Introduction
The following applies only to CDN Static services. Let's assume that your CDN service has 50 CDN Locations (consisting of let's say 200 CDN edge servers) enabled and that you prefetch a 100 MB file. The prefetch request will generate quite a big traffic on your origin server because all 200 CDN edge servers will request the 100 MB file from it. If your origin server does not have a very good uplink (e.g. 10Gbps) then the prefetch request may use all of its available bandwidth. It is usually not what you want because it can cause degraded performance for other visitors connecting to you origin server.
Origin shield is a server or a small family of servers between your origin and CDN edge servers.
your origin server → origin shield → CDN edge servers
The same prefetch request but with origin shield enabled will generate much lower traffic on your origin server because not all 200 CDN edge servers will request the 100 MB file from your origin server but only origin shield will request it and then it will send it to CDN edge servers. So the "big traffic" will happen on origin shield and not on your origin server.
Enabling origin shield
We don't have a product origin shield but with our architecture you can easily create one. Origin shield is simply a CDN service with just two (minimum is one but for redundancy it is recommend to use two or three) CDN Locations enabled. Let's assume that your Origin Domain is mycompany.com and that you want to create a CDN service with Service Domain cdn.mycompany.com and with origin shield enabled.
Create origin shield
Firstly create a CDN service with Origin Domain mycompany.com and with Service Domain shield.mycompany.com and with just two CDN Locations enabled.
Create CDN service on top of origin shield
Secondly create a CDN service with Origin Domain shield.mycompany.com and with Service Domain cdn.mycompany.com. This CDN service can have as much CDN Locations enabled as you wish, it is the CDN service that will serve content to your visitors.
So we have the following setup.
mycompany.com → shield.mycompany.com → cdn.mycompany.com
That's all you need to do to enable origin shield. Now integrate the CDN service cdn.mycompany.com into your website.
Notes
Traffic Costs
With origin shield your CDN traffic costs will slightly increase. A good estimate for the increase is your cache-hit ratio. If your cache hit ratio is 95% then your traffic costs will increase by 5%. So in general your traffic costs will increase by (100% - cache-hit ratio).
Purging
To purge a content from a CDN service with origin shield enabled you must first purge the content from the origin shield CDN service and then subsequently from the CDN service on top of it.