Method and system for protecting websites from public Internet threats

Abstract

The present invention addresses the known vulnerabilities of Web site infrastructure by making an origin server substantially inaccessible via Internet Protocol traffic. In particular, according to a preferred embodiment, the origin server is “shielded” from the publicly-routable IP address space. Preferably, only given machines (acting as clients) can access the origin server, and then only under restricted, secure circumstances. In a preferred embodiment, these clients are the servers located in a “parent” region of a content delivery network (CDN) tiered distribution hierarchy. The invention implements an origin server shield that protects a site against security breaches and the high cost of Web site downtime by ensuring that the only traffic sent to an enterprise's origin infrastructure preferably originates from CDN servers. The inventive “shielding” technique protects a site's Web servers (as well as backend infrastructure, such as application servers, databases, and mail servers) from unauthorized intrusion—improving site uptime and in the process, customer loyalty.

Description

[0001] This application is a continuation of U.S. Ser. No. 10 / 191,309, filed Jul. 9, 2002.BACKGROUND OF THE INVENTION [0002] 1. Technical Field [0003] The present invention relates generally to techniques for cloaking a Web site origin server from the public Internet while still ensuring that content otherwise available from the site is delivered quickly and without fail, regardless of a user location. [0004] 2. Description of the Related Art [0005] Today's Web sites are a double-edged sword. They present enterprises with the opportunity for both resounding success and costly, dramatic failure. The possibility for either scenario to occur is chiefly due to the Internet's open design. Indeed, the ability to reach a global community of customers and partners via the Web comes with serious security risks. The open design means that enterprises must expose themselves by opening a public entry-point to get the global reach they need. Couple that with the inherent weaknesses of centralize...

AI Technical Summary

Benefits of technology

[0009] It is a primary object of the present invention for “cloaking” a Web site from the public Internet while still ensuring that content is delivered quickly and without fail, regardless of user location. The inventive technique substantially eliminates the public entry points found on Web servers today while delivering end users of a protected site unparalleled performance and reliability.

[0011] According to an illustrative embodiment, the technical advantages of the present invention are achieved by deploying an origin server shield in the same data center as the origin Web server, typically behind upstream routers that provide Internet connectivity but in front of a firewall. This placement allows the shield to serve both as an external buffer for the origin site as well as the trusted party eligible to access the origin site. In this fashion, one or more dedicated content delivery network (CDN) server regions that comprise the shield handle communications with the “public” and connect to the origin server only when needed, preferably via a private connection. As a consequence, the shield protects the origin by effectively removing it from accessible Internet Protocol (IP) space.

[0012] In a given illustrative configuration, an origin server uses a content delivery network to serve given site content, and an origin server “shield” is established for the origin. The shield comprises at least one CDN “shield” region upstream of an enterprise firewall and access router but downstream of the router connecting the origin server to the rest of the data center of the Internet. The “shield” region also preferably serves as a “parent” region to the CDN edge servers. To provide maximum protection, two access controls are preferably implemented. First, an IP access control list (ACL) or equivalent access control is set downstream of the shield region so that the only IP traffic that can access the origin site is traffic originating from servers in the shield region. In an illustrative embodiment, this is accomplished by setting an access control list (ACL) on the enterprise firewall to restrict access to the origin server except, e.g., from IP addresses of the CDN servers in the shield region(s). In addition, the router upstream of the shield (e.g., the router connecting to the Internet) is provisioned to implement IP spoof blocking upstream of the shield region to ensure that only the shield region is able to pass through the downstream ACL.

[0013] Such access controls (e.g., upstream ACLs and router configurations) prevent any other machine on the Internet from spoofing the shield region server IP addresses in an attempt to masquerade as the shield server. As a result, no other machine on the Internet has the ability to communicate directly with the origin server. At the same time, however, the CDN's other distributed edge servers continue to have complete access to the current content as long as that content is accessible via the CDN. This is because the shield region(s) are configured to serve as a “parent” region for the edge servers. If a CDN edge server ever needs content that it cannot find at one of its peers, it will direct that request at one of the shield regions. As a result, bona fide end-users will always be able to retrieve content from edge servers with maximal performance and reliability while the origin remains protected.

Problems solved by technology

The inventive technique substantially eliminates the public entry points found on Web servers today while delivering end users of a protected site unparalleled performance and reliability.

Images