Abstract: Systems, methods, apparatuses, and software that announce prefixes associated content nodes of a content delivery network are provided herein. In one example, a method of operating a communication system comprising Internet service providers configured to exchange content requests between end user devices and content nodes is presented. The method includes assigning a content node of the content delivery network a first Internet Protocol (IP) address having an associated first short prefix and a first long prefix, and assigning the content node a second IP address having an associated second short prefix and a second long prefix. The method also includes announcing the first short prefix and the first long prefix to a first Internet service provider communicatively coupled to the content node, and announcing the second short prefix and the second long prefix to a second Internet service provider communicatively coupled to the content node.

Abstract: Systems and methods for server authentication in a content delivery network are provided. Various embodiments include a content delivery network obtaining multiple digital certificates from multiple certificate authorities. When a client attempts to access the content delivery network, the network serves the client a digital certificate and then monitors the authentication of the certificate. If the authentication fails, the content delivery network serves the client another digital certificate that was issued from a different certificate authority. In other embodiments, the content delivery network constantly monitors the function of each certificate authority. The content delivery network constantly pings each certificate authority. If any one of the certificate authorities fails to respond to the pings, the content delivery network will presume the certificate authority is non-operational and will stop using certificates from the non-operational certificate authorities until they resume operation.

Abstract: Systems, methods, apparatuses, and software that select network addresses of a content node of a content delivery network are provided herein. In one example, a method of operating a control node to perform network address selection that selects between different communication service providers according to network characteristics is presented. The control node receives a domain name lookup request from an end user device to reach a content node. The control node processes network characteristics and the domain name lookup request to select a network address that corresponds to one of the communication service providers. The end user device can use the selected network address to reach the content node over the selected communication service provider.

Abstract: Described herein are enhancements for operating cache nodes in a content delivery network to synchronize edge dictionary configurations. In at least one implementation, a cache node of a content delivery network receives a content request from an end user device. In response to the request, the cache node identifies a modification to a key-value pair of an edge dictionary, wherein the edge dictionary comprises a reference key-value function for a Hypertext Transfer Protocol (HTTP) accelerator service. The method further provides generating a modified version of the edge dictionary based on the modification, and transferring a notification of the modification to at least one other cache node in the content delivery network.

Abstract: Described herein are methods, systems, and software for encrypting and erasing data objects in a content node. In one example, a method of operating a content node that caches content divided into one or more data objects includes encrypting the one or more data objects using separate encryption keys for each of the one or more data objects, the separate encryption keys comprising a common portion shared by the one or more data objects and an individualized portion unique to each data object. The method further provides receiving a purge request to erase at least one data object and, responsive to the purge request, erasing at least one of the common portion or the individualized portion for the at least one data object based on the purge request.

Abstract: Systems, methods, and software for operating a content delivery system to purge cached content are provided herein. In one example, purge messages are transferred for delivery to content delivery nodes (CDNs) in the content delivery system. The CDNs receive the messages, purge content associated with the messages, and compile purge summaries based on the messages. The CDNs further periodically transfer the purge summaries to one another to compare the messages received, and gather purge information for purge messages that may have been inadvertently missed by the CDNs.

Abstract: Enhanced packet redirect capabilities are disclosed herein for draining traffic to a server. In an implementation, a server in an infrastructure service receives a packet from a stateless load balancer. The packet may comprise a request for content. A user space program on the server determines whether a connection identified in the packet belongs to the server. If the connection belongs to the server, the user space program handles the request for the content. If not, the server forwards the packet to a secondary server in the infrastructure service. The secondary server, to which the connection may belong, can then handle the request.

Abstract: Systems, methods, apparatus, and software for transitional caching in content delivery networks includes edge cache nodes configured to receive and reply to content requests. Content can be cached in edge cache nodes before receiving user requests or retrieved from an origin server. A transitional cache node array is configured to receive content requests from edge cache nodes and to receive origin content from edge cache nodes and/or origin servers, as well as to modify origin content to generate modified content. Modified content can include re-written origin content (e.g., translations), transcoded data (e.g., video), compressed or otherwise adjusted data (e.g., images), and transformed files (e.g., CSS and JavaScript files), among others. In addition to assisting with original and modified content flow to end users, transitional caching also can assist in threat detection and mitigation within a CDN, helping to protect the network, origin servers and the like.

Abstract: Disclosed herein are enhancements for operating a content delivery network to load balance origin requests to origin servers. In one implementation, a method of operating a content delivery network comprising a plurality of cache nodes that cache content between end user devices and origin servers includes, in a first cache node of the plurality of cache nodes, obtaining distribution information indicative of how each cache node in the plurality of cache nodes has distributed content requests to the origin servers. The method further provides, in the first cache node maintaining a load balancing profile for the plurality of origin servers based on the distribution information, and distributing a content request to an origin server in the plurality of origin servers based at least in part on the load balancing profile for the plurality of origin servers.

Abstract: A server detects a failure of an outbound path based on at least a measure of forward progress made on a connection between the server and an end point. In response to the failure, the server generates a hash value based at least on an identifying value of the connection and a failure counter associated with the measure of forward progress made on the connection. The server then selects a next outbound path for the packet flow based on at least the hash value generated in response to the failure. The server also sends the packet flow over the next outbound path to the end point.

Abstract: Disclosed herein are methods, systems, and software to enhance the testing of race conditions in programs. In one example, a method of testing race conditions in a target program with one or more concurrent processes includes generating a scheduling program based on race conditions identified in the target program, wherein the scheduling program includes order of operation rules for the one or more concurrent processes. The method further provides initiating execution of the scheduling program, and executing the target program based on the order of operation rules for the one or more concurrent processes.

Abstract: Systems, methods, and software for operating one or more content delivery nodes (CDN), which cache content for delivery to end users, are provided herein. In one example, content requests received from at least a first end user for the content at a first CDN are monitored to determine when the content requests comprise an attack on the first CDN. Responsive to the attack on the first CDN, a rate limit is established in the first CDN on at least the content requests received by the first CDN and an indication of the attack is transferred for delivery to at least a second CDN. Responsive to the indication of the attack, the rate limit is applied for further content requests received for the content at the second CDN.

Abstract: A communication system exchanges communications between end user devices, content delivery nodes (CDN) of a content delivery system, and a control system that selects CDNs of the content delivery system. The control system receives a domain name lookup request issued by an end user device for retrieving content cached by one or more CDNs of the content delivery system. The control system associates the end user device with a network performance profile to select a CDN of the content delivery system. The control system transfers a network address associated with the selected CDN for receipt by the end user device responsive to the domain name lookup request.

Abstract: Systems, methods, and software are disclosed herein for routing in-bound communications to an infrastructure service. In an implementation, an infrastructure service receives a request from an end point for content associated with an origin. The service sends a connection request to the origin from an initial network address. After detecting a failure of the origin to respond to the connection request, the service sends multiple connection requests to the origin from different network addresses. Upon receiving one or more replies to the connection requests, the service identifies which reply was received first and a network address to which the reply was sent. The service proceeds to establish a connection with the origin using the identified network address and obtains the content from the origin over the connection. The infrastructure service may then send the content to the end point.

Abstract: Systems, methods, apparatus, and software for pre-fetching and/or pre-loading sub-resources used in rendering HTML files, web pages and the like are provided herein. Implementations include expedited sub-resource loading in which a cache node or other content delivery network component receives a first end user device request seeking a primary resource (e.g., an HTML file). Using information in the first request, the content delivery network pre-fetches one or more identified sub-resources (e.g., JavaScript code) required for rendering of the HTML file. Pre-fetched sub-resources are held by the cache node. During parsing of the HTML file by the end user device, a web browser or other application requires the sub-resource(s) and the end user device thus sends a second request to the cache node asking for the required sub-resource(s). The cache node sends the requested, pre-fetched sub-resource(s).

Abstract: Disclosed herein are enhancements for deploying application in an edge system of a communication network. In one implementation, a runtime environment identifies a request from a Hypertext Transfer Protocol (HTTP) accelerator service to be processed by an application. In response to the request, the runtime environment may identify an isolation resource to support the request, initiate execution of code for the application, and pass context to the code. Once initiated, the runtime environment may copy data from the artifact to the isolation resource using the context and return control to the HTTP accelerator service upon executing the code.

Abstract: Disclosed herein are enhancements for operating a web application firewall to reduce load. In one implementation, a method of operating a content server for a web application comprising running a web accelerator with a plurality of threads on the content server. The method further provides receiving a request for content which will be provided to a web application, filtering the request and determining that the content will be requested from a second server. After determining that the content will be requested from a second server, reviewing the request with a web application firewall operating at a network layer 7, forwarding the request, receiving the content, and providing the content. Further, the web application firewall is controlled by a plurality of sets of rules, which can be updated without restarting the web accelerator.

Abstract: A client application establishes a connection between the client application and an origin server over one or more networks. The application generates a request to establish a secure session with the origin server over the connection. The request includes information, in a header of the request, that flags traffic sent during the secure session to a network of the one or more networks as subject to one or more optimizations performed by the network. Subsequent to establishing the secure session, the application encrypts the traffic in accordance with the secure session and sends the traffic to the origin server over the connection, subject to the one or more optimizations. The infrastructure service applies the one or more optimizations to the traffic as it passes through the edge network to the origin server.

Abstract: Systems, methods, apparatuses, and software for an edge network that serves content to end user devices is presented. In one example, a method includes establishing domain name relationships for use by a top-level DNS to recurse DNS queries to a DNS node associated with the edge network. The method also includes establishing address correlations between prefixed IPv6 network addresses and PQDNs that comprise indicators for at least a routing provider identifier and a server node grouping. The method also includes receiving recursed DNS queries and responsively translating domain names in the recursed DNS queries into associated IPv6 network addresses to reach content indicated by the domain names, the associated IPv6 network addresses each determined by at least selecting one of the prefixed IPv6 network addresses according to a desired routing provider and a desired server node grouping indicated in the PQDNs.

Abstract: Systems, methods, apparatus, and software for pre-fetching and/or pre-loading sub-resources used in rendering HTML files, web pages and the like are provided herein. Implementations include expedited sub-resource loading in which a cache node or other content delivery network component receives a first end user device request seeking a primary resource (e.g., an HTML file). Using information in the first request, the content delivery network pre-fetches one or more identified sub-resources (e.g., JavaScript code) required for rendering of the HTML file. Pre-fetched sub-resources are held by the cache node. During parsing of the HTML file by the end user device, a web browser or other application requires the sub-resource(s) and the end user device thus sends a second request to the cache node asking for the required sub-resource(s). The cache node sends the requested, pre-fetched sub-resource(s).