Akamai Technologies, Inc.

Hewlett-packard Development Company, L.p.

Agilent Technologies, Inc.

John A Dilley

Philip A Lisiecki

Stephen L Ludin

Erik L Nygren

Sudhin Mishra

Joshua Hunt

Karl-Eliv J Hallin

William Edward Weihl

Thomas P Devanneaux

Andrew D Berkheimer

Joel M Wein

Prasanna Laghate

John F Summers

Alexander Sherman

Don A Dailey

Chandrasekar Venkatraman

Robert H Hyerle

Marcos Frid

Leena Sansguiri

Paul Chou

Nandakumar Natarajan

Arne Luhrs

Dave Goh

Richard J Friedrich

Tai Y Jin

Martin F Arlitt

Stephane J Perret

Ronald Kroesen

A cloud-based firewall system and service is provided to protect customer sites from attacks, leakage of confidential information, and other security threats. In various embodiments, such a firewall system and service can be implemented in conjunction with a content delivery network (CDN) having a plurality of distributed content servers. The CDN servers receive requests for content identified by the customer for delivery via the CDN. The CDN servers include firewalls that examine those requests and take action against security threats, so as to prevent them from reaching the customer site. The CDN provider implements the firewall system as a managed firewall service, with the operation of the firewalls for given customer content being defined by that customer, independently of other customers. In some embodiments, a customer may define different firewall configurations for different categories of that customer's content identified for delivery via the CDN.

Cloud based firewall system and service

Cloud based firewell system and service

According to certain non-limiting embodiments disclosed herein, the functionality of a server is extended with a mechanism for identifying connections with clients that have exhibited attack characteristics (for example, characteristics indicating a DoS attack), and for transitioning internal ownership of those connections such that server resources consumed by the connection are reduced, while keeping the connection open. The connection thus moves from a state of relatively high resource use to a state of relatively low server resource use. According to certain non-limiting embodiments disclosed herein, the functionality of a server is extended by enabling the server to determine that any of a client and a connection exhibits one or more attack characteristics (e.g., based on at least one of client attributes, connection attributes, and client behavior during the connection, or otherwise). As a result of the determination, the server changes its treatment of the connection.

Server with queuing layer mechanism for changing treatment of client connections

Systems and methods for reducing server resources associated with a client connection

Server with mechanism for changing treatment of client connections determined to be related to attacks

A content file purge mechanism for a content delivery network (CDN) is described. A Web-enabled portal is used by CDN customers to enter purge requests securely. A purge request identifies one or more content files to be purged. The purge request is pushed over a secure link from the portal to a purge server, which validates purge requests from multiple CDN customers and batches the requests into an aggregate purge request. The aggregate purge request is pushed from the purge server to a set of staging servers. Periodically, CDN content servers poll the staging servers to determine whether an aggregate purge request exists. If so, the CDN content servers obtain the aggregate purge request and process the request to remove the identified content files from their local storage.

Method and system for purging content from a content delivery network

According to certain non-limiting embodiments disclosed herein, the functionality of a server is extended with a mechanism for identifying connections with clients that have exhibited attack characteristics (for example, characteristics indicating a DoS attack), and for transitioning internal ownership of those connections such that server resources consumed by the connection are reduced, while keeping the connection open. The connection thus moves from a state of relatively high resource use to a state of relatively low server resource use, and the server is able to free resources such as memory and processing cycles previously allocated to the connection. In some cases, the server maintains the connection for at least some time and uses it to keep the client occupied so that it cannot launch&#x2014;or has fewer resources to launch&#x2014;further attacks, and possibly to gather information about the attacking client.

Server with mechanism for reducing internal resources associated with a selected client connection

A network device includes a web server chip that is connectable to a computer network. The web server chip includes an embedded processor that is programmable to function as a manageability web server, obtain manageability information about the network device and send the manageability to a network manager. The web server chip further includes an interface for communicating with an IC bus in the network device. The embedded processor is programmable to obtain manageability information about devices connected to the IC bus. The embedded processor is also programmable to control fan controllers, power supply controllers and other controllers connected to the IC bus. This, in turn, allows a network manager to command the web server chip to remotely power up and power down the network device. Thus, the web server chip can perform network management functions without burdening the host processor of the network device. If network communications are performed via HTTP, the embedded processor can be programmed to implement an HTTP server, and the network manger can use a web browser and HTML files to run network management software.

Web server chip for network manageability

A tiered distribution service is provided in a content delivery network (CDN) having a set of surrogate origin (namely, 'edge') servers organized into regions and that provide content delivery on behalf of participating content providers, wherein a given content provider operates an origin server. According to the invention, a cache hierarchy is established in the CDN comprising a given edge server region and either (a) a single parent region, or (b) a subset of the edge server regions. In response to a determination that a given object request cannot be serviced in the given edge region, instead of contacting the origin server, the request is provided to either the single parent region or to a given one of the subset of edge server regions for handling, preferably as a function of metadata associated with the given object request. The given object request is then serviced, if possible, by a given CDN server in either the single parent region or the given subset region. The original request is only forwarded on to the origin server if the request cannot be serviced by an intermediate node.

System for tiered distribution in a content delivery network

Method and system for tiered distribution in a content delivery network

A data access network system is described that includes a content server coupled to a plurality of proxy servers via an interconnect network. The content server store at least one content file. The data access network system also includes a system of maintaining content consistency between the content server and the proxy servers. The system includes a subscription manager in the content server that specifies all of the proxy servers that are subscribed to the content file. The system also includes a consistency manager that notifies all of the subscribed proxy servers that cache the content file to discard the cached content file from those proxy servers when the content file is updated in the content server. A method of maintaining content consistency between the content server and the proxy servers is also described.

Content consistency in a data access network system

Growing community of inventors

Los Altos, CA, United States of America

John A Dilley