Abstract: Systems, methods, apparatuses, and software for a content delivery network that caches content for delivery to end user devices is presented. In one example, a method includes, for domain name system translation nodes associated with the content delivery network, establishing address translations to translate domain names into network addresses usable by the end user devices for reaching content at the cache nodes, with portions of the network addresses comprising stenographic information. The method also includes providing ones of the network addresses with the stenographic information to the end user devices responsive to domain name translation requests issued by the end user devices. The method also includes, responsive to content requests issued by the end user devices, determining locality information associated with attack traffic directed at the content delivery network based at least on the stenographic information in the network addresses of the content requests.

Abstract: Systems, methods, apparatuses, and software for a content delivery network that caches content for delivery to end user devices is presented. In one example, a method includes establishing address translations which translate domain names into network addresses usable by the end user devices for reaching content at the cache nodes, with portions of the network addresses comprising stenographic information, and responsive to domain name translation requests from the end user devices, providing ones of the network addresses. The method includes receiving content requests transferred by the end user devices that comprise the network addresses, and performing one or more actions based on the stenographic information in the network addresses.

Abstract: Methods, systems, and software for operating a data storage system of a content delivery node are provided herein. In one example, a method of operating a data storage system of a content delivery node is presented. The method includes receiving content data into a storage system, storing the content data in a first storage space, determining popular content data within the content data based on at least user requests for the content data, and storing the popular content data in a second storage space.

Abstract: Described herein are methods, systems, and software for handling packet buffering between end users and content servers, such as content delivery nodes. In one example, a method of operating a content server includes generating first and second data packets for first and second content requests. Once generated, the method provides storing the first packets in a packet buffer and transferring the first packets to a first user device. Upon transfer, the first packets are deleted from the packet buffer and replaced with the second packets.

Abstract: Systems, methods, and software for operating a content delivery system are provided herein. In one example, a method includes, in a first content delivery node, receiving a purge instruction to purge first content stored in the first content delivery node and responsively purging the first content. Responsive to purging the first content, the method includes transferring a content request for delivery to a second content delivery node, where the content request comprises a request for second content to replace the first content and a revision indicator of the first content. Responsive to the content request, the method includes receiving the second content for storage in the first content delivery node.

Abstract: Systems, methods, apparatuses, and software for operating content delivery networks are provided herein. In one example, a method of operating a domain name translation node in a first point-of-presence of a content delivery network is presented. The method includes receiving a translation message issued by an end user device for translation of a domain name into a content network address, and processing the translation message to identify a network address of a node that transferred the translation message. The method also includes selecting the content network address based at least in part on correlations between network addresses and performance factors to direct the end user device to a target cache node at a point-of-presence different than the point-of-presence of the domain name translation node, and transferring a response message indicating the content network address which directs the end user device to the target cache node at the second point-of-presence.

Abstract: Disclosed herein are methods, systems, and software for bypassing a domain name system. In one example, a method of operating a user communication device includes receiving a user instruction requesting content within a user application of the user communication device. The method further provides, in response to the user instruction, processing at least a domain name system bypass data structure on the user communication device to identify a network address for retrieving the content. The method further includes, requesting the content from a content node using the network address.

Abstract: A privatized link between an origin server and a content delivery network is provided. A privatized link can be direct connection that does not route over the internet. Another privatized link is one that rotates IP addresses. An origin server may be assigned to use a set of multiple IP addresses for communication with the content delivery network. However, at any given time, the origin server is only using a small number of IP addresses. When one of the IP addresses being used to communicate with the content delivery network comes under attack, the origin server switches to another IP address in the set in order to continue serving content to the content delivery network via an IP address that is not under attack.

Abstract: Described herein are methods, systems, and software for handling packet buffering between end users and content servers, such as content delivery nodes. In one example, a method of operating a content server includes generating first and second data packets for first and second content requests. Once generated, the method provides storing the first packets in a packet buffer and transferring the first packets to a first user device. Upon transfer, the first packets are deleted from the packet buffer and replaced with the second packets. Theses second packets are then transferred to a second user device and deleted from the packet buffer. Further, once the packets are transferred to the user devices, the method further includes monitoring for an acknowledgment from the user devices to ensure the packets are received.

Abstract: Described herein are methods, systems, and software for encrypting and erasing data objects in a content node. In one example, a method of operating a content node that caches content divided into one or more data objects includes encrypting the one or more data objects using separate encryption keys for each of the one or more data objects, the separate encryption keys comprising a common portion shared by the one or more data objects and an individualized portion unique to each data object. The method further provides receiving a purge request to erase at least one data object and, responsive to the purge request, erasing at least one of the common portion or the individualized portion for the at least one data object based on the purge request.

Abstract: Disclosed herein are methods, systems, and software for bypassing a domain name system. In one example, a method of operating a user communication device includes receiving a user instruction requesting content within a user application of the user communication device. The method further provides, in response to the user instruction, processing at least a domain name system bypass data structure on the user communication device to identify a network address for retrieving the content. The method further includes, requesting the content from a content node using the network address.

Abstract: Methods, systems, and software for operating a data storage system of a content delivery node are provided herein. In one example, a method of operating a data storage system of a content delivery node is presented. The method includes receiving content data into a storage system, storing the content data in a first storage space, determining popular content data within the content data based on at least user requests for the content data, and storing the popular content data in a second storage space.

Abstract: Disclosed herein are methods, systems, and software for handling secure transport of data between end users and content serving devices. In one example, a method of operating a content server includes identifying a content request from an end user device. The method further includes, responsive to the user request, determining a transmission control protocol window size and a secure layer protocol block size. The method also provides scaling the secure layer protocol block size to match the transmission control protocol window size, and transferring secure layer protocol packets to the end user device using the scaled secure layer protocol block size.

Abstract: Disclosed herein are methods, systems, and software for handling threaded processes in security handshaking between end users and content delivery nodes are presented. In one example, a method of operating a content delivery node includes identifying a secure layer connection request within an application thread, and initiating a new thread for a security handshake process based on the secure layer connection request. The method further includes, in response to completing the security handshake process, returning to the application thread.

Abstract: Described herein are methods, systems, and software for encrypting and erasing data objects in a content node. In one example, a method of operating a content node that caches content divided into one or more data objects includes encrypting the one or more data objects using separate encryption keys for each of the one or more data objects, the separate encryption keys comprising a common portion shared by the one or more data objects and an individualized portion unique to each data object. The method further provides receiving a purge request to erase at least one data object and, responsive to the purge request, erasing at least one of the common portion or the individualized portion for the at least one data object based on the purge request.

Abstract: Disclosed herein are methods, systems, and software for handling secure transport of data between end users and content serving devices. In one example, a method of operating a content server includes identifying a content request from an end user device. The method further includes, responsive to the user request, determining a transmission control protocol window size and a secure layer protocol block size. The method also provides scaling the secure layer protocol block size to match the transmission control protocol window size, and transferring secure layer protocol packets to the end user device using the scaled secure layer protocol block size.

Abstract: Disclosed herein are methods, systems, and software for handling threaded processes in security handshaking between end users and content delivery nodes are presented. In one example, a method of operating a content delivery node includes identifying a secure layer connection request within an application thread, and initiating a new thread for a security handshake process based on the secure layer connection request. The method further includes, in response to completing the security handshake process, returning to the application thread.

Abstract: Systems, methods, and software for operating a content delivery node to monitor requests for content transferred by at least an end user device to detect when the requests comprise an attack on the content delivery node. Responsive to detecting the attack on the content delivery node, the content delivery node establishes a rate limit in the content delivery node on at least the requests for the content associated with the end user device, and transfers an indication of the attack comprising the rate limit for delivery to another content delivery node that directs the other content delivery node to apply the rate limit to further requests for the content before the further requests are received by the other content delivery node.

Abstract: Described herein are methods, systems, and software for encrypting and erasing data objects in a content node. In one example, a method of operating a content node that caches content divided into one or more data objects includes encrypting the one or more data objects using separate encryption keys for each of the one or more data objects, the separate encryption keys comprising a common portion shared by the one or more data objects and an individualized portion unique to each data object. The method further provides receiving a purge request to erase at least one data object and, responsive to the purge request, erasing at least one of the common portion or the individualized portion for the at least one data object based on the purge request.

Abstract: Systems, methods, and software for operating one or more content delivery nodes (CDN), which cache content for delivery to end users, are provided herein. In one example, content requests received from at least a first end user for the content at a first CDN are monitored to determine when the content requests comprise an attack on the first CDN. Responsive to the attack on the first CDN, a rate limit is established in the first CDN on at least the content requests received by the first CDN and an indication of the attack is transferred for delivery to at least a second CDN. Responsive to the indication of the attack, the rate limit is applied for further content requests received for the content at the second CDN.