Abstract: Some embodiments set forth systems and methods enabling a first network to use the resources of various second networks in order to localize delivery of the first network content from the various second networks in a secure manner. Some embodiments provide a token-based authentication scheme to ensure that any configured content access restrictions are effectuated at the first network and any of the second networks providing localized content delivery for the first network. The scheme involves a two phase user authentication, wherein the user is separately authenticated at the first network and the redirected to second network using either the same or different set of access restrictions. The first network exchanges a first encryption key with content providers for encrypting/decrypting the first access restriction and a second encryption key with a second network for encrypting/decrypting the second access restriction.

Abstract: Some embodiments provide reconfigurable web application firewall (WAF) functionality across a distributed platform. Specifically, the WAF function at each distributed platform server is customizable on a per customer and per inbound message basis. When a server receives an inbound message, the server identities the content or services of which specific customer are implicated by the inbound message. The server screens the inbound message for attacks using a first set of rules and policies defined as part of a production profile from a WAF instance defined by the specific customer while contemporaneously testing the inbound message against a second set of rules and polices defined as part of an audit profile from the same WAF instance. In this manner, the specific customer tests the audit profile rules and policies while still receiving the protections of the production profile rules and policies.

Abstract: Techniques described herein may be used to provide a self-installing customer premise equipment (CPE) device that is capable of automatically registering with, and participating in, a network of CPE devices in response to being powered on. The CPE device may be capable of logically combining a connection with a wireless cellular network and a wired network to increase bandwidth and reliability. The CPE device may also detect a power failure and report the power failure to a centralized server in order to facilitate the diagnosis and correction of performance issues caused by the power failure.

Abstract: Some embodiments provide a director agent, a server agent, and a specialized hand-off protocol for improving scalability and resource usage within a server farm. A first network connection is established between a client and the director agent in order to receive a content request from the client from which to select a server from a set of servers that is responsible for hosting the requested content. A second network connection is established between the server agent that is associated with the selected server and a protocol stack of the selected server. The first network connection is handed-off to the server agent using the specialized hand-off protocol. The server agent performs network connection state parameter transformations between the two connections to create a network connection through which content can be passed from the selected server to the client without passing through the director.

Abstract: Some embodiments provide multi-tenant billing systems and methods whereby data network usage fees that are associated with delivering select content of different content providers over a data network are passed to the content provider that originates or is the source for that select content instead of the end users that request and receive the select content. A deep packet inspection server or a billing server may be configured with a list of identifiers to distinguish between the network usage that is related to the delivery of the designated free content from the network usage that is not related to the delivery of the designated free content. The network usage can be distinguished by filtering or processing usage logs that track the network usage using the configured list of identifiers. Such filtering or processing can be done in real-time or in a delayed manner in a standalone or integrated system.

Abstract: Some embodiments provide a transport session discovery protocol that enables load balancing devices of an Anycast reliant distributed platform to route legacy control messages to destinations within the distributed platform that manage the sessions or connections implicated by the legacy control messages, even when the implicated sessions or connections cannot be directly identified from the control message headers. The modified load balancing operation as a result of the transport session discovery protocol involves identifying a message header mapping to an unrecognized session or connection, extracting session or connection identifying information and an error or condition from the message body, generating a new messaging construct to encapsulate the extracted information, and multicasting the messaging construct to other load balancing devices operating within a common point-of-presence.

Abstract: Some embodiments provide an optimized multi-hit caching technique that minimizes the performance impact associated with caching of long-tail content while retaining much of the efficiency and minimal overhead associated with first hit caching in determining when to cache content. The optimized multi-hit caching utilizes a modified bloom filter implementation that performs flushing and state rolling to delete indices representing stale content from a bit array used to track hit counts without affecting identification of other content that may be represented with indices overlapping with those representing the stale content. Specifically, a copy of the bit array is stored prior to flushing the bit array so as to avoid losing track of previously requested and cached content when flushing the bit arrays and the flushing is performed to remove the bit indices representing stale content from the bit array and to minimize the possibility of a false positive.

Abstract: Some embodiments provide a capacity management agent that modifies bandwidth that is allocated between an end user and a carrier network by caching requested content that is streamed at a first rate and then providing the cached content to the end user through the carrier network at a second rate. The agent performs a process that includes receiving data intended for a service region of the carrier network from an external data network. The process identifies resource availability at the service region. Next, the process passes the data to the service region at the first rate when the resource availability at the service region is not less than a threshold amount and caches the data for passing to the service region at the second rate that consumes fewer carrier network resource than the first rate when the resource availability at the service region is less than the threshold amount.

Abstract: A test network is provided to test updates to configurations and resources of a distributed platform and to warm servers prior to their deployment in the distributed platform. The test network tests and warms using real-time production traffic of the distributed platform in a manner that does not impact users or performance of the distributed platform. At least one distributed platform caching server passes content requests that it receives to the test network using a connectionless protocol. The test network includes a test server that is loaded with any of a configuration or resource under test or whose cache is to be loaded prior to the server's deployment into the distributed platform. The test network also includes a replay server that receives the requests from the caching server, distributes the requests to the test server, and monitors the test server responses.

Abstract: Some embodiments provide a capacity exchange whereby capacity from different content delivery networks (CDNs) can be bought, sold, and traded. The capacity exchange is part of an “Open CDN” platform. The Open CDN platform federates the independent operation of CDNs and other operators of and service providers to distributed platforms participating in the Open CDN platform so that each participant can (1) dynamically scale its capacity without incurring additional infrastructure costs, (2) expand its service into previously untapped geographic regions without physically establishing points of presence (POPs) at those geographic regions, and (3) reduce sunk costs associated with unused capacity of already deployed infrastructure by selling that unused capacity to other participants that are in need of additional capacity.

Abstract: Some embodiments provide reconfigurable web application firewall (WAF) functionality across a distributed platform. Specifically, the WAF function at each distributed platform server is customizable on a per customer and per inbound message basis. When a server receives an inbound message, the server identities the content or services of which specific customer are implicated by the inbound message. The server screens the inbound message for attacks using a first set of rules and policies defined as part of a production profile from a WAF instance defined by the specific customer while contemporaneously testing the inbound message against a second set of rules and polices defined as part of an audit profile from the same WAF instance. In this manner, the specific customer tests the audit profile rules and policies while still receiving the protections of the production profile rules and policies.

Abstract: Some embodiments provide a content delivery network (CDN) solution that affords the CDN control over those elements of customer content that are delivered by third parties. The CDN integrates a distributed set of monitoring agents. Each monitoring agent monitors the delivery performance of third parties to the region in which the agent operates. The CDN uses the performance monitoring information to dynamically manage the content tags to the third-party delivered elements of CDN-customer content. Specifically, a CDN server retrieves the parent page for requested CDN-customer content. The CDN server identifies the region from where the request originates and retrieves the logs from the monitoring agents monitoring from that region. The CDN server then modifies the base page by dynamically removing the tags to the third-party delivered elements that are reported in the monitoring agent logs as being unavailable, inaccessible, or underperforming in the identified region.

Abstract: Some embodiments provide a log reporting system for a federation of independently operated CDNs so that logs, performance, analytics, and billing can be obtained for customers irrespective of which servers of which federation participants the customers' configurations are deployed to. The system includes a log aggregator, splitter, management agent, archival storage, dissemination agent, data log analyzer, and portal. The log aggregator aggregates server logs from servers of the federation participants. The splitter produces customer logs by regrouping the server logs on a per customer basis irrespective of which servers of which federation participants produced entries for each customer. The management agent controls operations of the archival storage, dissemination agent, and log analyzer. The archival storage archives customer logs. The dissemination agent disseminates customer logs. The log analyzer processes the customer logs to produce reports, analytics, and billing.

Abstract: Some embodiments provide instantaneous and non-blocking content purging across storage servers of a distributed platform. When a server receives a purge operation, it extracts an identifier from the purge operation. The server then generates a content purge pattern from the identifier and injects the pattern to its configuration. Instantaneous purging is then realized as the server averts access to any cached content identified by the pattern. The purging also occurs in a non-blocking fashion as the physical purge of the content occurs in-line with the server's cache miss operation. The content purge pattern causes the server to respond to a subsequently received content request with a cache miss, whereby the server retrieves the requested content from an origin source, serves the retrieved content to the requesting user, and replaces a previously cached copy of the content that is to be purged with the newly retrieved copy.

Abstract: Some embodiments implement systems and methods to monitor CDN performance from the end user's perspective. To achieve full end-to-end monitoring, the systems and methods monitor the performance of Anycast routing for routing an end user to the optimal PoP of the CDN and monitor the performance of different routes that deliver content from the optimally selected PoP back to the end user. Systems and methods are also provided to leverage the monitored performance in order to automatically optimize the performance of the CDN by optimizing or modifying Anycast routing and by performing route grooming as needed to ensure that the optimal route is selected to deliver content to different sets of end users that request content from a particular PoP.