Specifications

F-1
Cisco Internet Streamer CDS 2.0-2.2 API Guide
OL-14319-03
APPENDIX
F
URL Signing and Validation
This appendix describes the URL signing and validation method for the Cisco Internet Streamer CDS.
This appendix contains the following sections:
• Introduction, page F-1
• Configuring the CDS for URL Signing, page F-2
• URL Signing Script, page F-2
• Understanding the Signing Procedure , page F-5
Introduction
The Cisco Internet Streamer CDS accepts and fulfills requests for video content from client devices in
the form of content URLs. Content and service providers, in order to protect their copyright and fulfill
their licensing obligations, often need to restrict access to content and limit viewing times. Basic
authentication and authorization at the portal (for example, username and passwords) can help achieve
this objective by restricting content access to authorized users. However, because URLs are inherently
open, users (once authenticated at the portal) could potentially share these content URLs with other
possibly unauthorized users, or continue to access the content beyond the allotted time.
Cisco Internet Streamer CDS 2.2 provides the infrastructure to sign and validate content URLs,
restricting access to some users and limiting viewing times.
URL Signing Components
One of the easiest ways to restrict content access to a particular user is to embed, within the content URL,
the client IP address of the user for whom the content access was authorized. Similarly, to ensure that
the content expires after a predetermined time, an expiry timestamp could be embedded. These values
can then be validated against the actual client sending the request and the current time at the Service
Engine serving the request. If either of the two validations fail, the request is rejected.
However, because any of these strings in the URL could potentially be edited manually and circumvented
by any knowledgeable user, it is important to generate and attach a signature to the URL. This can be
achieved by attaching a keyed hash to the URL, using a secret key shared only between the signer (the
portal) and the validating component (CDS).