Systems and methods for controlling cacheability and privacy of objects

• US 9,641,640 B2
• Filed: 10/06/2014
• Issued: 05/02/2017
• Est. Priority Date: 10/04/2013
• Status: Active Grant

• Current Assignee: Akamai Technologies, Inc.
• Original Assignee: Akamai Technologies, Inc.
• Inventors: Flack, Martin T., Ludin, Stephen L., Steiner, Moritz M.
• Primary Examiner(s): Tiv, Backhean
• Application Number:
  US14/507,754
• Publication Number:
  US 20150207897A1
• Time in Patent Office: 939 Days
• Field of Search: None
• CPC Class Codes: G06F 16/00 Information retrieval; Database structures therefor; File system structures therefor
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 67/568 Storing data temporarily at an intermediate stage, e.g. caching
• CPC Class Codes: H04L 67/60 Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources admission control or resource allocation H04L47/70
• CPC Class Codes: H04N 21/23106 involving caching operations prefetching while addressing of a memory level in which the access to the desired data or data block requires associative addressing means within memory systems or architectures G06F12/0862; caching at an intermediate stage in a data network H04L67/568
• CPC Class Codes: H04N 7/1675 Providing digital key or authorisation information for generation or regeneration of the scrambling sequence pseudo-random number generators in general G06F7/58

Abstract

Described herein are systems, devices, and methods for content delivery on the Internet. In certain non-limiting embodiments, a caching model is provided that can support caching for indefinite time periods, potentially with infinite or relatively long time-to-live values, yet provide prompt updates when the underlying origin content changes. Origin-generated tokens can drive the process of caching, and can be used as handles for later invalidating origin responses within caching proxy servers delivering the content. Tokens can also be used to control object caching behavior at a server, and in particular to control how an object is indexed in cache and who it may be served to. Tokens may indicate, for example, that responses to certain requested URL paths are public, or may be used to map user-id in a client request to a group for purposes of locating valid cache entries in response to subsequent client requests.

Claims

1. A computer-implemented method operable in a server, comprising:

receiving a first request from a client device, the first request being directed to a URL, the first request including an identifier associated with any of (i) the client device and (ii) a user of the client device;

in response to the first request, generating a forward request to a remote source;

receiving a response to the forward request from the remote source, the response comprising content and a token, the token indicating that the identifier should not be used in calculating a cache key for the content;

storing the content in a local cache, wherein said storing comprises calculating a cache key for the content without reference to the identifier;

receiving a second request from a second client device, the second request being directed to the URL;

identifying the content in the local cache as responsive to the request, based at least in part on the cache key;

serving the content to the second client from the local cache, in response to the second request.

2. The method of claim 1, wherein the remote source is any of an origin server and a cache parent.

3. The method of claim 1, wherein the URL comprises any of a hostname, a path, and one or more query parameters.

4. The method of claim 1, wherein the URL represents an API endpoint.

5. The method of claim 1, wherein the identifier comprises any of:

a user-id in a URL string, and a user-id in a cookie.

6. A computer-implemented method operable in a server, comprising:

receiving a first request from a client device, the first request including a user identifier and being directed to a URL;

in response to the first request from the client device, generating a forward request to a remote source;

receiving a response to the forward request from the remote source, the response comprising a token that indicates that the user identifier is associated with a group identifier;

storing the association between the user identifier and the group identifier in a local data structure;

in response to any of;

the first request from the client device and a subsequent request from the client device, retrieving content from a local cache that is stored under a cache-key calculated based on the group-identifier;

serving the content to the client device, in response to any;

of the first request and the subsequent request.

7. The method of claim 6, further comprising:

receiving a second request from a second client device, the second request including a second user identifier;

determining that the second user identifier is associated with the group identifier;

identifying the content in the local cache as responsive to the second request;

serving the content to the second client device in response to the second request.

8. The method of claim 6, wherein the group identifier identifies the public.

9. The method of claim 6, wherein the user identifier comprises any of:

a user-id in a URL string, and a user-id in a cookie.

10. An apparatus, comprising:

a hardware processor;

computer memory storing computer program instructions executed by the one or more hardware processors, the computer program instructions comprising;

program code to receive a first request from a client device, the first request being directed to a URL, the first request including an identifier associated with any of (i) the client device and (ii) a user of the client device;

program code to, in response to the first request, generate a forward request to a remote source;

program code to receive a response to the forward request from the remote source, the response comprising content and a token, the token indicating that the identifier should not be used in calculating a cache key for the content;

program code to store the content in a local cache, wherein said storing comprises calculating a cache key for the content without reference to the identifier;

program code to receive a second request from a second client device, the second request being directed to the URL;

program code to identify the content in the local cache as responsive to the second request, based at least in part on the cache key;

program code to serve the content to the second client from the local cache, in response to the second request.

11. An apparatus, comprising:

a hardware processor;

computer memory storing computer program instructions executed by the one or more hardware processors, the computer program instructions comprising;

program code to receive a first request from a client device, the first request including a user identifier and being directed to a URL;

program code to, in response to the first request from the client device, generate a forward request to a remote source;

program code to receive a response to the forward request from the remote source, the response comprising a token that indicates that the user identifier is associated with a group identifier;

program code to store the association between the user identifier and the group identifier in a local data structure;

program code to, in response to any of the first request from the client device and a subsequent request from the client device, retrieve content from a local cache that is stored under a cache-key calculated based on the group-identifier;

program code to serve the content to the client device, in response to any of the first request and the subsequent request.