User access rate limiting among content delivery nodes
Systems, methods, and software for operating one or more content delivery nodes (CDN), which cache content for delivery to end users, are provided herein. In one example, content requests received from at least a first end user for the content at a first CDN are monitored to determine when the content requests comprise an attack on the first CDN. Responsive to the attack on the first CDN, a rate limit is established in the first CDN on at least the content requests received by the first CDN and an indication of the attack is transferred for delivery to at least a second CDN. Responsive to the indication of the attack, the rate limit is applied for further content requests received for the content at the second CDN.
1. A method of operating a content server in a network, the method comprising:
Identifying, at the content server, an incoming rate of traffic sent from a source to the content server, wherein the content server stores network content;
in response to determining that the incoming rate of the traffic exceeds a threshold rate, setting a rate limit against the source;
receiving a content request from the source after setting the rate limit; and
sending an alert from the content server to at least one other content server in the network to set the same rate limit against the source ahead of the one other content server receiving the content request.
2. The method of claim 1 further comprising:
receiving requests for content in the content server;
obtaining the content from an origin server if the content is not cached locally; and
replying to the requests with the content.
3. The method of claim 2 wherein the source of the traffic comprises a network address being used to send the traffic.
4. The method of claim 3 further comprising receiving an alert message from the one other content server indicative of a new network address to replace the network address against which the rate limit was set.
5. The method of claim 1 wherein the rate limit comprises a frequency at which the content server is allowed to reply to traffic sent from the source.
6. The method of claim 5 further comprising reducing the frequency in response to the incoming rate of the traffic continuing to exceed the threshold.
7. The method of claim 1 wherein the incoming rate of the traffic sent from the source indicates an occurrence of a denial of service attack.
8. A content server comprising:
one or more computer readable storage media;
a processing system operatively coupled to the one or more computer readable storage media; and
program instructions stored on the one or more computer readable storage media that, when executed by the processing system, direct the content server to at least:
store network content;
identify an incoming rate of traffic sent from a source to the content server;
in response to determining that the incoming rate of the traffic exceeds a threshold rate, set a rate limit against the source;
receive a content request from the source after setting the rate limit; and
send an alert to at least one other content server in the network to set the same rate limit against the source ahead of the one other content server receiving the content request.
9. The content server of claim 8 wherein the program instructions further direct the content server to:
receive requests for content in the content server;
obtain the content from an origin server if the content is not cached locally; and
reply to the requests with the content.
10. The content server of claim 9 wherein the source of the traffic comprises a network address being used to send the traffic.
11. The content server of claim 10 wherein the program instructions further direct the content server to receive an alert message from the one other content server indicative of a new network address to replace the network address against which the rate limit was set.
12. The content server of claim 8 wherein the rate limit comprises a frequency at which the content server is allowed to reply to traffic sent from the source.
13. The content server of claim 12 wherein the program instructions further direct the content server to reduce the frequency in response to the incoming rate of the traffic continuing to exceed the threshold.
14. The content server of claim 8 wherein the incoming rate of the traffic sent from the source indicates an occurrence of a denial of service attack.
15. A method of operating a communication service comprising:
in a first content server:
identifying an incoming rate of traffic sent from a source to the content server, wherein the content server stores network content;
in response to determining that the incoming rate of the traffic exceeds a threshold rate, setting a rate limit against the source;
receiving a content request from the source after setting the rate limit; and
sending an alert to at least a second content server in the network to set the same rate limit against the source ahead of the second content server receiving the content request; and
in a second content server, receiving the alert and setting the rate limit against the source.
16. The method of claim 15 further comprising, in the first content server:
receiving requests for content in the content server;
obtaining the content from an origin server if the content is not cached locally; and
replying to the requests with the content.
17. The method of claim 16 wherein the source of the traffic comprises a network address being used to send the traffic.
18. The method of claim 17 further comprising, in the second content server:
sending an alert message to the first content server indicative of a new network address to replace the network address against which the rate limit was set.
19. The method of claim 15 wherein the incoming rate of the traffic sent from the source indicates an occurrence of a denial of service attack.