Content Delivery Channel Selection Mechanism
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current content delivery networks (CDNs) face challenges in securely delivering sensitive content, as they require access to content providers' SSL/TLS private keys and may inadvertently expose private information, risking data corruption or security breaches due to misconfiguration and human error.
Innovation Solution
Implementing a system that allows clients to selectively choose between retrieving content from an origin server or a CDN, using verification codes such as content hashes to differentiate between channels, ensuring sensitive content is only delivered through the origin server, while public content can be cached and delivered through the CDN, thereby reducing the risk of data exposure and misconfiguration.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If content is delivered through CDN, then delivery performance is improved, but security risk increases due to potential exposure of private information
Solution Approach 1:
The patent segments content into two categories: public content and private content. Public content is delivered through the CDN for improved performance, while private content is delivered directly from the origin server to maintain security. This segmentation resolves the contradiction by allowing the system to optimize for performance where safe and maintain security where necessary.
Solution Approach 2:
The patent applies different delivery qualities to different types of content. Public content receives the high-performance CDN delivery mechanism, while private content receives the secure direct-origin delivery mechanism. This local differentiation of delivery quality based on content sensitivity resolves the contradiction between performance and security.
2Object-affected harmful factors
If all content is delivered through origin server, then security is maintained, but delivery performance decreases
Solution Approach 1:
The patent divides content delivery into two pathways: direct origin server delivery for private content and CDN delivery for public content. This segmentation allows the system to maintain security for sensitive content while leveraging CDN performance for non-sensitive content, resolving the contradiction.
Solution Approach 2:
The patent dynamically selects the delivery pathway based on content characteristics. The system evaluates whether content is public or private and automatically routes it through the appropriate channel (CDN or origin server). This dynamic adaptation resolves the contradiction by optimizing delivery based on real-time content assessment.
3Ease of operation
If CDN accesses content providers' SSL/TLS private keys, then content delivery functionality is enabled, but data corruption or security breaches may occur
Solution Approach 1:
The patent extracts private content from the CDN delivery system and routes it directly through the origin server. This extraction removes private content from the potentially insecure CDN environment, eliminating the need for CDN access to private keys while maintaining functionality for public content through the CDN.
Solution Approach 2:
The patent introduces an intermediary mechanism (hash verification) that allows the client to verify content integrity without requiring the CDN to have access to private keys. The origin server provides hash values for private content, and the client verifies these hashes locally, serving as an intermediary security check that eliminates the need for key sharing.
Data Source
AI summary
Described herein are methods, apparatus and systems for selectively delivering content through one of two communication channels, one being origin to client and the other being from or through a CDN to client. Thus a client may choose to request content from a CDN and/or from an origin server. This disclosure sets forth techniques for, among other things, distinguishing between which channel to use for a given object, using the CDN-client channel to obtain the performance benefit of doing so, and reverting to the origin-client channel where content may be private, sensitive, corrupted, or otherwise considered to be unsuitable from delivery from and/or through the CDN.