DRM License & Signed-URL Streaming Security

Traffic Controls

Legit segment requests 3.0/s

License token TTL 6.0s

Bot traffic injection 20%

Live Telemetry

Segments delivered

Active license

expired

Bots blocked

Detector accuracy

—

How it works

Real streaming platforms protect video the same two ways this model shows:

1. DRM license handshake
   client -> license server: device cert + content id
   server -> client: encrypted key, valid for TTL seconds
   (segments cannot be decrypted without a live token)

2. Signed, time-limited CDN URLs
   url = edge/segment?exp=now+TTL&sig=HMAC(path,exp,secret)
   edge node checks: now <= exp  AND  sig matches
   -> expired or forged signatures are rejected at the edge

The legit client (white core, left) must hold a valid token before it can pull a segment from any CDN edge node (the ring). When the token's countdown reaches zero, the next request forces a fresh handshake with the license server (center) before streaming resumes — exactly like a real DRM key rotation.

Bot traffic (red sparks) skips the handshake and hammers edge nodes directly at high, bursty rates. The anomaly detector keeps a rolling request-rate window per source:

rate(source) = requests in last 2s / 2
flag as bot if rate(source) > 3 x rate(legit client)

Flagged sources are quarantined at the edge (node flashes red, request rejected) instead of reaching the client — this is the same rate-based heuristic real CDN bot-management layers (Akamai, CloudFront, Cloudflare) use before falling back to fingerprinting or CAPTCHA challenges. Toggle detection off to see unfiltered bot traffic reach the client unchecked.

License token Legit segment Bot request / blocked

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.

DRM License Handshake & Signed-URL Streaming Security