Use these settings to minimize the information your website shares with clients and protect your infrastructure from unauthorized access or malicious threats.

Deployment Network Template

To secure content over HTTPS, Akamai offers two distinct security levels: Standard TLS and Enhanced TLS.

Standard TLS

Enabled by default, standard TLS uses a Level 1 (L1) certificate for secure HTTPS delivery. It is SOX and ISO compliant, but doesn't meet PCI or FedRAMP standards. Use it for general web traffic, public sites, and content that doesn't exchange Personally Identifiable Information (PII).

Standard TLS uses the edgesuite.net suffix for edge hostnames.

Enhanced TLS

Enhanced TLS uses a Level 3 (L3) certificate network engineered for high-assurance security requirements. It's fully PCI and FedRAMP compliant, which makes it best for sites handling sensitive data like PII, e-commerce transactions, or financial data. It also supports specialized non-SNI configurations for older legacy clients that don't send TLS SNI headers.

Enhanced TLS uses the edgekey.net suffix for edge hostnames.

Segmented Media Protection

This setting protects access to your media stream and provides confidentiality. These security solutions are implemented on-the-fly during content delivery via an Adaptive Media Delivery (AMD) configuration to prevent unauthorized access, duplication, and theft of your media streams.

Token Authentication (common for all formats)

Only end users that have been properly authenticated can access your streams. This is accomplished by generating, exchanging, and verifying shared secret tokens between AMD and the end-user's player.

If enabled, specify the following:

• Primary key. It's a hexadecimal value to serve as a "trusted shared secret." Comprise it of an even number of characters, but don't exceed 32 total characters. For example, "eee7e9157f81b2f6d471bf2c". You can also click the cycle button to automatically generate a proper value. Make note of this value. You use this value as the Key when generating the token.

• Advanced Options that includes:

  • Request Headers for Session Token Salt. Includes additional end-user-specific configurations to strengthen the relationship between the session token and playback session. These configurations are communicated via a salt value that AMD generates using various request headers that you specify here.

  • Field Carry-Over. Enables the security controls and fields you want to be carried over from the access token into the session token. These allow for better access control and analysis.

    • Session-Id. Carries over the session_id from the access token to the session token. This allows for tracking and counting unique playback sessions for a URL that is protected by a session token.
    • Data/Pyload. Carries over information from the data/payload field in the access token to the session token.
    • IP. Carries over the ip field from the access token to the session token. This limits access to requesting client access to the specific ip address included in the token.
    • ACL. Carries over the acl field from the access token to the session token. This limits requesting client access to the specific URL or path set in the acl field.

• Token Authentication Additions for HLS. Enable Token in URI to enter the names of relevant manifest files in the Master Manifest Files field. You can add or remove filenames as necessary.

• Token Authentication Additions for DASH. Enable Token in Query String to pass tokens in query strings, as an alternative to cookies.

• Token Based Access Revocation. Generates a "revocation list" of specific Token Authentication tokens to block access requests that include them. This helps to prevent token sharing between end users. To learn more, see Token Based Access Revocation.

To learn more, see Token Authentication with AMD.

Media Encryption

This encrypts your content and provides secure access keys to end users. Ideally, you should also use Token Authentication to ensure these secure keys are only delivered to end users that have also been authenticated.

• HLS Encryption. Adds media encryption to your AMD configuration to encrypt HLS-format segments.
• DASH Encryption. Adds media encryption to your AMD configuration to encrypt DASH-format segments.

To learn more, see Media Encryption with AMD.