Multicast Authentication via Service Intelligence Platform
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Multicast content distribution networks face challenges in securely authenticating and authorizing end users to access multimedia content, particularly in preventing unauthorized access and distributed denial of service attacks while maintaining scalability and reliability.
Innovation Solution
A method involving a service intelligence computer that verifies a token signed by a third-party content controller, generates and transmits authorization credentials, and uses symmetric keys for encryption and authentication to enable secure joining of multicast groups, leveraging the IGMPv3 protocol and Transport Layer Security for secure communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional authentication methods are used in multicast content distribution networks, then ease of operation is maintained, but security against unauthorized access and DDoS attacks deteriorates
Solution Approach 1:
The system performs preliminary authentication and authorization actions before the user joins the multicast group. The service intelligence computer verifies tokens, checks credentials, and validates user permissions in advance, establishing security policies and authorization keys before content distribution begins. This prevents unauthorized access and DDoS attacks by filtering malicious users before they can consume network resources.
Solution Approach 2:
The service intelligence computer acts as an intermediary between users and the multicast content distribution network. It mediates authentication by verifying tokens from content controllers, mediates authorization by generating credentials and authorization keys, and mediates accounting by tracking resource usage. This intermediary layer enforces security policies without requiring changes to the underlying multicast protocol infrastructure.
2Reliability
If robust authentication and authorization protocols are implemented, then security against unauthorized access is improved, but processing time and latency increase
Solution Approach 1:
Authentication and authorization are performed preliminarily before users join multicast groups, so that when content distribution begins, the users are already authenticated. The service intelligence computer verifies tokens and generates credentials in advance, storing authorization keys that enable rapid content delivery without repeated authentication delays.
Solution Approach 2:
The system uses token copying and credential verification where the service intelligence computer receives signed tokens from content controllers, verifies their authenticity, and generates derived credentials (authorization keys) that can be used for subsequent content access. This copying approach allows efficient authentication without requiring repeated verification of original credentials during content delivery.
3Reliability
If comprehensive user authentication and content authorization is performed, then unauthorized access is prevented, but network resource consumption increases
Solution Approach 1:
The authentication and authorization processing is extracted from the content distribution path and placed in a separate service intelligence computer. This extraction allows comprehensive security checking without burdening the multicast content delivery infrastructure. The service intelligence computer handles token verification, credential generation, and authorization key management separately from the actual content streaming, minimizing impact on network resource consumption for content delivery.
Solution Approach 2:
Users present their own tokens for verification, and the service intelligence computer automatically verifies these tokens against content controller signatures. The system self-manages authentication credentials and authorization keys without requiring manual intervention. This automated self-service approach reduces network resource consumption by eliminating manual authentication processes while maintaining comprehensive access control.
4Measurement precision
If token verification and credential generation are performed for each user, then authorization accuracy is improved, but device complexity of the service intelligence computer increases
Solution Approach 1:
The service intelligence computer generates derived credentials (authorization keys) by copying and transforming information from verified user tokens. Instead of implementing complex authorization logic from scratch, the system copies essential identification and permission data from the token, transforms it into the appropriate format, and generates authorization keys that accurately reflect user permissions. This copying approach maintains high authorization accuracy while reducing the complexity of the authorization service.
Solution Approach 2:
The system transforms token parameters into credential parameters through controlled parameter changes. The service intelligence computer takes parameters from the verified token (user identification, content permissions, time constraints) and transforms them into the appropriate format for authorization keys and credentials. This parameter transformation approach ensures accurate authorization while using standardized protocols that reduce implementation complexity.
Data Source
AI summary
An end user computer is assigned a multicast content distribution group by a network service intelligence platform. The network service intelligence platform authenticates a token sent by the user and signed by a third part content controller, and provides the user with credentials for joining the group. The credentials include an authorization key as well as identifications of the user and the requested content. The credentials are encrypted and authenticated by the third party content controller. The user includes the encrypted and authenticated credentials in a join request sent to a network resource, such as an edge router. After verifying the credentials, the network resource adds the end user computer to the multicast group.