Cisco Technology, Inc.

Riverbed Technology, Inc.

International Business Machines Corporation

Riverbad Technology, Inc.

MArk Stuart Day

Alfred Landrum

Nitin Gupta

Kand Ly

Barbara Liskov

Maksim Ioffe

Blanco Zee Leung Lam

Brian Miller

Steven McCanne

David Tze-Si Wu

James W O'Toole, Jr

Kartik Subbanna

Daniel Edwin Burman

Quinton Yves Zondervan

James O'Toole

Stephen John Foley

Gang Lu

Case Larsen

Shashidhar Merugu

A system of network proxies distributes data to multiple servers. Each network proxy is associated with a server. A network proxy intercepts a client request for data. If the network proxy determines that the request can be served using a copy of data stored on the local server, rather than the data stored on a remote server, it diverts the request to the local server. If the network proxy determines that the request cannot be served using a data from the local server, the network proxy diverts the request to a remote server storing the primary copy of the data. A server map specifies the locations of the primary copies of data. When a primary copy of data is updated on one of the servers, the associated network proxy propagates the updated data to the other servers. The servers can provide data from files, e-mail services, databases, or multimedia services.

Reliability and availability of distributed servers

Network devices include proxies and where multiple proxies are present on a network, they can probe to determine the existence of other proxies. Where more than two proxies are present and thus different proxy pairings are possible, the proxies are programmed to determine which proxies should form a proxy pair. Marked probe packets are used by proxies to discover each other and probing is done such a connection can be eventually formed even if some probe packets fail due to the marking. Asymmetric routing can be detected and proxies configured for connection forwarding as necessary.

System for selecting a proxy pair based on configurations of autodiscovered proxies on a network

Transparent network devices intercept messages from non-transparent network devices that establish a connection. Transparent network devices modify these messages to establish an inner connection with each other. The transparent network devices mimic at least some of the outer connection messages to establish their inner connection. The mimicked messages and any optional reset messages are intercepted by the transparent network devices to prevent them from reaching the outer connections. Transparent network devices modify network traffic, using error detection data, fragmentation data, or timestamps, so that inner connection network traffic inadvertently received by outer connection devices is rejected or ignored by the outer connection network devices. Transparent network devices may use different sequence windows for inner and outer connection network traffic. To prevent overlapping sequence windows, transparent network devices monitor the locations of the inner and outer connection sequence windows and may rapidly advance the inner connection sequence window as needed.

Establishing network connections between transparent network devices

Transaction accelerators can be configured to terminate secure connections. A server-side accelerator intercepts a secure connection request that is from a client and that is directed to a server. The server-side accelerator responds to the secure connection request in place of the server, thereby establishing a secure connection between the client and the server-side accelerator. Alternatively, the server-side accelerator monitors the establishment of a secure connection between the client and the server. After the secure connection has been established, the server-side accelerator forwards security information to a client-side accelerator, enabling the client-side accelerator to assume control of the secure connection. As a result of this arrangement, the client-side accelerator is able to encrypt and decrypt data on the secure connection and accelerate it in cooperation with the server-side accelerator. In a further embodiment, the accelerated traffic between accelerators is carried across the network via another secure connection.

Split termination for secure communication protocols

Mechanisms and techniques operating in a content distribution network in a peering relationship with a second content distribution network. The system maintains a first client list identifying a first set of client devices associated with a first content distribution network. The system also obtains a second client list identifying a second set of client devices associated with a second content distribution network. The system applies a client list filtering technique to the first client list and the second client list to produce a preferred client list associated with the second content distribution network. The preferred client list potentially identifies at least one preferred client device for which the second content distribution network preferably processes client requests. The system then operates a content routing technique to direct a client request associated with a client device to a content distribution network having a preferred client list that identifies the client device associated with the client request as a preferred client device.

Methods and apparatus for processing client requests in a content distribution network using client lists

Selecting proxies from among autodiscovered proxies

Preventing data corruption with transparent network connections

Presently disclosed are methods and apparatus for analyzing packets and packet flows to detect covert communications channels (including reverse tunnels) in real time. These systems actively probe a suspicious connection in ways that are not possible in prior art log-based techniques and may initiate countermeasures against discovered covert channels. The present system may be implemented in a network device, such as an intrusion detection system, content engine, or other intermediary device employing a web cache. Embodiments automatically detect suspicious activity at particular source addresses by using relatively simple tests to detect suspect packets that should receive more extensive scrutiny. After more rigorous secondary testing (optionally including active probing techniques), suspect packets are either returned to the occasionally-checked state or flagged for further action, such as raising an alert or taking automatic countermeasures against the covert channel or its originators.

Automatic detection of reverse tunnels

Mechanisms and techniques provide a method for distributing content over a network includes receiving content elements form content sources, queuing the elements for distribution on a transmission channel, and distributing the content elements over the transmission channel to a self-selecting network. distribution of the content elements can be based upon payment information or content characteristics of the content elements. These mechanisms and techniques provide an opportunity for the distribution of content, produced by individual providers, to a wide audience.

System and method for distribution of content over a network

Presently disclosed are apparatus and methods for coordinating the delivery of messages and/or message notifications among multiple messaging media and message services so that the successful delivery of one copy of a message results in the deletion of other, redundant message copies still in transit to the recipient and the cancellation of any other message waiting notifications still pending. The system may be implemented with a network-connected device (such as but not limited to a server, switch, or router) containing or having connected to it a user interface, a coordination server, and a plurality of message services. Embodiments of the invention thus provide message delivery management that is more user-friendly, computationally- and resource-efficient and more adaptable to changing user preferences and user locations/addresses.

Message delivery coordination among multiple messaging media

In an edge network, message traffic between the edge network and a core network passes through the edge router. A port scanning attack directed to the network as a whole (core network) potentially emanates from within the LAN. The edge router includes a network throttling device which identifies and mitigates harmful transmissions such that they do not propagate to the core network. The network throttling device has a connection daemon to scan transactions and determine deviant or atypical connection attempts. A session database stores a transaction history representing a window of previous connection attempts. A pattern detector examines the history and looks for malicious behavior. Identified deviant patterns cause a throttler enforcer to limit the triggering user by restricting future connection attempts, thus mitigating harmful effects. Usage, therefore, is not prevented, but resilience to deviant practices is provided. Accordingly, virus propagation via port scanning is mitigated to a safe level and false alarms targeting legitimate activity are minimized.

Network connection detection and throttling

A GUI and CDN server device provide user modifiable selections of preferences for delivery treatment, and map the user selections to technical operational parameters in the CDN servers for effecting the requested delivery treatment. Users typically find it beneficial to interact with a file (content) entity in terms of the user visible delivery treatment. The server device provides the ability to define the delivery treatment according to the manner in which the user finds most beneficial. However, the CDN operational parameters for effecting such delivery are not readily available or understood by a typical user. Using the GUI, the CDN server identifies a content entity, and receives at least one user selection variable indicative of delivery treatment of the identified content entity. A correlator maps the received user selections to operational parameters according a set of rules, and a delivery engine effects delivery of the content entity according to the mapped operational parameters to provide delivery results according to the preferred delivery treatment.

Growing community of inventors

Milton, MA, United States of America

MArk Stuart Day