Content Access Control (JWT)

Notice

This document is a machine-translated draft and is currently undergoing review. Some content may be inaccurate or differ from the original Korean version. For the most precise information, refer to the Korean documentation.

• PlanEnterprise

What is JWT-based content authentication?

JWT (JSON Web Token) is an industry-standard method for securely handling user authentication and authorization.

Kollus VOD implements the following high-level security measures through a JWT issuance mechanism based on a proprietary security key system.

• Prevention of URL tampering: After a playback URL is generated, signature verification ensures that the data cannot be arbitrarily altered externally.
• Fine-grained permission control: Playback permission is granted only to authenticated users, and content leakage is prevented by setting the token's validity period.

---

Keys used for authentication

Authentication key	Description
Security key	A secret key used to ensure the integrity of the JWT. It is used when generating the signature.
Custom key	A unique identifier for the user. It is delivered together with the JWT and serves as the basis for determining which account's security key should be used to verify the signature.
Media content key	A unique identifier assigned to content registered in a channel. It is included in the token to prove actual access rights to the corresponding content.

See Also

For key(Key/ID) information, refer to the document below.

• Authentication and Key Information

---

Basic structure of JWT

A JWT consists of three parts.

Component	Role
Header	Contains the token type (JWT) and information about the encryption algorithm used for the signature (e.g., HS256).
Payload	Contains claims, which are the actual authentication information. This includes the user ID, expiration date, allowed media content keys, and more.
Signature	A value created by combining the header and payload, then encrypting it with a security key known only to the server. This is the key mechanism for detecting forgery or tampering of the token.

---

Kollus VOD authentication processing workflow

Kollus VOD uses the industry-standard security algorithm HMAC SHA-256(HS256).

1. Token request: When a user attempts to sign in to the service, the customer server checks the user's information.
2. JWT generation: The customer server generates a JWT containing the user ID, expiration date, and other information using the security key.
3. Playback URL request: The client combines the generated JWT with the custom key to request playback using a URL in the following format.

https://v.kr.kollus.com/s?jwt={JWT}&custom_key={CUSTOM_KEY}

4. Integrity verification: The Kollus authentication server uses the received custom key to look up the corresponding account's security key and verify the JWT signature.
5. Playback approval: If the signature is valid and the expiration date in the payload has not passed, a playback session is issued immediately.

JWT payload example

Below is an example JWT payload for user catenoid to play content vnCVPVyV(media content key).

{
  "cuid": "catenoid",
  "expt": 1703980800,
  "mc": [
    {
      "mckey": "vnCVPVyV"
    }
  ]
}

Option	Description
cuid	User ID
expt	JWT expiration date (Unix timestamp)
mc	Array containing information about the content to be played
mckey	Media content key

Learn More(For Developers)

For detailed descriptions of JWT configuration, refer to the document below.

• Playback URL Generation (JWT)