and the destination, which in turn improves a user experience associated with the client device and the web application associated with the traffic. Moreover, permitting traffic associated with some web applications to be transmitted without using a proxy server device decreases the quantity of packets that is to be processed by the proxy server device, which decreases processing, memory, and networking resource usage of the proxy server device, reduces the time it takes to process traffic at the proxy server device (e.g., because the processing queue at the proxy server device is reduced), and allows the proxy server device to use the processing and/or memory resources of the proxy server device, that would have otherwise been used to process the traffic, for other purposes.

As indicated above, <FIG> are provided merely as an example.

<FIG> is a diagram of an example environment <NUM> in which systems and/or methods described herein may be implemented. As shown in <FIG>, environment <NUM> may include a client device <NUM>, a plurality of data store devices <NUM> (e.g., an application signature store <NUM>-<NUM>, a security policy store <NUM>-<NUM>, an application cache <NUM>-<NUM> and/or the like, collectively referred to as "data store devices <NUM>" and individually as "data store device <NUM>"), a network device <NUM>, an application platform <NUM> in a cloud computing environment <NUM> that includes a set of computing resources <NUM>, a network <NUM>, a proxy server device <NUM>, and/or the like. Devices of environment <NUM> may interconnect via wired connections, wireless connections, or a combination of wired and wireless connections.

Client device <NUM> includes one or more devices capable of receiving, generating, storing, processing, and/or providing data associated with generating an application-based proxy auto configuration. For example, client device <NUM> may include a mobile phone (e.g., a smart phone, a radiotelephone, etc.), a laptop computer, a tablet computer, a handheld computer, a gaming device, a wearable communication device (e.g., a smart wristwatch, a pair of smart eyeglasses, etc.), a desktop computer, and/or a similar type of device. Client device <NUM> may receive a PAC file from network device <NUM>, may transmit traffic based on the PAC file to network device <NUM>, and/or the like.

Data store device <NUM> includes one or more devices, such as storage device, a memory device, and/or the like, capable of receiving, generating, storing, processing, and/or providing data associated with generating an application-based proxy auto configuration. For example, application signature store <NUM>-<NUM> may include a storage device, a memory device, and/or the like that stores information associated with one or more applications, such as information associated with various web applications (e.g., a web-based productivity application or client management application, a computer-aided design application, and/or the like). For example, signature store <NUM>-<NUM> may store information identifying the web application, information identifying an application signature associated with the web application (e.g., information identifying one or more host domains, addresses, and/or communications protocols associated with the application). Security policy store <NUM>-<NUM> may include a storage device, a memory device, and/or the like that stores information identifying one or more application-based policies associated with the web application.

In some implementations, data store devices <NUM> may be standalone devices, may be included in a network device (e.g., network device <NUM>) or another device, and/or the like.

Network device <NUM> includes one or more devices capable of receiving, generating, storing, processing, and/or providing data associated with generating an application-based proxy auto configuration. In some implementations, network device <NUM> may include a firewall, a router, a gateway, a switch, a bridge, a wireless access point, a base station (e.g., eNodeB, NodeB, gNodeB, and/or the like), and/or the like. In some implementations, network device <NUM> may be implemented as a physical device implemented within a housing, such as a chassis. In some implementations, network device <NUM> may be implemented as a virtual device implemented by one or more computer devices of a cloud computing environment or a data center.

In some implementations, network device <NUM> may identify an application signature associated with a web application (e.g., based on information stored in data store devices <NUM>), may generate a PAC file, may provide the PAC file to client device <NUM>, may receive traffic from client device <NUM> based on the PAC file, and/or may update the PAC file.

Application platform <NUM> includes one or more devices capable of receiving, generating, storing, processing, and/or providing data associated with generating an application-based proxy auto configuration. For example, application platform <NUM> may include a server device (e.g., a host server, a web server, an application server, etc.), a data center device, and/or a similar device. Application platform <NUM> may receive a packet from network device <NUM>, may store the packet, may transmit the packet to another location, may modify the packet, may transmit one or more packets to the client device, may analyze the packet, and/or the like. In some implementations, application platform <NUM> may be associated with an application, and may receive the application, traffic associated with the application, a packet associated with the application, and/or the like.

In some implementations, as shown, application platform <NUM> may be hosted in cloud computing environment <NUM>. Notably, while implementations described herein describe application platform <NUM> as being hosted in cloud computing environment <NUM>, in some implementations, application platform <NUM> may not be cloud-based (i.e., may be implemented outside of a cloud computing environment) or may be partially cloud-based.

Cloud computing environment <NUM> includes an environment that hosts application platform <NUM>. Cloud computing environment <NUM> may provide computation, software, data access, storage, and/or other services. As shown, cloud computing environment <NUM> may include a group of computing resources <NUM> (referred to collectively as "computing resources <NUM>" and individually as "computing resource <NUM>").

Computing resource <NUM> includes one or more personal computers, workstation computers, server devices, or another type of computation and/or communication device. In some implementations, computing resource <NUM> may host application platform <NUM>. The cloud resources may include compute instances executing in computing resource <NUM>, storage devices provided in computing resource <NUM>, data transfer devices provided by computing resource <NUM>, etc. In some implementations, computing resource <NUM> may communicate with other computing resources <NUM> via wired connections, wireless connections, or a combination of wired and wireless connections.

As further shown in <FIG>, computing resource <NUM> may include a group of cloud resources, such as one or more applications ("APPs") <NUM>-<NUM>, one or more virtual machines ("VMs") <NUM>-<NUM>, one or more virtualized storages ("VSs") <NUM>-<NUM>, and/or one or more hypervisors ("HYPs") <NUM>-<NUM>.

Application <NUM>-<NUM> includes one or more software applications that may be provided to or accessed by one or more devices of environment <NUM>. Application <NUM>-<NUM> may eliminate a need to install and execute the software applications on devices of environment <NUM>. For example, application <NUM>-<NUM> may include software associated with application platform <NUM> and/or any other software capable of being provided via cloud computing environment <NUM>. In some implementations, one application <NUM>-<NUM> may send/receive information to/from one or more other applications <NUM>-<NUM>, via virtual machine <NUM>-<NUM>. In some implementations, application <NUM>-<NUM> may include a software application associated with one or more databases and/or operating systems. For example, application <NUM>-<NUM> may include an enterprise application, a functional application, an analytics application, and/or the like.

Virtual machine <NUM>-<NUM> includes a software implementation of a machine (e.g., a computer) that executes programs like a physical machine. Virtual machine <NUM>-<NUM> may be either a system virtual machine or a process virtual machine, depending upon use and degree of correspondence to any real machine by virtual machine <NUM>-<NUM>. A system virtual machine may provide a complete system platform that supports execution of a complete operating system ("OS"). A process virtual machine may execute a single program, and may support a single process. In some implementations, virtual machine <NUM>-<NUM> may execute on behalf of a user (e.g., a user of client device <NUM> and/or an operator of application platform <NUM>), and may manage infrastructure of cloud computing environment <NUM>, such as data management, synchronization, or long-duration data transfers.

Virtualized storage <NUM>-<NUM> includes one or more storage systems and/or one or more devices that use virtualization techniques within the storage systems or devices of computing resource <NUM>. In some implementations, within the context of a storage system, types of virtualizations may include block virtualization and file virtualization. Block virtualization may refer to abstraction (or separation) of logical storage from physical storage so that the storage system may be accessed without regard to physical storage or heterogeneous structure. The separation may permit administrators of the storage system flexibility in how the administrators manage storage for end users. File virtualization may eliminate dependencies between data accessed at a file level and a location where files are physically stored. This may enable optimization of storage use, server consolidation, and/or performance of non-disruptive file migrations.

Hypervisor <NUM>-<NUM> provides hardware virtualization techniques that allow multiple operating systems (e.g., "guest operating systems") to execute concurrently on a host computer, such as computing resource <NUM>. Hypervisor <NUM>-<NUM> may present a virtual operating platform to the guest operating systems, and may manage the execution of the guest operating systems. Multiple instances of a variety of operating systems may share virtualized hardware resources.

Network <NUM> includes one or more wired and/or wireless networks. For example, network <NUM> may include a mobile network (e.g., a long-term evolution (LTE) network, a code division multiple access (CDMA) network, a <NUM> network, a <NUM> network, a <NUM> network, another type of next generation network, etc.), a public land mobile network (PLMN), a local area network (LAN), a wide area network (WAN), a metropolitan area network (MAN), a telephone network (e.g., the Public Switched Telephone Network (PSTN)), a private network, an ad hoc network, an intranet, the Internet, a fiber optic-based network, a cloud computing network, or the like, and/or a combination of these or other types of networks.

Proxy server device <NUM> includes one or more physical and/or virtual devices capable of receiving, generating, storing, processing, and/or providing data associated with generating an application-based proxy auto configuration. In some implementations, proxy server device <NUM> may include a network device, a server device, a client device, and/or the like. In some implementations, proxy server device <NUM> may include various types of devices capable of functioning as an intermediary between client device <NUM> and application platform <NUM>. For example, proxy server device <NUM> may transmit, for client device <NUM>, traffic to application platform <NUM>, may transmit, for application platform <NUM>, traffic to client device <NUM>, and/or the like. In some implementations, proxy server device <NUM> may perform various security functions for traffic transmitted by, and traffic that is to be received by, client device <NUM>, such as threat detection and/or intrusion detection, deep packet inspection, and/or the like.

<FIG> and <FIG> are diagrams of example components of one or more devices of <FIG>. <FIG> is a diagram of example components of a device <NUM>. Device <NUM> may correspond to client device <NUM>, data store device <NUM>, network device <NUM>, application platform <NUM>, proxy server device <NUM>, and/or the like. In some implementations, client device <NUM>, data store <NUM>, network device <NUM>, application platform <NUM>, proxy server device <NUM>, and/or the like, may include one or more devices <NUM> and/or one or more components of device <NUM>. As shown in <FIG>, device <NUM> may include a bus <NUM>, a processor <NUM>, a memory <NUM>, a storage component <NUM>, an input component <NUM>, an output component <NUM>, and/or a communication interface <NUM>.

Bus <NUM> includes a component that permits communication among multiple components of device <NUM>. Processor <NUM> is implemented in hardware, firmware, and/or a combination of hardware and software. Processor <NUM> takes the form of a central processing unit (CPU), a graphics processing unit (GPU), an accelerated processing unit (APU), a microprocessor, a microcontroller, a digital signal processor (DSP), a field-programmable gate array (FPGA), an application-specific integrated circuit (ASIC), and/or another type of processing component. In some implementations, processor <NUM> includes one or more processors capable of being programmed to perform a function. Memory <NUM> includes a random access memory (RAM), a read only memory (ROM), and/or another type of dynamic or static storage device (e.g., a flash memory, a magnetic memory, and/or an optical memory) that stores information and/or instructions for use by processor <NUM>.

Communication interface <NUM> includes a transceiver-like component (e.g., a transceiver and/or a separate receiver and transmitter) that enables device <NUM> to communicate with other devices, such as via a wired connection, a wireless connection, or a combination of wired and wireless connections. Communication interface <NUM> may permit device <NUM> to receive information from another device and/or provide information to another device. For example, communication interface <NUM> may include an Ethernet interface, an optical interface, a coaxial interface, an infrared interface, a radio frequency (RF) interface, a universal serial bus (USB) interface, a Wi-Fi interface, a cellular network interface, or the like.

Device <NUM> may perform one or more processes described herein. Device <NUM> may perform these processes based on processor <NUM> executing software instructions comprised on or within a computer-readable medium, such as memory <NUM> and/or storage component <NUM>. A computer-readable medium may be a non-transitory memory device. A memory device includes memory space within a single physical storage device or memory space spread across multiple physical storage devices. In other examples, a computer-readable medium may be a transitory medium such as a carrier signal or a transmission medium.

<FIG> is a diagram of example components of a device <NUM>. Device <NUM> may correspond to network device <NUM>. In some implementations, network device <NUM> may include one or more devices <NUM> and/or one or more components of device <NUM>. As shown in <FIG>, device <NUM> may include one or more input components <NUM>-<NUM> through <NUM>-B (B ≥ <NUM>) (hereinafter referred to collectively as input components <NUM>, and individually as input component <NUM>), a switching component <NUM>, one or more output components <NUM>-<NUM> through <NUM>-C (C ≥ <NUM>) (hereinafter referred to collectively as output components <NUM>, and individually as output component <NUM>), and a controller <NUM>.

Input component <NUM> may be points of attachment for physical links and may be points of entry for incoming traffic, such as packets. In some implementations, input component <NUM> may send and/or receive packets.

In some implementations, switching component <NUM> may enable input components <NUM>, output components <NUM>, and/or controller <NUM> to communicate.

In some implementations, output component <NUM> may send packets and/or receive packets. In some implementations, input component <NUM> and output component <NUM> may be implemented by the same set of components (e.g., an input/output component may be a combination of input component <NUM> and output component <NUM>).

The processor is implemented in hardware, firmware, and/or a combination of hardware and software.

In some implementations, controller <NUM> may communicate with other devices, networks, and/or systems connected to device <NUM> in order to exchange information regarding network topology. Controller <NUM> may create routing tables based on the network topology information, create forwarding tables based on the routing tables, and forward the forwarding tables to input components <NUM> and/or output components <NUM>.

Controller <NUM> may perform one or more processes described herein. Controller <NUM> may perform these processes in response to executing software instructions stored by a non-transitory computer-readable medium.

<FIG> is a flow chart of an example process <NUM> for generating an application-based proxy auto configuration. In some implementations, one or more process blocks of <FIG> may be performed by a network device (e.g., network device <NUM>). In some implementations, one or more process blocks of <FIG> may be performed by another device or a group of devices separate from or including the network device, such as a client device (e.g., client device <NUM>), a data store device (e.g., data store device <NUM>), an application platform (e.g., application platform <NUM>), a proxy server device (e.g., proxy server device <NUM>), and/or the like.

As shown in <FIG>, process <NUM> may include identifying an application signature associated with a web application (block <NUM>). For example, the network device (e.g., using computing resource <NUM>, processor <NUM>, memory <NUM>, storage component <NUM>, communication interface <NUM>, input component <NUM>, switching component <NUM>, output component <NUM>, controller <NUM>, and/or the like) may identify an application signature associated with a web application, as described above.

As further shown in <FIG>, process <NUM> may include determining, based on an application-based policy associated with the web application, an access method to be used to transmit traffic associated with the web application (block <NUM>). For example, the network device (e.g., using computing resource <NUM>, processor <NUM>, memory <NUM>, storage component <NUM>, communication interface <NUM>, input component <NUM>, switching component <NUM>, output component <NUM>, controller <NUM>, and/or the like) may determine, based on an application-based policy associated with the web application, an access method to be used to transmit traffic associated with the web application, as described above.

As further shown in <FIG>, process <NUM> may include generating a proxy auto configuration (PAC) file using the application signature associated with the web application, and the access method to be used to transmit the traffic associated with the web application (block <NUM>). For example, the network device (e.g., using computing resource <NUM>, processor <NUM>, memory <NUM>, storage component <NUM>, controller <NUM>, and/or the like) may generate a PAC file using the application signature associated with the web application, and the access method to be used to transmit the traffic associated with the web application, as described above.

As further shown in <FIG>, process <NUM> may include providing the PAC file to a client device to permit the client device to transmit the traffic associated with the web application based on the PAC file (block <NUM>). For example, the network device (e.g., using computing resource <NUM>, processor <NUM>, memory <NUM>, storage component <NUM>, communication interface <NUM>, switching component <NUM>, output component <NUM>, controller <NUM>, and/or the like) may provide the PAC file to a client device to permit the client device to transmit the traffic associated with the web application based on the PAC file, as described above.

In some implementations, when identifying the application signature associated with the web application, the network device may identify the application signature based on information, associated with the web application, stored in an application signature store. In some implementations, when generating the PAC file, the network device may dynamically generate the PAC file based on an Internet protocol (IP) address and a port identifier, associated with the web application, identified in an application cache. In some implementations, the application-based policy, associated with the web application, may specify the access method to be used to transmit the traffic associated with the web application.

In some implementations, the traffic associated with the web application may be transmitted to an application server associated with the web application, via a deep packet inspection proxy server; the traffic associated with the web application may be transmitted to the application server associated with the web application, via an intrusion prevention system proxy server; or the traffic associated with the web application may be transmitted to the application server associated with the web application without using a proxy server.

In some implementations, when providing the PAC file to the client device, the network device may receive, from the client device, a request for the PAC file, and may provide, based on receiving the request, the PAC file to the client device. In some implementations, the network device may host the PAC file at a uniform resource identifier (URI) associated with the PAC file.

As further shown in <FIG>, process <NUM> may include associating the PAC file with a URL (block <NUM>). For example, the network device (e.g., using computing resource <NUM>, processor <NUM>, memory <NUM>, storage component <NUM>, communication interface <NUM>, input component <NUM>, switching component <NUM>, output component <NUM>, controller <NUM>, and/or the like) may associate the PAC file with a URL, as described above.

As further shown in <FIG>, process <NUM> may include providing the PAC file to a client device based on receiving a request, from the client device, that specifies the network address (block <NUM>). For example, the network device (e.g., using computing resource <NUM>, processor <NUM>, memory <NUM>, storage component <NUM>, communication interface <NUM>, switching component <NUM>, output component <NUM>, controller <NUM>, and/or the like) may provide the PAC file to a client device based on receiving a request, from the client device, that specifies the network address, as described above.

Process <NUM> may include additional implementations, including any single implementation or any combination of implementations described below and/or in connection with one or more other processes described elsewhere herein.

In some implementations, when generating the PAC file, the network device may dynamically generate the PAC file based on an Internet protocol (IP) address and a port identifier, associated with the web application, identified in an application cache. In some implementations, when dynamically generating the PAC file based on the IP address and the port identifier, associated with the web application, identified in the application cache, the network device may dynamically generate the PAC file based on determining that information identifying the IP address and a port identifier, associated with the web application, have been added to the application cache. In some implementations, when dynamically generating the PAC file, the network device may generate JavaScript code corresponding to an association between the IP address and the port identifier associated with the web application and the access method to be used to transmit the traffic associated with the web application.

In some implementations, when dynamically generating the PAC file based on the IP address and the port identifier, associated with the web application, identified in the application cache, the network device may determine whether a time interval, associated with the IP address and the port identifier identified in the application cache, has expired and may remove the IP address and the port identifier identified from the application cache based on determining that the time interval has expired.

In some implementations, the application signature comprises information identifying a user agent associated with the web application. In some implementations, information identifying the application signature associated with the web application may be stored in an application cache associated with the network device, and the application signature may include information identifying a host domain associated with the web application and information identifying an application protocol associated with the web application.

As shown in <FIG>, process <NUM> may include identifying a plurality of application signatures, wherein a respective application signature, of the plurality of application signatures, is associated with a respective web application of a plurality of web applications (block <NUM>). For example, the network device (e.g., using computing resource <NUM>, processor <NUM>, memory <NUM>, storage component <NUM>, communication interface <NUM>, input component <NUM>, switching component <NUM>, output component <NUM>, controller <NUM>, and/or the like) may identify a plurality of application signatures, as described above. In some implementations, a respective application signature, of the plurality of application signatures, may be associated with a respective web application of a plurality of web applications.

As further shown in <FIG>, process <NUM> may include determining a plurality of access methods to be used to transmit traffic associated with the plurality of web applications, wherein a respective access method, of the plurality of access methods, is to be used to transmit traffic associated with the respective web application (block <NUM>). For example, the network device (e.g., using computing resource <NUM>, processor <NUM>, memory <NUM>, storage component <NUM>, communication interface <NUM>, input component <NUM>, switching component <NUM>, output component <NUM>, controller <NUM>, and/or the like) may determine a plurality of access methods to be used to transmit traffic associated with the plurality of web applications, as described above. In some implementations, a respective access method, of the plurality of access methods, may be used to transmit traffic associated with the respective web application.

As further shown in <FIG>, process <NUM> may include generating a proxy auto configuration (PAC) file using each application signature of the plurality of application signatures, and the respective access method to be used to transmit traffic associated with the respective web application (block <NUM>). For example, the network device (e.g., using computing resource <NUM>, processor <NUM>, memory <NUM>, storage component <NUM>, controller <NUM>, and/or the like) may generate a PAC file using each application signature of the plurality of application signatures, and the respective access method to be used to transmit traffic associated with the respective web application, as described above.

As further shown in <FIG>, process <NUM> may include providing the PAC file to a client device (block <NUM>). For example, the network device (e.g., using computing resource <NUM>, processor <NUM>, memory <NUM>, storage component <NUM>, communication interface <NUM>, switching component <NUM>, output component <NUM>, controller <NUM>, and/or the like) may provide the PAC file to a client device, as described above.

In some implementations, a first web application, of the plurality of web applications, may be associated with a first web application type, a second web application, of the plurality of web applications, may be associated with a second web application type, and the first web application type and the second web application type may be different web application types.

In some implementations, each web application, of the plurality of web applications, may be associated with a different web application group type. In some implementations, when generating the PAC file, the network device may dynamically generate the PAC file based on an Internet protocol (IP) address and a port identifier, associated with the web application, identified in an application cache. In some implementations, when dynamically generating the PAC file, the network device may dynamically generate the PAC file based on determining that information identifying the IP address and a port identifier, associated with the web application, have been added to the application cache. In some implementations, when dynamically generating the PAC file, the network device may generate a JavaScript code corresponding to an association between the IP address and the port identifier associated with the web application and the access method to be used to transmit the traffic associated with the web application.

<FIG> is a flow chart of an example process <NUM> for statically generating an application-based proxy auto configuration. In some implementations, one or more process blocks of <FIG> may be performed by a network device (e.g., network device <NUM>). In some implementations, one or more process blocks of <FIG> may be performed by another device or a group of devices separate from or including the network device, such as a client device (e.g., client device <NUM>), a data store device (e.g., data store device <NUM>), an application platform (e.g., application platform <NUM>), a proxy server device (e.g., proxy server device <NUM>), and/or the like.

As shown in <FIG>, process <NUM> may include getting the next application signature, associated with a web application, from an application signature store (block <NUM>). For example, the network device (e.g., using computing resource <NUM>, processor <NUM>, memory <NUM>, storage component <NUM>, communication interface <NUM>, input component <NUM>, switching component <NUM>, output component <NUM>, controller <NUM>, and/or the like) may get the next application signature, associated with a web application, from an application signature store.

As further shown in <FIG>, process <NUM> may include getting the next application signature rule from the application signature (block <NUM>). For example, the network device (e.g., using computing resource <NUM>, processor <NUM>, memory <NUM>, storage component <NUM>, communication interface <NUM>, input component <NUM>, switching component <NUM>, output component <NUM>, controller <NUM>, and/or the like) may get the next application signature rule from the application signature.

As further shown in <FIG>, process <NUM> may include determining whether the application signature rule is a host-based pattern rule (block <NUM>). For example, the network device (e.g., using computing resource <NUM>, processor <NUM>, memory <NUM>, storage component <NUM>, communication interface <NUM>, switching component <NUM>, output component <NUM>, controller <NUM>, and/or the like) may determine whether the application signature rule is a host-based pattern rule. If the application signature rule is not a host-based pattern rule (e.g., the application signature rule includes rules other than server hostname or server URL rules) (block <NUM>-No), the network device may ignore the application signature rule and may return to block <NUM> to get next application signature rule from the application signature.

As further shown in <FIG>, if the application signature rule has a pattern for server hostname or server URL (block <NUM>-Yes), process <NUM> may include extracting the application signature rule from application signature (block <NUM>). For example, the network device (e.g., using computing resource <NUM>, processor <NUM>, memory <NUM>, storage component <NUM>, communication interface <NUM>, switching component <NUM>, output component <NUM>, controller <NUM>, and/or the like) may extract the application signature rule from application signature.

As further shown in <FIG>, process <NUM> may include extracting an access method policy, associated with the web application, from a security policy store (block <NUM>). For example, the network device (e.g., using computing resource <NUM>, processor <NUM>, memory <NUM>, storage component <NUM>, communication interface <NUM>, input component <NUM>, switching component <NUM>, output component <NUM>, controller <NUM>, and/or the like) may extract an access method policy, associated with the web application, from a security policy store.

As further shown in <FIG>, process <NUM> may include generating JavaScript code for the extracted application signature rule and access method policy (block <NUM>). For example, the network device (e.g., using computing resource <NUM>, processor <NUM>, memory <NUM>, storage component <NUM>, communication interface <NUM>, input component <NUM>, switching component <NUM>, output component <NUM>, controller <NUM>, and/or the like) may generate JavaScript code for the extracted application signature rule and access method policy. In some implementations, the extract application signature rule may include a pattern for a server hostname (or server URL), and the generated JavaScript code may include a pattern similar to that illustrated in <FIG>.

As further shown in <FIG>, process <NUM> may include determining whether there are any remaining application signature rules in the application signature (block <NUM>). For example, the network device (e.g., using computing resource <NUM>, processor <NUM>, memory <NUM>, storage component <NUM>, communication interface <NUM>, input component <NUM>, switching component <NUM>, output component <NUM>, controller <NUM>, and/or the like) may determine whether there are any remaining application signature rules in the application signature. If the network device determines that there are remaining application signature rules in the application signature (block <NUM>-Yes), process <NUM> may return to block <NUM> so that the next application signature rule may be extracted.

As further shown in <FIG>, if the network device determines that there are no remaining application signature rules in the application signature (block <NUM>-No), process <NUM> may include determining whether there are any remaining application signatures, included in the application signature store, to be processed (block <NUM>). For example, the network device (e.g., using computing resource <NUM>, processor <NUM>, memory <NUM>, storage component <NUM>, communication interface <NUM>, switching component <NUM>, output component <NUM>, controller <NUM>, and/or the like) may determine whether there are any remaining application signatures, included in the application signature store, to be processed. If the network device determines that there are any remaining application signatures, included in the application signature store, to be processed (block <NUM>-Yes), process <NUM> may return to block <NUM> so that the next application signature may be processed. If the network device determines that there are no remaining application signatures, included in the application signature store, to be processed (block <NUM>-No), process <NUM> may end.

<FIG> is a flow chart of an example process <NUM> for dynamically generating an application-based proxy auto configuration. In some implementations, one or more process blocks of <FIG> may be performed by a network device (e.g., network device <NUM>). In some implementations, one or more process blocks of <FIG> may be performed by another device or a group of devices separate from or including the network device, such as a client device (e.g., client device <NUM>), a data store device (e.g., data store device <NUM>), an application platform (e.g., application platform <NUM>), a proxy server device (e.g., proxy server device <NUM>), and/or the like.

As shown in <FIG>, process <NUM> may include determining whether a web application is a new web application added to an application cache (block <NUM>). For example, the network device (e.g., using computing resource <NUM>, processor <NUM>, memory <NUM>, storage component <NUM>, communication interface <NUM>, input component <NUM>, switching component <NUM>, output component <NUM>, controller <NUM>, and/or the like) may determine whether a web application is a new web application added to an application cache.

As further shown in <FIG>, if the web application is a new web application added to the application cache (block <NUM>-Yes), process <NUM> may include determining whether the web application configured in PAC file has a corresponding rule adding the entry to application cache does not have server hostname pattern or server URL pattern and was thus ignored during static PAC file generation (block <NUM>). For example, the network device (e.g., using computing resource <NUM>, processor <NUM>, memory <NUM>, storage component <NUM>, communication interface <NUM>, input component <NUM>, switching component <NUM>, output component <NUM>, controller <NUM>, and/or the like) may determine whether the web application configured in PAC file has a corresponding rule adding the entry to application cache does not have server hostname pattern or server URL pattern and was thus ignored during static PAC file generation.

As further shown in <FIG>, if the rule adding this entry in application cache does not correspond to one having server hostname or URL and was ignored during static PAC file generation (block <NUM>-Yes), process <NUM> may include generating a JavaScript code for the IP address and port identifier rule associated with the web application, and an access method policy associated with the web application (block <NUM>). For example, the network device (e.g., using computing resource <NUM>, processor <NUM>, memory <NUM>, storage component <NUM>, controller <NUM>, and/or the like) may generate a JavaScript code for the IP address and port identifier rule associated with the web application, and an access method policy associated with the web application.

As further shown in <FIG>, if the web application is not a new web application added to the application cache (block <NUM>-No), process <NUM> may include determining whether a time interval, associated with a cache entry of the web application in the application cache, has expired (block <NUM>). For example, the network device (e.g., using computing resource <NUM>, processor <NUM>, memory <NUM>, storage component <NUM>, communication interface <NUM>, switching component <NUM>, output component <NUM>, controller <NUM>, and/or the like) may determine whether a time interval, associated with a cache entry of the web application in the application cache, has expired.

As further shown in <FIG>, if the time interval has expired, process <NUM> may include deleting the cache entry, for the web application, from the application cache (block <NUM>). For example, the network device (e.g., using computing resource <NUM>, processor <NUM>, memory <NUM>, storage component <NUM>, communication interface <NUM>, input component <NUM>, switching component <NUM>, output component <NUM>, controller <NUM>, and/or the like) may delete the cache entry, for the web application, from the application cache.

As further shown in <FIG>, process <NUM> may include determining whether the cache entry, for the web application, in the application cache was used to generate the PAC file (block <NUM>). For example, the network device (e.g., using computing resource <NUM>, processor <NUM>, memory <NUM>, storage component <NUM>, communication interface <NUM>, input component <NUM>, switching component <NUM>, output component <NUM>, controller <NUM>, and/or the like) may determine whether the cache entry, for the web application, in the application cache was used to generate the PAC file.

As further shown in <FIG>, if the cache entry, for the web application, in the application cache was used to generate the PAC file, process <NUM> may include removing the JavaScript code, from PAC file, for the matching IP address and port identifier application signature rule (block <NUM>). For example, the network device (e.g., using computing resource <NUM>, processor <NUM>, memory <NUM>, storage component <NUM>, communication interface <NUM>, input component <NUM>, switching component <NUM>, output component <NUM>, controller <NUM>, and/or the like) may remove the JavaScript code, from PAC file, for the matching IP address and port identifier application signature rule.

As used herein, "traffic" or "content" may include a set of packets. A packet may refer to a communication structure for communicating information, such as a protocol data unit (PDU), a network packet, a datagram, a segment, a message, a block, a cell, a frame, a subframe, a slot, a symbol, a portion of any of the above, and/or another type of formatted or unformatted unit of data capable of being transmitted via a network.

It will be apparent that systems and/or methods, described herein, may be implemented in different forms of hardware, firmware, and/or a combination of hardware and software. The actual specialized control hardware or software code used to implement these systems and/or methods does not limit the implementations.

Claim 1:
A network device (<NUM>), comprising:
one or more memories (<NUM>); and
one or more processors (<NUM>) to:
identify an application signature associated with a web application;
determine, based on an application-based policy associated with the web application, an access method to be used to transmit traffic associated with the web application;
dynamically generate a proxy auto configuration "PAC" file based on network endpoint information, associated with the web application, identified in an application cache, using:
the application signature associated with the web application, and
the access method to be used to transmit the traffic associated with the web application; and
provide the PAC file to a client device to permit the client device to transmit the traffic associated with the web application based on the PAC file.