PROTECTING COMMUNICATION LINK BETWEEN CONTENT DELIVERY NETWORK AND CONTENT ORIGIN SERVER

• US 20170026338A1
• Filed: 07/22/2015
• Published: 01/26/2017
• Est. Priority Date: 07/22/2015
• Status: Active Grant

• Current Assignee: Fastly Incorporated
• Original Assignee: Fastly Incorporated
• Inventors: Leach, Sean A., Daly, Thomas J., Bergman, Artur
• Granted Patent: US 10,044,673 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 61/2539 Hiding addresses; Keeping addresses anonymous
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/5038 for local use, e.g. in LAN or USB networks, or in a controller area network [CAN]
• CPC Class Codes: H04L 61/5061 Pools of addresses
• CPC Class Codes: H04L 61/5092 by self-assignment, e.g. picking addresses at random and testing if they are already in use
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

A privatized link between an origin server and a content delivery network is provided. A privatized link can be direct connection that does not route over the internet. Another privatized link is one that rotates IP addresses. An origin server may be assigned to use a set of multiple IP addresses for communication with the content delivery network. However, at any given time, the origin server is only using a small number of IP addresses. When one of the IP addresses being used to communicate with the content delivery network comes under attack, the origin server switches to another IP address in the set in order to continue serving content to the content delivery network via an IP address that is not under attack.

Claims

1. A method of protecting a website from attack, comprising:

providing a content delivery network (CDN) having a set of content servers (CS) to provide content delivery on behalf of a set of participating content providers, at least one of the set of content providers sourcing content for delivery by the CDN from an origin server; and

,

providing a privatized link between at least one of the set of content servers and the origin server.

2. The method of claim 1, wherein the privatized link is a direct connection that does not route over the internet between the at least one of the set of content servers and the origin server.

3. The method of claim 1, wherein providing the privatized link comprises:

selecting a set of private IP addresses for use as IP addresses for the origin server for communication between the content delivery network and the origin server;

communicating, by the content delivery network, with the origin server using a first IP address of the set of private IP addresses;

determining that the first IP address is the subject of an attack; and

,

communicating, by the content delivery network, with the origin server using a second IP address of the set of private IP addresses.

4. The method of claim 3, further comprising:

selecting the second IP address from the set of private IP addresses for use as the IP address for the origin server for communication between the content delivery network and the origin server.

5. The method of claim 3, wherein the set of private IP addresses in non-contiguous.

6. The method of claim 3, wherein the set of IP addresses lie within a private IP address range allocated to the content delivery network.

7. The method of claim 4, wherein the second IP address is based on a predetermined order of IP addresses to be selected from the set of private IP addresses.

8. A communication system, comprising:

a content delivery network (CDN) having a set of content servers (CS) to provide content delivery on behalf of a set of participating content providers, at least one of the set of content providers sourcing content for delivery by the CDN from an origin server; and

,

a privatized link between at least one of the set of content servers and the origin server.

9. The communication system of claim 8, wherein the privatized link is a direct connection that does not route over the internet between the at least one of the set of content servers and the origin server.

10. The communication system of claim 8, wherein a set of private IP addresses is selected for use as IP addresses for the origin server for communication between the content delivery network and the origin server.

11. The communication system of claim 8, wherein when the content delivery network determines that a first IP address from the set of private IP addresses being used by the origin server is under attack, the content delivery network and the origin server use a second IP address from the set of private IP addresses for communication of the content between the content delivery network and the origin server.

12. The communication system of claim 11, wherein the set of private IP addresses is non-contiguous.

13. The communication system of claim 12, wherein the set of private IP addresses are contiguous within and within a single routing prefix.

14. The communication system of claim 11, wherein the second IP address is selected from the set of private IP addresses based on the first IP address.

15. The communication system of claim 14, wherein the set of private IP addresses lie within a routing prefix address range allocated to the content delivery network.

16. A method of supplying content to a content delivery network (CDN), comprising:

establishing a communication link between an origin server and a CDN using a first IP address for the origin server, the origin server to provide content to the CDN by responding to requests from the CDN directed to the first IP address;

determining that the first IP address is under attack;

in response to determining the first IP address is under attack, selecting a second IP address to be associated with the origin server; and

,

establishing a communication link between the origin server and the CDN using the second IP address for the origin server, the origin server to provide content to the CDN by responding to requests from the CDN directed to the second IP address.

17. The method of claim 16, wherein the first and second IP addresses are selected according to a predetermined order known to both the CDN and the origin server.

18. The method of claim 17, wherein the first and second IP addresses are selected from a set of IP addresses known to both the CDN and the origin server.

19. The method of claim 18, further comprising:

determining that the first IP address is not under attack;

in response to determining the first IP address is not under attack, selecting the first IP address to be associated with the origin server.

20. The method of claim 19, wherein the first IP address is selected based on determining that the second IP address is under attack.