Method and system for protecting websites from public Internet threats

Abstract

The present invention addresses the known vulnerabilities of Web site infrastructure by making an origin server substantially inaccessible via Internet Protocol traffic. In particular, according to a preferred embodiment, the origin server is “shielded” from the publicly-routable IP address space. Preferably, only given machines (acting as clients) can access the origin server, and then only under restricted, secure circumstances. In a preferred embodiment, these clients are the servers located in a “parent” region of a content delivery network (CDN) tiered distribution hierarchy. The invention implements an origin server shield that protects a site against security breaches and the high cost of Web site downtime by ensuring that the only traffic sent to an enterprise's origin infrastructure preferably originates from CDN servers. The inventive “shielding” technique protects a site's Web servers (as well as backend infrastructure, such as application servers, databases, and mail servers) from unauthorized intrusion—improving site uptime and in the process, customer loyalty.

Description

[0001] This application is a continuation of U.S. Ser. No. 10 / 191,309, filed Jul. 9, 2002.BACKGROUND OF THE INVENTION [0002] 1. Technical Field [0003] The present invention relates generally to techniques for cloaking a Web site origin server from the public Internet while still ensuring that content otherwise available from the site is delivered quickly and without fail, regardless of a user location. [0004] 2. Description of the Related Art [0005] Today's Web sites are a double-edged sword. They present enterprises with the opportunity for both resounding success and costly, dramatic failure. The possibility for either scenario to occur is chiefly due to the Internet's open design. Indeed, the ability to reach a global community of customers and partners via the Web comes with serious security risks. The open design means that enterprises must expose themselves by opening a public entry-point to get the global reach they need. Couple that with the inherent weaknesses of centralize...

AI Technical Summary

Benefits of technology

The present invention provides a technique for delivering a Web site from a protected site while ensuring that content is delivered quickly and without fail, regardless of user location. The invention eliminates public entry points found on Web servers today while delivering end users of a protected site unparalleled performance and reliability. The invention involves a collection of strategically-positioned content delivery network (CDN) server regions designed to complement an existing infrastructure protecting an origin site. The CDN server regions handle communications with the origin server only when needed, preferably via a private connection. The invention also includes an origin server shield in the same data center as the origin Web server, which protects the origin by effectively removing it from accessible Internet Protocol (IP) space. The invention prevents any other machine on the Internet from spoofing the shield region server IP addresses in an attempt to masquerade as the shield server. The technical effects of the invention include improved security, performance, and reliability of the protected site.

Problems solved by technology

The inventive technique substantially eliminates the public entry points found on Web servers today while delivering end users of a protected site unparalleled performance and reliability.

Images