URL Validation

To prevent live resources from being stolen, you can configure URL validation to add authentication information to the end of the original ingest or streaming URL. When a streamer starts live streaming or a viewer requests playback, CDN verifies encrypted information in a URL. Only the requests that pass the verification are responded, and other illegitimate requests are rejected.

Working Principle

Figure 1 URL validation working principles

The process is as follows:

  1. A tenant enables URL validation on the Live console and configures the authentication method, the key, and timeout interval.
  2. The Live service delivers the configured authentication method, key value, and timeout interval to a CDN node.
  3. The streamer or viewer requests CDN to push streams or play video through a signed ingest/streaming URL.
  4. CDN verifies the request based on authentication information carried in the URL. Only requests that pass the verification are allowed.

Notes

  • This function is optional and is disabled by default.
  • Streaming and playback authentication cannot use the same key value.
  • After this function is enabled, the original URLs cannot be used. You must generate signed URLs based on rules.
  • If a signed URL expires or the signature fails to be authenticated, the live stream fails to be played and the message "403 Forbidden" is returned.

Prerequisites

  • The ingest domain name and streaming domain name have been added and associated.
  • CNMAE records have been added to your domains' DNS records.

Enabling URL Validation

  1. Log in to the Live console.
  2. In the navigation pane, choose Domains.
  3. Click Settings in the row containing the target domain name.
  4. In the navigation pane, choose Basic Settings > Access Control.
  5. Choose URL Validation.

    The URL Validation dialog box is displayed.

  6. Turn on the switch and configure related parameters.

    Figure 2 Configuring URL validation
    Table 1 URL validation parameters

    Parameter

    Description

    Method

    Method to calculate the authentication string. There are methods A, B, and C.

    Key

    Authentication key.

    • You can customize a key. A key consists of 32 characters. Only letters and digits are allowed.
    • A key can also be automatically generated.

    Timeout Interval

    Timeout interval of URL authentication information, that is, the maximum difference between the request time carried in authentication information and the time when Live receives the request. This parameter is used to check whether an ingest URL or streaming URL expires. The unit is second. The value ranges from 1 minute to 7 days.

  7. Click OK.
  8. Obtain a signed URL in either of the following ways.

  9. Verify whether URL validation has taken effect.

    Use the video cloud app to verify the signed ingest URL and streaming URL. If the original ingest URL and streaming URL cannot be used but the signed ingest URL and stream URL can, URL validation has taken effect.

Signing Method A

A signed string is calculated based on the Key, timestamp, rand, uid, and URL.

Signed URL format:
Original URL?auth_key={timestamp}-{rand}-{uid}-{md5hash}
Formula for calculating md5hash is:
sstring = "{URI}-{Timestamp}-{rand}-{uid}-{Key}"
HashValue = md5sum(sstring)
Table 2 Authentication fields

Field

Description

timestamp

Start time of a valid request. The value is the total number of seconds that have elapsed since 00:00:00 January 1, 1970. It is a decimal or hexadecimal integer.

Example: 1592639100 (2020-06-20 15:45)

Validity Period

How long a signed URL remains effective.

If the validity period is set to 1800s, users can access the streaming URL within 1800s since the time indicated by timestamp. Authentication fails and the URL is inaccessible if users access the streaming URL 1800s later.

For example, if the access time is 00:00:00 (GMT+08:00) on June 30, 2020, the URL expires at 00:30:00 (GMT+08:00) on June 30, 2020.

rand

Random number. The recommended value is a UUID, which cannot contain hyphens (-).

Example: 477b3bbc253f467b8def6711128c7bec

uid

User ID. This parameter is not used now. Set it to 0.

md5hash

A string of 32 characters calculated using the MD5 algorithm. The string consists of digits (0 to 9) and lowercase letters.

sstring = "{URI}-{Timestamp}-{rand}-{uid}-{Key}"
HashValue = md5sum(sstring)

URI

Path from the domain name to the end in the original URL

Example: /livetest/huawei1.flv

Key

Key value set on the console. For details, see URL Validation

Signed URL example:

Generating a signed streaming URL is used as an example.
Original URL: http://test-play.example.com/livetest/huawei1.flv
timestamp: 1592639100
Validity Period: 1800s
Key: GCTbw44s6MPLh4GqgDpnfuFHgy25Enly
rand: 477b3bbc253f467b8def6711128c7bec
uid: 0
URI: /livetest/huawei1.flv
Obtain md5sum based on the calculation formula.
HashValue = md5sum("/livetest/huawei1.flv-1592639100-477b3bbc253f467b8def6711128c7bec-0-GCTbw44s6MPLh4GqgDpnfuFHgy25Enly") = dd1b5ffa00cf26acec0c169ae1cfabea

The signed streaming URL is:

http://test-play.example.com/livetest/huawei1.flv?auth_key=1592639100-477b3bbc253f467b8def6711128c7bec-0-dd1b5ffa00cf26acec0c169ae1cfabea

Signing Method B

A signed string is calculated based on the Key, timestamp, and StreamName.

Signed URL format:
Original URL?txSecret=md5(Key + StreamName + txTime)&txTime=hex(timestamp)
Table 3 Authentication fields

Field

Description

txTime

Effective time of a streaming URL. The value is a hexadecimal Unix timestamp.

If the value of txTime is greater than the requested time, the playback is normal. Otherwise, the playback is rejected.

Example: 5eed5888 (that is, 2020.06.20 08:30:00)

Key

Key value set on the console. For details, see URL Validation

txSecret

Encryption parameter in the URL.

The value is obtained by using the MD5 encryption algorithm to encrypt the character string consisting of key, StreamName, and txTime.

txSecret = md5 (Key + StreamName + txTime) 

Validity Period

How long a signed URL remains effective.

If txTime is set to the current time and the validity period is set to 1249s, the streaming URL expiration time is the current time plus 1249s.

Signed URL example:

Generating a signed streaming URL is used as an example.
Original URL: http://test-play.example.com/livetest/huawei1.flv
Key: GCTbw44s6MPLh4GqgDpnfuFHgy25Enly
StreamName: huawei1
txTime: 5eed5888
Validity Period: 12,495s
Obtain txSecret based on the calculation formula.
txSecret = md5(GCTbw44s6MPLh4GqgDpnfuFHgy25Enlyhuawei15eed5888) = 5cdc845362c332a4ec3e09ac5d5571d6

The signed streaming URL is:

http://test-play.example.com/livetest/huawei1.flv?txSecret=5cdc845362c332a4ec3e09ac5d5571d6&txTime=5eed5888

Signing Method C

A signed string is calculated based on the Key, Timestamp, AppName, StreamName, and CheckLevel.

Signed URL format:
Original URL?auth_info={Encrypted string}.{EncodedIV}
The algorithm for generating the authentication fields is as follows. For details about the code example, see Code Example.
  • LiveID = <AppName>+"/"+<StreamName>
  • Encrypted string = UrlEncode(Base64(AES128(<Key>,"$"+<Timestamp>+"$"+<LiveID>+"$"+<CheckLevel>)))
  • EncodedIV = Hex (IV used for encryption)

Table 4 describes encryption parameters in the algorithm.

Table 4 Encryption parameters

Field

Description

AppName

Application name, which is the same as the value of AppName in an ingest or streaming URL

StreamName

Stream name, which is the same as the value of StreamName in an ingest or streaming URL

Key

Key value set on the console. For details, see URL Validation

LiveID

Live stream ID, which uniquely identifies a live stream. The value consists of AppName and StreamName.

LiveID = <AppName>+"/"+<StreamName>

Timestamp

UTC time when an authentication parameter is generated, in yyyyMMddHHmmss format. This parameter is used to check whether the authentication parameter has expired, that is, whether the absolute value of the difference between Timestamp and the current time is greater than the configured timeout interval.

CheckLevel

Check level. The value is 3 or 5.

  • If CheckLevel is 3, the system only checks whether the value of LiveID is matched.
  • If CheckLevel is 5, the system checks whether the value of LiveID is matched and whether Timestamp times out.

IV

Cipher block chaining (CBC) depends on the initialization vector (IV). IV consists of 16 random digits and letters and must be 128 bits. In CBC mode, PKCS7 padding is used.

Signed URL example:

Generating a signed streaming URL is used as an example.

Original URL: http://test-play.example.com/livetest/huawei1.flv
AppName: live
StreamName: huawei1
Key: GCTbw44s6MPLh4GqgDpnfuFHgy25Enly
LiveID: live/huawei1
Timestamp: 20190428110000
CheckLevel: 3
IV: yCmE666N3YAq30SN
The encrypted string and EncodedIV are obtained according to the calculation formula.
Encrypted string = I90KW7GhxOMwoy5yaeKMStZsOC %2B6WIyqU2kLBYAvcso %3D
EncodIV = 79436d453636364e335941713330534e
The signed streaming URL is:
http://test-play.example.com/livetest/huawei1.flv?auth_info=I90KW7GhxOMwoy5yaeKMStZsOC%2B6WIyqU2kLBYAvcso%3D.79436d453636364e335941713330534e

Sample Code

The following is the code example for generating a signed string in method C:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
import javax.crypto.Cipher;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.SecretKeySpec;

import java.io.UnsupportedEncodingException;
import java.net.URLEncoder;

public class Main {

        public static void main(String[] args) {

		// data="$"+<Timestamp>+"$"+<LiveID>+"$"+<CheckLevel>. For details, see "Signing Method C."
                String data = "$20190428110000$live/stream01$3";

                // A random 16-digit string consisting of digits and letters
		byte[] ivBytes = "yCmE666N3YAq30SN".getBytes();

                // Key value configured on the Live console
		byte[] key = "GCTbw44s6MPLh4GqgDpnfuFHgy25Enly".getBytes();

                String msg = aesCbcEncrypt(data, ivBytes, key);
		try {
			System.out.println(URLEncoder.encode(msg, "UTF-8") + "." + bytesToHexString(ivBytes));
		} catch (UnsupportedEncodingException e) {
			e.printStackTrace();
		}
	}

        private static String aesCbcEncrypt(String data, byte[] ivBytes, byte[] key) {
		try {
			SecretKeySpec sk = new SecretKeySpec(key, "AES");
			Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");

                        if (ivBytes != null) {
				cipher.init(Cipher.ENCRYPT_MODE, sk, new IvParameterSpec(ivBytes));
			} else {
				cipher.init(Cipher.ENCRYPT_MODE, sk);
			}

                        return Base64.encode(cipher.doFinal(data.getBytes("UTF-8")));
		} catch (Exception e) {
			return null;
		}
	}

        public static String bytesToHexString(byte[] src) {
		StringBuilder stringBuilder = new StringBuilder("");
		if ((src == null) || (src.length <= 0)) {
			return null;
		}

                for (int i = 0; i < src.length; i++) {
			int v = src[i] & 0xFF;
			String hv = Integer.toHexString(v);
			if (hv.length() < 2) {
				stringBuilder.append(0);
			}
			stringBuilder.append(hv);
		}
		return stringBuilder.toString();
	}
}

Base64 is used to encode encrypted strings.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
public class Base64
{

    / ** Base64 encoding table */
    private static char base64Code[] =
    {
        'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R',
        'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z', 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j',
        'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z', '0', '1',
        '2', '3', '4', '5', '6', '7', '8', '9', '+', '/',};

    /**
     * The construction method is privatized to prevent instantiation.
     */
    private Base64()
    {
        super();
    }

    /**
     * Encode three bytes in a byte array into four visible characters.
     * @param bytes Byte data to be encoded
     * @return Base64 character string after encoding
     */
    public static String encode(byte[] bytes)
    {
        int a = 0;

        // Allocate memory based on the actual length after encoding for acceleration.
        StringBuffer buffer = new StringBuffer(((bytes.length - 1) / 3) << 2 + 4);

        // Encoding
        for (int i = 0; i < bytes.length; i++)
        {
            a |= (bytes[i] << (16 - i % 3 * 8)) & (0xff << (16 - i % 3 * 8));
            if (i % 3 == 2 || i == bytes.length - 1)
            {
                buffer.append(Base64.base64Code[(a & 0xfc0000) >>> 18]);
                buffer.append(Base64.base64Code[(a & 0x3f000) >>> 12]);
                buffer.append(Base64.base64Code[(a & 0xfc0) >>> 6]);
                buffer.append(Base64.base64Code[a & 0x3f]);
                a = 0;
            }
        }

        // For a byte array whose length is not an integral multiple of 3, add 0 before encoding and replace it with = after encoding.
        // The number of equal signs (=) is the same as the length of the missing data to identify the actual data length.
        if (bytes.length % 3 > 0)
        {
            buffer.setCharAt(buffer.length() - 1, '=');
        }
        if (bytes.length % 3 == 1)
        {
            buffer.setCharAt(buffer.length() - 2, '=');
        }
        return buffer.toString();
    }

}