Secure content delivery system

• US 20030097564A1
• Filed: 09/03/2002
• Published: 05/22/2003
• Est. Priority Date: 08/18/2000
• Status: Active Grant

• Current Assignee: Akamai Technologies, Inc.
• Original Assignee: Akamai Technologies, Inc.
• Inventors: Swildens, Eric Sven-Johan, Tewari, Anoop Kailasnath, Garg, Vikas
• Granted Patent: US 7,363,361 B2
• Time in Patent Office: Days
• US Class Current: 713/171
• CPC Class Codes: H04L 12/14 Charging , metering or billing arrangements for data wireline or wireless communications
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/4541 Directories for service discovery
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/1008 based on parameters of servers, e.g. available memory or workload monitoring of computer activity G06F11/30
• CPC Class Codes: H04L 67/101 based on network conditions
• CPC Class Codes: H04L 67/1014 based on the content of a request
• CPC Class Codes: H04L 67/1023 based on a hash applied to IP addresses or costs
• CPC Class Codes: H04L 67/1027 Persistence of sessions during load balancing
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04L 67/5682 Policies or rules for updating, deleting or replacing the stored data
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

A secure streaming content delivery system provides a plurality of content servers connected to a network that host customer content that can be cached and/or stored, e.g., images, video, text, and/or software. The content servers respond to requests for customer content from users. The invention load balances user requests for cached customer content to the appropriate content server. A user makes a request to a customer'"'"'s server/authorization server for delivery of the customer'"'"'s content. The authorization server checks if the user is authorized to view the requested content. If the user is authorized, then the authorization server generates a hash value using the authorization server'"'"'s secret key, the current time, a time-to-live value, and any other information that the customer has configured, and embeds it into the URL which is passed to the user. A content server receives a URL request from the user for customer content cached on the content server. The request is verified by the content server creating its own hash value using the customer server'"'"'s secret key, the current time, a time-to-live value, and any other related information configured for the customer. If the hash value from the URL matches the content server'"'"'s generated hash value, then the user'"'"'s request is valid and within the expiration time period and the content server delivers the requested content to the user.

Claims

1. A process for a secure content delivery and global traffic management network, comprising the steps of:

providing a plurality of content servers connected to said network;

wherein said content servers host customer content that can be cached and/or stored;

wherein said content servers respond to requests for said hosted customer content;

providing at least one customer server;

providing receiving means on said customer server for receiving a user request for customer content;

providing user authentication means on said customer server for authorizing a user for access to the requested customer content;

providing hash value calculation means on said customer server for calculating a hash value using a secret key if the user is an authorized user;

wherein said secret key is shared between said customer server and content servers that serve content for said customer server;

wherein said customer server returns a Universal Resource Locator (URL) to an authorized user in response to the user'"'"'s customer content request;

wherein said URL specifies a content server that caches said requested customer content; and

wherein said URL contains said hash value.

2. The process of claim 1, further comprising the step of:

providing a user authorization database on said customer server;

wherein said user authentication means references said user authorization database to authorize a user.

3. The process of claim 1, wherein said user authentication means requires the user to input his login information.

4. The process of claim 1, wherein said hash value calculation means uses a current time on said customer server in addition to said secret key to calculate said hash value.

5. The process of claim 1, wherein said hash value calculation means uses a time-to-live value in addition to said secret key to calculate said hash value.

6. The process of claim 1, wherein said hash value calculation means uses the user'"'"'s IP address in addition to said secret key to calculate said hash value.

7. The process of claim 1, wherein said hash value calculation means uses file name information in addition to said secret key to calculate said hash value.

8. The process of claim 1, wherein said hash value calculation means uses the user'"'"'s identification information in addition to said secret key to calculate said hash value.

9. The process of claim 1, further comprising the steps of:

providing traffic management means for load balancing content requests among said plurality of content servers;

wherein said traffic management means directs client requests for hosted customer content to the appropriate content server; and

wherein said hosted customer content includes, but is not limited to;

images, video, text, and/or software.

10. The process of claim 1, further comprising the steps of:

receiving said URL from a user on a content server;

providing hash value verification means on said content server for verifying said hash value in said URL; and

wherein said hash value verification means calculates a verification hash value using said secret key.

11. The process of claim 10, wherein if said hash value in said URL matches said verification hash value then said hash value verification means sends said requested customer content to the user, and wherein if said hash value in said URL does not match said verification hash value then said hash value verification means sends the user an access denied indicator.

12. The process of claim 10, wherein if said hash value in said URL matches said verification hash value and said content server'"'"'s current time is within a specified time-to-live then said hash value verification means sends said requested customer content to the user, and wherein if said content server'"'"'s current time is not within a specified time-to-live then said hash value verification means sends the user an access denied indicator.

13. The process of claim 10, wherein said hash value verification means uses a current time on said content server in addition to said secret key to calculate said hash value.

14. The process of claim 10, wherein said hash value verification means uses a time-to-live value in addition to said secret key to calculate said hash value.

15. The process of claim 10, wherein said hash value verification means uses the user'"'"'s IP address in addition to said secret key to calculate said hash value.

16. The process of claim 10, wherein said hash value verification means uses file name information in addition to said secret key to calculate said hash value.

17. The process of claim 10, wherein said hash value verification means uses the user'"'"'s identification information in addition to said secret key to calculate said hash value.

18. The process of claim 10, wherein if said content server finds that said requested customer content is not secure content, then said hash verification means sends said requested customer content without performing hash value verification.

19. An apparatus for a secure content delivery and global traffic management network, comprising:

a plurality of content servers connected to said network;

wherein said content servers host customer content that can be cached and/or stored;

wherein said content servers respond to requests for said hosted customer content;

at least one customer server;

receiving means on said customer server for receiving a user request for customer content;

user authentication means on said customer server for authorizing a user for access to the requested customer content;

hash value calculation means on said customer server for calculating a hash value using a secret key if the user is an authorized user;

wherein said secret key is shared between said customer server and content servers that serve content for said customer server;

wherein said customer server returns a Universal Resource Locator (URL) to an authorized user in response to the user'"'"'s customer content request;

wherein said URL specifies a content server that caches said requested customer content; and

wherein said URL contains said hash value.

20. The apparatus of claim 19, further comprising:

a user authorization database on said customer server;

wherein said user authentication means references said user authorization database to authorize a user.

21. The apparatus of claim 19, wherein said user authentication means requires the user to input his login information.

22. The apparatus of claim 19, wherein said hash value calculation means uses a current time on said customer server in addition to said secret key to calculate said hash value.

23. The apparatus of claim 19, wherein said hash value calculation means uses a time-to-live value in addition to said secret key to calculate said hash value.

24. The apparatus of claim 19, wherein said hash value calculation means uses the user'"'"'s IP address in addition to said secret key to calculate said hash value.

25. The apparatus of claim 19, wherein said hash value calculation means uses file name information in addition to said secret key to calculate said hash value.

26. The apparatus of claim 19, wherein said hash value calculation means uses the user'"'"'s identification information in addition to said secret key to calculate said hash value.

27. The apparatus of claim 19, further comprising:

traffic management means for load balancing content requests among said plurality of content servers;

wherein said traffic management means directs client requests for hosted customer content to the appropriate content server; and

wherein said hosted customer content includes, but is not limited to;

images, video, text, and/or software.

28. The apparatus of claim 19, further comprising:

a module for receiving said URL from a user on a content server;

hash value verification means on said content server for verifying said hash value in said URL; and

wherein said hash value verification means calculates a verification hash value using said secret key.

29. The apparatus of claim 28, wherein if said hash value in said URL matches said verification hash value then said hash value verification means sends said requested customer content to the user, and wherein if said hash value in said URL does not match said verification hash value then said hash value verification means sends the user an access denied indicator.

30. The apparatus of claim 28, wherein if said hash value in said URL matches said verification hash value and said content server'"'"'s current time is within a specified time-to-live then said hash value verification means sends said requested customer content to the user, and wherein if said content server'"'"'s current time is not within a specified time-to-live then said hash value verification means sends the user an access denied indicator.

31. The apparatus of claim 28, wherein said hash value verification means uses a current time on said content server in addition to said secret key to calculate said hash value.

32. The apparatus of claim 28, wherein said hash value verification means uses a time-to-live value in addition to said secret key to calculate said hash value.

33. The apparatus of claim 28, wherein said hash value verification means uses the user'"'"'s IP address in addition to said secret key to calculate said hash value.

34. The apparatus of claim 28, wherein said hash value verification means uses file name information in addition to said secret key to calculate said hash value.

35. The apparatus of claim 28, wherein said hash value verification means uses the user'"'"'s identification information in addition to said secret key to calculate said hash value.

36. The apparatus of claim 28, wherein if said content server finds that said requested customer content is not secure content, then said hash verification means sends said requested customer content without performing hash value verification.