Systems and methods for serving secure content
A method and system for maintaining and delivering secure online content includes facilitating registration of secure content with an online content placement auction system, auditing the registered content to ensure security requirements for the registered content are met, and holding an auction among bidders for placement of content in a secure online content space. The process of holding an auction for the content space includes receiving a call for secure content to be served in the content space, transmitting a bid request to bidders in response to the call, receiving bid replies having bid amounts and proposed content to be securely served in the content space, and determining a qualifying subset of the received bid replies having proposed content approved as secure.
1. A computer-implemented method comprising:
facilitating, by a processing system comprising a processor, registration of secure content with an online content placement system, the secure content comprising a network call chain; and
auditing, by the processing system, the registered secure content to ensure security requirements for the registered secure content are met;
wherein the auditing comprises:
determining, by the processing system, that each hop in the network call chain of the registered secure content is made over a secure connection, including performing, by the processing system, a secure sockets layer (SSL) security audit for each hop to ensure that network communication between a source device and a destination device associated with the hop is encrypted, wherein for each hop, the SSL security audit includes one or more of:
a check to confirm use of a valid SSL certificate;
a check to confirm use of a required encryption method; and
a check to confirm compliance with a minimum encryption key length;
identifying, by the processing system, a HTTPS URL of a first server in the network call chain, wherein the HTTPS URL is included in HTML code provided when serving the secure content in a secure online content space;
determining, by the processing system, that a secure impression inventory requires an additional security audit of the registered secure content;
conducting, by the processing system, the additional security audit of the registered secure content; and
responsive to a determination, by the processing system, that the registered secure content has passed the additional security audit, approving the registered secure content to serve on the secure impression inventory.
2. The method of claim 1 , wherein facilitating registration of the secure content comprises specifying one or both of a resource identifier for the secure content and source code of the secure content.
3. The method of claim 2 , wherein facilitating registration of the secure content further comprises specifying a pixel resource identifier for the secure content.
4. The method of claim 3 , wherein facilitating registration of the secure content further comprises specifying one or both of a resource identifier for a non-secure version of the secure content and source code of the non-secure version.
5. The method of claim 4 , wherein facilitating registration of the secure content further comprises specifying a pixel resource identifier for the non-secure version.
6. The method of claim 3 , wherein auditing the registered content comprises triggering a re-audit of the registered content upon detecting a modification to one or more of the resource identifier, the source code, and the pixel resource identifier.
7. A system, comprising:
a processing system including a processor; and
a memory that stores executable instructions that, when executed by the processing system, facilitates performance of operations, the operations comprising:
facilitating registration of secure content with an online content placement system, the secure content comprising a network call chain; and
auditing the registered secure content to ensure security requirements for the registered secure content are met;
wherein the auditing comprises:
determining that each hop in the network call chain of the registered secure content is made over a secure connection, including performing a secure sockets layer (SSL) security audit for each hop to ensure that network communication between a source device and a destination device associated with the hop is encrypted, wherein for each hop, the SSL security audit includes one or more of:
a check to confirm use of a valid SSL certificate;
a check to confirm use of a required encryption method; and
a check to confirm compliance with a minimum encryption key length;
identifying a HTTPS URL of a first server in the network call chain, wherein the HTTPS URL is included in HTML code provided when serving the secure content in a secure online content space;
determining that a secure impression inventory requires an additional security audit of the registered secure content;
conducting the additional security audit of the registered secure content; and
responsive to a determination that the registered secure content has passed the additional security audit, approving the registered secure content to serve on the secure impression inventory.
8. The system of claim 7 , wherein facilitating registration of the secure content comprises specifying one or both of a resource identifier for the secure content and source code of the secure content.
9. The system of claim 8 , wherein facilitating registration of the secure content further comprises specifying a pixel resource identifier for the secure content.
10. The system of claim 9 , wherein facilitating registration of the secure content further comprises specifying a resource identifier for a non-secure version of the secure content.
11. The system of claim 10 , wherein facilitating registration of the secure content further comprises specifying source code of the non-secure version.
12. The system of claim 10 , wherein facilitating registration of the secure content further comprises specifying a pixel resource identifier for the non-secure version.
13. The system of claim 9 , wherein auditing the registered content comprises triggering a re-audit of the registered content upon detecting a modification to one or more of the resource identifier, the source code, and the pixel resource identifier.
14. A non-transitory machine-readable storage medium, comprising executable instructions that, when executed by a processor, facilitate performance of operations, comprising:
facilitating registration of secure content with an online content placement system, the secure content comprising a network call chain; and
auditing the registered secure content to ensure security requirements for the registered secure content are met;
wherein the auditing comprises:
determining that each hop in the network call chain of the registered secure content is made over a secure connection, including performing a secure sockets layer (SSL) security audit for each hop to ensure that network communication between a source device and a destination device associated with the hop is encrypted, wherein for each hop, the SSL security audit includes one or more of:
a check to confirm use of a valid SSL certificate;
a check to confirm use of a required encryption method; and
a check to confirm compliance with a minimum encryption key length;
identifying a HTTPS URL of a first server in the network call chain, wherein the HTTPS URL is included in HTML code provided when serving the secure content in a secure online content space;
determining that a secure impression inventory requires an additional security audit of the registered secure content;
conducting the additional security audit of the registered secure content; and
responsive to a determination that the registered secure content has passed the additional security audit, approving the registered secure content to serve on the secure impression inventory.
15. The non-transitory machine-readable storage medium of claim 14 , wherein facilitating registration of the secure content comprises specifying one or both of a resource identifier for the secure content and source code of the secure content.
16. The non-transitory machine-readable storage medium of claim 15 , wherein facilitating registration of the secure content further comprises specifying a pixel resource identifier for the secure content.
17. The non-transitory machine-readable storage medium of claim 16 , wherein facilitating registration of the secure content further comprises specifying a resource identifier for a non-secure version of the secure content.
18. The non-transitory machine-readable storage medium of claim 17 , wherein facilitating registration of the secure content further comprises specifying source code of the non-secure version.
19. The non-transitory machine-readable storage medium of claim 17 , wherein facilitating registration of the secure content further comprises specifying a pixel resource identifier for the non-secure version.
20. The non-transitory machine-readable storage medium of claim 16 , wherein auditing the registered content comprises triggering a re-audit of the registered content upon detecting a modification to one or more of the resource identifier, the source code, and the pixel resource identifier.