Method and system for automatically bypassing network proxies in the presence of interdependent traffic flows

1. A method comprising:

initiating, by a client device, a communication session with an origin server;

determining, by a terminal facilitating communication between the client device and a remotely located gateway over a first network, if messages in the communication session contain state information associated with a secure session;

querying a first database within the terminal for an internet protocol (IP) address of the origin server, if the messages do not contain state information, the first database containing, at least in part, one or more bypass IP addresses;

establishing the communication session directly with the origin server via the gateway and over a public network if the messages contain state information or if the IP address of the origin server is present in the first database;

establishing the communication session, via a proxy server within the gateway and over the public network, with the origin server if the messages do not contain state information and if the IP address of the origin server is not present in the first database; and

automatically updating a second database within the terminal with a symbolic name of the origin server if the communication session is established directly with the origin server, the second database containing, at least in part, one or more symbolic names.

2. The method of claim 1 , wherein establishing the communication session via a proxy server further comprises:

querying the second database for the symbolic name of the origin server; and

automatically updating the first database with the IP address of the origin server if the symbolic name is present in the second database.

3. The method of claim 1 , further comprising:

detecting an incomplete state message resulting from the communication session established via the proxy server;

querying the second database for a host name contained in the incomplete state message; and

automatically updating the first database with an IP address corresponding to the host name contained in the incomplete state message, if the host name is present in the second database.

4. The method of claim 1 , wherein initiating a communication session further comprises:

monitoring a port number associated with the communication session; and

concluding that messages in the communication session contain state information if the port number is reserved for secure communication.

5. The method of claim 4 , wherein the port number is reserved for secure communication, and the concluding further comprises:

performing a reverse Domain Name System (DNS) lookup of the destination IP address of the origin server in order to obtain a resulting symbolic name;

querying the second database for the resulting symbolic name; and

automatically updating the first database with the IP address of the origin server if the resulting symbolic name is present in the second database.

6. The method of claim 4 , wherein the port number is reserved for secure communication, and the concluding further comprises:

performing a reverse DNS lookup of the IP address of the origin server in order to obtain a resulting symbolic name; and

automatically updating the second database with the resulting symbolic name.

7. The method of claim 4 , wherein the port number is reserved for secure communication, and the concluding further comprises:

examining a client hello message transmitted while initiating the communication session;

extracting a domain name stored within a “server name” field of the client hello message; and

updating the second database with the extracted domain name.

8. The method of claim 1 , further comprising:

receiving a 3xx status response from the origin server after the communication session has been established;

detecting a secure Uniform Resource Locator (URL) in a “location field” of the 3xx status response; and

updating the first database with the IP address of the origin server.

9. The method of claim 1 , further comprising:

performing a deep packet inspection of a request header transmitted while initiating the communication session;

extracting a protocol stored in an “upgrade” field of the request header;

determining whether the extracted protocol can support a secure communication session; and

updating the first database with the destination IP address of the origin server.

10. The method of claim 1 , further comprising:

monitoring responses from DNS lookups to detect canonical name (CNAME) responses and detect one or more IP addresses corresponding to the CNAME responses;

automatically updating the first database with the detected one or more IP addresses; and

automatically updating the second database with the detected CNAME response.

11. A system comprising:

at least one client device capable of initiating a communication session with an origin server;

a terminal configured, at least in part, to facilitate communication to/from the at least one client device over a first network, the terminal comprising:

a proxy routing unit,

a proxy communication unit,

a first database for storing a plurality of bypass IP addresses, and

a second database for storing symbolic names of a plurality of origin servers; and

a gateway for routing traffic to/from the terminal over the first network and to/from the origin server over a public network, the gateway comprising:

a proxy server configured to provide intermediary functions between the at least one client device and the origin server, and

at least one processor configured, at least in part, to manage routing operations and intermediary functions,

wherein the proxy routing unit is configured to:

determine if messages in the communication session contain state information associated with a secure session,

query the first database for an internet protocol (IP) address of the origin server, if the messages do not contain state information, the first database containing, at least in part, one or more bypass IP addresses,

establish the communication session directly with the origin server, via the gateway and the public network, if the messages contain state information or if the IP address of the origin server is present in the first database, and

automatically updating a second database with a symbolic name of the origin server if the communication session is established directly with the origin server, the second database containing, at least in part, one or more symbolic names,

wherein the proxy communication unit is configured to establish the communication session, via the proxy server and the public network, with the origin server if the messages do not contain state information and if the IP address of the origin server is not present in the first database, and

wherein the gateway is remotely located from the terminal.

12. The system of claim 11 , wherein the proxy communication unit is further configured to:

query the second database for the symbolic name of the origin server; and

update the first database with the IP address of the origin server if the symbolic name is present in the second database.

13. The system of claim 11 , wherein the proxy communication unit is further configured to:

detect an incomplete state message resulting from the communication session established via the proxy server;

query the second database for a host name contained in the incomplete state message; and

update the first database with an IP address corresponding to the host name contained in the incomplete state message, if the host name is present in the second database.

14. The system of claim 11 , wherein the proxy routing unit is further configured to:

monitoring a port number associated with the communication session; and

conclude that messages in the communication session contain state information if the port number is reserved for secure communication.

15. The system of claim 14 , wherein:

the port number is reserved for secure communication;

the terminal further comprises an address lookup and translation unit configured to perform a reverse DNS lookup of the destination IP address of the origin server in order to obtain a resulting symbolic name; and

the proxy routing unit is further configured to query the second database for the resulting symbolic name, and update the first database with the IP address of the origin server if the resulting symbolic name is present in the second database.

16. The system of claim 14 , wherein:

the port number is reserved for secure communication;

the terminal further comprises an address lookup and translation unit configured to perform a reverse DNS lookup of the destination IP address of the origin server in order to obtain a resulting symbolic name; and

the proxy routing unit is further configured to update the second database with the resulting symbolic name.

17. The system of claim 14 , wherein the port number is reserved for secure communication, and proxy routing unit is further configured to:

examine a client hello message transmitted while initiating the communication session;

extract a domain name stored within a “server name” field of the client hello message; and

update the second database with the extracted domain name.

18. The system of claim 11 , wherein the proxy communication unit is further configured to:

examine a 3xx status response from the origin server after the communication session has been established;

detect a secure Uniform Resource Locator (URL) in a “location field” of the 3xx status response; and

update the first database with the IP address of the origin server.

19. The system of claim 11 , wherein the proxy communication unit is further configured to:

perform a deep packet inspection of a request header transmitted while initiating the communication session;

extract a protocol stored in an “upgrade” field of the request header;

determine whether the extracted protocol can support a secure communication session; and

update the first database with the destination IP address of the origin server.

20. The system of claim 11 , wherein the terminal further comprises an address lookup and translation unit configured to:

maintain protocol conversion information for at least known origin servers;

monitor responses from DNS lookups to detect canonical name (CNAME) responses and detect one or more IP addresses corresponding to the CNAME responses;

update the first database with the detected one or more IP addresses; and

update the second database with the detected CNAME response.