Method for scalable access control decisions
Content access may be provided and processed by assigning responsibility for obtaining entitlement data to the client's browser. Thus, in one example, the client may be configured to synchronize and coordinate data lookups associated with a content request, rather than relying on the server to do so. The network architecture may use a mediator design pattern, in which the client's browser acts as the mediator (i.e., middleman) between a content server and an entitlement data server. Accordingly, synchronous calls between server-side services might not be required. Instead, data necessary for the content server to process a client request for access to protected content may be received in the incoming request from the client's browser.
1. A method comprising:
receiving, by a first computing device from a second computing device, a redirect to a third computing device, wherein the redirect comprises a digital token comprising an indication that the redirect is authorized by the second computing device;
validating, by the first computing device, the digital token;
obtaining entitlement data for the first computing device or a user of the first computing device by following the redirect to the third computing device;
transmitting the entitlement data for the first computing device or the user of the first computing device to the second computing device, wherein the entitlement data authorizes the first computing device or the user to access a content item; and
after transmitting the entitlement data to the second computing device, receiving, by the first computing device, an unencrypted version of a location of the content item from the second computing device.
2. The method of claim 1 , further comprising:
transmitting a request for the content item to the second computing device using the unencrypted version of the location, the request comprising content data specific to the content item.
3. The method of claim 2 , wherein the content data comprises the digital token and an encrypted address of the content item.
4. The method of claim 3 , wherein the content data further comprises an expiration time for the digital token.
5. The method of claim 2 , further comprising receiving an application configured to execute on the first computing device and interface with the second computing device.
6. The method of claim 1 , further comprising:
prior to receiving the redirect, receiving an encrypted version of the location of the content item.
7. The method of claim 1 , wherein obtaining the entitlement data comprises obtaining a content subscription of the first computing device or the user of the first computing device.
8. The method of claim 1 , further comprising determining whether the entitlement data is cached by the second computing device,
wherein receiving the redirect to the third computing device is performed responsive to determining that the entitlement data is not cached by the second computing device.
9. The method of claim 1 , wherein the digital token comprises an expiration timer.
10. The method of claim 1 , wherein the digital token comprises a security key.
11. A method comprising:
responsive to a determination that entitlement data for accessing a content item stored at a first server is not cached by a computing device, requesting, by the computing device, a redirect from the first server and to a second server storing the entitlement data;
validating a digital token received with the redirect from the first server to the second server, wherein the digital token comprises an indication that the redirect is authorized by the first server;
following the redirect from the first server to the second server; and
following a redirect from the second server to the first server, the redirect from the second server to the first server comprising the entitlement data.
12. The method of claim 11 , further comprising:
receiving the entitlement data from the first server upon following the redirect from the second server to the first server.
13. The method of claim 11 , wherein following the redirect from the second server to the first server comprises requesting the content item from the first server.
14. The method of claim 11 , further comprising:
after following the redirect from the second server to the first server, receiving an unencrypted version of a location of the content item from the first server.
15. The method of claim 14 , further comprising:
prior to requesting the redirect from the first server to the second server, accessing a pseudo-address of the content item.
16. The method of claim 14 , further comprising:
prior to requesting the redirect from the first server to the second server, receiving an encrypted version of the location of the content item.
17. The method of claim 11 , further comprising:
after following the redirect from the first server to the second server, receiving a list of content items accessible to the computing device or a user of the computing device.
18. A method comprising:
receiving, by a first server, a request for a content item from a computing device;
providing the computing device with a redirect configured to redirect the computing device to a second server storing entitlement data for the computing device or a user of the computing device, wherein the redirect comprises a digital token comprising an indication that the redirect is authorized by the first server;
receiving the entitlement data and the digital token;
validating the entitlement data and the digital token; and
transmitting an unencrypted version of a location of the content item to the computing device, the unencrypted version of the location configured to allow the computing device to access the content item.
19. The method of claim 18 , further comprising transmitting an encrypted version of the location of the content item prior to providing the computing device with the redirect.
20. The method of claim 18 , wherein receiving the entitlement data and the digital token comprises receiving content subscription information of the computing device or the user of the computing device.