Secure Media Stream Distribution via Server-Side Token Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing HTTP-based media streaming protocols lack robust security measures to prevent unauthorized access, leading to issues with encryption, device verification, and compatibility with various devices.
Innovation Solution
A secure distribution system using access tokens and client tokens for secure stream distribution across different platforms, enforcing geographic, time-of-day, device, and platform restrictions without requiring additional hardware or software on client devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If DRM solutions are implemented to secure HTTP-based stream distribution, then security protection is improved, but device complexity and hardware/software requirements increase
Solution Approach 1:
The patent extracts the security verification function from the client device and relocates it to the server side. The server performs authentication and authorization decisions, while the client only needs to store and transmit simple tokens. This extraction eliminates the need for complex DRM software and specialized hardware on client devices, resolving the contradiction between security protection and device complexity.
Solution Approach 2:
The patent introduces server-side authentication mechanisms and tokens as intermediaries between the client and the streaming content. Instead of requiring clients to handle complex encryption and decryption operations, the server acts as an intermediary that verifies credentials and issues tokens, simplifying the client device requirements while maintaining security.
2Reliability
If DRM solutions with encryption are implemented, then unauthorized access is prevented, but playback start latency increases
Solution Approach 1:
The patent performs authentication and authorization actions in advance before the actual streaming begins. The server verifies client credentials and issues tokens during a preliminary phase, so that when streaming starts, the client can immediately begin playback without delays for encryption key retrieval or decryption setup. This preliminary action separates authentication from playback initiation, reducing latency.
3Reliability
If signed cookies are used for device verification, then device authentication is improved, but cross-platform compatibility deteriorates due to browser restrictions
Solution Approach 1:
The patent uses server-side authentication and token issuance as an intermediary mechanism that bridges different browser and platform environments. Instead of relying on browser-specific cookie storage mechanisms that have varying support across platforms, the server acts as a universal intermediary that handles authentication logic centrally, issuing tokens that can be stored and transmitted across different platforms without browser restrictions.
Solution Approach 2:
The patent replaces the mechanical cookie storage mechanism (which is browser-specific and has limited cross-platform support) with a server-based authentication system using tokens. This substitution moves the authentication mechanism from the client/browser level to the server level, eliminating platform-specific limitations while maintaining authentication reliability.
4Reliability
If content encryption is implemented at the source, then security is improved, but device complexity increases due to required decryption hardware and software
Solution Approach 1:
The patent extracts the encryption and decryption operations from the client device and relocates them to the server side. The server encrypts content before transmission and handles decryption, while the client only needs to receive and play decrypted content. This extraction eliminates the need for specialized decryption hardware and software on client devices, maintaining content security while reducing device complexity.
Data Source
AI summary
Disclosed is a system and associated methods for secure media stream distribution across different platforms associated with different Internet domains. A first node of a first platform receives a first request from a device, performs a first verification based on credentials provided by the device matching stored credentials, generates a first signed token, and provides the first signed token with a second link for the device to access the requested media stream from a second network node of a second platform. The second network node determines that the device was verified at the first network node based on a second stream request from the device including the first signed token, generates a second token that uniquely identifies the device in the second domain, and streams requested stream data to the device in response to performing a second verification based on requests for the stream data including the second token.