Fastly, Inc.

Fasly, Inc.

Tyler B McMullen

Artur Bergman

Sean A Leach

Simon Wistow

Jonathan T Foote

Christian Peron

Eric Hodel

Patrick Hickey

Jason Cook

Federico Schwindt

Alan Kasindorf

Bruce Spang

Disclosed herein are enhancements for operating a web application firewall to reduce load. In one implementation, a method of operating a content server for a web application comprising running a web accelerator with a plurality of threads on the content server. The method further provides receiving a request for content which will be provided to a web application, filtering the request and determining that the content will be requested from a second server. After determining that the content will be requested from a second server, reviewing the request with a web application firewall operating at a network layer 7, forwarding the request, receiving the content, and providing the content. Further, the web application firewall is controlled by a plurality of sets of rules, which can be updated without restarting the web accelerator.

Web application firewall for an online service

Disclosed herein are enhancements for deploying application in an edge system of a communication network. In one implementation, a runtime environment identifies a request from a Hypertext Transfer Protocol (HTTP) accelerator service to be processed by an application. In response to the request, the runtime environment may identify an isolation resource to support the request, initiate execution of code for the application, and pass context to the code. Once initiated, the runtime environment may copy data from the artifact to the isolation resource using the context and return control to the HTTP accelerator service upon executing the code.

Isolating applications at the edge

Disclosed herein are enhancements for operating a web application firewall to reduce load. In one implementation, a method of operating a content server for a web application comprising running a web accelerator with a plurality of threads on the content server. The method further provides receiving a request for content which will be provided to a web application, filtering the request and determining that the content will be requested from a second server. After determining that the content will be requested from a second server, reviewing the request with a web application firewall operating at a network layer, forwarding the request, receiving the content, and providing the content. Further, the web application firewall is controlled by a plurality of sets of rules, which can be updated without restarting the web accelerator.

Disclosed herein are methods, systems, and software for configuration change processing for end-user content request handling in content delivery nodes. In one example, a method of changing a content configuration for a content delivery node includes receiving a configuration change request by an end user. The method further provides, processing the configuration change request and a present configuration to generate a changed configuration comprising an assembly level code representation of the changed configuration, and transferring the changed configuration for delivery to the content delivery node.

Configuration change processing for content request handling

Disclosed herein are enhancements for deploying applications in an edge system of a communication network. In one implementation, a cache node in a content delivery network identifies a request for an application that is shared by a plurality of customers. In response to the request, the cache node determines whether the customer associated with the request is permitted to execute the application and, if permitted, initiates the application as an isolation instance. The cache node further, in response to completing the application, returns control to a source operation associated with the request.

Managing shared applications at the edge of a content delivery network

Described herein are methods, systems, and software to handle verification information in a content node. In one example, a method of operating a content node includes receiving a secure content request from an end user device and determining the availability of verification information stored on the content node to service the secure content request. The method further provides, if the verification information is available, verifying the end user device based on the verification information. The method also includes, if the verification information is unavailable, querying an origin server to verify the end user device.

Security information management for content delivery

Described herein are enhancements for operating content nodes in a content delivery network. In at least one implementation, a content node deploys a request handler configuration and a key-value object, wherein the key-value object includes one or more key-value pairs and wherein the request handler configuration calls, in response to a content request from an end user device, the key-value object using a key associated with the content request and the key-value object returns a value associated with the key. The content node further obtains a request to modify the key-value object, identifies a modification to the key-value object based on the command, and updates the key-value object with the modification.

Management of edge dictionary containers in content nodes of a content delivery network

Described herein are enhancements for operating cache nodes in a content delivery network to synchronize edge dictionary configurations. In at least one implementation, a cache node of a content delivery network receives a content request from an end user device. In response to the request, the cache node identifies a modification to a key-value pair of an edge dictionary, wherein the edge dictionary comprises a reference key-value function for a Hypertext Transfer Protocol (HTTP) accelerator service. The method further provides generating a modified version of the edge dictionary based on the modification, and transferring a notification of the modification to at least one other cache node in the content delivery network.

Management of edge dictionaries in a content delivery network

Described herein are methods, systems, and software for encrypting and erasing data objects in a content node. In one example, a method of operating a content node that caches content divided into one or more data objects includes encrypting the one or more data objects using separate encryption keys for each of the one or more data objects, the separate encryption keys comprising a common portion shared by the one or more data objects and an individualized portion unique to each data object. The method further provides receiving a purge request to erase at least one data object and, responsive to the purge request, erasing at least one of the common portion or the individualized portion for the at least one data object based on the purge request.

Encrypted purging of data from content node storage

Systems, methods, and software for operating a content delivery system to purge cached content are provided herein. In one example, purge messages are transferred for delivery to content delivery nodes (CDNs) in the content delivery system. The CDNs receive the messages, purge content associated with the messages, and compile purge summaries based on the messages. The CDNs further periodically transfer the purge summaries to one another to compare the messages received, and gather purge information for purge messages that may have been inadvertently missed by the CDNs.

Data purge distribution and coherency

Disclosed herein are enhancements for operating a content delivery network to load balance origin requests to origin servers. In one implementation, a method of operating a content delivery network comprising a plurality of cache nodes that cache content between end user devices and origin servers includes, in a first cache node of the plurality of cache nodes, obtaining distribution information indicative of how each cache node in the plurality of cache nodes has distributed content requests to the origin servers. The method further provides, in the first cache node maintaining a load balancing profile for the plurality of origin servers based on the distribution information, and distributing a content request to an origin server in the plurality of origin servers based at least in part on the load balancing profile for the plurality of origin servers.

Load balancing across origin servers

Systems, methods, and software for operating one or more content delivery nodes (CDN), which cache content for delivery to end users, are provided herein. In one example, content requests received from at least a first end user for the content at a first CDN are monitored to determine when the content requests comprise an attack on the first CDN. Responsive to the attack on the first CDN, a rate limit is established in the first CDN on at least the content requests received by the first CDN and an indication of the attack is transferred for delivery to at least a second CDN. Responsive to the indication of the attack, the rate limit is applied for further content requests received for the content at the second CDN.

Growing community of inventors

San Francisco, CA, United States of America

Tyler B McMullen