CDN Access Control via Ticket Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing CDN-based access control methods are vulnerable to intruders obtaining content resource URLs, allowing unauthorized access to content resources stored in CDN servers.
Innovation Solution
Implementing a CDN-based access control method that uses access tickets for authentication, where the CDN server receives an HTTP request with an access ticket from a user terminal, sends the identification information to a service server for authentication, and only provides the content resource to the user terminal after a valid content fingerprint is obtained and verified, ensuring that the content fingerprint is stored and not passed through the user terminal.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If the CDN server stores content resources and allows direct access via URL, then the response speed is improved and network congestion is mitigated, but the security of content resources deteriorates as intruders can obtain actual addresses and bypass authentication
Solution Approach 1:
The patent introduces an access ticket as an intermediary mechanism between the user terminal and content resource. The access ticket contains authentication information and is verified by the CDN server before providing content access. This mediator prevents direct URL access while maintaining fast content delivery, resolving the contradiction between speed and security.
Solution Approach 2:
The patent implements preliminary authentication by requiring users to obtain an access ticket before accessing content resources. The authentication process occurs in advance, and the resulting access ticket is stored on the user terminal. This preliminary action ensures security is established before content delivery, allowing fast access for authenticated users while blocking unauthorized access.
2Reliability
If the CDN server implements authentication verification for each content access, then the security of content resource is improved, but the device complexity increases due to additional authentication mechanisms
Solution Approach 1:
The patent creates a copy of authentication information in the form of an access ticket that is stored on the user terminal. Instead of repeatedly verifying user credentials, the system uses this copied authentication data in the access ticket for quick verification. This copying mechanism maintains security while reducing the complexity of repeated authentication processes.
Solution Approach 2:
The patent extracts the essential authentication information from the full authentication process and places it into a compact access ticket format. This extracted authentication data contains only the necessary verification elements, simplifying the authentication mechanism while maintaining security. The CDN server verifies this extracted information rather than processing complete authentication credentials each time.
3Ease of operation
If the system uses traditional URL-based content delivery, then the ease of operation is maintained, but the loss of information increases as intruders can crack URLs and obtain content without permission
Solution Approach 1:
The patent changes the access parameter from a static URL to a dynamic access ticket that contains authentication information. The access ticket can be in URL format but includes additional security parameters such as authentication tokens, time limits, and user identifiers. This parameter change maintains the ease of URL-based access while preventing unauthorized access through cracked URLs, as the access ticket validates user permissions.
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
Embodiments of the present invention disclose a CDN-based access control method, so as to improve security of a content resource stored in a CDN server. The CDN-based access control method in the embodiments of the present invention includes: receiving, by a CDN server, an HTTP request sent by a user terminal and identification information of the user terminal, where the HTTP request includes an access ticket; sending the identification information of the user terminal and the HTTP request to a service server, so that the service server performs authentication on the access ticket by using the identification information of the user terminal; if an authentication result is that the access ticket is valid, receiving an HTTP response that includes a content fingerprint and that is returned by the service server, where the content fingerprint is used to identify a content resource; and obtaining the content resource according to the content fingerprint and sending the content resource to the user terminal. The embodiments of the present invention further provide a CDN server and a service server that are configured to implement the access control method.