How to Properly Use the SDK Encryption String

Updated: 2024-12-16 19:20:19

Polyv VOD SDK requires users to provide the following configuration parameters: userid, readtoken, writetoken, and secretkey to decrypt and play videos. For security reasons, it is recommended to store these parameters on the server side, and have the APP retrieve and configure them from the server upon startup.

To prevent these parameters from being sniffed on the APP side, the transmitted content needs to be encrypted. Therefore, the SDK加密串 is introduced—encrypting the above four parameters on the server side, and decrypting them correspondingly on the APP side. Developers should design their own encryption and decryption methods, and the APP side should request the server interface via the https protocol.

For quick integration and debugging of SDK features, the Polyv management backend provides a temporary SDK encryption string with a fixed encryption method. Do not use it directly in a production environment.

For detailed VOD SDK integration documentation, see:

Production Solution

1. Design Your Own Encryption and Decryption Method

Server-side Java Example:

   /*该示例采用AES加密算法，开发者也可以选择使用不同的加密算法，并在APP端做对应的解密。*/
    String plainString = userid + "," + secretkey + "," + readtoken + "," + writetoken;
    String key = "1234567812345678"; // 加密密钥
    String iv = "1234567812345678"; // 加密向量

    Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
    int blockSize = cipher.getBlockSize();

    byte[] dataBytes = plainString.getBytes();
    int plaintextLength = dataBytes.length;
    if (plaintextLength % blockSize != 0) {
        plaintextLength = plaintextLength + (blockSize - (plaintextLength % blockSize));
    }

    byte[] plaintext = new byte[plaintextLength];
    System.arraycopy(dataBytes, 0, plaintext, 0, dataBytes.length);

    SecretKeySpec keyspec = new SecretKeySpec(key.getBytes(), "AES");
    IvParameterSpec ivspec = new IvParameterSpec(iv.getBytes());

    cipher.init(Cipher.ENCRYPT_MODE, keyspec, ivspec);
    byte[] encrypted = cipher.doFinal(plaintext);
    String baseString = Base64.encode(encrypted);
    System.out.println(baseString);

Server-side PHP Encryption Example:

<?php
   /*该示例采用AES加密算法，开发者也可以选择使用不同的加密算法，并在APP端做对应的解密。*/
    $privateKey = "1234567812345678";// 加密密钥
    $iv = "1234567812345678"; // 加密向量

    $userid = "你的userid";
    $secretkey = "你的secretkey";
    $readtoken = "你的readtoken";
    $writetoken = "你的writetoken";
    $plainstring = $userid.",".$secretkey.",".$readtoken.",".$writetoken;

    $str_padded = $plainstring;
    if (strlen($str_padded) % 16) {
        $str_padded = str_pad($str_padded, strlen($str_padded) + 16 - strlen($str_padded) % 16, "\0");
    }

    $encrypted = openssl_encrypt($str_padded, 'aes-128-cbc', $privateKey, OPENSSL_RAW_DATA, $iv);
    echo(base64_encode($encrypted));
?>

Android Decryption and Configuration:

public class PolyvApplication extends Application {
    @Override
    public void onCreate() {
        new LoadConfigTask().execute();
    }

    private class LoadConfigTask extends AsyncTask<String, String, String> {

    @Override
    protected String doInBackground(String... params) {
        String config = PolyvSDKUtil.getUrl2String("https://demo.ipolyv.cn/demo/appkey.php");
        if (TextUtils.isEmpty(config)) {
        try {
            throw new Exception("没有取到数据");
        } catch (Exception e) {
            e.printStackTrace();
        }
        }

        return config;
    }

    @Override
    protected void onPostExecute(String config) {
        PolyvSDKClient client = PolyvSDKClient.getInstance();
        String iv = "1234567812345678"; // 加密密钥
        String aeskey = "1234567812345678"; // 加密向量
        client.settingsWithConfigString(config, aeskey, iv);
      /*
       *开发者若使用其它加密算法，可自行解密并使用
       *client.settingsWithUserid(String userid, String secretkey, String readtoken, String writetoken)方法进行初始化。
      */
      
    }
    }
}

iOS Decryption and Configuration:

- (BOOL)application:(UIApplication *)application didFinishLaunchingWithOptions:(NSDictionary *)launchOptions
{
    NSData *data = [NSData dataWithContentsOfURL:[NSURL URLWithString:@"https://demo.ipolyv.cn/demo/appkey.php"]];
    NSString *configString  =[[NSString alloc] initWithData:data encoding:NSUTF8StringEncoding];
    NSString *aesKey = @"1234567812345678";
    NSString *aesIv = @"1234567812345678";
    NSError *error = nil;
    //使用保利威点播 SDK 提供的加密方式得到 SDK 配置信息
    [PLVVodSettings settingsWithConfigString:configString key:aesKey iv:aesIv error:&error];
    
    /* 客户也可以用自己的方法解密得到 secretkey 等信息，并使用以下方法初始化 SDK
    [PLVVodSettings settingsWithUserid:userId readtoken:readtoken writetoken:writetoken secretkey:secretkey];
    */
    return YES;
}

2. Ensure Server Interface Stability

An unstable server interface may prevent the successful retrieval of the encryption string, causing the APP to fail to decode and play videos. It is recommended to:

Implement a retry mechanism for failed API requests in the program;
Use CDN acceleration and caching for the encryption string and other infrequently changed configurations to ensure high availability;
Set up a backup interface; when the primary interface request and retries all fail, call the backup interface.

3. Reinforce the APP

For companies with high security requirements, the APP can be reinforced to prevent reverse engineering and source code leakage, which could lead to the exposure of account and user privacy data. There are many products available on the market for APP reinforcement.

Video-on-Demand Product