CDN Media Authentication Using Per-Client Code Libraries
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing media delivery systems lack robust security and authentication controls, making them susceptible to malicious and fraudulent attacks, and suffer from inefficiencies in caching and scalability.
Innovation Solution
Implement a method using unique application code libraries with cryptography keys for each client device, dynamically obfuscating code components, and employing time-bound authentication tokens to verify requests, ensuring secure and efficient content delivery.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional authentication methods are used in media delivery systems, then implementation is simple, but security is weak and susceptible to malicious attacks
Solution Approach 1:
The authentication system is segmented into multiple independent components: per-user cryptography keys, unique application code libraries, and time-bound authentication tokens. Each component operates independently but contributes to the overall security, allowing the system to achieve high security without requiring a monolithic complex authentication mechanism
Solution Approach 2:
Cryptography keys are pre-generated and assigned to each user before content delivery. Unique application code libraries are prepared in advance and cached at CDN nodes. Time-bound authentication tokens are issued beforehand with embedded validity periods. These preliminary actions enable fast verification without real-time key generation or complex computations during content delivery
2Reliability
If per-user authentication states are maintained for each user, then security verification is possible, but caching efficiency decreases due to state management overhead
Solution Approach 1:
The authentication token contains all necessary verification information including the user's cryptography key identifier and time-bound validity data. The token is self-verifying through cryptographic signatures, eliminating the need for the CDN to maintain external authentication states. The token itself carries the authentication state, enabling stateless verification that is fully cacheable
Solution Approach 2:
Instead of maintaining centralized authentication states on the server, the authentication information is copied into self-contained tokens that are distributed to clients. These token copies can be independently verified by any CDN node without requiring connection to the authentication server, enabling distributed caching without state management overhead
3Reliability
If code obfuscation is applied to protect software applications, then security against hacks improves, but code execution complexity increases
Solution Approach 1:
Different portions of the software application receive different levels of obfuscation. Critical authentication and content delivery code is heavily obfuscated with unique per-user transformations, while standard library functions remain relatively simple. This localized approach provides maximum security where needed without unnecessarily complicating the entire codebase
Solution Approach 2:
The obfuscation parameters are dynamically changed per user through unique cryptography keys and time-bound transformations. The same base code can be executed by different users with different obfuscation parameters applied, providing security without requiring separate code versions for each user. The runtime system handles parameter substitution automatically
Data Source
AI summary
Systems and methods for secure content delivery are described, whereby a software application is provided to a plurality of client devices, the software application configured to implement an application code library. A respective application code library is provided to each one of the plurality of client devices, wherein each application code library implements a respective cryptography key. A CDN cryptographically verifies that a received request was generated using the respective application code library of the requesting client device, before delivering content to the software application on the requesting client device. Other embodiments are also described and claimed.