Secure traffic optimization in an edge network
A client application establishes a connection between the client application and an origin server over one or more networks. The application generates a request to establish a secure session with the origin server over the connection. The request includes information, in a header of the request, that flags traffic sent during the secure session to a network of the one or more networks as subject to one or more optimizations performed by the network. Subsequent to establishing the secure session, the application encrypts the traffic in accordance with the secure session and sends the traffic to the origin server over the connection, subject to the one or more optimizations. The infrastructure service applies the one or more optimizations to the traffic as it passes through the edge network to the origin server.
1. A method of operating a client application comprising:
establishing a connection between the client application and an origin server over one or more communication networks;
generating a request to establish a secure session with the origin server over the connection, wherein the request includes information, in a header of the request, that flags traffic sent during the secure session to a network of the one or more networks as subject to one or more optimizations performed by the network; and
subsequent to establishing the secure session, encrypting the traffic in accordance with the secure session and sending the traffic to the origin server over the connection, subject to the one or more optimizations performed by the network.
2. The method of claim 1 wherein the connection comprises a transport layer connection established between the client application and the origin server in accordance with a connection protocol.
3. The method of claim 2 wherein the transport layer connection comprises one of a transmission control protocol (TCP) connection and user datagram protocol (UDP) connection.
4. The method of claim 2 wherein the secure session comprises one of a transport layer security (TLS) session and a secure session layer (SSL) session.
5. The method of claim 1 wherein the request to establish the secure session comprises an initial message in a security handshake between the client application and the origin server.
6. The method of claim 1 wherein the traffic comprises one or more of Session Initiation Protocol (SIP) traffic and Internet of Things (IoT) traffic and wherein the network comprises an edge network that shields the origin server from distributed denial of service (DDoS) attacks.
7. The method of claim 1 wherein the request to establish the secure session comprises a ClientHello message, wherein the header of the request includes a server name identification (SNI) field, and wherein the method further comprises populating the SNI field with the information.
8. The method of claim 1 wherein the one or more optimizations comprises one or more of:
selecting a preferred path for the traffic through the network;
replacing a source address of the traffic with a new source address to influence a return path taken by return traffic sent by the origin server to the client application; and
selecting an egress point of presence (PoP) of the network to a transit network situated between the network and the origin server and routing the traffic to the egress PoP.
9. A computing apparatus comprising:
one or more computer readable storage media;
one or more processors operatively coupled with the one or more computer readable storage media; and
program instructions stored on the one or more computer readable storage media that, when executed by the one or more processors, direct the computing apparatus to at least:
establish a connection between a client application and an origin server over one or more communication networks;
generate a request to establish a secure session with the origin server over the connection, wherein the request includes information, in a header of the request, that flags traffic sent during the secure session to a network of the one or more networks as subject to one or more optimizations performed by the network; and
subsequent to establishing the secure session, encrypt the traffic in accordance with the secure session and sending the traffic to the origin server over the connection, subject to the one or more optimizations performed by the network.
10. The computing apparatus of claim 9 wherein the connection comprises a transport layer connection established in accordance with a connection protocol and wherein the request to establish the secure session comprises an initial message in a security handshake.
11. A method of operating an edge network comprising:
receiving a request, sent by a client application for delivery to an origin server, to establish a secure session over a connection between the client application and the origin server, wherein the request includes information in a header of the request that identifies traffic sent during the secure session as subject to one or more optimizations by the edge network;
removing the information from the header of the request and passing the request through to the origin server; and
subsequent to the client application and the origin server establishing the secure session, applying the one or more optimizations to the traffic sent by the client application as the traffic passes through the edge network to the origin server.
12. The method of claim 11 wherein the connection comprises a transport layer connection established between the client application and the origin server in accordance with a connection protocol.
13. The method of claim 12 wherein the transport layer connection comprises a transmission control protocol (TCP) connection.
14. The method of claim 13 wherein the secure session comprises a transport layer security (TLS) session.
15. The method of claim 13 wherein the request to establish the secure session comprises an initial message in a security handshake between the client application and the origin server.
16. The method of claim 15 wherein the initial message comprises a ClientHello message.
17. The method of claim 16 wherein the header of the request includes a service name identification (SNI) and wherein the SNI field includes the information.
18. The method of claim 11 wherein the one or more optimizations comprises selecting a preferred path for the traffic through the network.
19. The method of claim 11 wherein the one or more optimizations comprises replacing a source address of the traffic with a new source address to force a return path taken by return traffic sent by the origin server to the client application.
20. The method of claim 11 wherein the one or more optimizations comprises selecting an egress point of presence (PoP) of the network to a transit network situated between the network and the origin server and routing the traffic to the egress PoP.