Extending an internet content delivery network into an enterprise environment by locating ICDN content servers topologically near an enterprise firewall

• US 20020138437A1
• Filed: 01/07/2002
• Published: 09/26/2002
• Est. Priority Date: 01/08/2001
• Status: Abandoned Application

• Current Assignee: Akamai Technologies, Inc.
• Original Assignee: Akamai Technologies, Inc.
• Inventors: Lewin, Daniel M., Lewin, Anne E.
• Application Number:
  US10/040,532
• Publication Number:
  US 20020138437A1
• Time in Patent Office: Days
• US Class Current: 705/51
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 65/1101 Session protocols
• CPC Class Codes: H04L 65/613 for the control of the source by the destination control signals issued by the client directed to the server or network components specially adapted for selective content distribution H04N21/637
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

An Internet content delivery network deploys one or more CDN server regions in an enterprise and manages those regions as part of the Internet CDN. In one aspect of the invention, a CDN service provider (CDNSP) deploys one or more CDN regions behind an enterprise'"'"'s corporate firewall(s). The regions are used to deliver Internet content—content that has been tagged or otherwise made available for delivery over the Internet from the CDN'"'"'s content servers. This content includes, for example, content that given content providers have identified is to be delivered by the CDN. In addition, the enterprise may tag intranet content, which is then also served from the CDN regions behind the firewall. Intranet content remains secure by virtue of using the enterprise'"'"'s existing security infrastructure. In accordance with another aspect of the invention, the CDNSP implements access controls and deploys one or more CDN regions outside an enterprise'"'"'s firewall(s) such that intranet content can be served from regions located outside the firewall(s). In this embodiment, the CDNSP can provide granular control, such as permissions per groups of users. In this way, the CDNSP, in effect, extends a conventional virtual private network (VPN) to all or a portion of the ICDN, thereby enabling the CDNSP to use multiple regions and potentially thousands of content servers available to serve the enterprise'"'"'s internal content. In addition to making internal content available from the edge of the network, the CDNSP provides a mechanism by which an enterprise may share secure data with its business partner(s) without setting up any special infrastructure.

Claims

1. A method operative in an Internet content delivery network (ICDN) having a set of content servers organized into regions and that provides delivery of Internet content on behalf of participating content providers, comprising:

establishing a set of one or more enterprise CDN regions topologically near an enterprise firewall, wherein each enterprise CDN region has one or more ECDN-aware surrogate origin servers;

responsive to a request for given ECDN content originating from an a given entity, mapping the given entity to a preferred enterprise CDN region that is likely to host the given ECDN content;

determining if the given entity is authorized to obtain the given ECDN content; and

if the given entity is authorized to obtain the given ECDN content, attempting to serve the given ECDN content from the preferred enterprise CDN region.

2. The method as described in claim 1 wherein the request for given ECDN content identifies a domain that is aliased to an ICDN domain.

3. The method as described in claim 1 wherein the ECDN is published to the ECDN-aware surrogate origin servers in an encrypted format.

4. The method as described in claim 1 further including the steps of:

determining whether the given ECDN content is available from the preferred enterprise CDN region; and

if the given ECDN content is not available from the preferred enterprise CDN region, tunneling back through the enterprise firewall to attempt to fetch the given ECDN content.

5. The method as described in claim 1 wherein the tunneling occurs over an authenticated and encrypted channel.

6. The method as described in claim 1 wherein the given entity is an end user behind the enterprise firewall.

7. The method as described in claim 1 wherein the given entity is an end user associated with an enterprise partner.

8. A method operative in an Internet content delivery network (ICDN) having a set of content servers organized into regions and that provides delivery of Internet content on behalf of participating content providers, comprising:

establishing a first enterprise CDN region topologically near an enterprise firewall, wherein the first enterprise CDN region has one or more ECDN-aware surrogate origin servers;

establishing a second enterprise CDN region within the enterprise firewall, wherein the second enterprise CDN has one or more ICDN-aware surrogate origin servers;

responsive to a request for given content originating from an end user within the enterprise, mapping the end user to the first enterprise CDN region if the given content is ECDN content and mapping the end user to the second enterprise CDN region if the given content is ICDN content;

attempting to serve the given content from the respective enterprise CDN region.

9. The method as described in claim 8 further including the step of determining whether the end user mapped to the second enterprise CDN region is authorized to retrieve the ECDN content.

10. The method as described in claim 8 wherein the second enterprise CDN region is established in a public IP address space.