Token-Based Video Service Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Service providers face challenges in authenticating and authorizing non-proprietary applications and users accessing video services, particularly when these applications are developed by independent developers, to ensure secure and subscriber-specific content access.
Innovation Solution
A multi-part authorization process using tokens, incorporating OAuth, SAML, and JWT protocols, where an identity provider authenticates users and an application administrator authenticates applications, issuing tokens with privileges to manage access to video services, ensuring secure and authorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a multi-part authorization process using tokens is implemented to authenticate both applications and users, then security and controlled access to subscriber-specific content is improved, but device complexity and processing overhead increase
Solution Approach 1:
The authorization process is segmented into distinct components: application authentication (verifying the app's identity and privileges), user authentication (verifying the user's identity), and token-based access control. Each component handles a specific aspect of security, allowing the system to maintain high security while managing complexity through modular design. The identity provider, application administrator, and service provider each perform specialized functions rather than a single monolithic authentication system.
Solution Approach 2:
Tokens serve as intermediaries that carry authentication information between different system components. The application token mediates between the application administrator and the service provider, while the access token mediates between the authenticated user/application and the protected video content. These intermediary tokens reduce direct complexity by standardizing the exchange of authentication data between different parties in the multi-part authorization process.
2Measurement precision
If separate authentication mechanisms are used for applications and users, then access control precision is improved, but processing time and system overhead increase
Solution Approach 1:
The application authentication is performed in advance before user authentication occurs. The application administrator issues an application token that validates the application's identity and privileges beforehand. This preliminary action allows the system to quickly reject unauthorized applications without undergoing the full user authentication process, thereby maintaining precise access control while reducing overall processing time for unauthorized requests.
Solution Approach 2:
The system merges the application token validation and user authentication results into a single access decision process. Both the application's authorization (via application token) and the user's authentication (via user credentials) are combined to issue a final access token that grants or denies access to video content. This merging allows precise control over both application and user dimensions while streamlining the overall authentication flow.
Data Source
AI summary
Authorizing an application to access web services or other electronic services is contemplated. Authorization of application may include requiring the application to successfully obtain an appToken and a userToken. The appToken may be provided by an application administrator to attest to an authenticity or level of trust with the application. The userToken may be issued by an identity provider (IdP) attest to an authenticity or level of trust with a user of the application. A service provider sourcing the services may analyze the appToken and userToken to determine content available to application.