US 11,082,401 B2Granted

Cloud based firewall system and service

AssigneeAkamai Technologies, Inc.

InventorsJohn A. Dilley, Prasanna Laghate, John F. Summers, Thomas Devanneaux

Life of this patent

Estimating the term…

Loading patent…

Abstract

A cloud-based firewall system and service is provided to protect customer sites from attacks, leakage of confidential information, and other security threats. In various embodiments, such a firewall system and service can be implemented in conjunction with a content delivery network (CDN) having a plurality of distributed content servers. The CDN servers receive requests for content identified by the customer for delivery via the CDN. The CDN servers include firewalls that examine those requests and take action against security threats, so as to prevent them from reaching the customer site. The CDN provider implements the firewall system as a managed firewall service, with the operation of the firewalls for given customer content being defined by that customer, independently of other customers. In some embodiments, a customer may define different firewall configurations for different categories of that customer's content identified for delivery via the CDN.

Claims8

Dependent claims

A method of content delivery in a content delivery network (CDN) operated by a content delivery network service provider (CDNSP) on behalf of a plurality of participating content providers, wherein the plurality of participating content providers have content delivered via the CDN, the CDN having a plurality of CDN servers deployed around the Internet at an edge, the edge being any of in and adjacent to an end user access network, the method comprising:

the CDNSP providing a user interface through which a particular participating content provider any of:
creates and selects a first firewall instance for the plurality of CDN servers, which are deployed around the Internet at the edge, to apply to network traffic associated with the particular participating content provider, the network traffic comprising requests for content of the particular participating content provider, the content to be delivered via the CDN;
the user interface further enabling the particular participating content provider to any of:
create and select a second firewall instance for the plurality of CDN servers, which are deployed around the Internet at the edge, to apply to network traffic associated with the particular participating content provider, the network traffic comprising requests for content of the particular participating content provider, the content to be delivered via the CDN;
the first firewall instance comprising:
(i) a first application layer control, which comprises one or more security criteria to be checked against a request and an action to take if an attack is identified;
(ii) a first network layer control, which comprises one or more IP-layer restrictions to apply to requests from particular IP addresses;
and
(iii) a designation of a first set of one or more of the plurality of CDN servers to which the first firewall instance will apply;
the second firewall instance comprising:
(i) a second application layer control, which comprises one or more security criteria to be checked against a request and an action to take if an attack is identified;
(ii) a second network layer control, which comprises one or more IP-layer restrictions to apply to requests from particular IP addresses;
and,
(iii) a designation of a second set of one or more of the plurality of CDN servers to which the second firewall instance will apply, the second set being different than the first set.

11 more elements

A system comprising a content delivery network (CDN) operated by a content delivery network service provider (CDNSP) on behalf of a plurality of participating content providers, wherein the plurality of participating content providers have content delivered via the CDN, the CDN having a plurality of CDN servers deployed around the Internet at an edge, the edge being any of in and adjacent to an end user access network, the system further comprising:

the plurality of CDN servers;
and,
a user interface through which a particular participating content provider any of:
creates and selects a first firewall instance for the plurality of CDN servers, which are deployed around the Internet at the edge, to apply to network traffic associated with the particular participating content provider, the network traffic comprising requests for content of the particular participating content provider, the content to be delivered via the CDN;
the user interface further enabling the particular participating content provider to any of:
create and select a second firewall instance for the plurality of CDN servers, which are deployed around the Internet at the edge, to apply to network traffic associated with the particular participating content provider, the network traffic comprising requests for content of the particular participating content provider, the content to be delivered via the CDN;
the first firewall instance comprising:
(i) a first application layer control, which comprises one or more security criteria to be checked against a request and an action to take if an attack is identified;
(ii) a first network layer control, which comprises one or more IP-layer restrictions to apply to requests from particular IP addresses;
and
(iii) a designation of a first set of one or more of the plurality of CDN servers to which the first firewall instance will apply;
the second firewall instance comprising:
(i) a second application layer control, which comprises one or more security criteria to be checked against a request and an action to take if an attack is identified;
(ii) a second network layer control, which comprises one or more IP-layer restrictions to apply to requests from particular IP addresses;
and,
(iii) a designation of a second set of one or more of the plurality of CDN servers to which the second firewall instance will apply, the second set being different than the first set.

13 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/266,335Filed 4 Feb 2019 · continuation
Priority: 12 Dec 2009
Published: US 2020/0007506 A12 Jan 2020
Granted: 3 Aug 2021
Term ends: Not estimatedThe source records don’t support an estimate.

Classification6 codes

H04L 63/0263
Filtering policies: rule management
H04L 63/0218
Architectural arrangements, e.g. perimeter networks or demilitarized zones: distributed architectures, e.g. distributed firewalls
H04L 63/0227
For separating internal from external traffic, e.g. firewalls: filtering policies
H04L 63/16
Network architectures or network communication protocols for network security: implementing security features at a particular protocol layer

Family

Application61/285,958Us provisional application · filed 12 Dec 2009
Application12/965,188Parent of this continuation · filed 10 Dec 2010
Application13/896,995Parent of this continuation · filed 17 May 2013
US 8,458,769 B2Parent of this continuation · filed 4 Jun 2013
Application14/998,187Parent of this continuation · filed 24 Dec 2015
US 2020/0007506 A1Pre-grant publication · published 2 Jan 2020
US 10,243,952 B2Parent of this continuation
US 10,243,925 B2Related patent
US 2011/0225647 A1Published application
US 2013/0269023 A1Published application
US 2016/0373411 A1Published application
US 9,009,781 B2Related patent
US 11,082,401 B2This patent

From the US filing history. Foreign family members aren’t listed.