Systems and methods for controlling cacheability and privacy of objects

• US 10,404,820 B2
• Filed: 03/23/2017
• Issued: 09/03/2019
• Est. Priority Date: 10/04/2013
• Status: Active Grant

• Current Assignee: Akamai Technologies, Inc.
• Original Assignee: Akamai Technologies, Inc.
• Inventors: Flack, Martin T., Ludin, Stephen L., Steiner, Moritz M.
• Primary Examiner(s): Tiv, Backhean
• Application Number:
  US15/467,918
• Publication Number:
  US 20180041599A1
• Time in Patent Office: 894 Days
• Field of Search: None
• CPC Class Codes: G06F 16/00 Information retrieval; Database structures therefor; File system structures therefor
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 67/568 Storing data temporarily at an intermediate stage, e.g. caching
• CPC Class Codes: H04L 67/60 Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources admission control or resource allocation H04L47/70
• CPC Class Codes: H04N 21/23106 involving caching operations prefetching while addressing of a memory level in which the access to the desired data or data block requires associative addressing means within memory systems or architectures G06F12/0862; caching at an intermediate stage in a data network H04L67/568
• CPC Class Codes: H04N 7/1675 Providing digital key or authorisation information for generation or regeneration of the scrambling sequence pseudo-random number generators in general G06F7/58

Abstract

Described herein are systems, devices, and methods for content delivery on the Internet. In certain non-limiting embodiments, a caching model is provided that can support caching for indefinite time periods, potentially with infinite or relatively long time-to-live values, yet provide prompt updates when the underlying origin content changes. Origin-generated tokens can drive the process of caching, and can be used as handles for later invalidating origin responses within caching proxy servers delivering the content. Tokens can also be used to control object caching behavior at a server, and in particular to control how an object is indexed in cache and who it may be served to. Tokens may indicate, for example, that responses to certain requested URL paths are public, or may be used to map user-id in a client request to a group for purposes of locating valid cache entries in response to subsequent client requests.

Claims

1. A computer-implemented method performed by a server, comprising:

receiving a first request from a client device, the first request including a first identifier and being directed to a URL, the first identifier corresponding to a first class of one or more users;

in response to the first request from the client device, generating a forward request to an origin server;

receiving a response to the forward request from the origin server, the response comprising a token that comprises a second identifier, the second identifier corresponding to a second class of one or more users;

upon receiving the response, storing a mapping of the first identifier to the second identifier in a local data structure;

receiving a second request from the client device, and in response to the second request;

(i) consulting the local data structure to obtain the mapping of the first identifier to the second identifier;

(ii) incorporating the second identifier into a cache-key computation to determine a cache-key;

(iii) retrieving content from a local cache, the content being stored under the cache-key calculated based on the second identifier;

(iv) serving the content to the client device.

2. The method of claim 1, further comprising:

receiving a third request from a second client device, the third request including a third identifier;

determining that the third identifier is associated with the second identifier;

identifying the content in the local cache as responsive to the third request;

serving the content to the second client device in response to the third request.

3. The method of claim 1, wherein the second identifier corresponds with the second class of one or more users, and the second class is the public.

4. The method of claim 1, wherein the first identifier in the first request is in a cookie.

5. The method of claim 1, further comprising, the server propagating the local data structure across a network of servers.

6. The method of claim 1, wherein the first class comprises an admin class, and the second class comprises a user class.

7. The method of claim 1, wherein the second request comprises the first identifier.

8. The method of claim 1, wherein the token in the response indicates that the first identifier should be mapped to the second identifier.

9. An apparatus, comprising:

a hardware processor;

computer memory storing computer program instructions executed by the one or more hardware processors, the computer program instructions comprising;

program code to receive a first request from a client device, the first request including a first identifier and being directed to a URL, the first identifier corresponding to a first class of one or more users;

program code to, in response to the first request from the client device, generate a forward request to an origin server;

program code to receive a response to the forward request from the origin server, the response comprising a token that comprises a second identifier, the second identifier corresponding to a second class of one or more users;

program code to store a mapping of the first identifier to the second identifier in a local data structure;

program code to receive a second request from the client device, and in response to the second request;

(i) consult the local data structure to obtain the mapping of the first identifier to the second identifier;

(ii) incorporate the second identifier into a cache-key computation to determine a cache-key;

(iii) retrieve content from a local cache is the content being stored under the cache-key calculated based on the second identifier;

(iv) serve the content to the client device.

10. The apparatus of claim 9, wherein the first identifier in the first request is in a cookie.

11. The apparatus of claim 9, wherein the second class is the public.

12. The apparatus of claim 9, wherein the first class comprises an admin class, and the second class comprises a user class.