Abstract:
One embodiment of the present invention provides a system that facilitates security-enabled content caching. The system operates by first receiving a request from a user at a cache server for restricted content, wherein the cache server stores content for an application server. Next, the system determines if the restricted content is located on the cache server. If so, the system determines if the user is authorized to access the restricted content. If the user is authorized to access the restricted content, the system provides the restricted content to the user from the cache server. Providing the restricted content from the cache server eliminates the time consuming operations involved in requesting and receiving the restricted content from the application server.

Description:
BACKGROUND  
         [0001]    1. Field of the Invention  
           [0002]    The present invention relates to cache servers. More specifically, the present invention relates to a method and an apparatus to facilitate security-enabled content caching at a cache server.  
           [0003]    2. Related Art  
           [0004]    Computer users, both business and individual, are turning to the World Wide Web for rapid dissemination of content. This content can include business data such as financial status and inventory, and general data such as world news. Providers of this content use many devices and methods to assist the rapid delivery of content to users and to reduce the number of “hits” requesting the content that are received at the content source. One of these devices is a cache server, which stores previously accessed data, and then serves this previously accessed data in response to subsequent requests.  
           [0005]    [0005]FIG. 1 illustrates a cache server  104  that supplies content received from an application server  106  to a browser  102 . During operation, a user (not shown) at browser  102  makes a request  108  for content from application server  106 . Request  108  is routed to cache server  104  where cache server  104  determines if the content is available at cache server  104 . If so, cache server  104  supplies content  114  to browser  102 . If the content is not available at cache server  104 , cache server  104  makes a request  110  to application server  106  for the content. Application server  106  creates the content and supplies the content  112  to cache server  104 . Cache server  104  then saves a copy of content  112  and supplies the content to browser  102  as content  114 . Note that creating the content at application server  106  may be a lengthy operation.  
           [0006]    [0006]FIG. 2 illustrates multiple cache servers supplying content to browsers. The system includes application server  202 , cache servers  204 ,  208 ,  212 , and  216 , and browsers  206 ,  210 ,  214 , and  218 . Cache servers  204 ,  208 ,  212 , and  216  can be located in different geographical areas to provide localized access to content from application server  202 . For example, cache server  204  may be located in Japan, cache server  208  may be located in the United States, cache server  212  may be located in Europe, and cache server  216  may be located in India. Note that there may be more browsers communicating with each cache server than is shown in FIG. 2. These browsers, cache servers, and application server  202  operate in a similar manner as described above in conjunction with FIG. 1.  
           [0007]    These content caching servers (cache servers) have traditionally been used only for rapid delivery of “public” (i.e., unrestricted) content to content consumers. However, in many situations, it is desirable to be able to deliver certain types of sensitive content to restricted subsets of users. In these situations, existing cache server designs do not provide mechanisms to deliver this content efficiently. In particular, content caches do not provide support to verify user identity and to apply access control checks before delivering the content to a user. Thus, restricted content presently has to be obtained from a content-originating server (an application server) so that the application server can apply the access control logic. This results in slower response to the user, reduced capacity/scalability in the system, and increased data traffic at the application server.  
           [0008]    Hence, what is needed is a method and an apparatus that facilitates efficient content caching for restricted content without the problems described above.  
         SUMMARY  
         [0009]    One embodiment of the present invention provides a system that facilitates security-enabled content caching. The system operates by first receiving a request from a user at a cache server for restricted content, wherein the cache server stores content for an application server. Next, the system determines if the restricted content is located on the cache server. If so, the system determines if the user is authorized to access the restricted content. If the user is authorized to access the restricted content, the system provides the restricted content to the user from the cache server. Providing the restricted content from the cache server eliminates the time consuming operations involved in requesting and receiving the restricted content from the application server.  
           [0010]    In a variation of this embodiment, if the restricted content is not located at the cache server, the system requests an access authorization for the user from a security infrastructure. If the access authorization is received, the system requests the restricted content from the application server. After receiving the restricted content, the system caches the restricted content and provides the restricted content to the user.  
           [0011]    In a further variation, determining if the user is authorized to access the restricted content involves first requesting the access authorization for the user from the security infrastructure and then, if the access authorization is received, providing the restricted content to the user.  
           [0012]    In a further variation, if the restricted content is not located at the cache server, the system requests the restricted content from the application server on behalf of the user. In response, the system receives the restricted content from the application server, including an access tag that provides access authorization information. The system caches the restricted content and forwards the access tag to a security infrastructure. Finally, the system provides the restricted content to the user.  
           [0013]    In a further variation, determining if the user is authorized to access the restricted content involves first requesting an access authorization for the user from the security infrastructure. The security infrastructure uses the access tag to determine if the user is authorized to receive the restricted content. Upon receiving the access authorization, the system provides the restricted content to the user.  
           [0014]    In a further variation, if the restricted content is not located at the cache server, the system requests the restricted content from the application server on behalf of the user. After receiving the restricted content from the application server, the system caches the restricted content and provides the restricted content to the user.  
           [0015]    In a further variation, determining if the user is authorized to access the restricted content involves: requesting an authorization from the application for the user to access the restricted content; and if the authorization is received, providing the restricted content to the user.  
       
    
    
     BRIEF DESCRIPTION OF THE FIGURES  
       [0016]    [0016]FIG. 1 illustrates a cache server that supplies content received from an application server to a browser.  
         [0017]    [0017]FIG. 2 illustrates multiple cache servers supplying content to browsers.  
         [0018]    [0018]FIG. 3 illustrates a cache server for centrally managed access in accordance with an embodiment of the present invention.  
         [0019]    [0019]FIG. 4 presents a flowchart illustrating the process of centrally managed access in accordance with an embodiment of the present invention.  
         [0020]    [0020]FIG. 5 illustrates a cache server for externalizable application managed access in accordance with an embodiment of the present invention.  
         [0021]    [0021]FIG. 6 presents a flowchart illustrating the process of externalizable application managed access in accordance with an embodiment of the present invention.  
         [0022]    [0022]FIG. 7 illustrates a cache server for non-externalizable application managed access in accordance with an embodiment of the present invention.  
         [0023]    [0023]FIG. 8 presents a flowchart illustrating the process of non-externalizable application managed access in accordance with an embodiment of the present invention. 
     
    
     DEFINITIONS  
       [0024]    Cache server: An entity, which takes part in real-time content delivery as well as non-real-time content delivery, such as in the case of a search engine, which indexes content off-line.  
       DETAILED DESCRIPTION  
       [0025]    The following description is presented to enable any person skilled in the art to make and use the invention, and is provided in the context of a particular application and its requirements. Various modifications to the disclosed embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other embodiments and applications without departing from the spirit and scope of the present invention. Thus, the present invention is not intended to be limited to the embodiments shown, but is to be accorded the widest scope consistent with the principles and features disclosed herein.  
         [0026]    The data structures and code described in this detailed description are typically stored on a computer readable storage medium, which may be any device or medium that can store code and/or data for use by a computer system. This includes, but is not limited to, magnetic and optical storage devices such as disk drives, magnetic tape, CDs (compact discs) and DVDs (digital versatile discs or digital video discs), and computer instruction signals embodied in a transmission medium (with or without a carrier wave upon which the signals are modulated). For example, the transmission medium may include a communications network, such as the Internet.  
         [0027]    Centrally Managed Access  
         [0028]    [0028]FIG. 3 illustrates a cache server  310  for centrally managed access in accordance with an embodiment of the present invention. Users  302  and  304  communicate with cache server  310  using browsers  306  and  308 , respectively.  
         [0029]    During operation, cache server  310  receives a request for restricted content from a browser, say browser  306 , on behalf of a user, such as user  302 . In response to the request, cache server  310  requests access authorization from security infrastructure  312  for user  302  to receive the restricted content. If access authorization is received and the restricted content is not available in cache server  310 , cache server  310  requests the restricted content from application server  314 . Upon receiving the restricted content from application server  314 , cache server  310  stores the restricted content and provides a copy of the restricted content to user  302  at browser  306 .  
         [0030]    If cache server  310  subsequently receives a request for the same restricted content from a different user, say user  304  at browser  308 , cache server  310  similarly requests access authorization from security infrastructure  312 . If access authorization is received for user  304 , cache server  310  provides the restricted content, which was previously stored at cache server  310 . Obtaining the restricted content from cache server  304  eliminates the time and communication traffic involved in contacting application server  314 , generating the restricted content, and returning the restricted content to cache server  310 .  
         [0031]    Centrally Managed Access Process  
         [0032]    [0032]FIG. 4 presents a flowchart illustrating the process of centrally managed access in accordance with an embodiment of the present invention. In centrally managed access, cache server  310  communicates with security infrastructure  312  to determine if the users are authorized to access restricted content from application server  314 . The system starts when a request is received at a cache server for restricted content (step  402 ). Next, the system determines if the restricted content is stored at the cache server (step  404 ).  
         [0033]    If the restricted content is not available at the cache server, the system consults the security infrastructure to determine if the user has access to the restricted content (step  406 ). If the user does not have access to the restricted content, the process is terminated (step  408 ). Otherwise, the system requests the restricted content from the application server (step  410 ). Upon receiving the restricted content, the cache server stores the restricted content (step  412 ). Finally, the cache server forwards the restricted content to the user (step  414 ).  
         [0034]    If the restricted content is available at the cache server at step  404 , the system consults the security infrastructure to determine if the user has access to the restricted content (step  416 ). If the user does not have access to the restricted content, the process is terminated (step  418 ). Otherwise, the system forwards the restricted content to the user at step  414 .  
         [0035]    Externalizable Application Managed Access  
         [0036]    [0036]FIG. 5 illustrates a cache server  510  for externalizable application managed access in accordance with an embodiment of the present invention. As is illustrated in FIG. 5, users  502  and  504  communicate with cache server  510  using browsers  506  and  508 , respectively. In externalizable application managed access, application server  514  determines if the users are authorized to access restricted content from application server  514 . If so, application server  514  sends a tag with the restricted content. This tag includes metadata describing which users are authorized to access the restricted content. Cache server  510  forwards this tag to security infrastructure  512 .  
         [0037]    During operation, cache server  510  receives a request for restricted content from a browser, say browser  506 , on behalf of a user (user  502  in this case). In response to the request, cache server  510  determines if the restricted content is available in the cache. If not, cache server  510  requests the restricted data from application server  514  on behalf of user  502 . Application server  514  then determines which users are authorized to access the restricted content and provides a tag with the restricted content. Upon receiving the restricted content and the tag, cache server  510  forwards the tag to security infrastructure  512 , saves the restricted content in the cache, and provides the restricted content to user  502 .  
         [0038]    In a subsequent operation, if cache server  510  receives a request for the same restricted content from a different user, say user  504  at browser  508 , cache server  510  requests access authorization from security infrastructure  512 . Security infrastructure  512  uses the tag previously received to determine if user  504  is authorized to access the restricted content. If access authorization is received for user  504  from security infrastructure  512 , cache server  510  provides the restricted content from the content previously stored by cache server  510 . Obtaining the restricted content from the cache server in this manner eliminates the time and communication traffic involved in contacting application server  514 , generating the restricted content, and returning the restricted content to cache server  510 .  
         [0039]    Externalizable Application Managed Access Process  
         [0040]    [0040]FIG. 6 presents a flowchart illustrating the process of externalizable application managed access in accordance with an embodiment of the present invention. The system starts when a request is received at a cache server for restricted content (step  602 ). In response to this request, the system determines if the restricted content is stored in the cache (step  604 ).  
         [0041]    If the restricted content is not stored at the cache server, the cache server requests the restricted content from the application server on behalf of the user (step  606 ). The application server determines the access rules for the restricted content, including whether the user is authorized to access the restricted content (step  608 ). If the user is not authorized to access the restricted content, the process is terminated (step  610 ). Otherwise, the application server provides the restricted content and a tag to the cache server (step  612 ). This tag includes metadata defining who has access to the restricted content.  
         [0042]    Upon receiving the restricted content and the tag, the cache server stores the restricted content in the cache, and sends the tag to the security infrastructure (step  614 ). Finally, the cache server delivers the restricted content to the user (step  616 ).  
         [0043]    If the restricted content is stored at the cache server at step  604 , the cache server requests an access authorization from the security infrastructure (step  618 ). The security infrastructure determines whether the user has access by using the previously provided tag. If the user does not have access, the process is terminated (step  620 ). Otherwise, the cache server delivers the restricted content to the user from the cache at step  616 .  
         [0044]    Non-Externalizable Application Managed Access  
         [0045]    [0045]FIG. 7 illustrates a cache server for non-externalizable application managed access in accordance with an embodiment of the present invention. As is illustrated in FIG. 7, users  702  and  704  communicate with cache server  710  using browsers  706  and  708 , respectively. In non-externalizable application managed access, application server  714  always determines if the user is authorized to access restricted content from application server  714 .  
         [0046]    During operation, cache server  710  receives a request for restricted content from a browser, say browser  706 , on behalf of a user (user  702  in this case). In response to the request, cache server  710  determines if the restricted content is available in the cache. If not, cache server  710  requests the restricted data from application server  714  on behalf of user  702 . Application server  714  determines if the user is authorized to access the restricted content and, if so, provides the restricted content to cache server  710 . Upon receiving the restricted content, cache server  710  saves the restricted content in the cache and provides the restricted content to user  702 .  
         [0047]    If cache server  710  subsequently receives a request for the same restricted content from a different user (say user  704 ) at browser  708 , cache server  710  requests access authorization from security infrastructure  712 . Security infrastructure  712 , in turn, requests authorization from application server  714 . If access authorization is received for user  704  from application server  714 , security infrastructure  712  forwards the authorization to cache server  710 . Cache server  710  then provides the restricted content from the content previously stored by cache server  710 . Providing the restricted content from the cache eliminates the time and communication traffic involved in contacting application server  714 , generating the restricted content, and returning the restricted content to cache server  710 . Note that a minimal amount of time and communication traffic is required to contact application server  714  to obtain the access authorization.  
         [0048]    Non-Externalizable Application Managed Access Process  
         [0049]    [0049]FIG. 8 presents a flowchart illustrating the process of non-externalizable application managed access in accordance with an embodiment of the present invention. The system starts when a request is received for restricted content at the cache server (step  802 ). In response to this request, the cache server determines if the restricted content is available at the cache server (step  804 ).  
         [0050]    If the restricted content is not available at the cache server, the cache server requests the restricted content from the application server (step  806 ). The application server then determines if the user can access the restricted content (step  808 ). If the user does not have access to the restricted content, the process is terminated (step  810 ).  
         [0051]    If the application server determines that the user has access to the restricted content, the application server provides the restricted content to the cache server (step  812 ). The cache server stores this restricted content in the cache (step  814 ). Finally, the cache server delivers the restricted content to the user (step  816 ).  
         [0052]    If the restricted content is available at the cache server at step  804 , the cache server requests access authorization from the security infrastructure (step  818 ). The security infrastructure, in turn, requests authorization from the application server (step  820 ). If access authorization is not received from the application server, the process is terminated (step  822 ). If access authorization is received from the application server, the security infrastructure provides the authorization to the cache server. The cache server then delivers the restricted content to the user at step  816 .  
         [0053]    The foregoing descriptions of embodiments of the present invention have been presented for purposes of illustration and description only. They are not intended to be exhaustive or to limit the present invention to the forms disclosed. Accordingly, many modifications and variations will be apparent to practitioners skilled in the art. Additionally, the above disclosure is not intended to limit the present invention. The scope of the present invention is defined by the appended claims.