Secure personal server system and method
View Patent ↗A provider computer announces content to the provider computer and establishes a secure connection to a VPN server. Requests for the content are received in one protocol (HTTPS) from the consumer computer and forwarded to the VPN server in a less secure protocol (HTTP) by a protocol conversion proxy, which then forwards the request to the provider computer. A public URL and secure URL may be associated with the same content. The public URL is announced to a consumer computer. A public server receives the public URL and returns the secure URL, which consumer computer uses to establish a secure connection to the provider computer. Upon the secure URL being compromised, a new secure URL is associated with the public URL. The source IP addresses of requests for the public and secure URLs may be compared to determine whether the secure URL is compromised.
1. A method for providing access to content comprising:
receiving, by a server system from a first network address, a first request containing a first reference to a first content on a first computer;
returning, by the server system to the first network address, in response to the first request, a response containing a second reference to a second content on a second computer;
receiving, by the server system from a second network address, a second request containing the second reference to the second content on the second computer;
determining, by the server system, that the second request was received from the second network address that is different from the first network address to which the server system previously transmitted the second reference; and
in response to determining that the second request was received from the second network address that is different from the first network address to which the server system previously transmitted the second reference to the second content, refraining from returning the second content from the second computer to the second network address.
2. The method of claim 1 , further comprising:
receiving, by the server system a third request containing the second reference to the second content on second computer;
determining, by the server system, that the third request is from the first network address; and
in response to determining that the third request is from the first network address to which the server system previously transmitted the second reference, returning, by the server system to the first network address, the second content from the second computer.
3. The method of claim 2 , further comprising:
in response to determining that the third request is from the first network address, forwarding, by the server system, the third request to the second computer, receiving a response from the second computer and sending the response, by the server system, to the first network address; and
in response to determining that the second network address is different from the first network address, refraining from forwarding the second request to the second computer.
4. The method of claim 3 , wherein forwarding the third request to the second computer comprises sending the third request through a reverse connection between the server system and the second computer.
5. The method as in claim 4 , wherein the reverse connection between the server system and the second computer comprises one from a group of virtual private network (VPN) tunnel, proxy connection and secure shell (SSH) connection.
6. The method as in claim 2 , wherein returning the second content from the second computer to the first network address comprises establishing an encrypted communication channel between the second computer and a computer associated with the first network address, the channel being established by using an encryption key accessible by the second computer.
7. The method of claim 6 , wherein the encrypted communication channel uses hyper text transfer secure protocol (HTTPS) and the encryption key accessible by the second computer is a private key for a secure socket layer (SSL) certificate.
8. The method as in claim 6 , further comprising:
in response to determining that the second network address is different from the first network address, sending notification, by the server system, that security of the encryption key accessible by the second computer is compromised.
9. The method as in claim 1 , further comprising:
in response to determining that the second network address is different from the first network address, refraining from returning the second content from the second computer for one or more requests for the second content following the second request.
10. The method as in claim 1 , further comprising:
in response to determining that the second network address is different from the first network address, returning, by the server system, at least one response to a third request for the first content containing a third reference to the second content different from the second reference to the second content returned in response to the first request for the first content.
11. A system for providing access to content comprising one or more processors and one or more memory devices operably coupled to the one or more processors and storing executable and operational code effective to cause the one or more processors to:
receive from a first network address, a first request containing a first reference to a first content on a first computer,
return, to the first network address, a response containing a second reference to a second content on a second computer,
receive, a second request containing the second reference to the second content on the second computer,
if the second request is not from the first network address to which the system previously transmitted the second reference to the second content, refrain from returning the second content in response to the second request.
12. The system of claim 11 , wherein the executable and operational code are further effective to cause the one or more processors to:
only if the second request is from the first network address to which the system previously transmitted the second reference to the second content, return to the first network address, the second content from the second computer.
13. The system of claim 11 , wherein the executable and operational code are further effective to cause the one or more processors to:
only if the second request is from the first network address, (a) forward the second request to the second computer, (b) receive a response to the second request from the second computer, and (c) send the response to the second request to the first network address; and
if the second request is not from the first network address, refrain from forwarding the second request to the second computer.
14. The system of claim 13 , wherein the executable and operational code are further effective to cause the one or more processors to forward the second request to the second computer by sending the second request through a reverse connection between the system and the second computer.
15. The system of claim 14 , wherein the reverse connection between the system and the second computer is selected from the group consisting of a virtual private network (VPN) tunnel, a proxy connection, and a secure shell (SSH) connection.
16. The system of claim 12 , wherein the executable and operational code are further effective to cause the one or more processors to:
return the second content from the second computer to the first network address by establishing an encrypted communication channel between the second computer and a computer associated with the first network address, the channel being established by using an encryption key accessible by the second computer.
17. The system of claim 16 , wherein the encrypted communication channel implements a hyper text transfer secure protocol (HTTPS) and the encryption key accessible by the second computer is a private key for a secure socket layer (SSL) certificate.
18. The system as in claim 16 , wherein the executable and operational code are further effective to cause the one or more processors to:
in response to determining that both of (a) the second request includes the second reference and (b) the second request is from the second network address that is different from the first network address to which the server system sent the second reference, send a notification to the second computer indicating that security of the encryption key accessible by the second computer is compromised.
19. The system as in claim 11 , wherein the executable and operational code are further effective to cause the one or more processors to:
if both of (a) the second request includes the second reference and (b) the second request is from the second network address that is different from the first network address to which the server system sent the second reference, refrain from returning the second content from the second computer for one or more requests for the second content following the second request.
20. The system of claim 11 , wherein the executable and operational code are further effective to cause the one or more processors to, if both of (a) the second request includes the second reference and (b) the second request is from the second network address that is different from the first network address to which the server system sent the second reference:
map a third reference to the second content and the first reference to the first content;
in response to each request subsequent to the second request and including the first reference to the first content, return the third reference to the second content to a source of the each request instead of the second reference to the second content.
21. The system of claim 20 , wherein the first reference is a hypertext transfer protocol (HTTP) uniform resource locator and wherein the second reference and the third reference are hypertext transfer protocol secure (HTTPS) uniform resource locators.