Secure Token Specification

  • Updated on Aug 27, 2024
  • Published on Sep 12, 2023
  • 1 minute(s) read
Prev Next

Overview

Triton Digital's Secure Token mechanism is a solution to provide additional information about users in a trusted manner. Being trusted means that the token can only be issued by someone (broadcaster, web site, player application, etc.) that is in possession of the secret key.

Triton Digital's Secure Token works the same way for live streams, on-demand music services, and podcasts.

Using the Secure Token mechanism, you can:

  • Perform access control;

  • Vary the number of ads between registered/non-registered users, or other similar scenarios;

  • Send targeting data (for advertising) in a trusted and obfuscated manner;

  • Obtain analytics break-downs, based on the token's attributes.

The Secure Token mechanism has the following design goals:

  • Based on JSON Web Token (JWT) and JSON Web Signature (JWS) RFCs.

  • The token must have a limited validity period (to prevent replay attacks, bookmarks, or simply reuse of a stream URL by an unauthorized aggregator).

  • The token must be cryptographically signed using a secret key.

  • The token's secret key must not be shared between Triton customers, to allow revocation of old keys, and to prevent other customers from generating tokens that are valid for mounts/stations they do not own.

  • Must work for mobile and Web-based players.

Two specific tokens are described:

References