Akamai Technologies, Inc.

Microsoft Technology Licensing, LLC

T-mobile Usa, Inc.

Michael A Bishop

Stephen L Ludin

Tin Qian

Martin T Flack

Aravind Ramarathinam

Shawn David Corey

Alan Denis MacDonald

Moritz M Steiner

Andrew Lee Watts

Utkarsh Goel

Jeff Ahmet

Taha Najeeb

Waqas Gull

Grzegorz Wosik

Hirsch Patrick Singhal

Keith Wood

Aditya Mehta

Boris Maisuradze

Muhammad Shakil

Jay Eritsland

Tomas Soderberg

Aaron Sorrell

Duncan Allan Horn

It is often important that a server's responses to a set of client requests are coherent with one another, but if the client's requests are spread over time, that may not occur. In accordance with the teaching of this patent document, a client is able to communicate with a server to achieve coherency. A client can send a request (e.g., an HTTP request for a given resource) with a data preservation directive. The data preservation directive causes the server to initiate a server-side process to preserve the state of underlying server-side data upon which the response relies (or will rely). Also, a client can send a request with an attribute requesting the response be coherent with respect to some date-time or other reference point. This attribute thus asks the server to ensure coherency in the response to the client.

Ensuring coherency across responses when handling a series of client requests

A multi-tenant service platform provides network services, such as content delivery, edge compute, and/or media streaming, on behalf of, or directly for, a given tenant. The service platform offers a policy layer enabling each tenant to specify levels of acceptable performance degradation that the platform may incur so that the platform can use electricity with desirable characteristics to service client requests associated with that tenant. Service nodes in the platform (e.g., edge servers) enforce the policy layer at the time of a service request. Preferably, the 'quality' of the electricity is a measurement of source of the energy, e.g., whether it is sourced from high-carbon fossil fuels (low-quality) or low-carbon renewables (high-quality). If the desired quality of electricity cannot be achieved, the node can resort to using less electricity to handle the request, which is achieved in a variety of ways.

Service platform with configurable electricity usage characteristics

This document describes, among other things, systems and methods for more efficiently resuming a client-to-origin TLS session through a proxy layer that fronts the origin in order to provide network security services. At the time of an initial TLS handshake with an unknown client, for example, the proxy can perform a set of security checks. If the client passes the checks, the proxy can transmit a 'proxy token' upstream to the origin. The origin can incorporate this token into session state data which is passed back to and stored on the client, e.g., using a TLS session ticket extension field, pre-shared key extension field, or other field. On TLS session resumption, when the client sends the session state data, the proxy can recover its proxy token from the session state data, and upon successful validation, bypass security checks that it would otherwise perform against the client, thereby more efficiently handling known clients.

Systems and methods for proxying encrypted traffic to protect origin servers from internet threats

Systems and methods for authenticating a peripheral device prior to allowing the peripheral device access to components and data stored on user equipment. In some examples, the user equipment may include an authorization component that is configured to physically decouple a hardware interface from other components of the user equipment until the authorization component is able to authenticate the peripheral device. Both authorized peripheral devices and the user equipment may be provisioned with authorization data and/or credentials from a system outside the control of the individual users of the user equipment.

Host-based hardware peripheral authorization system

Techniques for proxy based network access are discussed herein. In some examples, the techniques can be implemented in a network proxy device for Citizens Broadband Radio Service (CBRS). A base station or a domain proxy device may manage or otherwise use CBRS resources by exchanging signaling messages with a Spectrum Access System (SAS). The base station or domain proxy device may transmit signaling messages in a first private network to a network device bridging the first private network and a second private network with limited access to a public network. The network device send proxy message(s) in response to the signaling messages to the SAS and can establish an encrypted session layer or application layer tunnel between the base station and/or domain proxy device. The proxy based network access preserves secure networks while still allowing limited messaging with other public or private networks.

Proxy based network access

Systems and techniques are provided for detecting rogue base stations and preventing malicious actors from intercepting and stealing data traffic from mobile devices through rogue base stations. Upon connecting to a newly detected base station for a cellular network service, a mobile device attempts to validate the cellular base station with a validation server before any data is transmitted over the new connection. If the mobile device does not receive a confirmation of validity from the validation server, the mobile device would identify the cellular base station as a rogue base station, disconnect from the rogue base station, and search for a valid base station for connection to the cellular network.

Network assisted validation of secure connection to cellular infrastructure

A system includes a processor and a computer-readable medium storing instructions for execution. The instructions include generating a cryptographic pair of user public and private keys for a user. The instructions include registering an identity of the user with an identity provider, transmitting the user public key, and receiving a user certificate from the identity provider. The instructions include signing a trust certificate for a web server, including an address and a public key of the web server, with the user private key. The instructions include, in response to an access request from the user specifying a second web server: obtaining a second trust certificate from the second web server; and establishing a connection with the second web server in response to successful verification of a signature of the second trust certificate using a public key corresponding to a trusted contact of the user.

Identity-based certificate authority system architecture

Among other things, this document describes systems, devices, and methods for improving the delivery of resources embedded on a web page. In one embodiment, a content delivery network analyzes markup language documents that clients have requested to embedded resources, such as linked references to images, scripts, fonts, cascading style sheets, or other types of content. This analysis may be conducted on the content server and/or asynchronously, in a dedicated analytical environment, to produce delivery instructions. Where embedded resources have hostnames for which the content delivery network is authoritative, and where certain conditions are met, servers can be instructed to push additional certificates for such hostnames over the primary connection. When embedded resources have hostnames for which the platform is not authoritative, and where certain conditions are met, servers can be instructed to pre-fetch and push such resources with a signature from the authoritative origin.

Content delivery network (CDN) providing accelerated delivery of embedded resources from CDN and third party domains

A network performance monitor for a computer. The performance monitor maintains a baseline for communication paths between a networked computer and other networked computers connected. The network performance baseline is established and maintained by measuring and updating network performance parameters of the communication paths. The network performance parameters are updated using values obtained during time intervals when the communication path consumed a bandwidth approximately equal to its estimated bandwidth. If congestion is detected on the network or the network is underutilized, values of the network performance parameters obtained during that interval are not used to update the network performance parameters. Some performance parameters in the baseline, such as minimum and maximum bandwidth values may be updated by computing a moving average of each parameter. Asymmetric weight values for updating the moving average may be selected based on a direction of change of a value of a network parameter.

Network performance monitor

A method of measuring, for communication paths between a networked computer and at least one other networked computer connected via a network performance, network information to detect network performance degradation and diagnose source(s) of the performance degradation. The diagnosis may be performed by a progressive elimination of possible sources. Network performance degradation may be attributed to problems at a local network or the Internet. The problem sources on the Internet may comprise, for example, an internet server provider (ISP) or a single remote server in communication with the networked computer. A network performance baseline established and maintained for each path may be employed in diagnosing the network performance degradation.

Growing community of inventors

Bellevue, WA, United States of America

Michael A Bishop