A CDN content hotlinking prevention method and system based on edge and origin collaboration

Abstract

This invention belongs to the field of information security technology, specifically relating to a CDN content anti-leeching method and system based on edge and origin-side collaboration, including the following steps: S1, executed by the origin server: selecting a session encryption key from a pre-set key matrix according to the preset risk level of the Class C network segment to which the client IP of the requested content belongs; and signing the content resource path by combining the session encryption key and the time sharding identifier to generate an access token, and sending the URL containing the access token to the client; S2, executed by the CDN edge node. This invention reduces the credibility of malicious request sources that fail signature verification, and combines threshold-based silent interception with progressively longer durations to identify and combat persistent attack behaviors, protecting the stability and availability of CDN services.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, specifically relating to a CDN content anti-leeching method and system based on edge and origin collaboration. Background Technology

[0002] Content Delivery Networks (CDNs) improve user access speed and website availability by distributing content from an origin server to edge nodes closest to users. Hotlinking refers to unauthorized third-party websites or applications linking to and using resources from the origin server within a page or service, thus consuming the origin server's bandwidth and computing resources, increasing operating costs, and potentially affecting normal service due to traffic overload. Anti-hotlinking technologies primarily rely on HTTP Referer field validation or IP address-based blacklists and whitelists. Referer validation checks the URL of the requesting page to determine its legitimacy, but the Referer field is easily forged, resulting in low security and reliability. IP blacklists and whitelists restrict access from specific IP addresses or address ranges, but they are complex to manage, difficult to counter hotlinking attacks using IP addresses or proxy servers, and prone to mistakenly penalizing legitimate users sharing the same IP address.

[0003] CDN anti-leeching solutions use a pre-shared key from the origin server, combined with the resource path and expiration timestamp, to generate a signature. This signature is then appended to the URL and sent to the client. Upon receiving a request, CDN edge nodes verify the signature and timestamp using the same key and algorithm, thus controlling access. However, this defense strategy uses a fixed key and signature algorithm, failing to provide differentiated security protection based on the risk level of different users or request sources. For legitimate users whose tokens expire due to network latency or normal pauses, no renewal or verification channels are provided. Furthermore, the lack of assessment and response capabilities for request behavior makes it impossible to identify and penalize malicious, repeated signature forgery attempts at tiered punishment, hindering the containment of malicious attack sources. Summary of the Invention

[0004] This invention provides a CDN content hotlinking prevention method and system based on edge and origin collaboration, to solve the technical problems of existing methods' defense strategies being unable to provide differentiated security protection based on the risk level of different users or request sources, and being unable to identify and punish forged signatures at each level.

[0005] In a first aspect, the present invention provides a CDN content hotlinking prevention method based on edge and origin-backward collaboration, comprising the following steps:

[0006] S1, executed by the origin server: Based on the preset risk level of the Class C network segment to which the client IP of the requested content belongs, select a session encryption key from the preset key matrix; and sign the content resource path by combining the session encryption key and the time segmentation identifier to generate an access token, and send the URL containing the access token to the client;

[0007] S2, executed by the CDN edge node: After receiving a client request carrying an access token, it reconstructs the session encryption key based on the preset risk level of the Class C network segment to which the client IP belongs and the current time fragmentation identifier, and verifies the access token;

[0008] S3, when the verification passes and the local cache is hit, the header metadata of the content resource in the cache is decrypted using the reconstructed session encryption key to obtain the basic decryption offset. Based on the request source trust index maintained by the CDN edge node for the client IP, the basic decryption offset is adjusted to the decryption offset. Then, the decryption offset is used to decrypt the data block of the content resource and respond to the client.

[0009] S4. When verification fails due to time fragmentation identifier expiration and the request source credibility index is higher than the first preset threshold, a collaborative verification request is initiated to the origin server, and the origin server generates and issues a temporary access token based on the credibility index. When verification fails due to signature mismatch, the request source credibility index is reduced. If the reduced request source credibility index is lower than the second preset threshold, the silent interception duration is calculated based on the difference between the request source credibility index and the second preset threshold, and silent interception is initiated on the client IP.

[0010] Furthermore, a session encryption key is selected from the preset key matrix, including:

[0011] The preset key matrix is ​​set as a two-dimensional matrix. The row index of the two-dimensional matrix corresponds to the risk level of the Class C network segment, and the column index corresponds to the time segment identifier. The process of selecting the session encryption key is as follows: the risk level of the Class C network segment to which the client IP belongs is used as the row index, and the current time segment identifier is used as the column index. The unique session encryption key is searched and determined in the two-dimensional matrix.

[0012] Furthermore, the content resource path is signed by combining the session encryption key and the time-segment identifier to generate an access token, including:

[0013] The content resource path, time segment identifier, and session encryption key are concatenated to form a string to be signed; the HMAC-SHA256 algorithm is used to hash the string to be signed to generate a signature digest; the signature digest is Base64 encoded and used as an access token.

[0014] Furthermore, based on the request source trust index maintained by the CDN edge nodes for the client IP, the basic decryption offset is adjusted to a decryption offset, including:

[0015] Set the source credibility index initial value and maximum value All values ​​are 100, and the range is [0, 100]. Calculate the decryption offset using the following formula. :

[0016] ;

[0017] in, Based on the decryption offset, This is the preset adjustment coefficient.

[0018] Furthermore, the data blocks of the content resource are decrypted using the decryption offset and responded to the client, including:

[0019] Treat the data blocks of the content resource as a sequence of bytes; starting from the beginning of the byte sequence, skip the number of bytes specified by the decryption offset; start reading continuous content data from the skipped position, and respond to the client with the read content data as the decrypted content resource.

[0020] Furthermore, when verification fails due to signature mismatch, the credibility metric of the request source is lowered, including:

[0021] Each time a verification fails due to a signature mismatch, a fixed downgrade score is subtracted from the current request source credibility index value.

[0022] Furthermore, the silent interception duration is calculated based on the difference between the request source credibility index and the second preset threshold, and silent interception is initiated for the client IP, including:

[0023] Set the second preset threshold as Calculate the silent interception duration using the following formula. :

[0024] ;

[0025] in, This is an indicator of the credibility of the current request source. The preset time penalty factor; within the calculated silent interception period, all subsequent requests from the client IP are rejected.

[0026] Secondly, the present invention provides a CDN content hotlinking prevention system based on edge and origin-backward collaboration, comprising the following modules:

[0027] The generation module is executed by the origin server: based on the preset risk level of the Class C network segment to which the client IP of the requested content belongs, it selects a session encryption key from the preset key matrix; and signs the content resource path by combining the session encryption key and the time segmentation identifier, generates an access token, and sends the URL containing the access token to the client.

[0028] The verification module, executed by the CDN edge node, receives a client request carrying an access token, reconstructs the session encryption key based on the preset risk level of the Class C network segment to which the client IP belongs and the current time fragmentation identifier, and verifies the access token.

[0029] The adjustment module is used to decrypt the header metadata of the content resource in the cache using the reconstructed session encryption key when the verification passes and the local cache is hit, to obtain the basic decryption offset, and adjust the basic decryption offset to the decryption offset based on the request source trust index maintained by the CDN edge node for the client IP. Then, the decryption offset is used to decrypt the data block of the content resource and respond to the client.

[0030] The interception module is used to initiate a collaborative verification request to the origin server when the verification fails due to the expiration of the time slice identifier and the source trust index is higher than the first preset threshold. The origin server generates and issues a temporary access token based on the trust index. When the verification fails due to signature mismatch, the source trust index is reduced. If the reduced source trust index is lower than the second preset threshold, the silent interception duration is calculated based on the difference between the source trust index and the second preset threshold, and silent interception is started on the client IP.

[0031] Furthermore, a session encryption key is selected from the preset key matrix, including:

[0032] The preset key matrix is ​​set as a two-dimensional matrix. The row index of the two-dimensional matrix corresponds to the risk level of the Class C network segment, and the column index corresponds to the time segment identifier. The process of selecting the session encryption key is as follows: the risk level of the Class C network segment to which the client IP belongs is used as the row index, and the current time segment identifier is used as the column index. The unique session encryption key is searched and determined in the two-dimensional matrix.

[0033] Furthermore, the content resource path is signed by combining the session encryption key and the time-segment identifier to generate an access token, including:

[0034] The content resource path, time segment identifier, and session encryption key are concatenated to form a string to be signed; the HMAC-SHA256 algorithm is used to hash the string to be signed to generate a signature digest; the signature digest is Base64 encoded and used as an access token.

[0035] The beneficial effects are as follows: This invention utilizes a key matrix based on the risk level of the client's IP address to achieve differentiated access token generation and verification, enhancing the security strength and anti-forgery capabilities of signatures. It encrypts cached content at edge nodes and uses request source trustworthiness indicators to intervene twice in the decryption process, protecting the security of cached data on CDN nodes and controlling access permissions based on request history. Furthermore, for trusted users with expired tokens, a fault-tolerant channel for origin-based collaborative verification is established, issuing temporary tokens to ensure access continuity and improving the user experience degradation caused by network latency. By reducing the trustworthiness of malicious request sources that fail signature verification and combining this with threshold-based, progressively longer silent interception, it can identify and combat persistent attacks, protecting the stability and availability of CDN services. Attached Figure Description

[0036] Figure 1 This is a flowchart of a CDN content hotlinking prevention method based on edge and origin collaboration. Detailed Implementation

[0037] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0038] An embodiment of the CDN content hotlinking prevention method based on edge and origin-back collaboration provided by this invention:

[0039] like Figure 1 As shown, the CDN content hotlinking prevention method based on edge and origin collaboration includes the following steps:

[0040] S1, executed by the origin server: Based on the preset risk level of the Class C network segment to which the client IP of the requested content belongs, select a session encryption key from the preset key matrix; and sign the content resource path by combining the session encryption key and the time segmentation identifier to generate an access token, and send the URL containing the access token to the client.

[0041] The origin server maintains a risk level database to store and query the preset risk level of the Class C network segment to which the client IP belongs. The preset risk level is a predetermined level, such as high risk, medium risk, or low risk, based on an assessment of the Class C network segment's historical attack frequency, geographical location, and whether it is an IDC or proxy. This database records the aforementioned assessment information for different IPs and Class C network segments, such as 202.xxx.22.0, and uses this information to classify risk levels. Simultaneously, the origin server pre-configures a two-dimensional key matrix. The row index represents the risk level, and the column index represents the time shard identifier. The time shard identifier is obtained by dividing the current Unix timestamp by a preset duration and rounding down. The matrix stores string keys of varying strengths. When a request is received from a client with an IP such as 202.xxx.22.10, the server queries and determines that the risk level of the Class C network segment 202.xxx.22.0 to which the request belongs is medium.

[0042] The server selects the corresponding session encryption key, such as KeyMediumSecurity, from the key matrix based on the row index of the intermediate risk level. The server obtains the current Unix timestamp, divides it by a preset duration, such as 300 seconds, and rounds it down to obtain the time segment identifier, such as 16788864. The server concatenates the content resource path / videos / movie.mp4 and the time segment identifier 16788864, and hashes the concatenated string using the HMAC-SHA256 algorithm and the session encryption key KeyMediumSecurity to generate a hexadecimal string as the access token.

[0043] The resource path, access token, and time-slice identifier are combined into a URL, such as http: / / cdn.example.com / videos / movie.mp4?token=xxxxxxxx&ts=16788864, and returned to the client.

[0044] In an optional embodiment, selecting a session encryption key from a preset key matrix includes:

[0045] The preset key matrix is ​​set as a two-dimensional matrix. The row index of the two-dimensional matrix corresponds to the risk level of the Class C network segment, and the column index corresponds to the time segment identifier. The process of selecting the session encryption key is as follows: the risk level of the Class C network segment to which the client IP belongs is used as the row index, and the current time segment identifier is used as the column index. The unique session encryption key is searched and determined in the two-dimensional matrix.

[0046] For example, the rows of this matrix can be defined as risk levels 1, 2, and 3, representing low, medium, and high risk, respectively. The columns of the matrix correspond to time segment identifiers divided into 10-minute intervals throughout the day, such as 001, 002, up to 144. Each cell in the matrix stores a unique key string. When a client from IP address 202.xxx.134.133 initiates a request, its Class C network segment is determined to be 202.xxx.134.0. A query of the risk assessment database reveals that the risk level of this network segment is 2, i.e., medium risk. Simultaneously, the current timestamp is obtained, and the current time segment identifier is calculated to be 005. Therefore, a search is performed in the two-dimensional matrix using row index 2 and column index 005 to locate the unique session encryption key.

[0047] In an optional embodiment, the content resource path is signed by combining the session encryption key and the time-segmentation identifier to generate an access token, including:

[0048] The content resource path, time segment identifier, and session encryption key are concatenated to form a string to be signed; the HMAC-SHA256 algorithm is used to hash the string to be signed to generate a signature digest; the signature digest is Base64 encoded and used as an access token.

[0049] Assume the client requests content resource path ` / data / document.pdf`, the current time segment identifier is 123, and the corresponding session encryption key `secretkey12345` has been obtained using the aforementioned method. Concatenate the three elements in a predetermined order to form a string to be signed, for example, ` / data / document.pdf123secretkey12345`. Use the session encryption key `secretkey12345` as the key for hash calculation on the string to be signed, ` / data / document.pdf123secretkey12345`, to generate a 256-bit binary signature digest. Encode the binary signature digest using Base64, converting it into a printable ASCII string, for example, `eW91clRva2VuSGVyZQ==`. This string is the generated access token used to verify the legitimacy of the request.

[0050] S2, executed by the CDN edge node: After receiving a client request carrying an access token, it reconstructs the session encryption key based on the preset risk level of the Class C network segment to which the client IP belongs and the current time fragmentation identifier, and verifies the access token.

[0051] The specific method for reconstructing the session encryption key is as follows: using the preset risk level of the Class C network segment to which the client IP belongs as the row index and the current time fragment identifier as the column index, a unique session encryption key is searched and determined in the locally synchronized preset key matrix. This process ensures that the reconstructed key is completely consistent with the session encryption key selected by the origin server in step S1 for signing (generating the access token). After reconstructing the session encryption key, the verification module uses this key and the HMAC-SHA256 algorithm to recalculate the signature of the resource path and time fragment identifier in the request, and compares and verifies it with the access token carried in the request.

[0052] The CDN edge nodes also synchronize the origin server's risk level database and key matrix. When receiving the aforementioned URL request from IP 202.xxx.22.10, the edge node extracts the client IP and determines the risk level to be medium. The edge node then selects the same session encryption key, KeyMediumSecurity, from its local key matrix based on the medium risk level. Simultaneously, the edge node obtains the current Unix timestamp and calculates the current time slice identifier in the same way. The edge node extracts the resource path / videos / movie.mp4 and the time slice identifier 16788864 from the request URL, concatenates the string using the exact same rules as the origin server, and calculates a new signature using the reconstructed session encryption key KeyMediumSecurity and the HMAC-SHA256 algorithm. The newly generated signature is compared bit-by-bit with the access token token=xxxxxxxx carried in the URL; if they match exactly, the verification passes.

[0053] S3, when the verification passes and the local cache is hit, the basic decryption offset is obtained by decrypting the header metadata of the content resource in the cache using the reconstructed session encryption key. Based on the request source trust index maintained by the CDN edge node for the client IP, the basic decryption offset is adjusted to the decryption offset. Then, the decryption offset is used to decrypt the data block of the content resource and respond to the client.

[0054] Specifically, the edge node confirms that it has a cached copy of movie.mp4 stored locally. This cached copy's data blocks were uniformly encrypted during caching, and the metadata header of the cached copy contains a field encrypted with a session encryption key. The edge node decrypts this field using the reconstructed session encryption key KeyMediumSecurity, obtaining a base decryption offset value, such as 1024. Simultaneously, the edge node maintains an initial trust metric of 80 points for IP202.xxx.22.10 locally. Based on a preset algorithm, such as decryption offset = base decryption offset + (100 - trust metric) × 16, the edge node calculates a decryption offset of 1344. The edge node then uses this decryption offset of 1344 as a decryption parameter, for example, as the initial vector for a streaming decryption algorithm or the starting point for reading the byte stream, to decrypt the cached encrypted data blocks and send the decrypted video stream data to the client via the HTTP response body.

[0055] In an optional embodiment, the base decryption offset is adjusted to a decryption offset based on the request source trust index maintained by the CDN edge node for the client IP, including:

[0056] Set the source credibility index initial value and maximum value All values ​​are 100, and the range is [0, 100]. Calculate the decryption offset using the following formula. :

[0057] ;

[0058] in, Based on the decryption offset, This is the preset adjustment coefficient.

[0059] A request source trust metric is maintained for each client IP address, with a maximum score of 100. The default base decryption offset is 1024 bytes, and the adjustment factor is 10. For a client IP that is accessing the site for the first time or has consistently behaved normally, the request source trust metric is 100. According to the calculation formula, the decryption offset remains 1024 bytes. The client with the highest trust will use the smallest offset to obtain the fastest response. If the client IP subsequently exhibits abnormal behavior, such as multiple signature verification failures, the request source trust metric drops to 60. At this point, the decryption offset is recalculated, resulting in 400. The decryption offset is then adjusted to 1424 bytes. By increasing the starting position of the decrypted data, a slight resource consumption penalty is imposed on request sources with lower trust.

[0060] In an optional embodiment, decrypting data blocks of the content resource using the decryption offset and responding to the client includes:

[0061] Treat the data blocks of the content resource as a sequence of bytes; starting from the beginning of the byte sequence, skip the number of bytes specified by the decryption offset; start reading continuous content data from the skipped position, and respond to the client with the read content data as the decrypted content resource.

[0062] Suppose a client requests a 1-megabyte video file, and the decryption offset calculated using the aforementioned method is 2048 bytes. When processing the request, the edge node server locates the original data block of the video file in storage. This data block can be viewed as a continuous sequence of bytes from byte 0 to byte 1048575. The server does not start reading data from byte 0; instead, it moves the file read pointer forward 2048 bytes, positioning itself at the 2048th byte of the byte sequence. From this new position, the server continuously reads all data from the 2048th byte to the end of the file. Partially read data is encapsulated in the HTTP response and sent to the client. The first 2048 bytes of the original file are ignored in this response.

[0063] S4. When verification fails due to time fragmentation identifier expiration and the request source credibility index is higher than the first preset threshold, a collaborative verification request is initiated to the origin server, and the origin server generates and issues a temporary access token based on the credibility index. When verification fails due to signature mismatch, the request source credibility index is reduced. If the reduced request source credibility index is lower than the second preset threshold, the silent interception duration is calculated based on the difference between the request source credibility index and the second preset threshold, and silent interception is initiated on the client IP.

[0064] Specifically, if the current time shard identifier calculated by the edge node is 16788865, which does not match 16788864 in the request URL, the token is deemed expired. At this time, the node queries the trustworthiness index of the request source (IP 202.xxx.22.10) and finds it to be 80 points, which is higher than the preset first threshold of 70 points. The edge node then initiates an internal API request to the origin server, containing the client IP, the original request path, and the current request source trustworthiness index of 80. Upon receiving the request, the origin server recognizes that the request originated from a trusted edge node as a renewal request initiated by a highly trustworthy user. It immediately regenerates a temporary access token using the latest time shard identifier 16788865 and the corresponding session encryption key, and returns the new URL containing this temporary token to the edge node. The edge node then distributes the new token to the client via HTTP redirection or other methods, allowing the client to continue accessing the service.

[0065] If the signature calculated by the edge node does not match the token carried in the URL, it is determined to be a signature forgery attempt. The edge node will query the current request source credibility index of IP202.xxx.22.10. For example, if it is 35 points, it will decrease by 10 points to update it to 25 points. After the update, the edge node checks whether this score is lower than the preset second threshold of 30 points. It finds that 25 points is lower than 30 points. Therefore, the edge node calculates the interception time to be 300 seconds according to the formula, for example, silent interception time = (second threshold - current index) × 60 seconds. The edge node adds IP202.xxx.22.10 to a local temporary blacklist and sets the expiration time to 300 seconds. During this period, any requests from this IP are directly dropped without any processing until they are automatically unblocked after 300 seconds.

[0066] In an optional embodiment, when verification fails due to signature mismatch, the request source trust metric is lowered, including:

[0067] Each time a verification fails due to a signature mismatch, a fixed downgrade score is subtracted from the current request source credibility index value.

[0068] A fixed downgrade score is pre-set, for example, deducting 10 points for each failed signature verification. A client IP address of 8.8.8.8 initiates a request, initially with a trustworthiness score of 100. When this client makes a request, but the access token's signature mismatch is detected during verification, the request is deemed illegitimate. The request is rejected, and the trustworthiness score associated with the client IP address 8.8.8.8 is updated. The pre-set downgrade score of 10 is subtracted from the current value of 100, reducing the trustworthiness score to 90. If the next request from this IP address again results in a signature mismatch error, the trustworthiness score will be reduced by another 10 points from 90, decreasing to 80, and so on, until the score drops to the pre-set threshold.

[0069] In an optional embodiment, the silent interception duration is calculated based on the difference between the request source credibility index and a second preset threshold, and silent interception is initiated for the client IP, including:

[0070] Set the second preset threshold as Calculate the silent interception duration using the following formula. :

[0071] ;

[0072] in, This is an indicator of the credibility of the current request source. The preset time penalty factor; within the calculated silent interception period, all subsequent requests from the client IP are rejected.

[0073] The second preset threshold for triggering silent blocking is, for example, 30, and a time penalty factor of 5 seconds per minute. A client IP's request source credibility index drops from 35 to 25 due to consecutive request failures. At this point, it is detected that the request source credibility index of 25 is lower than the second preset threshold of 30, therefore, silent blocking is initiated. The difference between the request source credibility index and the second preset threshold is calculated, which is 5. This difference of 5 is multiplied by the time penalty factor of 5, resulting in a silent blocking duration of 25 seconds. The client IP address is added to a temporary blacklist, and the blocking end time is marked. For the next 25 seconds, any requests from this IP address will be dropped without any processing, until the 25-second penalty period ends.

[0074] An embodiment of the CDN content hotlinking prevention system based on edge and origin collaboration provided by this invention includes the following modules:

[0075] The generation module is executed by the origin server: based on the preset risk level of the Class C network segment to which the client IP of the requested content belongs, it selects a session encryption key from the preset key matrix; and signs the content resource path by combining the session encryption key and the time segmentation identifier, generates an access token, and sends the URL containing the access token to the client.

[0076] The verification module, executed by the CDN edge node, receives a client request carrying an access token, reconstructs the session encryption key based on the preset risk level of the Class C network segment to which the client IP belongs and the current time fragmentation identifier, and verifies the access token.

[0077] The adjustment module is used to decrypt the header metadata of the content resource in the cache using the reconstructed session encryption key when the verification passes and the local cache is hit, to obtain the basic decryption offset, and adjust the basic decryption offset to the decryption offset based on the request source trust index maintained by the CDN edge node for the client IP. Then, the decryption offset is used to decrypt the data block of the content resource and respond to the client.

[0078] The interception module is used to initiate a collaborative verification request to the origin server when the verification fails due to the expiration of the time slice identifier and the source trust index is higher than the first preset threshold. The origin server generates and issues a temporary access token based on the trust index. When the verification fails due to signature mismatch, the source trust index is reduced. If the reduced source trust index is lower than the second preset threshold, the silent interception duration is calculated based on the difference between the source trust index and the second preset threshold, and silent interception is started on the client IP.

[0079] The above are all preferred embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Therefore, all equivalent changes made in accordance with the structure, shape and principle of the present invention should be covered within the scope of protection of the present invention.

Claims

1. An edge and back source cooperative CDN content anti-piracy link method, characterized in that, The method comprises the following steps: S1, performed by the source station server: selecting a session encryption key from a preset key matrix according to a preset risk level of a C-class network segment to which a client IP of a content request belongs; and signing a content resource path in combination with the session encryption key and a time slice identifier to generate an access token, and issuing a URL containing the access token to the client; S2, performed by the CDN edge node: after receiving a client request carrying the access token, reconstructing the session encryption key according to the preset risk level of the C-class network segment to which the client IP belongs and the current time slice identifier, and verifying the access token; S3, when the verification passes and the local cache is hit, the header metadata of the content resource in the cache is decrypted using the reconstructed session encryption key to obtain the basic decryption offset. Based on the request source trustworthiness index maintained by the CDN edge node for the client IP, the basic decryption offset is adjusted to the decryption offset, including: setting the request source trustworthiness index. initial value and maximum value All values ​​are 100, and the range is [0, 100]. Calculate the decryption offset using the following formula. : ;in, Based on the decryption offset, Using the preset adjustment coefficients, the data blocks of the content resources are decrypted using the decryption offset and then responded to the client; S4, when the verification fails due to expiration of the time slice identifier and the request source credibility index is higher than a first preset threshold, initiating a collaborative verification request to the source station server, and generating and issuing a temporary access token by the source station server according to the credibility index; when the verification fails due to signature mismatch, reducing the request source credibility index; if the reduced request source credibility index is lower than a second preset threshold, calculating a silent interception duration based on the difference between the request source credibility index and the second preset threshold, and starting silent interception for the client IP.

2. The CDN content anti-piracy chaining method based on edge and backsource cooperation according to claim 1, characterized in that, The session encryption key is selected from the preset key matrix, comprising: The preset key matrix is set as a two-dimensional matrix, the row index of the two-dimensional matrix corresponds to the risk level of the C-class network segment, and the column index corresponds to the time slice identifier; the process of selecting the session encryption key is: taking the risk level of the C-class network segment to which the client IP belongs as the row index, and taking the current time slice identifier as the column index, searching and determining the unique session encryption key in the two-dimensional matrix.

3. The CDN content anti-piracy chaining method based on edge and backsource cooperation of claim 1, characterized in that, The content resource path is signed in combination with the session encryption key and the time slice identifier to generate an access token, comprising: The content resource path, the time slice identifier and the session encryption key are concatenated to form a to-be-signed string; the to-be-signed string is subjected to hash operation by using the HMAC-SHA256 algorithm to generate a signature digest; and the signature digest is subjected to Base64 encoding to serve as the access token.

4. The CDN content anti-piracy chaining method based on edge and backsource cooperation of claim 1, characterized in that, The data block of the content resource is decrypted by using the decryption offset and the client is responded, comprising: The data block of the content resource is regarded as a byte sequence; starting from the beginning of the byte sequence, a number of bytes specified by the decryption offset is skipped; and continuous content data is read from the position after the skipping, and the read content data is responded to the client as the decrypted content resource.

5. The edge and backsource coordination based CDN content anti-stealing link method according to claim 1, characterized in that, When the verification fails due to signature mismatch, the request source credibility index is reduced, comprising: Each time the verification fails due to signature mismatch, a fixed degradation score value is subtracted from the current request source credibility index value.

6. The CDN content anti-piracy chaining method based on edge and backsource cooperation of claim 1, characterized in that, The silent interception duration is calculated based on the difference between the request source credibility index and the second preset threshold, and the client IP is started for silent interception, comprising: The second preset threshold is set as ; the silence blocking duration is calculated according to the following formula : ； wherein, is a current request source trustworthiness indicator, is a preset time penalty factor; all subsequent requests of the client IP are rejected within the calculated silence interception duration.

7. A system for implementing the edge and backsource coordination based CDN content anti-piracy chaining method of any one of claims 1-6, characterized in that, The method comprises the following modules: The generating module is configured to select a session encryption key from a preset key matrix according to a preset risk level of a C-class network segment to which a client IP of a content request belongs by the source station server; and sign a content resource path in combination with the session encryption key and a time slice identifier to generate an access token, and issue a URL containing the access token to the client; The verification module is configured to perform the following by the CDN edge node: after receiving the client request carrying the access token, reconstructing the session encryption key according to the preset risk level of the C-class network segment to which the client IP belongs and the current time slice identifier, and verifying the access token; The adjustment module is configured to, when the verification passes and the local cache hits, decrypt the header metadata of the cache content resource by using the reconstructed session encryption key to obtain a basic decryption offset, adjust the basic decryption offset to a decryption offset based on the request source credibility index maintained by the CDN edge node for the client IP, and decrypt the data block of the content resource by using the decryption offset and respond to the client; The interception module is configured to, when the verification fails due to the expiration of the time slice identifier and the request source credibility index is higher than a first preset threshold, initiate a collaborative verification request to the source station server, and generate and issue a temporary access token by the source station server according to the credibility index. When the verification fails due to the signature mismatch, the request source credibility index is reduced; if the reduced request source credibility index is lower than a second preset threshold, the silence interception duration is calculated based on the difference between the request source credibility index and the second preset threshold, and the silence interception is started for the client IP.

8. The CDN content anti-piracy link system based on edge and backsource cooperation of claim 7, characterized in that, The session encryption key is selected from the preset key matrix, including: The preset key matrix is set as a two-dimensional matrix, the row index of the two-dimensional matrix corresponds to the risk level of the C-class network segment, and the column index corresponds to the time slice identifier; the process of selecting the session encryption key is as follows: taking the risk level of the C-class network segment to which the client IP belongs as the row index and the current time slice identifier as the column index, the unique session encryption key is found and determined in the two-dimensional matrix.

9. The CDN content anti-piracy link system based on edge and backsource cooperation of claim 7, characterized in that, The content resource path is signed in combination with the session encryption key and the time slice identifier to generate the access token, including: The content resource path, the time slice identifier and the session encryption key are string-spliced to form a to-be-signed string; the HMAC-SHA256 algorithm is used to perform hash operation on the to-be-signed string to generate a signature digest; and the signature digest is Base64 encoded as the access token.

Images