Piracy and CDN Leeching: How the Next-Generation Tokens Will Make CDN Piracy-Proof

Conference Proceedings

Home
Piracy and CDN Leeching: How the Next-Generation Tokens Will Make CDN Piracy-Proof

Description

Stealing content directly from the Content Delivery Network (CDN) of legitimate content providers has become too easy. It is time for CDNs to join the fight against piracy, rather than turning a blind eye to the issue. Streaming security experts have largely overlooked the role of the CDNs for a long time. To fight piracy, service providers have first focused on trusted hardware authentication from controlled set-top-boxes, and then implemented DRM for their OTT services. The CDN tokens have been designed to offer a light-weight optional security layer without compromising the streaming scalability, which is the baseline purpose of CDN servers. The adoption of software-based authentication to support mobile devices and the vulnerabilities of DRMs, epitomized by Widevine L3, have put CDNs in a more central position and calls for revisiting the design of CDN tokens. However, the streaming community has not agreed on a best practice yet. The CTA Wave working group, which standardizes a common CDN token format, has postponed the release of its first reference document. Meanwhile, the industry, in desperate need for a token, has designed multiple proprietary formats, which prevents re-use and multi-vendor delivery services. We also miss a reference study on the best implementation of time expiration in tokens. The community distinguishes short-lived tokens (which either have a short expiration time or refer to a small number of consecutive assets) and long-lived tokens (which either have a long expiration tine or refer to a long series of consecutive assets). In this talk, we will introduce the best practices with respect to the state-of-the-art work such as CAT. We will discuss the concept of mixed-lived token, which could make pirate operations more difficult, and the changes it would require from content providers, video players, and CDN servers.