CDN Security Profile Caching With Risk-Based Domain Eviction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Content delivery networks (CDNs) face challenges in managing a large number of domains due to storage and performance constraints, leading to inefficient handling of security profiles, which can result in increased security risks and overhead.
Innovation Solution
Implementing a domain map and an auto-adjusting list within CDN instances to manage a virtually unlimited number of security profiles, using a domain security scaler to update the list based on risk scores and next-level domains, allowing asynchronous operations to minimize performance impact.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If each CDN instance holds security profiles for all possible domains, then per-domain security customization is achieved, but storage requirements and memory overhead become infeasible when handling millions of domains
Solution Approach 1:
The patent divides the security profile management into two segments: a global security profile stored centrally in the origin server, and local security profile snippets cached in CDN instances. This segmentation allows per-domain security customization without requiring each CDN instance to store all domain profiles, thereby reducing storage requirements while maintaining adaptability.
Solution Approach 2:
The patent introduces an intermediary mechanism where the origin server acts as a mediator between CDN instances and security profiles. When a CDN instance encounters a domain without a cached security profile, it queries the origin server which returns the appropriate security profile or snippet. This intermediary approach enables access to per-domain security profiles without requiring all profiles to be pre-loaded in each CDN instance.
2Speed
If CDN instances cache security profiles for all domains, then security lookup speed is improved, but memory consumption and system overhead become unmanageable
Solution Approach 1:
The patent applies local quality by caching only the security profiles or security snippets that are locally relevant to each CDN instance's served domains, rather than uniformly caching all security profiles. This localized caching strategy maintains fast lookup speed for commonly accessed domains while significantly reducing overall memory consumption across the CDN network.
Solution Approach 2:
The patent implements partial action by caching only a subset of security profiles (those frequently accessed or locally relevant) in each CDN instance, rather than caching all security profiles. The origin server serves as a fallback for retrieving complete security profiles when needed, allowing the system to achieve acceptable lookup speeds without the excessive memory consumption of full caching.
3Reliability
If security profiles are frequently updated for all domains, then security effectiveness is maintained, but network overhead and update latency increase
Solution Approach 1:
The patent extracts only the necessary security profile information (security snippets) from complete security profiles and caches these minimal representations in CDN instances. When updates are needed, only the specific snippet changes need to be propagated to CDN instances rather than entire security profiles, significantly reducing network overhead while maintaining security effectiveness through selective updates.
4Device complexity
If a single security profile is used for all domains, then system complexity is reduced, but per-domain security customization and flexibility are lost
Solution Approach 1:
The patent implements universality by designing a security profile structure where a single security profile template can serve multiple domains through parameter substitution. The security profile contains domain-agnostic security rules that can be customized for different domains by replacing specific parameters (such as domain names, allowed paths, or rate limits), allowing the same profile structure to provide per-domain customization without requiring separate profiles for each domain.
Data Source
AI summary
A method to manage domain-based security profiles in a content delivery network (CDN) is disclosed. The method includes receiving security events detected by one or more security solutions implemented by one or more CDN instances of the CDN, determining, for each of a plurality of domains, a risk score for the domain based on the security events, determining possible next level domains for a CDN instance of the CDN, determining an updated order of an auto-adjusting list maintained by the CDN instance based on risk scores for the domains included in the auto-adjusting list and the possible next level domains for the CDN instance, and sending an update to the CDN instance to cause the CDN instance to update the order of the auto-adjusting list to reflect the updated order, wherein the order of the auto-adjusting list indicates an eviction priority for the domains included in the auto-adjusting list.