Token-Based Validation for Segmented Content Delivery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing token-based validation methods for segmented content delivery are vulnerable to deep-linking attacks and require long-lived tokens, which decrease security and introduce statefulness in HTTP adaptive streaming (HAS) protocols, compromising the low-overhead, stateless nature of HAS.
Innovation Solution
A token-based validation scheme that generates and uses short-lived validation information, including tokens and timing information, which is embedded in the manifest file or URL query strings, allowing each segment request to be validated independently without relying on cookies or session information, thus reducing the risk of deep-linking and maintaining the stateless protocol advantage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If long-lived tokens are used for segment validation, then security against replay attacks is reduced, but vulnerability to deep-linking attacks increases
Solution Approach 1:
The patent implements dynamic token validation by embedding timing information (timestamps) in segment URLs and validating that segments are requested in chronological order within a valid time window. This dynamic approach allows tokens to be effectively short-lived without requiring explicit expiration, preventing both replay attacks (by rejecting out-of-order or stale segments) and deep-linking (by requiring sequential access within a time-bound session)
Solution Approach 2:
The patent changes the parameter of token validity from static (long-lived) to conditional (time-bound). By incorporating timing information as a validation parameter and enforcing sequential segment access within a time window, the system transforms the token's security properties without requiring complex expiration logic or state management
2Object-affected harmful factors
If tokens are made short-lived to prevent deep-linking, then security against deep-linking improves, but token validity duration decreases
Solution Approach 1:
The system dynamically determines token effectiveness through timing validation rather than relying on fixed expiration times. Each segment request is validated against the previous request's timestamp, creating de facto short-lived tokens that are effective only for the duration of continuous sequential playback, eliminating deep-linking while maintaining sufficient validity for legitimate use
3Reliability
If state or session information is stored to validate segments, then validation accuracy improves, but system complexity and overhead increase
Solution Approach 1:
The patent extracts the session state from server memory and embeds it directly in the segment URLs themselves. Timing information and segment identifiers are included in each URL, allowing any CDN node to validate segments independently without requiring centralized session management. This eliminates state storage complexity while maintaining validation accuracy through self-contained URL information
Solution Approach 2:
Each segment URL is self-sufficient containing all necessary validation information (segment identifier, timing data, sequence information). Any CDN node can validate a segment request by examining the URL parameters alone, without needing to query session databases or maintain state. The URL itself carries the validation credentials, enabling distributed validation with minimal overhead
4Reliability
If cookies or session information are used for validation, then security control improves, but HTTP protocol statefulness increases
Solution Approach 1:
The patent removes dependence on HTTP cookies and server-side sessions by extracting all necessary validation state from server memory and embedding it in the segment URLs. Each URL contains segment identifiers, timing information, and sequence data that enable validation without requiring protocol-level state management or cookie exchange, preserving HTTP's stateless nature while maintaining security control
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A token-based validation method for delivery of at least part of a segmented content item and a content delivery system configured for executing such method are described. Said segmented content item may be associated with at least one manifest file comprising one or more segment identifiers. The method may comprises the steps of: a content processing device sending a first segment request message comprising a first segment identifier associated with a first segment to said at least one delivery node; generating first validation information for use with a further second segment request message, said first validation information comprising at least a first token and associated first timing information; and, sending a first response message and said first validation information to said content processing device, said first response message comprising at least part of said segment or location information associated with at least one delivery node for delivering said segment.