MANAGING SECURE CONTENT IN A CONTENT DELIVERY NETWORK

• US 20130191645A1
• Filed: 03/11/2013
• Published: 07/25/2013
• Est. Priority Date: 09/04/2009
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Richardson, David R., Abrar, Mustafa I., Johnson, Don, Cormie, John, Cavage, Mark Joseph, Marshall, Bradley E.
• Granted Patent: US 9,130,756 B2
• Time in Patent Office: Days
• US Class Current: 713/176
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

A system, method, and computer readable medium for managing secure content by CDN service providers are provided. A network storage provider stores one or more resources on behalf of a content provider. A CDN service provider obtains client computing device requests for secure content. Based on processing first signature information, the CDN service provider determines whether the secure content is available to the client computing device. If the CDN service provider does not maintain the requested content, the CDN service provider transmits a request to the network storage provider. Based on second signature information and an identifier associated with the CDN service provider, the network storage provider processes the request based policy information associated with the identifier.

Claims

1. A system for managing content requests comprising:

one or more first storage devices including a processor and a memory, the one or more first storage devices operative to;

host or process content on behalf of an original content provider;

receive a client request for an embedded resource from a client computing device, wherein the client request is associated with an embedded resource identifier and wherein the client request includes first signature information originally provided to the client computing device from the original content provider; and

provide the embedded resource to the client computing device based on processing the first signature information; and

one or more second storage devices including a processor and a memory, the one or more second storage devices operative to;

receive a first storage device request for an embedded resource from one of the one or more first storage devices, wherein the first storage device request includes second signature information, wherein the second signature information is different from the first signature information; and

responsive to the first storage device request, provide the embedded resource to the first storage device based on processing the second signature information.

2. The system as recited in claim 1, wherein the client request includes a DNS query associated with the embedded resource.

3. The system as recited in claim 1, wherein the second signature information is originally provided by the one or more second storage components.

4. The system as recited in claim 1, wherein the one or more second storage components provide the embedded resource further in accordance with policies associated with the embedded resource identifier.

5. The system as recited in claim 4, wherein the policies associated with the embedded resource identifier correspond to an access control list associated with the embedded resource identifier.

6. The system as recited in claim 5, wherein the access control list is configured by the original content provider.

7. The system as recited in claim 5, wherein the access control list is configured on behalf of the original content provider.

8. The system as recited in claim 5, wherein the access control list identifies one or more entities that may access the requested embedded resource.

9. The system as recited in claim 8, wherein the access control list defines one or more parameters associated with access to the embedded resource by the one or more identified entities.

10. The system as recited in claim 5, wherein the access control list defines one or more parameters associated with the requested embedded resource.

11. The system as recited in claim 10, wherein the one or more parameters include expiration data associated with the requested embedded resource.

12. The system as recited in claim 1, wherein the one or more first storage devices are further operative to verify the first signature information.

13. The system as recited in claim 1, wherein a secure information verification service verifies the first signature information.

14. The system as recited in claim 1, wherein the one or more second storage devices are further operative to verify the second signature information.

15. The system as recited in claim 1, wherein a secure information verification service verifies the second signature information.

16. A computer-implemented method for managing content requests comprising:

hosting or processing content, by a content delivery network (CDN) computing device corresponding to a CDN service provider, on behalf of an original content provider;

receiving, by the CDN computing device, a client request for an embedded resource from a client computing device, wherein the client request is associated with an embedded resource identifier and wherein the client request includes first signature information originally provided to the client computing device from the original content provider;

providing, by the CDN computing device, the embedded resource to the client computing device based on processing the first signature information;

receiving, by a network storage computing device, a first storage device request for an embedded resource from one of the one or more first storage devices, wherein the first storage device request includes second signature information, wherein the second signature information is different from the first signature information; and

responsive to the first storage device request, providing, by the network storage computing device, the embedded resource to the first storage device based on processing the second signature information.

17. The computer-implemented method as recited in claim 16, wherein the second signature information is originally provided by the network storage computing device.

18. The computer-implemented method as recited in claim 16, wherein the network storage computing device provides the embedded resource further in accordance with policies associated with the embedded resource identifier.

19. The computer-implemented method as recited in claim 18, wherein the policies associated with the embedded resource identifier correspond to an access control list associated with the embedded resource identifier.

20. The computer-implemented method as recited in claim 19, wherein the access control list is configured by the original content provider.

21. The computer-implemented method as recited in claim 19, wherein the access control list identifies one or more entities that may access the requested embedded resource.

22. The computer-implemented method as recited in claim 19, wherein the access control list defines one or more parameters associated with the requested embedded resource.

23. The computer-implemented method as recited in claim 22, wherein the one or more parameters include expiration data associated with the requested embedded resource.

24. The computer-implemented method as recited in claim 16 further comprising verifying, by the CDN computing device, the first signature information.

25. The computer-implemented method as recited in claim 16 further comprising verifying, by the network storage computing device, the second signature information.