Security policy editor
A shared computing infrastructure has associated therewith a portal application through which users access the infrastructure and provision one or more services, such as content storage and delivery. The portal comprises a security policy editor, a web-based configuration tool that is intended for use by customers to generate and apply security policies to their media content. The security policy editor provides the user the ability to create and manage security policies, to assign policies so created to desired media content and/or player components, and to view information regarding all of the customer's current policy assignments. The editor provides a unified interface to configure all media security services that are available to the CDN customer from a single interface, and to enable the configured security features to be promptly propagated and enforced throughout the overlay network infrastructure. The editor advantageously enables security features to be configured independently of a delivery configuration.
1. Apparatus, comprising:
a hardware processor; and
computer memory holding computer program code, the computer program code executed by the hardware processor and configured to:
store a template that defines logic configured to perform a security operation associated with a service, the logic being common to at least a set of content providers that use the apparatus, and wherein the service is associated with a set of policies;
receive a request to access content that is protected by a given one of the set of policies;
responsive to receipt of the request, determining whether the request is associated with digital property and path data that is matched for a particular content provider and a policy;
upon a determination of a match, retrieving information associated with the policy using one or more response headers over a response header interface;
setting at least one variable defined in the policy into the template to enforce the policy with respect to the request; and
thereafter executing the logic to perform the security operation associated with the service;
wherein the information and the template remain bifurcated until receipt of the request for the content.
2. The apparatus as described in claim 1 wherein the service is one of:
token authentication, content targeting, media encryption, and media player verification.
3. The apparatus as described in claim 1 wherein the information comprises customer-specific parameters.
4. The apparatus as described in 1 wherein the information is stored as an Edge Side Include (ESI) fragment.
5. The apparatus as described in claim 1 wherein the information is stored in a pre-compiled decision tree.
6. The apparatus as described in claim 1 wherein, as between the template and the information, the template is static and the information is adapted to be updated as necessary to enforce a change to the policy.
7. The apparatus as described in claim 1 wherein the information comprises a path value that points to content in a customer configuration that is to be protected by the policy.
8. The apparatus as described in claim 1 wherein the information comprises a range of time for which the policy will be valid.
9. The apparatus as described in claim 1 wherein the information comprises a policy history.
10. The apparatus as described in claim 1 wherein the information comprises a set of features active and enabled for the policy.
11. The apparatus as described in claim 10 wherein the set of features comprises one of: token authentication, content targeting, media encryption, and media player verification.
12. The apparatus as described in claim 1 wherein the information comprises an assignment of the policy to a media player component.