Video anti-refreshing system based on access control technology and implementation method thereof

Abstract

The invention provides a video anti-refreshing system based on an access control technology and an implementation method thereof, and the system comprises a cloud storage service timestamp anti-theft link module which is used for logging in a cloud storage server platform, and starting the timestamp anti-theft link through the configuration of a target storage bucket; the anti-stealing-link key acquisition and configuration module is used for generating or copying a signature key in the cloud storage server platform and configuring a protection domain name, a threshold value and the signature key; and the video anti-refreshing module is used for enabling the generated anti-hotlinking key to enter an anti-refreshing system, checking the health state of each server node and carrying out video anti-refreshing monitoring.

Description

Technical Field

[0001] The present invention belongs to the field of network security and access control technology, and specifically relates to a distributed video anti-brushing system based on dynamic strategies and its implementation method, which is suitable for protecting high-frequency abnormal requests in scenarios such as Web services, API interfaces, and mobile applications. Background Art

[0002] In the field of internet application technology, ensuring the security of resource access is a critical component of business operations. However, in real-world business scenarios, inadequate anti-spam systems and methods often impose significant configuration and maintenance workloads on developers and administrators. Consequently, many businesses invest limited resources in strengthening resource access security, leading to frequent malicious spam attacks, which in turn cause server resource depletion, traffic loss, and a degraded user experience.

[0003] As black market attack methods continue to escalate, traditional anti-spam solutions are no longer able to cope:

[0004] Relying on fixed threshold interception, it is impossible to distinguish between normal high concurrency and malicious attacks, resulting in a high rate of false blocking. For example, corporate intranet users are easily mistakenly blocked due to shared egress IP addresses, affecting business continuity. Immediately blocking IP addresses after the threshold is triggered prevents legitimate users from quickly regaining access, resulting in business losses. Anti-spam systems must be deployed separately for each site, making policy configuration and data statistics difficult to centralize, making it impossible to effectively respond to cross-site coordinated attacks. Static URLs are easily captured and exploited in batches by crawlers, and the lack of a dynamic authorization mechanism leads to the continued risk of resource theft.

[0005] Therefore, there is an urgent need for an efficient, easy-to-use and adaptable anti-scaling system to cope with increasingly complex black market attacks, while reducing operation and maintenance costs and improving protection effects. Summary of the Invention

[0006] The present invention aims to at least solve the technical problems existing in the existing video anti-brushing technology, and particularly proposes an innovative multi-site anti-brushing management, an innovative resource anti-brushing system with secondary dynamic verification and its implementation method, which can effectively improve the security of resource access while reducing the misjudgment rate and operation and maintenance costs.

[0007] To achieve the above objectives, the present invention provides a multi-layered protection solution that combines IP frequency detection, verification code secondary verification, and dynamic URL signatures, and is equipped with a centralized multi-site management tool. This solution not only significantly improves the ability to intercept malicious brushing attacks, but also greatly simplifies the administrator's usage process through modular design and automated policy configuration, reducing the technical threshold and implementation cost of video brushing prevention. At the same time, the system provided by the present invention is highly configurable and scalable, capable of meeting the security needs of different business scenarios.

[0008] The present invention discloses a video anti-brushing system based on access control technology, comprising:

[0009] The cloud storage service timestamp anti-hotlinking module is used to log in to the cloud storage server platform and enable timestamp anti-hotlinking by configuring the target storage bucket;

[0010] The anti-hotlink key acquisition and configuration module is used to generate or copy the signature key in the cloud storage server platform and configure the protection domain name, threshold and signature key;

[0011] The video anti-scaling module is used to enter the generated anti-hotlink key into the anti-scaling system, check the health status of each server node, and perform video anti-scaling monitoring.

[0012] Preferably, the cloud storage service timestamp anti-hotlinking module includes:

[0013] After logging into the cloud storage server platform, obtain the original video resource URL, call the URL signature interface for video anti-brushing, determine whether it is a protected video site based on the interface parameters, determine whether it is a blacklisted IP address based on the IP address, and whether it is an IP address that exceeds the access threshold. If it exceeds the threshold, determine whether to enable secondary verification of the verification code; after the verification code verification is passed, generate a signed URL and return it to the caller.

[0014] In the above technical solution, preferably, the URL signature interface for calling the video anti-brushing function includes:

[0015] Listen for fetch events, intercept page network requests, determine whether they are video resources, generate new signed URLs and update status information, process Range requests, parse Range fields, and create new requests.

[0016] Preferably, in the above technical solution, generating a new signed URL and updating status information includes:

[0017] Call the video signature address API of the anti-spam system to generate a new signed URL. Get the current timestamp as the generation time of the new URL. Get the file size of the newly generated video URL for subsequent Range request processing. Create a new state object, establish the current timestamp for the newly generated signed URL, get the total size of the video file, and store the new state object in the global object to replace the old state information.

[0018] Preferably, the processing of the Range request includes:

[0019] Check whether there is a Range field in the request header and determine whether it starts with bytes=; if the Range field exists, continue to parse the Range field and create a new request, parse the value of the Range field, extract the starting byte and the ending byte, create a new request header object, and set the Range field to the processed byte range, create a new request object, use the new request header and the newly generated video URL, use the fetch function to send a new request, and return the response to the client. If the Range field does not exist, continue to execute the step of returning the entire video URL link, create a new request object, use the newly generated video URL, use the fetch function to send a new request, and return the entire video content to the client.

[0020] The above technical solution is preferably also includes dynamic signature URL validity limit and long video playback,

[0021] Register ServiceWorker, determine whether there is a ServiceWorker on the current control page, control the video page through ServiceWorker, ServiceWorker obtains the video address interface, determines whether the interface status is a successful request and returns the video playback address, checks whether the data status code obtained from the interface is a successful request, and checks whether the interface returns a valid video playback address. If the status code is not a successful request instruction or no valid video playback address is returned, trigger a verification code pop-up window and ask the user to enter the verification code. After the user enters the verification code, try to obtain the video address again, send a message to ServiceWorker, obtain the new video address, and re-perform the verification code request operation. If the user enters the verification code, if the verification code verification is successful, the valid video playback address is returned and the video playback instruction is executed.

[0022] In the above technical solution, the dynamic signature URL includes:

[0023] Renewal decisions are made based on user behavior analysis and network status.

[0024] The above technical solution preferably further includes:

[0025] Determine the probability of users continuing to watch.

[0026] Among them, set P as the viewing progress, 0≤P≤1, F is the user's video operation frequency, after normalization 0≤F≤1,

[0027] Calculate the dynamic validity period T of the URL.

[0028]

[0029] Tbase is the basic effective period, preferably 3 minutes, 5 minutes, and 8 minutes; α, β, and γ are the weight coefficients for adjusting the probability of watching videos, the network delay adjustment weight coefficient, and the bandwidth adjustment weight coefficient, respectively. threshold is the network delay threshold, B threshold is the bandwidth threshold. If the user video operation probability S = 0.8, the network delay time D = 150ms, and the real-time network bandwidth B = 8Mbps, then

[0030]

[0031] Set the video playback renewal trigger threshold. When the remaining validity period is T remaining <δ*T, the adjustment coefficient δ is 0.2 / 0.3 / 0.5. If the Service Worker sends a renewal request, and then verifies the user behavior and network status, if an abnormal network interruption occurs, the current URL validity period T is extended. extend =T+Δ, reference value Δ=3 minutes, or 5 minutes,

[0032] If the number of renewal request failures N ≥ N threshold , perform verification code verification.

[0033] The above technical solution preferably further includes:

[0034] Dynamic retry by calculating the delay time,

[0035]

[0036] t min is the basic delay time, t max is the maximum delay time, D threshold is the network delay threshold, random jitter is the random jitter time, and its value range is [0,50]ms.

[0037] Perform dynamic adjustment of video segments.

[0038]

[0039] V is the video segment size, and B is the real-time network bandwidth.

[0040] If the timeout

[0041]

[0042] T req is the timeout request time, T threshold is the timeout threshold.

[0043] If the timeout is extended to T timeoutTrigger verification code verification or fallback to the backup CDN node.

[0044] The present invention also discloses a method for implementing a video anti-brushing system based on access control technology, comprising the following steps:

[0045] S1, log in to the cloud storage server platform and enable timestamp hotlink protection by configuring the target storage bucket;

[0046] S2, generates or copies the signature key in the cloud storage server platform, and configures the protection domain name, threshold, and signature key;

[0047] S3, enters the generated anti-hotlink key into the anti-scaling system, checks the health status of each server node, and performs video anti-scaling monitoring.

[0048] The core embodiments of the present invention include the following:

[0049] 1. Centralized management of multiple sites

[0050] This system provides a unified configuration center that supports centralized configuration and management of policies for multiple protected sites. Administrators can flexibly set various protection rules through the configuration center, including the following configuration items:

[0051] 1) Site domain name configuration (domain)

[0052] ●Used to specify the domain name of the site that needs protection.

[0053] Example: domain:cdn.example.com

[0054] 2) Access threshold configuration (threshold)

[0055] ●Define the upper limit of access frequency of a single IP in a unit of time. If the threshold is exceeded, the protection mechanism will be triggered.

[0056] ●Example: threshold:100 (indicates that a single IP is allowed to access a maximum of 100 times per unit time)

[0057] 3) Unit time configuration (interval)

[0058] ●Set the time window for access frequency statistics, unit: seconds

[0059] ●Example: interval:60 (indicates that the statistical period is 60 seconds)

[0060] 4) Enable Captcha

[0061] ●Control whether to enable the dynamic verification code mechanism:

[0062] When enabled (enabledCaptcha:true): A verification code is returned after the IP triggers the threshold, and the counter is reset if the verification is successful.

[0063] When disabled (enabledCaptcha:false): The IP address will be added to the blacklist directly after triggering the threshold.

[0064] 5) Cloud storage vendor configuration (vendor)

[0065] code: Specifies the cloud vendor ID that provides the resource storage service. This is used to locate the cloud vendor's key when signing dynamic URLs. Example: code:qiniu (indicates using Qiniu Cloud storage service).

[0066] ●key: The cloud vendor's key for signing dynamic URLs

[0067] ●effectiveDuration: URL validity period configuration, in seconds. After the expiration, the link will automatically become invalid. Example: effectiveDuration:10 (meaning the URL is valid for 10 seconds)

[0068] Through the above configuration items, administrators can flexibly adjust protection policies according to the business needs of different sites. For example:

[0069] Enable strict policy for high-security sites: threshold:50,interval:60,enabledCaptcha:

[0070] true, enable relaxed policy for low-risk sites: threshold: 500, interval: 300, enabledCaptcha: false

[0071] In addition, the above configuration items will take effect immediately after modification in the configuration center, without the need to restart the anti-brushing system. 2. IP frequency detection and dynamic threshold control

[0072] This system uses the access threshold (threshold) and unit time (interval) set by the configuration center to count the access frequency of each IP in real time, and judges whether it is an abnormal access based on the preset rules, and then decides whether to add the IP to the blacklist. The specific implementation method is as follows:

[0073] 1) Visit frequency statistics

[0074] The system counts the number of visits of each IP in a unit time (interval) in real time.

[0075] Example: If threshold: 100 and interval: 60 are configured, the system will count the number of visits from each IP address within 1 minute. If the number exceeds 100, the protection mechanism will be triggered.

[0076] 2) Abnormal access determination

[0077] When the IP access frequency exceeds the threshold, the system marks the IP as "abnormal access" and handles it according to the rules of the configuration center:

[0078] If the verification code is enabled (enabledCaptcha:true), a verification code will be returned to the user for verification. If the verification is passed, the user will not be blacklisted.

[0079] If the verification code is turned off (enabledCaptcha:false), the IP address will be added to the blacklist directly if the threshold is exceeded.

[0080] 3) Dynamic threshold adjustment

[0081] The system supports dynamic adjustment of thresholds based on business scenarios.

[0082] 4) Blacklist management

[0083] The system maintains a global blacklist that records all blocked IP addresses. IP addresses on the blacklist cannot access protected resources during the blocking period. Manual unblocking of blocked IP addresses is supported to improve user experience.

[0084] Through the above mechanism, the system can accurately identify abnormal access behavior while avoiding the mistaken blocking of legitimate users, significantly improving protection effectiveness and business continuity.

[0085] 3. Verification code secondary verification mechanism

[0086] After the IP triggers the access threshold, this system returns an image verification code and requires the user to submit verification to effectively distinguish machine traffic from manual operations and reduce the false positive rate. To solve the problem of verification codes interfering with each other in certain scenarios (such as corporate intranets and public Wi-Fi) where multiple users share the same exit IP, this mechanism further introduces a random number (randomCode) as the unique identifier of the verification code to ensure that different users under the same IP do not affect each other. The specific implementation method is as follows:

[0087] 1) Verification code generation and return

[0088] When the IP access frequency exceeds the threshold, the system generates a time-sensitive combination of a random number (randomCode) and an image verification code.

[0089] Example: Generate a verification code {randomCode:"6ddd1631695f46549f1c577068d8ec7c",captcha:"base64-encoded verification code image string"} and bind randomCode to the current IP address.

[0090] 2) Verification code submission and verification

[0091] Users need to submit both the verification code and the random number (randomCode) to complete the verification.

[0092] The system finds the corresponding verification code record based on randomCode and verifies whether the user input is correct.

[0093] Example: The user submits {randomCode:"6ddd1631695f46549f1c577068d8ec7c",captcha:"123456"}, and the system verifies whether the captcha matches the verification code corresponding to randomCode.

[0094] 3) Verification result processing

[0095] If verification is successful:

[0096] Reset the access counter of the IP address to allow the user to continue accessing.

[0097] Delete the verification code record corresponding to randomCode to avoid reuse.

[0098] If verification fails:

[0099] An error message is returned, and the user is asked to obtain a verification code again.

[0100] 4) Guarantee the uniqueness of random numbers

[0101] Each verification code request generates a unique randomCode, ensuring that verification codes obtained by different users under the same IP address do not interfere with each other. The validity period of the randomCode is the same as the verification code, and it will automatically become invalid after it expires.

[0102] Through the above mechanism, this system can not only effectively intercept machine traffic, but also solve the verification code interference problem in shared IP scenarios, significantly improving user experience and protection effects.

[0103] 4. Dynamic URL Signature and Time Limit Control

[0104] This system generates temporary access links with timestamps and expiration dates by signing and encrypting resource URLs, preventing crawlers from using static URLs for long-term fraud. The specific implementation is as follows:

[0105] 1) Cloud storage anti-hotlink configuration

[0106] Enable the timestamp hotlink protection feature in the cloud storage service to ensure that an unauthorized access error is returned when the client directly accesses the resource using the original URL.

[0107] 2) URL Signed Request

[0108] Before accessing resources, the client must first send the original URL as a parameter to the anti-spoofing system to request the generation of a signed URL.

[0109] Example: Client Request

[0110] / access / address?path=https: / / cdn.example.com / demo.mp4&src=abc.com&dest=qiniu

[0111] 3) Signed URL Generation

[0112] The anti-spam system signs the URL according to the original URL (path), source (src) and destination (dest) passed in by the interface parameters, according to the algorithm specified by the cloud storage service provider, and returns the signed URL to the caller.

[0113] The following is an example of the signed URL generated:

[0114] https: / / cdn.example.com / demo.mp4?sign=41b04fc8ab4acfca0d70d96db334d85a&t=67ad587f

[0115] 4) URL validity period control

[0116] Signed URLs are accessible only within their validity period. After the expiration date, the cloud storage service will reject the request to prevent crawlers from using static URLs for long-term theft.

[0117] 5) Client access process

[0118] After the client obtains the signed URL, it directly uses the URL to access the resource.

[0119] The cloud storage service verifies the timestamp and signature, and returns the resource content if verification is successful. Otherwise, it returns an error indicating that the resource is not authorized.

[0120] 6) Security enhancements

[0121] Signature keys (secretKey) are rotated regularly to prevent security risks caused by key leaks.

[0122] 5. Combined with browser Service Worker to achieve seamless video playback with anti-theft protection

[0123] To resolve the conflict between the validity period of dynamic signed URLs and the need for long video playback, this paper proposes a video anti-skimming and seamless playback solution that combines browser Service Worker technology. This solution uses Service Worker to intercept video requests and dynamically update signed URLs, ensuring that long videos are not interrupted during playback due to URL expiration while maintaining the effectiveness of the anti-skimming function. The specific implementation method is as follows:

[0124] 1) Service Worker registration and installation

[0125] Register the Service Worker in the client page.

[0126] 2) Video request interception and signed URL update

[0127] The Service Worker intercepts the video request initiated by the client and checks whether the current request return status is 200. If the return status is not 200, it requests a new signed URL from the anti-spam system.

[0128] 3) Seamless playback

[0129] The Service Worker applies the new signed URL to subsequent video requests to ensure uninterrupted video playback, dynamically replacing the request URL through the fetch event listener.

[0130] Through the above mechanism, this system can effectively prevent crawlers from using static URLs to steal videos, while ensuring that legitimate users can access videos normally, significantly improving the security and controllability of video access.

[0131] This invention has a wide range of applications, especially in business systems with high concurrency and high security requirements, such as corporate portals and online education. Compared to existing technologies, this solution offers significant advantages in protection effectiveness, user experience, and operational efficiency, providing enterprises with a more efficient and reliable solution for preventing resource spamming. BRIEF DESCRIPTION OF THE DRAWINGS

[0132] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments with reference to the accompanying drawings, in which:

[0133] Figure 1 It is a schematic diagram of the system deployment structure of the present invention.

[0134] Figure 2 This is a schematic diagram of the anti-brushing system configuration steps.

[0135] Figure 3 This is a schematic diagram of the logical processing steps of the anti-brushing system.

[0136] Figure 4 This is a flow chart of the JS file for the video playback logic of the anti-brushing system.

[0137] Figure 5 This is a diagram of the logic processing of the anti-brushing system video playback ServiceWorker. DETAILED DESCRIPTION

[0138] The following describes embodiments of the present invention in detail. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended only to explain the present invention and are not to be construed as limiting the present invention.

[0139] See Figure 1 As shown, the present invention relates to a resource anti-brushing system based on access control technology, including an anti-brushing system, a client, and a cloud storage service. Among them, the cloud storage service is compatible with the storage services of a variety of mainstream cloud storage service providers (such as AWS S3, Alibaba Cloud OSS, Qiniu Cloud Storage, etc.), and has good adaptability and scalability. The anti-brushing system is the core component of the present invention, which adopts the current mainstream Spring Cloud microservice architecture, supports distributed deployment and rapid horizontal expansion, can efficiently cope with the surge in access volume, and ensure the stability and reliability of the system in high-concurrency scenarios. The client is the caller of resource access, usually a browser on a PC or mobile device, and may also include other applications that access resources through the HTTP / HTTPS protocol.

[0140] See Figure 2 As shown, the deployment and configuration process of the resource anti-brushing system of the present invention includes the following steps:

[0141] 1. Step 1: Enable the cloud storage service timestamp anti-hotlink function

[0142] ●Log in to the management console of the cloud storage service provider (such as AWS S3, Alibaba Cloud OSS, Qiniu Cloud Storage, etc.).

[0143] ●On the configuration page of the target bucket, find the "Anti-hotlinking" or "Access Control" related settings.

[0144] ●Enable the timestamp anti-hotlink function.

[0145] 2. Step 2: Get the anti-hotlink signature key

[0146] ●In the cloud storage service's management console, go to the "Key Management" or "Security Settings" page.

[0147] Generate or copy the configured signing key (Secret Key).

[0148] ●Rotate signing keys regularly (e.g., once a month) to reduce the risk of key leakage.

[0149] 3. Step 3: Configure the protected domain name, threshold, signature key and other configuration items

[0150] ●Log in to the management console of the anti-brushing system and enter the "Configuration Center" page.

[0151] ●Add the domain name of the site that needs to be protected, and support adding and editing.

[0152] ●Configure the following protection rules:

[0153] ◆Access threshold (Threshold): Set the upper limit of the access frequency of a single IP in a unit of time (such as 100 times / second).

[0154] ◆Time unit (Interval): defines the time window for access frequency statistics (such as 60 seconds, 120 seconds).

[0155] ◆Enabled Captcha: Select whether to enable the secondary verification mechanism using the verification code.

[0156] ◆Secret Key: Enter the signature key obtained from the cloud storage service.

[0157] ◆URL Effective Duration: Set the effective duration of the signed URL (e.g. 120 seconds).

[0158] Save the configuration and publish it to each node of the anti-spam system to ensure that the policy takes effect in real time.

[0159] 4. Step 4: Start the anti-brush system

[0160] ●On the anti-spam system server, start the various components of the Spring Cloud microservice architecture (such as the Nacos registration center, configuration center, anti-spam core service, etc.).

[0161] Verify system status:

[0162] ◆Check the health status of each service node to ensure there are no abnormalities.

[0163] ◆Test the policy delivery function of the configuration center to confirm that the protection rules have been synchronized to all nodes.

[0164] ●Monitoring system operation:

[0165] ◆Configure alarm rules (such as sending notifications when abnormal traffic surges) to ensure timely response to potential risks.

[0166] See Figure 3 As shown in the figure, the logical processing flow of the resource anti-brushing system described in the present invention is designed to effectively identify and intercept malicious swiping behaviors through a multi-level security protection mechanism, while ensuring normal access for legitimate users. The system combines technologies such as IP access frequency detection, verification code secondary verification, and dynamic URL signing to achieve refined control over resource access. The following are the detailed processing steps of the system:

[0167] 1. Step 1: Get the original resource URL

[0168] ●The client initiates a resource access request and passes the original resource URL as a parameter to the anti-spam system.

[0169] ●Original resource URL example: https: / / cdn.example.com / demo.mp4

[0170] 2. Step 2: Call the URL signature interface of the anti-swiping system

[0171] ●The anti-spam system receives client requests, parses the original resource URL and performs subsequent processing.

[0172] ●Interface parameters include path (original resource URL), src (domain name of the protected site), and dest (cloud storage vendor code where the resource is located)

[0173] ●Example: Client Request

[0174] / access / address?path=https: / / cdn.example.com / demo.mp4&src=abc.com&dest=qiniu

[0175] 3. Step 3: Determine whether it is a protected site

[0176] ●The system queries the configuration center to determine whether the domain name in the original URL is in the list of protected sites.

[0177] If the domain name is not protected:

[0178] ◆Return to the original URL directly to end the process.

[0179] If the domain name is protected:

[0180] ◆Continue with the next steps.

[0181] 4. Step 4: Get the client IP

[0182] ●Extract IP address from client request and support parsing proxy header information such as X-Forwarded-For.

[0183] ●Example: Extract the IP address 114.242.27.45.

[0184] 5. Step 5: Determine if the IP is on the blacklist

[0185] ●Query the global blacklist to determine whether the current IP has been banned.

[0186] If the IP is in the blacklist:

[0187] ◆Return error information (such as 403Forbidden) and end the process.

[0188] If the IP address is not in the blacklist:

[0189] ◆Continue with the next steps.

[0190] 6. Step 6: Determine whether the IP exceeds the access threshold

[0191] ●Query the access count of the IP in the Redis cluster to determine whether it exceeds the configured threshold.

[0192] If the threshold is exceeded:

[0193] ◆Proceed to step 7.

[0194] If the threshold is not exceeded:

[0195] ◆Increase the access count of the IP address by one and proceed to step 10.

[0196] 7. Step 7: Determine whether to enable verification code verification

[0197] ●Query the configuration center to determine whether the verification code verification mechanism (enabledCaptcha) is enabled.

[0198] If the verification code is not enabled:

[0199] ◆Add the IP to the blacklist, return an error message, and end the process.

[0200] If you enable verification code:

[0201] ◆Continue to step 8.

[0202] 8. Step 8: Generate and return verification code

[0203] • Call the Captcha service to generate an image Captcha containing a random number (randomCode).

[0204] • Return the Captcha and random number to the client, asking the user to input the Captcha.

[0205] • Example: Return {randomCode: "6ddd1631695f46549f1c577068d8ec7c",

[0206] captcha: "base64 encoded Captcha image string"}.

[0207] 9. Step 9: Processing after Captcha verification

[0208] • The client submits the Captcha and random number, and the system checks whether the input is correct.

[0209] • If the verification is successful:

[0210] ◆ Reset the access count for this IP and continue to Step 10.

[0211] • If the verification fails:

[0212] ◆ Return an error message and end the process.

[0213] 10. Step 10: Generate a signed URL and return it to the caller

[0214] • According to the original URL, the current timestamp, and the configured effective duration (effectiveDuration), use the algorithm specified by the cloud storage service provider to generate a signature (sign).

[0215] • Example: Generate a signed URL

[0216] https: / / cdn.example.com / demo.mp4?sign=41b04fc8ab4acfca0d70d96db334d85a&t=67ad587f

[0217] • Return the signed URL to the client for accessing the resource.

[0218] 11. Step 11: End the process

[0219] To solve the contradiction between the dynamic signed URL expiration limit and the long video playback demand, the browser side also needs to use ServiceWorker technology to realize the continuous playback of the video, Figure 4 This describes how to enable ServiceWorker, and the specific process is as follows:

[0220] 1. Step 1: Register ServiceWorker

[0221] ●Register a ServiceWorker in the browser. A ServiceWorker is a script that runs in the background of the browser, independent of the web page thread, and is mainly used to implement functions such as push notifications and caching strategies.

[0222] 2. Step 2: Determine whether the current control page has a ServiceWorker

[0223] ●Check whether the current page has registered ServiceWorker.

[0224] ●If you are not registered, skip to step 3.

[0225] ●If you have already registered, proceed to the next step.

[0226] 3. Step 3: Reload the page

[0227] ●If the current page does not register the ServiceWorker, reload the page to ensure that the ServiceWorker can be registered correctly.

[0228] 4. Step 4: The page is controlled and ServiceWorker obtains the video address interface

[0229] ●After the page is controlled by ServiceWorker, the video playback address is obtained by calling a specific interface.

[0230] 5. Step 5: Check if the interface status is 200 and the return address is

[0231] ● Check whether the status code of the data obtained from the interface is 200 (indicating a successful request).

[0232] ●Also check whether the interface returns a valid video address.

[0233] ●If the status code is not 200 or no valid address is returned, jump to step 6.

[0234] ●If the status code is 200 and a valid address is returned, proceed to the next step.

[0235] 6. Step 6: Video plays normally

[0236] ●When the status code returned by the interface is 200 and a valid video address is provided, the video will play as expected.

[0237] 7. Step 7: Send a message to the player page to trigger the verification code pop-up window and send the verification code

[0238] • If the status code returned by the interface is not 200 or a valid address is not provided, send a message to the player page.

[0239] • Trigger a verification code popup, requiring the user to input the verification code.

[0240] • After the user inputs the verification code, attempt to obtain the video address again.

[0241] 8. Step 8: Send a message to the ServiceWorker to obtain a new video address

[0242] • If the verification code verification is successful, send a message to the ServiceWorker again to request a new video address.

[0243] 9. Step 9: Send a message to the player page to play the video

[0244] • After obtaining the new video address, send a message to the player page to start playing the video.

[0245] Figure 5 The anti-brush system described in the present application realizes the anti-brush and seamless playback functions of video resources through Service Worker technology. The Service Worker intercepts video requests on the client side, dynamically updates the signed URL, and processes Range requests to ensure the continuity and efficiency of video playback. The specific logic processing steps are as follows:

[0246] Step 1: fetch event listening, intercepting page network requests

[0247] • Register a fetch event listener in the Service Worker script to intercept network requests initiated by the client

[0248] Step 2: Determine if the resource is a video resource

[0249] • Check the path or file extension of the request URL to determine if it is a video resource (such as.mp4,.webm).

[0250] • If it is a video resource, continue to execute the video resource request processing flow.

[0251] • If it is not a video resource, directly release the request without special processing.

[0252] Step 3: Video resource request processing

[0253] • Check if the current video has state information (such as URL, generation time, file size, etc.).

[0254] • If there is state information, continue to step 4.

[0255] ●If the status information does not exist, initialize the status information and store it in the global object.

[0256] Step 4: Check whether the difference between the current time and the generated time in the status information exceeds 100 seconds

[0257] ●Get the current timestamp and compare it with the URL generation time in the status information.

[0258] ●If the time difference exceeds 100 seconds, proceed to step 5 to generate a new signed URL.

[0259] ●If the time difference does not exceed 100 seconds, continue processing the request using the existing signed URL.

[0260] Step 5: Generate a new signed URL and update the status information

[0261] ●Call the video signature address interface of the anti-brushing system to generate a new signed URL.

[0262] ●Get the current timestamp as the generation time of the new URL.

[0263] ●Get the file size of the newly generated video URL for subsequent Range request processing.

[0264] ●Create a new state object containing the following information:

[0265] Video URL: the newly generated signed URL.

[0266] Generated Time: Current timestamp.

[0267] File Size: The total size of the video file.

[0268] Store the new state object into the global object, replacing the old state information.

[0269] Intercept video playback through Service Worker operations, record user operation logs, and use the navigator.connection API to obtain network status.

[0270] Conduct user behavior analysis and build predictive models

[0271] Determine the probability of users continuing to watch.

[0272] Among them, set P as the viewing progress, 0≤P≤1, F is the user's video operation frequency, after normalization 0≤F≤1,

[0273] Calculate the dynamic validity period T of the URL.

[0274]

[0275] T base is the basic effective period, preferably 3 minutes, 5 minutes, and 8 minutes; α, β, and γ are the weight coefficients for adjusting the probability of watching videos, the network delay adjustment weight coefficient, and the bandwidth adjustment weight coefficient, respectively. threshold is the network delay threshold, B threshold is the bandwidth threshold. If the user video operation probability S = 0.8, the network delay time D = 150ms, and the real-time network bandwidth B = 8Mbps, then

[0276]

[0277] Set the video playback renewal trigger threshold. When the remaining validity period is T remaining <δ*T, the adjustment coefficient δ is 0.2 / 0.3 / 0.5. If the Service Worker sends a renewal request, and then verifies the user behavior and network status, if an abnormal network interruption occurs, the current URL validity period T is extended. extend =T+Δ, reference value Δ=3 minutes, or 5 minutes,

[0278] If the number of renewal request failures N ≥ N threshold , perform verification code verification.

[0279] Dynamic retry by calculating the delay time,

[0280]

[0281] t min is the basic delay time, t max is the maximum delay time, D threshold is the network delay threshold, random jitter is the random jitter time, and its value range is [0,50]ms.

[0282] Perform dynamic adjustment of video segments.

[0283]

[0284] V is the video segment size, and B is the real-time network bandwidth.

[0285] If the timeout

[0286]

[0287] T req Tt is the timeout request time. hreshold is the timeout threshold, α′ is the timeout request adjustment weight coefficient, and β is the network delay adjustment weight coefficient.

[0288] If the timeout is extended to T timeout Trigger verification code verification or fallback to the backup CDN node.

[0289] Combining multi-dimensional network parameters (bandwidth, latency, request duration) with dynamic formulas, it surpasses traditional single-parameter or fixed strategy solutions.

[0290] For example, the delay factor in the dynamic retry strategy And random jitter design requires a deep understanding of network protocols and distributed systems.

[0291] Improved retry success rate: Through dynamic adjustments, the retry success rate in high-latency networks was increased from 60% to 85% (simulated data). Comprehensive timeout calculation reduced average request latency from 5.2 seconds to 3.8 seconds (test environment). The resumable download fallback design reduced the number of interruptions and increased user satisfaction by 30% (AB testing).

[0292] It is suitable for scenarios such as long video playback and large file transfer in mobile networks and weak network environments, filling the gaps in existing technologies in dynamic network adaptation.

[0293] Step 6: Processing Range Requests

[0294] ● Check whether the Range field exists in the request header and determine whether it starts with bytes=.

[0295] ●If the Range field exists, proceed to step 7.

[0296] ●If the Range field does not exist, proceed to step 8.

[0297] Step 7: Parse the Range field and create a new request

[0298] ●Parse the value of the Range field and extract the starting byte (start) and the ending byte (end).

[0299] ●Create a new request header object and set the Range field to the processed byte range.

[0300] ●Create a new request object with the new request headers and the newly generated video URL.

[0301] ●Use the fetch function to send a new request and return a response to the client.

[0302] Step 8: Return the entire video

[0303] ●Create a new request object using the newly generated video URL.

[0304] ●Use the fetch function to send a new request and return the entire video content to the client.

[0305] Step 9: End the process

[0306] ●Record the processing results of this request (such as the time when the new URL was generated, the Range request range, etc.).

[0307]

[0308]

[0309] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to the embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the claims and their equivalents.

Claims

1. A video anti-brushing system based on access control technology, characterized in that: include: The cloud storage service timestamp anti-hotlinking module is used to log in to the cloud storage server platform and enable timestamp anti-hotlinking by configuring the target storage bucket; The anti-hotlink key acquisition and configuration module is used to generate or copy the signature key in the cloud storage server platform and configure the protection domain name, threshold and signature key; The video anti-scaling module is used to enter the generated anti-hotlink key into the anti-scaling system, check the health status of each server node, and perform video anti-scaling monitoring.

2. The video anti-brushing system based on access control technology according to claim 1 is characterized in that: The cloud storage service timestamp anti-hotlink module includes: After logging into the cloud storage server platform, obtain the original video resource URL, call the URL signature interface for video anti-brushing, determine whether it is a protected video site based on the interface parameters, determine whether it is a blacklisted IP address based on the IP address, and whether it is an IP address that exceeds the access threshold. If it exceeds the threshold, determine whether to enable secondary verification of the verification code; after the verification code verification is passed, generate a signed URL and return it to the caller.

3. The video anti-brushing system based on access control technology according to claim 2 is characterized in that: The URL signature interface for calling video anti-brushing includes: Listen for fetch events, intercept page network requests, determine whether they are video resources, generate new signed URLs and update status information, process Range requests, parse Range fields, and create new requests.

4. The video anti-brushing system based on access control technology according to claim 3 is characterized in that: Generating a new signed URL and updating status information includes: Call the video signature address API of the anti-spam system to generate a new signed URL. Get the current timestamp as the generation time of the new URL. Get the file size of the newly generated video URL for subsequent Range request processing. Create a new state object, establish the current timestamp for the newly generated signed URL, get the total size of the video file, and store the new state object in the global object to replace the old state information.

5. The video anti-brushing system based on access control technology according to claim 4 is characterized in that: Processing a Range request includes: Check whether there is a Range field in the request header and determine whether it starts with bytes=; if the Range field exists, continue to parse the Range field and create a new request, parse the value of the Range field, extract the starting byte and the ending byte, create a new request header object, and set the Range field to the processed byte range, create a new request object, use the new request header and the newly generated video URL, use the fetch function to send a new request, and return the response to the client. If the Range field does not exist, continue to execute the step of returning the entire video URL link, create a new request object, use the newly generated video URL, use the fetch function to send a new request, and return the entire video content to the client.

6. The video anti-brushing system based on access control technology according to claim 1 is characterized in that: It also includes dynamic signature URL validity limit and long video playback. Register ServiceWorker, determine whether there is a ServiceWorker on the current control page, control the video page through ServiceWorker, ServiceWorker obtains the video address interface, determines whether the interface status is a successful request and returns the video playback address, checks whether the data status code obtained from the interface is a successful request, and checks whether the interface returns a valid video playback address. If the status code is not a successful request instruction or no valid video playback address is returned, trigger a verification code pop-up window and ask the user to enter the verification code. After the user enters the verification code, try to obtain the video address again, send a message to ServiceWorker, obtain the new video address, and re-perform the verification code request operation. If the user enters the verification code, if the verification code verification is successful, the valid video playback address is returned and the video playback instruction is executed.

7. The video anti-brushing system based on access control technology according to claim 6 is characterized in that: The dynamic signed URL includes: Renewal decisions are made based on user behavior analysis and network status.

8. The video anti-brushing system based on access control technology according to claim 2 is characterized in that: Also includes: Determine the probability of users continuing to watch. Among them, set P as the viewing progress, 0≤P≤1, F is the user's video operation frequency, after normalization 0≤F≤1, Calculate the dynamic validity period T of the URL. T base is the basic effective period, preferably 3 minutes, 5 minutes, and 8 minutes; α, β, and γ are the weight coefficients for adjusting the probability of watching videos, the network delay adjustment weight coefficient, and the bandwidth adjustment weight coefficient, respectively. threshold is the network delay threshold, B threshold is the bandwidth threshold. If the user video operation probability S = 0.8, the network delay time D = 150ms, and the real-time network bandwidth B = 8Mbps, then Set the video playback renewal trigger threshold. When the remaining validity period is T remaining <δ*T, the adjustment coefficient δ is 0.2 / 0.3 / 0.

5. If the Service Worker sends a renewal request, and then verifies the user behavior and network status, if an abnormal network interruption occurs, the current URL validity period T is extended. extend =T+Δ, reference value Δ=3 minutes, or 5 minutes, If the number of renewal request failures N ≥ N threshold , perform verification code verification.

9. The video anti-brushing system based on access control technology according to claim 8 is characterized in that: Also includes: Dynamic retry by calculating the delay time, t min is the basic delay time, t max is the maximum delay time, D threshold is the network delay threshold, random jitter is the random jitter time, and its value range is [0,50]ms. Perform dynamic adjustment of video segments. V is the video segment size, and B is the real-time network bandwidth. If the timeout T req is the timeout request time, T threshold is the timeout threshold. If the timeout is extended to T timeout Trigger verification code verification or fallback to the backup CDN node.

10. A method for implementing a video anti-brushing system based on access control technology, characterized in that: The steps include: S1, log in to the cloud storage server platform and enable timestamp hotlink protection by configuring the target storage bucket; S2, generates or copies the signature key in the cloud storage server platform, and configures the protection domain name, threshold, and signature key; S3, enters the generated anti-hotlink key into the anti-scaling system, checks the health status of each server node, and performs video anti-scaling monitoring.

Images