CDN Content Access Tokens Bound to DRM Session Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Unauthorized access to digital content over a content delivery network (CDN) is facilitated by the sharing of CDN access tokens, leading to network load and content piracy, especially with the vulnerability of Digital Rights Management (DRM) licenses being hacked, necessitating improved security measures.
Innovation Solution
A method involving a user device that signs and/or encrypts content requests using a session key from a DRM license, generating an authentication tag to prove access, and a content provider system that generates and transmits an encrypted session key within an access token, ensuring secure communication with the CDN.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If CDN access tokens are bound to IP addresses to prevent unauthorized access, then security against token sharing is improved, but user experience deteriorates when users move between networks causing session interruptions
Solution Approach 1:
The patent introduces a DRM license as an intermediary binding mechanism between the access token and the user device. Instead of directly binding to IP addresses, the system binds to the DRM license which is device-specific and persists across network changes. The DRM license acts as a mediator that maintains the security relationship while allowing network mobility.
Solution Approach 2:
The patent changes the binding parameter from IP address to DRM license identifier. This parameter change allows the system to maintain security through device-specific DRM licenses while enabling users to switch between networks (WiFi, mobile data) without session interruptions, as the DRM license remains valid across different network interfaces.
2Reliability
If DRM licenses are used to protect content access, then content encryption and usage control are improved, but security deteriorates when DRM licenses are hacked allowing key extraction and sharing
Solution Approach 1:
The patent segments the security architecture into two independent parts: the DRM license for content decryption and the access token for CDN access control. The access token includes a binding to the DRM license identifier, creating a separate authentication layer. This segmentation means that even if the DRM license is compromised, the access token can still be used to control CDN access, and vice versa.
Solution Approach 2:
The access token serves as an intermediary between the user device and the CDN, incorporating the DRM license identifier as a binding parameter. This intermediary structure adds an additional security layer that verifies both CDN access authorization and content decryption rights, preventing unauthorized access even when one component is compromised.
3Ease of operation
If access tokens are shared between devices to enable multi-device access, then user convenience is improved, but unauthorized access and network load increase
Solution Approach 1:
The patent changes the access token structure to include a binding parameter that references the DRM license identifier specific to each device. This parameter change enables legitimate multi-device access through different DRM licenses while preventing token sharing between unauthorized devices, as each device must have its own valid DRM license for the token to be valid.
Solution Approach 2:
The CDN receives feedback through the access token about the device's DRM license status and uses this information to verify authorization. The binding parameter allows the CDN to check whether the accessing device has proper DRM licensing, providing feedback mechanism that prevents unauthorized access while allowing legitimate multi-device usage.
Data Source
AI summary
The method includes the steps, performed by the user device, of: sending an access request to access a content to a content provider system; receiving, from the content provider system, an access token for said content, said access token including an encrypted session key, and a Digital Right Management, DRM, license, including the session key; and transmitting a content request including the received access token to a content delivery network and, in response, receiving from the content delivery network content data of the requested content, in a communication session; wherein the content request further comprises an authentication tag obtained by executing a cryptographic operation, performed by a DRM client module of the user device, of signing and/or encrypting, with the session key of the received DRM license, input data that is based on at least part of the content request.