Abstract: A dynamic image delivery system receives a client request for an image at an image caching server. The image caching server measures the client's network access speed and looks for an appropriate pre-rendered copy of the requested image that is rendered for the client's network access speed in local storage. If the appropriate rendered copy is found, then the image caching server sends the rendered image to the client. If it is not found, then the image caching server dynamically renders a copy of the image and sends it to the client.

Abstract: A secure streaming content delivery system provides a plurality of content servers connected to a network that host customer content that can be cached and/or stored, e.g., images, video, text, and/or software. The content servers respond to requests for customer content from users. The invention load balances user requests for cached customer content to the appropriate content server. A user makes a request to a customer's server/authorization server for delivery of the customer's content. The authorization server checks if the user is authorized to view the requested content. If the user is authorized, then the authorization server generates a hash value using the authorization server's secret key, the current time, a time-to-live value, and any other information that the customer has configured, and embeds it into the URL which is passed to the user. A content server receives a URL request from the user for customer content cached on the content server.

Abstract: A method for determining metrics of a content delivery and global traffic management network provides service metric probes that determine the service availability and metric measurements of types of services provided by a content delivery machine. Latency probes are also provided for determining the latency of various servers within a network. The latency probe calculates, for example, the latency from its location to a client's location using the round trip time for sending a packet to the client to obtain the latency value for that client. DNS servers use the latency test results, along with traffic weightings, to determine a server to return for a given DNS name.

Abstract: Techniques are provided for using the mobility support features of IPv6 to allow client and server nodes to communicate without the continuing intervention of a load-balancing node that selected the server node. A load-balancing node intercepts a TCP SYN packet addressed to a virtual IP address. The load-balancing node selects a server node from among multiple server nodes, and sends the packet toward the server node. The server node sends an IPv6 packet toward the client node. The packet contains a Binding Update option that specifies the virtual IP address as a Home Address. This information causes the client node to replace destination addresses in outgoing IP packets so that packets that the client node would have sent toward the virtual IP address are sent toward the selected server node's IP address instead. Consequently, the IP packets are routed toward the selected server node instead of the load-balancing node.

Abstract: A dynamic multimedia fingerprinting system is provided. A user requests multimedia content from a Web cache server that verifies that the user is authorized to download the content. A custom fingerprint specific to the user is generated and dynamically inserted into the content as the content is delivered to the user. The custom fingerprint can be generated on the Web cache server or at the content provider's server. The system allows a content provider to specify where the custom fingerprint is inserted into the content or where the fingerprint is to replace a placeholder within the content.

Abstract: A method and apparatus for serving content requests using global and local load balancing techniques is provided. Web site content is cached using two or more point of presences (POPs), wherein each POP has at least one DNS server. Each DNS server is associated with the same anycast IP address. A domain name resolution request is transmitted to the POP in closest network proximity for resolution based on the anycast IP address. Once the domain name resolution request is received at a particular POP, local load balancing techniques are performed to dynamically select the appropriate Web server at the POP for use in resolving the domain name resolution request. Approaches are described for handling bursts of traffic at a particular POP, security, and recovering from the failure of various components of the system.

Abstract: Methods for determining and utilizing server performance metrics in a network are provided. For example, such methods can involve determining the service availability and metric measurements of types of services provided by a content delivery machine. User weightings can be used to indicate whether more traffic should be sent to one content server address compared to another. DNS servers use the test result updates and/or user weightings to determine the best server to return in response to a request to resolve a given DNS name. Computer systems and apparatus for carrying out such methods are also provided.

Abstract: A system and method for client-side authentication for secure Internet communications is disclosed. In one embodiment, an intermediate device receives a web browser secure socket layer certificate from a web browser, authenticates the web browser using the secure socket layer certificate, and then re-signs the secure socket layer certificate with an intermediate device public key and an intermediate device certificate authority signature. The intermediate device sends the re-signed secure socket layer certificate to a web server and the web server authenticates the intermediate device using the re-signed secure socket layer certificate. In another embodiment, an intermediate device receives a web browser secure socket layer certificate from a web browser, inserts the web browser secure socket layer certificate into a HTTP header of a packet, and sends the packet to a web server.

Abstract: Techniques are provided for using the mobility support features of IPv6 to allow client and server nodes to communicate without the continuing intervention of a load-balancing node that selected the server node. A load-balancing node intercepts a TCP SYN packet addressed to a virtual IP address. The load-balancing node selects a server node from among multiple server nodes, and sends the packet toward the server node. The server node sends an IPv6 packet toward the client node. The packet contains a Binding Update option that specifies the virtual IP address as a Home Address. This information causes the client node to replace destination addresses in outgoing IP packets so that packets that the client node would have sent toward the virtual IP address are sent toward the selected server node's IP address instead. Consequently, the IP packets are routed toward the selected server node instead of the load-balancing node.

Abstract: A method and mechanism for a distributed on-demand computing system. The system automatically provisions distributed computing servers with customer application programs. The parameters of each customer application program are taken into account when a server is selected for hosting the program. The system monitors the status and performance of each distributed computing server. The system provisions additional servers when traffic levels exceed a predetermined level for a customer's application program and, as traffic demand decreases to a predetermined level, servers can be un-provisioned and returned back to a server pool for later provisioning. The system tries to fill up one server at a time with customer application programs before dispatching new requests to another server. The customer is charged a fee based on the usage of the distributed computing servers.

Abstract: A method and mechanism for protecting a website against defacement are provided. A content owner may associate content with a digital signature. The digital signature allows a recipient of the content to verify that the content originated from the content owner, and that the content has not been defaced. The digital signature may be comprised within the content, or stored external to the content, e.g., in a repository accessible to a Web cache server serving the content. To construct the digital signature, initially, the content owner creates a content validity value for a portion of content, the content validity value is encrypted to create the digital signature. The Web cache server may use the digital signature to determine whether the content has been defaced.

Abstract: A distributed DNS network includes a central origin server that actually controls the zone, and edge DNS cache servers configured to cache the DNS content of the origin server. The edge DNS cache servers are published as the authoritative servers for customer domains instead of the origin server. When a request for a DNS record results in a cache miss, the edge DNS cache servers get the information from the origin server and cache it for use in response to future requests. Multiple edge DNS cache servers can be deployed at multiple locations. Since an unlimited number of edge DNS cache servers can be deployed, the system is highly scalable. The disclosed techniques protect against DoS attacks, as DNS requests are not made to the origin server directly.

Abstract: Techniques are provided that allow client and server nodes to communicate without the continuing intervention of a load-balancing node that selected the server node. A load-balancing node intercepts a TCP SYN packet addressed to a virtual IP address. The load-balancing node selects a server node from among multiple server nodes, and sends the packet toward the server node. The server node sends an IPv6 packet toward the client node. The packet contains a Binding Update option that specifies the virtual IP address as a Home Address. This information causes the client node to replace destination addresses in outgoing IP packets so that packets that the client node would have sent toward the virtual IP address are sent toward the selected server node's IP address instead. Consequently, the IP packets are routed toward the selected server node instead of the load-balancing node.

Abstract: A dynamic image delivery system receives a client request for an image at an image caching server. The image caching server measures the client's network access speed and looks for an appropriate pre-rendered copy of the requested image that is rendered for the client's network access speed in local storage. If the appropriate rendered copy is found, then the image caching server sends the rendered image to the client. If it is not found, then the image caching server dynamically renders a copy of the image and sends it to the client.

Abstract: A network of point of presence servers allows a customer to organize their web site by functions where functions are mapped into domain names. The functions have requirements that define what is needed by a server to satisfy the function. The domain names are mapped into resources or servers that can be addressed by the domain name and that satisfy requests for the function that domain name has been defined to support. This method of organization allows individual elements of a web page to be retrieved from different resources and gives the name server the control to direct users to an available and optimal server for a given resource.

Abstract: A content delivery and global traffic management network system provides a plurality of caching servers connected to a network. The caching servers host customer content that can be cached and stored, and respond to requests for Web content from clients. If the requested content does not exist in memory or on disk, it generates a request to an origin site to obtain the content. A DNS Server load balances network requests among customer Web servers and directs client requests for hosted customer content to the appropriate caching server. The customer pays a service that provides the content delivery and global traffic management network system a fee for usage of the content delivery and global traffic management network system.

Abstract: A method and apparatus for establishing session persistence between a client and an origin server are provided. The session persistence can be managed by an intermediate cache server. The persistence is established by inserting an identifier and origin server address in a cookie or URL. Alternatively, the persistence is established by a table mapping a source IP address or a session ID to a specific origin server. Subsequent requests from the same client are mapped to the same origin server using these methods of establishing persistence.