Cloud Based Firewall System And Service

Abstract

A cloud-based firewall system and service is provided to protect customer sites from attacks, leakage of confidential information, and other security threats. In various embodiments, such a firewall system and service can be implemented in conjunction with a content delivery network (CDN) having a plurality of distributed content servers. The CDN servers receive requests for content identified by the customer for delivery via the CDN. The CDN servers include firewalls that examine those requests and take action against security threats, so as to prevent them from reaching the customer site. The CDN provider implements the firewall system as a managed firewall service, with the operation of the firewalls for given customer content being defined by that customer, independently of other customers. In some embodiments, a customer may define different firewall configurations for different categories of that customer's content identified for delivery via the CDN.

What is claimed is: 
     
         1 . A method of content delivery in a content delivery network (CDN) operated by a content delivery network service provider (CDNSP) on behalf of a plurality of participating content providers, wherein the plurality of participating content providers identify content to be delivered over the CDN, the method comprising:
 receiving one or more first firewall settings from a first participating content provider that specify how a firewall is to operate with respect to requests for content identified by the first participating content provider for delivery over the CDN;   receiving one or more second firewall settings from a second participating content provider that specify how a firewall is to operate with respect to requests for content identified by the second participating content provider for delivery over the CDN;   communicating the one or more first firewall settings and the one or more second firewall settings to the plurality of content servers in the CDN;   at one of the plurality of content servers in the CDN, receiving a first request for content identified by the participating content provider for delivery over the CDN, and evaluating the first request using a firewall configured with the one or more first firewall settings;   at one of the plurality of content servers in the CDN, receiving a second request for content identified by the second participating content provider for delivery over the CDN, and evaluating the second request using a firewall configured with the one or more second firewall settings.   
     
     
         2 . The method of  claim 1 , wherein the firewall configuration specified by the one or more first firewall settings is different from the firewall configuration specified by the one or more second firewall settings. 
     
     
         3 . The method of  claim 1 , wherein evaluating the first request using a firewall configured with the one or more first firewall settings comprises: testing the first request against one or more criteria, and if the one or more criteria are met, taking an action with respect to the first request. 
     
     
         4 . The method of  claim 3 , wherein the action taken is a protective action. 
     
     
         5 . The method of  claim 3 , wherein evaluating the second request using a firewall configured with the one or more second firewall settings comprises: testing the second request against one or more criteria, and if the one or more criteria are met, taking an action with respect to the second request. 
     
     
         6 . The method of  claim 1 , wherein any of the one or more first firewall settings and the one or more second firewall settings specify at least one of: (i) one or more criteria against which to test a content request, and (ii) an action to be taken with respect to a content request that meets one or more criteria. 
     
     
         7 . The method of  claim 1 , wherein any of the one or more first firewall settings and the one or more second firewall settings specify one or more criteria against which to test a content request, the one or more criteria defining rules that seek to identify security threats. 
     
     
         8 . The method of  claim 1 , wherein any of the one or more first firewall settings and the one or more second firewall settings specify an action to be taken with respect to a request if that request meets one or more criteria, the action selected from the group of actions that are: deny the request, generate an alert, modify the request, stop processing the request, and log the request. 
     
     
         9 . The method of  claim 1 , wherein any of the one or more first firewall settings and the second firewall settings specify one or more IP addresses, traffic from which is subject to a given action. 
     
     
         10 . The method of  claim 9 , wherein any of the one or more first firewall settings and the second firewall settings specify one or more IP addresses from which traffic is blocked. 
     
     
         11 . The method of  claim 1 , wherein at least one of the first request and the second request is an application layer request. 
     
     
         12 . The method of  claim 11 , wherein at least one of the first request and the second request is an HTTP request. 
     
     
         13 . The method of  claim 1 , wherein the one or more the first firewall settings and the one or more second firewall settings are communicated to the plurality of content servers in a metadata configuration file. 
     
     
         14 . A content delivery network (CDN) operated by a content delivery network service provider (CDNSP) on behalf of a plurality of participating content providers, wherein the plurality of participating content providers identify content to be delivered over the CDN, the CDN comprising one or more content servers having a processor and a memory storing instructions that, when executed by the processor, cause the one or more content servers to execute the following steps:
 receiving one or more first firewall settings that specify how a firewall is to operate with respect to requests for content identified by a first participating content provider for delivery over the CDN;   receiving one or more second firewall settings that specify how a firewall is to operate with respect to requests for content identified by a second participating content provider for delivery over the CDN;   at one of the plurality of content servers in the CDN, receiving a first request for content identified by the participating content provider for delivery over the CDN, and evaluating the first request using a firewall configured with the one or more first firewall settings;   at one of the plurality of content servers in the CDN, receiving a second request for content identified by the second participating content provider for delivery over the CDN, and evaluating the second request using a firewall configured with the one or more second firewall settings.   
     
     
         15 . The method of  claim 14 , wherein the firewall configuration specified by the one or more first firewall settings is different from the firewall configuration specified by the one or more second firewall settings. 
     
     
         16 . The method of  claim 14 , wherein evaluating the first request using a firewall configured with the one or more first firewall settings comprises: testing the first request against one or more criteria, and if the one or more criteria are met, taking an action with respect to the first request. 
     
     
         17 . The method of  claim 16 , wherein the action taken is a protective action. 
     
     
         18 . The method of  claim 16 , wherein evaluating the second request using a firewall configured with the one or more second firewall settings comprises: testing the second request against one or more criteria, and if the one or more criteria are met, taking an action with respect to the second request. 
     
     
         19 . The method of  claim 14 , wherein any of the one or more first firewall settings and the one or more second firewall settings specify at least one of: (i) one or more criteria against which to test a content request, and (ii) an action to be taken with respect to a content request that meets one or more criteria. 
     
     
         20 . The method of  claim 14 , wherein any of the one or more first firewall settings and the one or more second firewall settings specify one or more criteria against which to test a content request, the one or more criteria defining rules that seek to identify security threats. 
     
     
         21 . The method of  claim 14 , wherein any of the one or more first firewall settings and the one or more second firewall settings specify an action to be taken with respect to a request if that request meets one or more criteria, the action selected from the group of actions that are: deny the request, generate an alert, modify the request, stop processing the request, and log the request. 
     
     
         22 . The method of  claim 14 , wherein any of the one or more first firewall settings and the second firewall settings specify one or more IP addresses, traffic from which is subject to a given action. 
     
     
         23 .- 51 . (canceled)