Method and system for protecting web sites from public internet threats

• US 20040010601A1
• Filed: 07/09/2002
• Published: 01/15/2004
• Est. Priority Date: 07/09/2002
• Status: Active Grant

• Current Assignee: Akamai Technologies, Inc.
• Original Assignee: Akamai Technologies, Inc.
• Inventors: Sundaram, Ravi, Rahul, Hariharan S., Afergan, Michael M., Ellis, Andrew B.
• Granted Patent: US 7,260,639 B2
• Time in Patent Office: Days
• US Class Current: 709/229
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 65/1101 Session protocols
• CPC Class Codes: H04L 65/612 for unicast
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers

Abstract

The present invention addresses the known vulnerabilities of Web site infrastructure by making an origin server substantially inaccessible via Internet Protocol traffic. In particular, according to a preferred embodiment, the origin server is “shielded” from the publicly-routable IP address space. Preferably, only given machines (acting as clients) can access the origin server, and then only under restricted, secure circumstances. In a preferred embodiment, these clients are the servers located in a “parent” region of a content delivery network (CDN) tiered distribution hierarchy. The invention implements an origin server shield that protects a site against security breaches and the high cost of Web site downtime by ensuring that the only traffic sent to an enterprise'"'"'s origin infrastructure preferably originates from CDN servers. The inventive “shielding” technique protects a site'"'"'s Web servers (as well as backend infrastructure, such as application servers, databases, and mail servers) from unauthorized intrusion—improving site uptime and in the process, customer loyalty.

Claims

1. A method operative in a content delivery network (CDN) having a set of content servers organized into regions and that provide content delivery on behalf of participating content providers, wherein a given content provider operates an origin server, comprising:

shielding the given content provider'"'"'s origin server from Internet Protocol (IP) traffic routable over the public Internet; and

delivering content published at the given content provider'"'"'s origin server from a CDN region.

2. The method as described in claim 1 wherein the step of shielding the given content provider'"'"'s origin server includes the step of restricting access to the origin server except via a private IP address space.

3. The method as described in claim 2 further including the step of restricting IP spoofing for addresses within the private IP address space.

4. The method as described in claim 1 wherein the shielding step further includes the steps of:

restricting access to the origin server except via a private IP address space; and

restricting IP spoofing for addresses within the private IP address space

5. The method as described in claim 3 wherein the restricting step is implemented using an access control.

6. The method as described in claim 5 wherein the access control is implemented at a firewall.

7. The method as described in claim 1 further including the step of:

if a given object request cannot be serviced from a CDN region, forwarding the given object request back to the origin server.

8. In a Web site comprising an origin server, a firewall and router connectable to the publicly-routable Internet, the improvement comprising:

apparatus associated with a private IP address space and being positioned upstream of the firewall and downstream of the router for shielding the origin server from Internet Protocol (IP) traffic routable over the public Internet; and

a security mechanism comprising (a) a first access control implemented in the firewall for restricting access to the origin server except via the private IP address space, and (b) a second access control implemented in the router for restricting IP spoofing for addresses within the private IP address space.

9. In the Web site infrastructure as described in claim 8 wherein the apparatus comprises at least one server.

10. In the Web site infrastructure as described in claim 8 wherein the apparatus comprises at least first and second redundant servers.

11. In the Web site infrastructure as described in claim 8 wherein the first access control is an access control list.

12. A method of protecting a Web site from attack, the Web site comprising an origin server, a firewall and router connectable to the publicly-routable Internet, comprising:

restricting access to the origin server except from a private IP address space located between the firewall and the router; and

serving content published at the origin server from a content delivery network.

13. The method as described in claim 12 wherein the step of serving content includes delivering content from a set of content servers.

14. The method as described in claim 13 wherein the set of content servers includes at least one CDN distribution node intermediate the origin server and a subset of content servers located at an Internet Point Of Presence (PoP).