Andrew B Ellis

US Patent:

7260639, Aug 21, 2007

Filed:

Jul 9, 2002

Appl. No.:

10/191309

Inventors:

Michael M. Afergan - Cambridge MA, US
Andrew B. Ellis - Medford MA, US
Ravi Sundaram - Cambridge MA, US
Hariharan S. Rahul - Cambridge MA, US

Assignee:

Akamai Technologies, Inc. - Cambridge MA

International Classification:

G06F 15/16

US Classification:

709229, 709214, 709218, 709219, 709224, 709228, 726 12, 726 22

Abstract:

The present invention addresses the known vulnerabilities of Web site infrastructure by making an origin server substantially inaccessible via Internet Protocol traffic. In particular, according to a preferred embodiment, the origin server is “shielded” from the publicly-routable IP address space. Preferably, only given machines (acting as clients) can access the origin server, and then only under restricted, secure circumstances. In a preferred embodiment, these clients are the servers located in a “parent” region of a content delivery network (CDN) tiered distribution hierarchy. The invention implements an origin server shield that protects a site against security breaches and the high cost of Web site downtime by ensuring that the only traffic sent to an enterprise's origin infrastructure preferably originates from CDN servers. The inventive “shielding” technique protects a site's Web servers (as well as backend infrastructure, such as application servers, databases, and mail servers) from unauthorized intrusion—improving site uptime and in the process, customer loyalty.

US Patent:

20040093419, May 13, 2004

Filed:

Oct 23, 2002

Appl. No.:

10/278249

Inventors:

William Weihl - San Francisco CA, US
Andrew Ellis - Medford MA, US
Martin Kagan - Woodside CA, US

International Classification:

G06F015/16
G06F015/167

US Classification:

709/229000, 709/203000, 709/214000

Abstract:

A method of and system for secure content delivery. The method is carried out by a content delivery network service provider (CDNSP), which operates a secure CDN. The secure CDN may be a dedicated network or a subset of a larger distributed network that is managed by the service provider. A Web site obtains secure content delivery, preferably as a managed service, by aliasing the site (or given domains) to the CDN. Edge servers are selectively authenticated into the secure CDN before they can be used to deliver secure content, and the CDN service provider serves SSL pages over a secure connection on the site's behalf, preferably using an SSL certificate provided by the site. A copy of the customer's SSL certificate resides on the secure edge servers to allow them to serve SSL content on the customer's behalf. A key agent running on the edge server, however, ensures that the copy of the certificate only resides in memory and not on disk. Further, a server that cannot be fully monitored by the CDN service provider removes the certificate from its memory and no longer serves the SSL traffic.

US Patent:

20070283419, Dec 6, 2007

Filed:

Aug 20, 2007

Appl. No.:

11/841006

Inventors:

Michael Afergan - Cambridge MA, US
Andrew Ellis - Medford MA, US
Ravi Sundaram - Cambridge MA, US
Hariharan Rahul - Cambridge MA, US

Assignee:

AKAMAI TECHNOLOGIES, INC. - Cambridge MA

International Classification:

H04L 9/32

US Classification:

726003000

Abstract:

The present invention addresses the known vulnerabilities of Web site infrastructure by making an origin server substantially inaccessible via Internet Protocol traffic. In particular, according to a preferred embodiment, the origin server is “shielded” from the publicly-routable IP address space. Preferably, only given machines (acting as clients) can access the origin server, and then only under restricted, secure circumstances. In a preferred embodiment, these clients are the servers located in a “parent” region of a content delivery network (CDN) tiered distribution hierarchy. The invention implements an origin server shield that protects a site against security breaches and the high cost of Web site downtime by ensuring that the only traffic sent to an enterprise's origin infrastructure preferably originates from CDN servers. The inventive “shielding” technique protects a site's Web servers (as well as backend infrastructure, such as application servers, databases, and mail servers) from unauthorized intrusion—improving site uptime and in the process, customer loyalty.

US Patent:

20120124372, May 17, 2012

Filed:

Oct 12, 2011

Appl. No.:

13/272071

Inventors:

John A. Dilley - Los Altos CA, US
Andrew B. Ellis - Medford MA, US
Stephen L. Ludin - Mill Valley CA, US
John Summers - Newton MA, US

Assignee:

AKAMAI TECHNOLOGIES, INC. - Cambridge MA

International Classification:

H04L 29/06

US Classification:

713162

Abstract:

Websites and website users are subject to an increasing array of online threats and attacks. Disclosed herein are, among other things, approaches for protecting websites and website users from online threats. For example, a content server, such as a proxying content delivery network (CDN) server that is delivering content on behalf of an origin server, can modify URLs as they pass through the content server to obscured values that are given to the end-user client browser. The end-user browser can use the obscured URL to obtain content from the content server, but the URL may be valid only for a limited time, and may be invalid for obtaining content from the origin. Hence, information is hidden from the client, making attacks against the website more difficult and frustrating client-end malware that leverages knowledge of browsed URLs.