Akamai Technologies, Inc.

David Tang

Charles E Gero

Cameron Ross

Vishal A Patel

John Payne

Methods for implementing Proof of Work (PoW) as an authorization signal are provided in a multi-node distributed operating environment wherein a set of authorization proxies are used to control access to protected resources. Each authorization proxy is enabled to provide PoW challenges to requesting clients. The methods enforce the constraint that PoW can only be exchange for access once. The approach thus prevents replays of PoW, e.g., wherein a client could do the work and then use that PoW for access multiple times, or a nefarious user could steal the PoW from another client to gain access to the protected resource.

Proof of work as an authorization signal

An agent deployed within a private network creates on-demand connections to an intermediary node outside the private network. When a client contacts the intermediary node for an application or more generally any service available from within the private network, the intermediary node signals the agent to create the on-demand connection outbound to the intermediary. The agent may include advance information in the signal that accelerates the establishment of the on-demand connection and/or transmission of responsive data to the client.

Establishing on demand connections to intermediary nodes with advance information for performance improvement

It is often necessary to securely transfer data, such as authenticators or authorization tokens, between programs running on the same end-user device. The teachings hereof enable the pairing of two programs executing on a given end-user device and then the transfer of data from one program to the other. In an embodiment, a first program connects to a server and sends encrypted data elements. A second program intercepts the connection and/or the encrypted data elements. The second program tunnels the encrypted data elements (which remain opaque to the second program at this point) to a server, using an encapsulating protocol. This enables the server to receive the data elements sent by the first program, decrypt them, and provide them to the second program via return message using control fields of the encapsulating protocol. Once set up, the tunneling arrangement enables bidirectional data transfer.

Secure transfer of data between programs executing on the same end-user device

Among other things, this document describes systems, devices, and methods for improving the mapping of end user clients to content servers. In one embodiment, an intermediary DNS server receives a DNS answer with multiple IP addresses. The intermediary DNS server modifies this answer before passing it on to the end user client&#x2014;that is the end user client that originally requested name resolution of the hostname. Modification can involve filtering the list to remove low-performing IP addresses, re-ordering the list, blocking certain IPs according to policy, or other things. The intermediary DNS server can be operated by a internet service provider (carrier) or an enterprise, for example, or provided on their behalf by a third party as a service. The modification can be based on knowledge of the client-side network, including the location and connectivity of the end user client.

Growing community of inventors

Medford, MA, United States of America

David Tang