Utilize este identificador para referenciar este registo: http://hdl.handle.net/10451/13937
Título: Security on over the top tv services
Autor: Pereira, Carlos Filipe Zambujo Lopes
Orientador: Neves, Nuno
Christin, Nicolas
Palavras-chave: security
IPTV
video
OTT
Internet
Data de Defesa: 2011
Resumo: The widespread availability of high bandwidth Internet access on fixed and mobile networks, in conjunction with the availability of mobile devices powerful enough to play streamed high quality video, has created the demand for services that deliver television and video content over the Internet to television sets, personal computers and mobile devices. This demand has lead to the appearance of over-the-top TV and video service providers that deliver video over the Internet, using networks not operated by them. Video delivery in an open environment, like the Internet, requires operators to implement security mechanisms to protect their valuable content from illicit access and distribution. In this thesis, we investigate security properties needed to securely deliver OTT video services. In order to assess the security mechanisms employed to enforce authentication, authorization, digital rights management and geographical restrictions, we survey three prominent OTT service providers. Due to their size and choice of technologies, we selected Netflix, Hulu and Comcast. We studied the interactions between the client applications and the providers’ servers by inspecting the traffic of messages exchanged. For each of the security mechanisms analyzed, experiments were designed to find flaws and test their effectiveness. The most import- ant of the identified security issues are related to the handling and transmission of HTTP cookies when using web browser-based clients. These vulnerabilities are common to all surveyed providers and can be exploited by adversaries to steal authentication cookies and impersonate the customer, allowing illicit access to video assets and private information of the customer. A cookie stealing and session hijacking attack is described and mitigation strategies are presented for OTT service providers, users and wireless network access point administrators. These consist in the use of SSL to protect authentication tokens, the use HTTPS only or VPN services, and the use of WPA2 to protect wireless networks, respectively. An interesting result, observed with the analyzed mobileclient for Android devices, is that it uses SSL to protect the transmission of HTTP cookies used forauthentication. Thus, it is not vulnerable to the described attack.
URI: http://hdl.handle.net/10451/13937
http://repositorio.ul.pt/handle/10455/6783
Aparece nas colecções:FC-DI - Master Thesis (dissertation)

Ficheiros deste registo:
Ficheiro Descrição TamanhoFormato 
thesis_carlos_2011 - FCUL - double sided.pdf1,11 MBAdobe PDFVer/Abrir    Acesso Restrito. Solicitar cópia ao autor!


FacebookTwitterDeliciousLinkedInDiggGoogle BookmarksMySpace
Formato BibTex MendeleyEndnote Degois 

Todos os registos no repositório estão protegidos por leis de copyright, com todos os direitos reservados.