Security policy editor
A shared computing infrastructure has associated therewith a portal application through which users access the infrastructure and provision one or more services, such as content storage and delivery. The portal comprises a security policy editor, a web-based configuration tool that is intended for use by customers to generate and apply security policies to their media content. The security policy editor provides the user the ability to create and manage security policies, to assign policies so created to desired media content and/or player components, and to view information regarding all of the customer's current policy assignments. The editor provides a unified interface to configure all media security services that are available to the CDN customer from a single interface, and to enable the configured security features to be promptly propagated and enforced throughout the overlay network infrastructure. The editor advantageously enables security features to be configured independently of a delivery configuration.
1. A method of enforcing security in a shared computing infrastructure, the computing infrastructure having associated therewith a portal application through which portal users access the shared computing infrastructure and provision one or more services, a storage system, and a set of edge servers from which protected content is delivered to requesting end users, the method comprising:
for a particular security service provided from the shared computing infrastructure structure, distributing a security metadata template to the set of edge servers, the security metadata template defining logic for performing a security operation associated with the particular security service, the logic being common to at least a set of content providers that use the shared computing infrastructure to deliver their protected content to the requesting end users;
receiving, via the portal application executing on a hardware element, information defining a security policy associated with a particular content provider, the information being specific to the particular content provider;
storing, in a data store, the information; and
upon receipt at an edge server of a request for the protected content and a determination that the request includes digital property and path data that is matched for the particular content provider and the information defining the security policy, fetching the information, the information being fetched as one or more response headers over a response header interface between the data store and the edge server, stitching the information into the security metadata template by setting at least one variable defined in the security policy into the security metadata template, and thereafter executing the logic to enforce the security policy with respect to the request, wherein the information and the security metadata template remain bifurcated until receipt at the edge server of the request for the protected content.
2. The method as described in claim 1 wherein the information defining the security policy comprises customer-specific parameters received via the portal application.
3. The method as described in claim 1 wherein the information is stored as an ESI fragment.
4. The method as described in claim 3 wherein the information is stored in a pre-compiled decision tree.
5. The method as described in claim 1 wherein, as between the security metadata template and the information, the security metadata template is relatively static and the information is adapted to be updated as necessary to enforce a change to the security policy.
6. The method as described in claim 1 wherein the security service is one of: token authentication, content targeting, media encryption, media player verification, digital watermarking, digital rights management, fraud detection, and security analytics.
7. The method as described in claim 1 further including caching the information at the edge server for re-use during a given time period.
8. A system comprising a set of machines, the system comprising:
a first machine for providing a web-based application having a display interface into which is received information specifying one or more security policies associated with a security service, each security policy uniquely associated with a particular content provider, the information being specific to the particular content provider;
a data store in which the information is stored; and
a second machine at which is stored a security metadata template, the security metadata template defining logic for performing a security operation associated with the security service, the logic being common to at least a set of content providers that use the system to deliver their protected content to requesting end users, wherein, upon receipt of a request to access content that is protected by a given one of the security policies and a determination that the request includes digital property and path data that is matched for the particular content provider and the information defining the security policy, the information is retrieved from the data store over a response header interface and applied by setting at least one variable defined in the security policy into the security metadata template to enforce the given security policy with respect to the request, wherein the information and the security metadata template remain bifurcated until receipt at the edge server of the request for the protected content.
9. The system as described in claim 8 wherein the security service is one of: token authentication, content targeting, media encryption, and media player verification.
10. The system as described in claim 8 wherein the information comprises customer-specific parameters received via the display interface.
11. The system as described in claim 8 wherein the information is stored as an ESI fragment.
12. The system as described in claim 8 wherein the information is stored in a pre-compiled decision tree.
13. The system as described in claim 8 wherein, as between the security metadata template and the information, the security metadata template is relatively static and the information is adapted to be updated as necessary to enforce a change to the security policy.
14. The system as described in claim 8 wherein the display interface is adapted to be used to create and manage the one more security policies.
15. The system as described in claim 8 wherein the display interface is adapted to be used to assign security policies to media content or player components.
16. The system as described in claim 8 wherein the display interface is adapted to be used to display information regarding security policy assignments.