Abstract: Systems and methods for protecting a network including providing a mapping between internal addresses as seen by devices of the protected network and external addresses; providing devices with a mapped address for a destination in response to a lookup request; rewriting, at a gateway, destination addresses of packets exiting the protected network based on the mapping; and rewriting, at the destination-network gateway, source addresses of packets entering the protected network based on the mapping. Embodiments include a gateway coupled to a protected network, an external network, and a name server. The name server, in response to a hostname lookup request, configured to provide a network device with the internal address; and the gateway with a mapping including the internal address, the addresses of the device, and the hostname. The gateway configured to rewrite destination addresses of outbound packets, and source addresses of inbound packets, based on the mapping.

Abstract: In some embodiments, a first location server, in response to a request from a client to access an object, determines whether a first location information stored at the first location server indicates locations of instance(s) of the object. The first location server, in response to a determination that the first location information indicates the locations of the instances of the object, determines a first location of a first instance of the object at a first payload server and a second location of a second instance of the object at a second payload server from the first location information. The first location server determines priority values of the first and second locations. The first location server generates a reply to the request, the reply indicating the first and second locations of the first and second instances of the object, and the priority values of the first and second locations.

Abstract: Systems and methods for protecting a network including preventing data traffic from exiting the network unless a domain name request has been performed by a device attempting to transmit the data traffic. In an embodiment, a device within the protected network attempting to send data outside the protected network requests an address for a destination outside the protected network from a domain name server (DNS). In response, the DNS provides an address of the destination to the device and a gateway. In response to receiving the address, the gateway temporarily allows access to the address. In an embodiment, a DNS is coupled to a protected network and the gateway, the DNS provides an external address to a device in response to a request; and a mapping to the gateway; the gateway, coupled to a protected network and an external network, allows traffic according to the mapping.

Abstract: In some embodiments, a first location server, in response to a request from a client to access an object, determines whether a first location information stored at the first location server indicates locations of instance(s) of the object. The first location server, in response to a determination that the first location information indicates the locations of the instances of the object, determines a first location of a first instance of the object at a first payload server and a second location of a second instance of the object at a second payload server from the first location information. The first location server determines priority values of the first and second locations. The first location server generates a reply to the request, the reply indicating the first and second locations of the first and second instances of the object, and the priority values of the first and second locations.

Abstract: A client is redirected to use a surrogate payload server to access a substantially identical copy of an object that is located on a primary payload server. A proxy location server intercepts object location queries from clients and replies with the location of the surrogate payload server as the preferred source for the object rather than the location of the primary payload server.