Secure traffic optimization in an edge network
A client application establishes a connection between the client application and an origin server over one or more networks. The application generates a request to establish a secure session with the origin server over the connection. The request includes information, in a header of the request, that flags traffic sent during the secure session to a network of the one or more networks as subject to one or more optimizations performed by the network. Subsequent to establishing the secure session, the application encrypts the traffic in accordance with the secure session and sends the traffic to the origin server over the connection, subject to the one or more optimizations. The infrastructure service applies the one or more optimizations to the traffic as it passes through the edge network to the origin server.
1. A method of operating a data center, comprising:
receiving a first request to establish a network connection between an end point and an origin server;
forwarding the request to the origin server;
receiving a second request to establish a secure connection over the network connection;
identifying information in a header of the second request that indicates that data exchanged over the secure connection should be subject to an optimization;
forwarding the second request to the origin server;
receiving first encrypted traffic over the secure connection; and
applying the optimization to the first encrypted traffic.
2. The method of claim 1 , wherein the optimization comprises selecting a preferred path for the traffic through the network.
3. The method of claim 1 wherein the request to establish the secure session comprises an initial message in a security handshake between the client application and the origin server.
4. The method of claim 1 , wherein receiving the first request happens in response to a domain name translation request.
5. The method of claim 1 , wherein forwarding the request to the origin server comprises forwarding the request to a second data center, wherein the second data center is not the origin server, but is configured to forward the request to the origin server.
6. The method of claim 1 , wherein the first encrypted traffic comprises traffic encrypted using an encryption key held by the end point and the origin server.
7. The method of claim 1 wherein the network connection comprises a transmission control protocol (TCP) connection.
8. The method of claim 1 wherein the secure connection comprises a transport layer security (TLS) session.
9. The method of claim 1 , wherein the second request to establish a secure connection comprises an initial message in a security handshake between the end point and the origin server.
10. A computing apparatus, comprising:
one or more computer readable storage media;
one or more processors operatively coupled with the one or more computer readable storage media; and
program instructions stored on the one or more computer readable storage media that, when executed by the one or more processors, direct the computing apparatus to at least:
receive a first request to establish a network connection between an end point and an origin server;
forward the request to the origin server;
receive a second request to establish a secure connection over the network connection;
identify information in a header of the second request that indicates that data exchanged over the secure connection should be subject to an optimization;
forward the second request to the origin server;
receive first encrypted traffic over the secure connection; and
apply the optimization to the first encrypted traffic.
11. The computing apparatus of claim 10 , wherein the optimization comprises selecting a preferred path for the traffic through the network.
12. The computing apparatus of claim 10 , wherein the request to establish the secure session comprises an initial message in a security handshake between the client application and the origin server.
13. The computing apparatus of claim 10 , wherein receiving the first request happens in response to a domain name translation request.
14. The computing apparatus of claim 10 , wherein forwarding the request to the origin server comprises forwarding the request to a second data center, wherein the second data center is not the origin server, but is configured to forward the request to the origin server.
15. The computing apparatus of claim 10 , wherein the first encrypted traffic comprises traffic encrypted using an encryption key held by the end point and the origin server.
16. The computing apparatus of claim 10 , wherein the network connection comprises a transmission control protocol (TCP) connection.
17. The computing apparatus of claim 10 , wherein the secure connection comprises a transport layer security (TLS) session.
18. The computing apparatus of claim 10 , wherein the second request to establish a secure connection comprises an initial message in a security handshake between the end point and the origin server.
19. A computing apparatus, configured to:
receive a first request to establish a network connection between an end point and an origin server;
forward the request to the origin server;
receive a second request to establish a secure connection over the network connection;
identify information in a header of the second request that indicates that data exchanged over the secure connection should be subject to an optimization;
forward the second request to the origin server;
receive first encrypted traffic over the secure connection; and
apply the optimization to the first encrypted traffic.
20. The computing apparatus of claim 19 , wherein the optimization comprises selecting a preferred path for the traffic through the network.