Access control for content delivery networks

1. A computer-implemented method, comprising

distributing, from an origin server, a plurality of content items to a server in a content delivery network, the content items each being identified in a manner that expresses relationships between a respective one of the content items and an associated content element, wherein the content element and the respective one of the content items represent a portion of an electronic content work such as an electronic book, magazine, or article, and

providing a requesting Web browser associated with a client computer a request signature that is based on a client identifier, a content element identifier, and trusted credentials to be used by the server in the content delivery network for verifying that the browser is authorized to receive the content items and the associated content element, wherein the credentials comprise a request signature that uniquely associates the requesting browser with the content elements,

wherein during loading of the content element from the server in the content delivery network, the requesting Web browser specifies, for each respective one of the content items, uniform resource locators that include bindings that uniquely associate the content items with the associated content element in a cryptographically secure manner, comprising: the content element identifier; a unique identifier for the respective access-restricted content item that is based on an identifier for the content element, an asset identifier for the respective access-restricted content item, and the trusted credentials; the request signature; and the content item identifier.

2. A computer-implemented method, comprising:

receiving, at a server of a content delivery network (CDN), a resource request from a requesting browser associated with a client, the resource request identifying a content element that comprises content items, wherein the content element and the content items represent a portion of an electronic content work such as an electronic book, magazine, or article, a plurality of which content items are access-restricted content items, the access-restricted content items each having an associated unique identifier, wherein the unique identifier for each respective access-restricted content item is based on an identifier for the content element, an asset identifier for the respective access-restricted content item, and the common trusted credentials known to an origin server and the CDN server, wherein the credentials comprise a request signature that uniquely associates the requesting browser with the content elements;

determining, by the server and without contacting the origin server for the content element, whether the client is authorized to receive the access-restricted content items;

and, if so, returning the access-restricted content items to the client, otherwise, not returning the access-restricted content items to the client,

wherein the determination is made according to subsequent resource requests from the client for each respective access-restricted content item and said subsequent resource requests use a uniform resource locator formatted to express a binding between each respective access-restricted content item and the content element in a manner that facilitates validation of the client's authorization to receive the respective access-restricted content item according to common trusted credentials within each of said subsequent resource requests, wherein the binding uniquely associates each respective content item with the associated content element in a cryptographically secure manner.

3. A content delivery network (CDN) server, comprising:

an interface configured to receive a resource request from a browser associated with a client, the resource request identifying a content element that comprises content items, wherein the content element and the content items represent a portion of an electronic content work such as an electronic book, magazine, or article, a plurality of which content items are access-restricted content items, the access-restricted content items each having an associated unique identifier wherein the unique identifier for each respective access-restricted content item is based on an identifier for the content element, an asset identifier for the respective access-restricted content item, and the common trusted credentials known to an origin server and the CDN server, wherein the credentials comprise a request signature that uniquely associates the requesting browser with the content elements;

a processor configured to determine, without contacting the origin server for the content element, whether the client is authorized to receive the access-restricted content items;

and, if so, to effect a return of the access-restricted content items to the client, otherwise, to not effect the return of the access-restricted content items to the client,

wherein the determination is made according to subsequent resource requests received from the client for each respective access-restricted content item, and said subsequent resource requests use a uniform resource locator formatted to express bindings between each respective access-restricted content items and the content element in a manner that facilitates validation of the client's authorization to receive the respective access-restricted content item according to common trusted credentials within each of said subsequent resource requests, wherein the bindings uniquely associate the content items with the associated content element in a cryptographically secure manner.

4. The server of claim 3 wherein the resource request includes an identifier for the content element as well as the unique identifier for each respective access-restricted content item based on an identifier for the content element, an asset identifier for the respective access-restricted content item, and the common trusted credentials.