URL Validation

Implementation

Referer validation works in a simple way. After a blacklist or whitelist is configured on the VOD console, VOD distributes the blacklist or whitelist to CDN. When receiving a request, CDN checks whether the request is valid based on the list. If the request is valid, CDN accesses the requested resource. If the request is invalid, CDN rejects the request and returns a status code 403.

URL validation is implemented by VOD edge nodes and origin server in VOD. It is a more secure and reliable anti-piracy solution than referer validation. Figure 1 shows how URL validation works.

Figure 1 URL validation working principles

The process is as follows:

1. You enable URL validation on the VOD console and configure the allowed time difference and algorithm.
2. VOD delivers the configured key value to CDN nodes.
3. You obtain the authentication URL of a VOD media file.
4. Viewers request CDN to play a video through the authentication playback URL.
5. CDN verifies the request based on authentication information carried in the playback URL. Only requests that pass the verification are allowed.

Notes

• This function is optional and is disabled by default.
• After this function is enabled, the original URLs cannot be used. New authentication URLs must be generated based on rules.
• If the authentication URL expires or the signature fails to be authenticated, the video fails to be played and the message "403 Forbidden" is returned.
• Algorithms A, B, and C do not support HLS and DASH playback scenarios.
• To disable URL validation, submit a service ticket.

Procedure

1. Log in to the VOD console.
2. In the navigation pane, choose Domain Name Management.
3. Click Settings in the row containing your domain name and then click the Hotlink Protection Settings tab.
4. Click URL Validation and switch on URL Validation.
5. Configure URL validation parameters. Table 1 describes the parameters.

   Table 1 Parameter description

   Parameter	Description
   Key	Click Generate to generate a key value.
   Maximum Time Difference	How long an authentication URL remains valid. The default value is 120 minutes. For example, if the authentication URL generation time is 1573806090 (Nov. 15, 2019 16:21:30 GMT+08:00) and the allowed time difference is 120 minutes, the authentication URL expires at Nov. 15, 2019 18:21:30 GMT+08:00.
   Expiration Time of the Old Key	By default, the old key expires 60 minutes later since the new key takes effect. For example, if the effective time of the new key is Nov. 15, 2019 16:21:30 GMT+08:00 and Expiration Time of the Old Key is 60 minutes, the old authentication URL expires at Nov. 15, 2019 17:21:30 GMT+08:00.
   Algorithm	Key encryption algorithm. The following algorithms are supported: Algorithms A, B, and C: The MD5 digest algorithm is used. For details, see Encryption Algorithm A, Encryption Algorithm B, and Encryption Algorithm C. Algorithm D: The symmetric encryption algorithm is used. For details, see Encryption Algorithm D. Algorithm E: The SHA-256 algorithm is used. For details, see Encryption Algorithm E (same as the Signing Method C2 of CDN). NOTE: Algorithms A, B, and C do not support HLS and DASH playback. Algorithm D or E is recommended. Currently, algorithm E supports preview only for HLS and MP4 files. The preview function of MP4 files takes effect only when the packaging format MOOV is in front of MDAT. After the preview function is enabled, the playback URL can be obtained from the VOD console. The default preview duration is 300s.

6. Click OK.
7. If you select algorithm D, you need to submit a service ticket for approval after configuring the parameters. The submitted information must contain the configured domain name and information listed in Table 1.

   URL validation settings take effect once your request is approved. If you modify the URL validation settings, you also need to submit a service ticket for approval.

8. Verify whether the URL validation settings have taken effect.

   Obtain the authentication playback URL and play the content via the URL. If the playback is successful, the URL validation settings have taken effect.

Generating an Authentication URL

Encryption Algorithm A

Authentication URL format

Original URL?auth_key={timestamp}-{rand}-{uid}-{auth_key}

auth_key = MD5(/asset/{assetId}/{file_name}-{timestamp}-{rand}-{uid}-{private_key})

Encryption Algorithm B

https://{cdn_domain}/{date_YYYYmmddHHMM}/{md5sum}/asset/{asset_id}/{file_name}

md5sum = md5({private_key}{date_yyyyMMddHHmm}/asset/{asset_id}/{file_name})

Original URL: http://1.cdn.myhuaweicloud.com/asset/6b2d740f10b8697d8ea6672868ecdb6f/test.mp4
private_key: myPrivateKey
date_yyyyMMddHHmm: 201901102026
file_name: test.mp4

Obtain md5sum based on the calculation formula.

md5sum = md5(myPrivateKey201901102026/asset/6b2d740f10b8697d8ea6672868ecdb6f/test.mp4) = 713ef643de8df076da6ec3c0545968cb

An authentication URL based on algorithm B is:

http://1.cdn.myhuaweicloud.com/201901102026/713ef643de8df076da6ec3c0545968cb/asset/6b2d740f10b8697d8ea6672868ecdb6f/test.mp4

Encryption Algorithm C

https://{cdn_domain}/{md5hash}/{time_hex}/asset/{asset_id}/{file_name}

md5hash = md5({private_key}/asset/{asset_id}/{file_name}{time_hex})

Original URL: http://1.cdn.myhuaweicloud.com/asset/6b2d740f10b8697d8ea6672868ecdb6f/test.mp4
private_key: myPrivateKey
time_hex: hex(timestamp) = hex(1547123166) = 5C3739DE
file_name: test.mp4

md5hash=md5(myPrivateKey/asset/6b2d740f10b8697d8ea6672868ecdb6f/test.mp45C3739DE) = afa20c956043fe6d130b16f2704ac870

An authentication URL based on algorithm C is:

http://1.cdn.myhuaweicloud.com/afa20c956043fe6d130b16f2704ac870/5C3739DE/asset/6b2d740f10b8697d8ea6672868ecdb6f/test.mp4 

Encryption Algorithm D

Authentication URL format

Original URL?auth_info={Encrypted string}.{EncodedIV}

byte[] iv = new byte[16];
SecureRandom secureRand = new SecureRandom();
secureRand.nextBytes(iv);

Original URL: https://179.cdn-vod.huaweicloud.com/asset/32237c8f68fcc6071a2d8e3421eee20d/play_video/index.m3u8
path: /asset/32237c8f68fcc6071a2d8e3421eee20d/play_video/
key: 8Ks1qn14XRO28qOa
Timestamp: 20190805102430

Original encrypted string = url_encoding("/asset/32237c8f68fcc6071a2d8e3421eee20d/play_video/") + "$" + "20190805102430"
Encrypted string = aes_cbc_128_pkcs5padding (original encrypted string, key, IV) = 34M%2F6KtYgxuAozdBLIVTe0dUVAZdvXsYQoYAnDmuhRHh1hshYg%2B2Tl0AmSwySDh%2BmkER44qYKpSP%2BgfsLM%2FIZe4F6K4n1Nx6ouGwyKfqdDA%3D
EncodedIV = hex(IV) = 79436d453636364e335941713330534e

https://179.cdn-vod.huaweicloud.com/asset/32237c8f68fcc6071a2d8e3421eee20d/play_video/index.m3u8?auth_info=34M%2F6KtYgxuAozdBLIVTe0dUVAZdvXsYQoYAnDmuhRHh1hshYg%2B2Tl0AmSwySDh%2BmkER44qYKpSP%2BgfsLM%2FIZe4F6K4n1Nx6ouGwyKfqdDA%3D.79436d453636364e335941713330534e

Encryption Algorithm E

Authentication URL format

Original URL?auth_key={authKey}&timestamp={timestamp}&exper={exper}

Original URL: http://1.cdn.myhuaweicloud.com/asset/6b2d740f10b8697d8ea6672868ecdb6f/test.mp4
private_key: 32d6b2d740f10b86
timestamp: 1547123166
fileName: /asset/6b2d740f10b8697d8ea6672868ecdb6f/test.mp4
exper: 300

auth_key = sha256(32d6b2d740f10b86/asset/6b2d740f10b8697d8ea6672868ecdb6f/test.mp41547123166300) = 3a935cf1d8299fe63ec8d4e0afb5ef3304883a702a4e760f3c5ae838a4b69768

http://1.cdn.myhuaweicloud.com/asset/6b2d740f10b8697d8ea6672868ecdb6f/test.mp4?auth_key=3a935cf1d8299fe63ec8d4e0afb5ef3304883a702a4e760f3c5ae838a4b69768&timestamp=1547123166&exper=300