CDN Composite Cache Key for Restricted Access Resources
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Content delivery networks (CDNs) are not effectively utilized for resources with restricted access due to security concerns, as they typically cache only publicly accessible content, limiting their advantages to publicly available resources.
Innovation Solution
A method is introduced where a CDN server creates a composite cache key combining a resource identifier and part of the authentication token to securely deliver restricted-access resources, allowing for caching and direct service without needing to forward requests to the origin server for authorized clients, thereby enabling CDN use for dynamically generated resources with restricted access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If a CDN caches publicly accessible content, then delivery speed and reliability are improved, but restricted-access resources cannot be cached
Solution Approach 1:
The cache key is segmented into multiple components: resource identifier, authentication token, and optional parameters. This segmentation allows the system to distinguish between public and restricted resources, enabling secure caching of authorized content while maintaining separation between different user contexts
Solution Approach 2:
The authentication token acts as an intermediary element that bridges the CDN caching mechanism with security requirements. By incorporating the token into the cache key, the system enables the CDN to serve restricted resources without compromising security, as the token verifies user identity and authorization before content delivery
2Reliability
If authorization checks are performed for every request, then security is maintained, but latency increases and productivity decreases
Solution Approach 1:
The authorization check is performed preliminarily at the CDN level before content retrieval, using the authentication token in the composite cache key. This preliminary action filters out unauthorized requests early, preventing unnecessary origin server calls and reducing latency for authorized users while maintaining security through the token verification mechanism
Solution Approach 2:
The CDN server performs self-service authorization by checking the authentication token against the composite cache key before forwarding requests to the origin server. This self-service approach reduces the burden on the origin server and enables faster response times, as the CDN can independently handle authorization decisions for cached content
3Productivity
If the same cache key is used for multiple users, then cache utilization improves, but access control and security are compromised
Solution Approach 1:
The cache key is segmented to include user-specific authentication tokens, ensuring that different users have distinct cache entries even for the same resource. This segmentation maintains cache utilization efficiency while preventing unauthorized access, as each user's token creates a separate cache context
Solution Approach 2:
The authentication token adds local quality differentiation to the cache key, allowing the system to distinguish between different users and their access rights. This local quality approach enables fine-grained access control at the cache level, ensuring that each user only accesses content they are authorized for while maintaining efficient cache management
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Summarizing the invention, a computer-implemented method for delivering restricted-access resources hosted on an origin server using a CDN comprising a plurality of CDN servers is provided. The method comprises receiving, by a CDN server from a client, a request for a restricted-access resource hosted on the origin server, wherein the request comprises a resource identifier of the restricted-access resource and an authentication token; and performing a delivery step comprising: creating, by the CDN server, a composite cache key comprising the resource identifier and at least part of the authentication token; comparing, by the CDN server, the composite cache key with one or more composite cache keys previously stored at the CDN server; if a match between the composite cache key and one of the previously stored composite cache key is found, delivering, by the CDN server, a response associated to the composite cache key to the client; if no match between the composite cache key and one of the previously stored composite cache key is found, performing a retrieval step comprising: forwarding, by the CDN server, the request to the origin server; checking, by the origin server, whether the authentication token allows access to the restricted-access resource; if the access is allowed: retrieving, by the origin server, the restricted-access resource; sending, by the origin server, a response comprising the restricted-access resource to the CDN server; if the access is not allowed: sending, by the origin server, a response comprising a refusal of the request to the CDN server; storing, by the CDN server, the response in association to the composite cache key; delivering, by the CDN server, the response to the client.