# US 10,873,451 B2 · Content delivery network processing method, content delivery network, device, and storage medium

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,873,451 B2
- Document ID: US10873451B2
- Status: Granted
- Kind: B2
- Application number: 15/977,191
- Filed: 2018-05-11
- Published: 2018-09-13
- Granted: 2020-12-22
- Earliest claimed: 2016-07-20
- Assignees: Tencent Technology (Shenzhen) Company Limited
- Applicants: Tencent Technology (Shenzhen) Company Limited
- Inventors: Bo Liu; Long Liao; Bingqi Huang; Zhiqian Da
- Web page: https://patentgrep.com/patent/US10873451B2

## CPC

- H04L 9/0838: {Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these (network architectures or network communication protocols for key exchange in a packet data network H04L63/061)}
- G06F 16/25: Integrating or interfacing systems involving database management systems
- G06F 16/95: Retrieval from the web
- H04L 9/3247: {involving digital signatures}
- H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]}
- H04L 61/3025: {Domain name generation or assignment}
- H04L 61/4511: using domain name system [DNS]
- H04L 61/4541: Directories for service discovery
- H04L 63/0442: {wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30)}
- H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)}
- H04L 63/168: {above the transport layer}
- H04L 67/1008: based on parameters of servers, e.g. available memory or workload (monitoring of computer activity G06F11/30)
- H04L 67/101: based on network conditions
- H04L 67/1031: Controlling of the operation of servers by a load balancer, e.g. adding or removing servers that serve requests
- H04L 67/34: {involving the movement of software or configuration parameters (network booting or remote initial program loading [RIPL] G06F9/4416)}
- H04L 61/301: Name conversion
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Content delivery systems and methods are provided. A center node may determine a service domain name to be processed. The center node may obtain configuration parameters corresponding to the service domain name. The center node may generate configuration items based on the obtained configuration parameters. The configuration items may cause a plurality of edge nodes to deploy Hypertext Transfer Protocol Secure (HTTPS) security acceleration for the service domain name. The center node may send, to the edge nodes in the CDN, the configuration items that are based on the corresponding configuration parameters. The configuration item may include comprise a digital certificate providing mode and a back-to-source mode of an origin site. A first configuration parameter may correspond to the digital certificate providing and a second configuration parameter may correspond to a back-to-source mode of the origin site.

## Claims

### Claim 1

A content delivery system, comprising:
a plurality of edge nodes; and
a center node comprising hardware circuitry configured to convert a service domain name into a new domain name, generate a digital certificate having the new domain name, and send the digital certificate to the edge nodes, the center node is further configured to receive a request communicated by a client for accessing the service domain name and redirect the request to an edge node that meets a load balancing condition in a content delivery network (CDN), wherein
the edge node comprises hardware circuitry configured to, in response to a detection of a load balancing condition, establish an encrypted connection with a client according to the digital certificate sent by the center node, obtain data requested by the client, and send the data to the client through the encrypted connection.

### Claim 2 (depends on 1)

The content delivery system according to claim 1, wherein the hardware circuitry of the center node is further configured to:
substitute a character in the service domain name;
combine the service domain name with a second domain name to form the new domain name;
generate a digital certificate having the new domain name and a public key of an asymmetric encryption algorithm;
calculate a digest of the new domain name using a private key of the asymmetric encryption algorithm; and
generate, based on the digest, a digital signature of the digital certificate.

### Claim 3 (depends on 1)

The content delivery system according to claim 1, wherein
the hardware circuitry of the center node is further configured to, in response to receipt of the request communicated by the client and in response the edge nodes being balanced, select an edge node having a least communication delay with the client.

### Claim 4 (depends on 1)

The content delivery system according to claim 1, wherein
the hardware circuitry of the edge node is further configured to:
send the digital certificate to the client;
perform, in response to the client successfully verifying a digital signature of the digital certificate, a negotiation operation with the client; and
determine, based on the negotiation operation with the client, a session key between the client and the edge node.

### Claim 5 (depends on 4)

The content delivery system according to claim 4, wherein
to determine the session key, the hardware circuitry of the edge node is further configured to select an encryption algorithm from encryption algorithms supported by the client, and encrypt, based on the encryption algorithm selected from encryption algorithms supported by the client, a random number generated by the edge node and a random number generated by the client, wherein
the client is further configured to encrypt, using the encryption algorithm selected by the edge node, the random number generated by the edge node and the random number generated by the client, and determine the session key.

### Claim 6 (depends on 4)

The content delivery system according to claim 4, wherein the hardware circuitry of the edge node is further configured to:
determine whether the service domain name that the client requests to access is associated with a template domain name of the new domain name specified by the digital certificate, the template domain name being the service domain name that is converted to form the new domain name;
send, in response to determination that the service domain name that the client requests to access is associated with the template domain name of the new domain name, the digital certificate to the client; and
ignore the request of the client in response to determination that the service domain name that the client requests to access is not associated with the template domain name of the new domain name.

### Claim 7 (depends on 1)

The content delivery system according to claim 1, wherein the hardware circuitry of the edge node is further configured to:
in response to receipt of the request of the client through the encrypted connection, search for data requested by the client in the edge node locally without accessing the CDN; and
transmit the data requested by the client to the client via the encrypted connection.

### Claim 8 (depends on 7)

The content delivery system according to claim 7, wherein the hardware circuitry of the edge node is further configured to:
establish, in response to the data requested by the client not being found in the edge node locally and a preset back-to-source mode corresponding to the service domain name is Hypertext Transfer Protocol Secure (HTTPS) back-to-source, an encrypted connection with an origin site of the service domain name based on the digital certificate;
obtain, from the origin site, using the encrypted connection with the origin site, data requested by the client; and
transmit the data through the encrypted connection with the client.

### Claim 9 (depends on 7)

The content delivery system according to claim 7, wherein the hardware circuitry of the edge node is further configured to: in response to the data requested by the client not being found in the edge node locally and a preset back-to-source mode of the service domain name being Hypertext Transfer Protocol (HTTP) back-to-source, obtain, based on an HTTP connection with the origin site, the data requested by the client; and
transmit the data through the encrypted connection with the client.

### Claim 10 (depends on 7)

The content delivery system according to claim 7, wherein the hardware circuitry of the edge node is further configured to:
cache the data requested by the client; and
in response to expiration of a cache period specified in a cache strategy for a corresponding data type, delete cached data having the corresponding data type.

### Claim 11 (depends on 1)

The content delivery system according to claim 1, wherein the hardware circuitry of the center node is further configured to:
in response to the service domain name being associated with a CDN-provided digital certificate, convert the service domain name to form the new domain name; and
send the digital certificate to the edge node.

### Claim 12 (depends on 1)

The content delivery system according to claim 1, wherein the hardware circuitry of the center node is further configured to:
in response to the service domain name being associated with a parameter to stop using a digital certificate provided by the CDN for the service domain name, instruct the edge node to delete a digital certificate of the new domain name corresponding to the service domain name.

### Claim 13

A method, comprising:
converting, by a center node of a content delivery network (CDN), a service domain name into a new domain name;
generating, by the center node, a digital certificate having the new domain name;
sending, by the center node, the digital certificate to edge nodes of the CDN;
redirecting, by the center node, in response to receipt of a request of a client for accessing the service domain name, the request to an edge node that meets a load balancing condition in the CDN;
establishing, by the edge node, based on the load balancing condition, an encrypted connection with the client according to the digital certificate sent by the center node;
obtaining, by the edge node, data requested by the client, and sending, by the edge node, the data to the client via the encrypted connection.

### Claim 14 (depends on 13)

The method according to claim 13, wherein converting, by the center node of the CDN, the service domain name into the new domain name further comprises:
substituting, by the center node, a character in the service domain name;
combining, by the center node, the service domain name with a second domain name to form the new domain name;
generating, by the center node, a digital certificate carrying the new domain name and a public key of an asymmetric encryption algorithm;
calculating a digest of the new domain name by using a private key of the asymmetric encryption algorithm; and
generating a digital signature for the digital certificate.