Secure content delivery system

• US 7,743,132 B2
• Filed: 04/22/2008
• Issued: 06/22/2010
• Est. Priority Date: 08/18/2000
• Status: Expired due to Term

• Current Assignee: Akamai Technologies, Inc.
• Original Assignee: Akamai Technologies, Inc.
• Inventors: Tewari, Anoop Kailasnath, Garg, Vikas, Swildens, Eric Sven-Johan
• Primary Examiner(s): Winder; Patrice
• Assistant Examiner(s): Duong; Thomas
• Application Number:
  US12/107,734
• Publication Number:
  US 20090007241A1
• Time in Patent Office: 791 Days
• Field of Search: 709/223, 709/213
• US Class Current: 709/223
• CPC Class Codes: H04L 12/14 Charging , metering or billing arrangements for data wireline or wireless communications
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/4541 Directories for service discovery
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/1008 based on parameters of servers, e.g. available memory or workload monitoring of computer activity G06F11/30
• CPC Class Codes: H04L 67/101 based on network conditions
• CPC Class Codes: H04L 67/1014 based on the content of a request
• CPC Class Codes: H04L 67/1023 based on a hash applied to IP addresses or costs
• CPC Class Codes: H04L 67/1027 Persistence of sessions during load balancing
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04L 67/5682 Policies or rules for updating, deleting or replacing the stored data
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

A secure streaming content delivery system provides a plurality of content servers connected to a network that host customer content that can be cached and/or stored, e.g., images, video, text, and/or software. The content servers respond to requests for customer content from users. The invention load balances user requests for cached customer content to the appropriate content server. A user makes a request to a customer'"'"'s server/authorization server for delivery of the customer'"'"'s content. The authorization server checks if the user is authorized to view the requested content. If the user is authorized, then the authorization server generates a hash value using the authorization server'"'"'s secret key, the current time, a time-to-live value, and any other information that the customer has configured, and embeds it into the URL which is passed to the user. A content server receives a URL request from the user for customer content cached on the content server. The request is verified by the content server creating its own hash value using the customer server'"'"'s secret key, the current time, a time-to-live value, and any other related information configured for the customer. If the hash value from the URL matches the content server'"'"'s generated hash value, then the user'"'"'s request is valid and within the expiration time period and the content server delivers the requested content to the user.

Claims

1. A process for a secure content delivery and global traffic management network, comprising:

hosting customer content that can be cached and/or stored on a plurality of caching servers connected to the network;

wherein the customer is a customer of a service that manages the plurality of caching servers, the customer paying a fee to the service for hosting customer content on the caching servers;

wherein the caching servers respond to requests for the hosted customer content;

receiving a user request for customer content on a customer'"'"'s server, the customer'"'"'s server managed by the customer;

authorizing the user on the customer'"'"'s server for access to the requested customer content;

calculating an authorization value on the customer'"'"'s server using any of;

the user'"'"'s IP address, corporate gateway IP address, or proxy server IP address;

sending a Universal Resource Locator (URL) to the user in response to the user'"'"'s customer content request, the URL containing the authorization value and specifying a caching server that hosts the requested customer content; and

selecting the caching server from the plurality of caching servers by load balancing requests for hosted customer content among caching servers that host the requested customer content.

2. The process of claim 1, further comprising:

providing a user authorization database on the customer server; and

wherein the user authentication step references the user authorization database to authorize a user.

3. The process of claim 1, wherein the user authentication step requires the user to input his login information.

4. The process of claim 1, wherein the authorization value calculation step uses a current time on the customer server in addition to a secret key to calculate the authorization value.

5. The process of claim 1, wherein the authorization value calculation step uses a time-to-live value in addition to a secret key to calculate the authorization value.

6. The process of claim 1, wherein the authorization value calculation step uses a secret key in addition to the user'"'"'s IP address, corporate gateway IP address, or proxy server IP address, to calculate the authorization value.

7. The process of claim 1, further comprising:

load balancing user requests directed to customer servers among a plurality of customer servers; and

wherein the customer server load balancing step and the caching server load balancing step are performed by an integrated load balancer.

8. The process of claim 1, further comprising:

receiving the URL from a user on a caching server;

verifying the authorization value in the URL on the caching server.

9. The process of claim 8, wherein if the authorization value in the URL is valid then the caching server sends the requested customer content to the user, and wherein if the authorization value in the URL is not valid then the caching server sends the user an access denied indicator.

10. The process of claim 8, wherein if the authorization value in the URL is valid and the caching server'"'"'s current time is within a specified time-to-live then the caching server sends the requested customer content to the user, and wherein if the caching server'"'"'s current time is not within a specified time-to-live then the caching server sends the user an access denied indicator.

11. An apparatus for a secure content delivery and global traffic management network, comprising:

a plurality of caching servers connected to the network hosting customer content that can be cached and/or stored on caching servers;

wherein the customer is a customer of a service that manages the plurality of caching servers, the customer paying a fee to the service for hosting customer content on the caching servers;

wherein the caching servers respond to requests for the hosted customer content;

a user request receiving subsystem that receives a user request for customer content on a customer'"'"'s server, the customer'"'"'s server managed by the customer;

a user authentication subsystem that authorizes the user on the customer'"'"'s server for access to the requested customer content;

an authorization value calculation subsystem that calculates an authorization value on the customer'"'"'s server using any of;

the user'"'"'s IP address, corporate gateway IP address, or proxy server IP address, thereby limiting access via a specific IP address;

a URL subsystem that sends a Universal Resource Locator (URL) to the user in response to the user'"'"'s customer content request, the URL containing the authorization value and specifying a caching server that hosts the requested customer content; and

a caching server load balancer that selects the caching server from the plurality of caching servers by load balancing requests for hosted customer content among caching servers that host the requested customer content.

12. The apparatus of claim 11, further comprising:

a user authorization database on the customer server;

wherein the user authentication subsystem references the user authorization database to authorize a user.

13. The apparatus of claim 11, wherein the user authentication subsystem requires the user to input his login information.

14. The apparatus of claim 11, wherein the authorization value calculation subsystem uses a current time on the customer server in addition to a secret key to calculate the authorization value.

15. The apparatus of claim 11, wherein the authorization value calculation subsystem uses a time-to-live value in addition to a secret key to calculate the authorization value.

16. The apparatus of claim 11, wherein the authorization value calculation subsystem uses a secret key in addition to the user'"'"'s IP address, corporate gateway IP address, or proxy server IP address, to calculate the authorization value.

17. The apparatus of claim 11, further comprising:

a customer load balancer that load balances user requests directed to customer servers among a plurality of customer servers; and

wherein the customer server load balancer and the caching server load balancer are co-located in an integrated load balancer.

18. The apparatus of claim 11, further comprising:

a subsystem that receives the URL from a user on a caching server;

a subsystem that verifies the authorization value in the URL on the caching server.

19. The apparatus of claim 18, wherein if the authorization value in the URL is valid then the caching server sends the requested customer content to the user, and wherein if the authorization value in the URL is not valid then the caching server sends the user an access denied indicator.

20. The apparatus of claim 18, wherein if the authorization value in the URL is valid and the caching server'"'"'s current time is within a specified time-to-live then the caching server sends the requested customer content to the user, and wherein if the caching server'"'"'s current time is not within a specified time-to-live then the caching server sends the user an access denied indicator.