Content Delivery Networks

• websites often need to handle lot of traffic

• video on demand replacing linear TV

• videos need lots of bandwidth

• connecting to server far away introduces latency

• latency is foe of user satisfaction

• DDoS are common

• distribute load over lot of content servers

• have servers physically as near as possible to customer site

  
  

• edge-caches

• may be placed in ISP networks (e.g. netflix does that)

• distributing load can mitigate DDoS

• caching can reduce amount of traffic between ASes

• for customer

  • lower latency

  • higher reliability

• for ISP and consumer

  • lower traffic

  • reduced cost

  • better service quality

• for content providers

  • lower traffic

  • reduced costs

  • better service quality

from high to low distance to customer:

• Full content archive (ARCHIVE)

• -> connects to several

• Regional Caches (e.g. Europe, Asia, America,…)

• -> connect to several

• Edge Caches

• -> connect to several

• Customers

• archive holds all the data (e.g. whole video library)

  • might be distributed itself…

• regional caches get content from archive

• edge caches (located at ISP/IXPs) get content from regional cache

• if cache does not hold requested content -> ask its parent…

• real deployments may have more levels / be more sophisticated

• client connects to load balancer

• distributing the requests to several content servers

• data plane devices forward packets

• -> packets usually belong to flow

• -> there may be multiple next hops for the destinaiton of a packet

• => if different next hops used within one flow, packets might be reordered

• => messes with TCP congestion control…

• use 5-tuple hash

• => calculate hash over 5-tuple

• => same for all packets within one flow

• => chose next hop based on means of the hash…

• => packets all on same path between soruce and destination…

• one has to choose a server for each flow…

• moduo hashing

• consistent hashing

  
  

• N servers

• -> redirect client (with 5-tuple hash value h) to server

• h mod N

• what happens if N changes?

• eery client is hashed to new location…

• map each client to point on the edge of a circle

• e.g. [0,…,15]

• walk aroud the “circle” until a server is reached

• (-> each server also gets assigned to a point in the circle…)

• points are removed or added on circle

• => clents are remapped according to available positions on the circle…

  
  

• only K/N keys need to be remapped on average with K being the number of clients

  
  

• map servers not to single but multiple positions in the circle

• -> more even distribution of clients to server mapping

• Have front end server (for redirects)

• front end knows pool of content servers

• front end always answers with “302 temporarily moved”

• browser will automatically connect to content server mentioned in moved message

• front end may want to select server based on URL, cookies

• traffic contains confidential content

• front end server needs to have the TLS certificate

• => what happens after the conection is decrypted?!!!

• use SSL/TLS front-end special high performance hardware

  • snooping inside network yields clear text

  • very cost efficient

  • one central configuration

• perform decryption / encryption on content server

  • may burn lot of CPU cycles

  • decryption as late as possinble

  • easily deployed out-of-the box

• remove useless RTT caused by frontend redirect

• => directly connect to correct content server

• => resolve URL to different IP (from the different content servers)

• lots of entries

• geo based

• DNS may return mutlipel A/AAAA entries

• client chooses randomly

• => in average, each server shoudl get equal amount of traffic

• clietn / DNS does the load balancing

• may lead to endpoitns far away

solition:

• nameserver has IP address of resolver

• resolver may give the /24 prefix of client

• => nameserver knows rough geographical locatoin of resolver/client

• => provide the resolver/client with nearest content server

=> Geo-DNS

• But: may still be mislead (use resolver in another coutry which doesnt give /24 prefix)

• set up DNS so that it points to the protectoin provider’s CDN (e.g. cloudflare)

• => all traffic passes through the CDN

• CDN caches static content (e.g. videos)

• forwards dynamic content requests (e.g. php-websites) to the real webserver

• CDN needs to terminate TLS connection

• => CDN has complete access to connetion, including secret cookies, passwords,…

• => protection between CND and actual webserver migth be protected, might be not…

• still may be misleading

• DNS was never intended to work that way

• packets routed through BGP

• Basically:

  • manipulate routes via BGP

  • assiogn lots of content servers same IP

  • -> announce IP prefix through lots of different sites / perrings

  • => BGP searches best path (shortest…) from each source itself…

• decrease latency of requests from clients

• increase hit-cache ratio

• which objects to cache?

• where to cache?

• What size of cache do we need?

• caching strategy?

• how to update the caceh?

• cache-hit / cache-miss

• many objects only accessed once

• uses disk space without benefit

• more accessed objects could be eviced from cache (LRU)

• use cache filtering

• bloom filter

• use filter to decide which objects to cache

• example policy: only cache objects already seen once

Bloom filter:

• stochastic data structure

• map object hashes into table with binary entries

• use multiple has functions to decerase false positives

• data structure that uses hashing

• -> space efficient and easy to test wether element in set or to add element to set…

• -> says element is definitely not in set or it is possible in the set…

• bit array of m bits -> initially set to 0

• k hash functions that map to interval [0, m-1]

-> add elemetn by applying all hashes to it and then set resulting index in bit array to 1…

• speed -> use sungle hash and partition it into multiple hashes

• size: balance between false positives (e.g. indices set to 1 correspond to element not in list…); number of hash functions, number of stored objects and size of list…