The EU, BPI France and Région Bretagne awarded the collaborative project “FireCache” to Broadpeak, Almond and the University of Rennes in the context of the call for project “i-Démo régionalisé” (https://inno-avenir.bretagne.bzh/i-demo-regionalise/). The project has been kicked off in October 2025.
Objectives of the project
The project aims at building high-performance security and anti-piracy solutions for video streaming Content Delivery Networks (CDNs). The project builds around the following three objectives:
- Build a high-performance security and anti-piracy firewall for CDNs: The project designs and implements security and anti-piracy solutions for Broadpeak CDNs and third-party CDNs. The objective if to build a scalability, energy efficient and easy to integrate solution providing countermeasures that meets the challenges posed by pirates. This approach allows to scale streaming, security and anti-piracy at the same time, reduce infrastructure and operational costs. One approach consists in integrating anti-piracy and security directly into the engine of Broadpeak’s CDN caches (https://edgepeak.broadpeak.tv/ ), thereby minimizing the overhead and cost of additional calculations and allowing to utilize existing hardware as much as possible instead of deploying new one. Many video-streaming deployments being multi-CDN, the project also investigates the techniques and methods that can be deployed with third party CDNs, thereby providing an over-arching and comprehensive approach to security and anti-piracy.
- Provide CDN monitoring and supervision for security and anti-piracy: The project aims at building supervision, monitoring and control systems building upon anomaly detection and AI to discover, detect and highlight new suspect pirate patterns in video streaming. The centralized supervision tools and dashboards also provide actionable controls to act (block, deter…) piracy or security issues.
- Extend a Cyber Range infrastructure and attack emulation platform: The project will extensively test and validate the proposed solution. Therefore the project relies on the Almond Cyber Range M&NTIS platform (https://mantis-platform.io/). By extending this platform and ease the creation of any topology (typically CDN-like topologies) and attack and piracy scenarios on the CDN, the project can validate the technical approach and countermeasures proposed by the project.
How to achieve the objectives?
High performance CDN caching engine augmented with anti-piracy and security
Broadpeak has developed a new generation of cache servers which is now included in Broadpeak’s CDN products: AdvancedCDN (https://broadpeak.tv/our-solutions/advanced-cdn/) and Edgepeak (https://edgepeak.broadpeak.tv/). The software stack of the CDN cache has been completely redesigned from scratch and in particular a new high-performance cache engine has been developed. The architectural choices made during the implementation were driven by the characteristics of the underlying hardware (CPU, memory, disks…).
This allowed Broadpeak to build the highest density CDN cache on the market: for a given hardware platform, the CDN cache can process more simultaneous streaming sessions for the same energy consumption than any other caching engine. Broadpeak has demonstrated that we can serve up to 1 Tbps per server.
The project will leverage this software stack to add security and anti-piracy features directly into the CDN engine while continuing to apply the same architectural principles. The new features will therefore benefit from performance gains and not interfere with CDN caching. Features, such as WAF, log parsing, intelligent metric and event counting or firewalling that would often run on separate processes next to the caching server are directly integrated and do not compete for the underlying hardware resources.
Anti-piracy and security with multiple CDNs
The project will investigate several techniques and solutions to add security and anti-piracy to third party CDN edge caches. Being third party, the core cache engine cannot be modified and the security and anti-piracy solution must be deployable at strategic yet non-intrusive locations of the video-streaming workflow. Such locations might be upstream locations such as shield caches or downstream in front of edge caches as a filtering element.
One approach is to rely on Direct Server Return approaches where only one-directional traffic traverses a particular network element capable of processing and analyzing it for security and anti-piracy purposes. The WIDE team at IRISA, University of Rennes, will tackle key issues for infrastructures using Direct Server Return (DSR), particularly in CDNs and distributed architectures requiring efficient network traffic management.
The IRISA WIDE team has developed a new approach to DSR, introducing specialized intermediate nodes in the processing chain. This work lead to a publication to the highly renowned Usenix NSDI conference. The project will leverage this new approach to DSR to fully exploit its advantages in terms of load balancing, reducing bottlenecks, and optimizing network performance.
Monitoring and supervision
The project will draw on data collected from CDN access logs and aggregated counters reported by security components included in the cache engine. Based on this data, the project proposes aggregation and visualization methods that enable a operation center to monitor and track CDN activities and, if necessary, conduct manual investigations or trigger actions such as filtering a set of IP addresses, tokens or accounts.
The project will rely on unsupervised learning and inference that is either run centrally on the supervision platform and/or in a distributed manner integrated into the CDN engines in order to respond more quickly and directly to attacks and piracy. In this context, the project will study and implement methods for analyzing access logs to try to detect anomalies and potential new families of attacks on the video CDN, such as detecting abnormal HTTP request patterns within a streaming session or suspicious usage patterns related to token renewal.
Cyber Range infrastructure and attack emulation platform
Almond has developed the M&NTIS platform (https://mantis-platform.io/), an adversary simulation and information system simulation solution based on Cyber Range technology. The M&NTIS Platform aims to address the challenges of cybersecurity investments (products, service providers, internal teams, and architecture choices) by measuring the effectiveness of solutions and identifying areas with low cybersecurity maturity, and therefore at risk.
Following the Infrastructure as Code principle, the information system simulation engine allows users to input a formalization of the information system architecture and instantiate the simulated IS in a reproducible manner, thereby simplifying the work of fine-tuning the IS within the Cyber Range. The adversary emulation engine enables the implementation of complex attack scenarios by implementing the cyber kill chain concept and relying on a catalog of unit attacks classified according to the MITRE ATT&CK framework. This adversary emulation engine automatically executes scenarios, ensuring consistency in the sequence of unit attacks.
This M&NTIS platform will be made available to partners to enable them to test, qualify, and validate the effectiveness of the security and anti-piracy measures developed. In particular, the platform will simulate a CDN content distribution infrastructure in order to deploy the solutions developed as part of the project and measure its performance. The M&NTIS platform will also be enhanced as part of the project to enable the rapid construction of threat scenarios for testing the target solution.
About the consortium
Broadpeak is a SME specializing in CDN and video streaming. Broadpeak enables streaming platforms and broadband service providers to stream at scale and monetise without limits. More than 200 companies trust Broadpeak to bring the most-loved live sports, news, and entertainment content to over 250 million people across 50 countries. Broadpeak pioneers the highest performance video delivery and advertising technologies to increase quality of experience, improve subscriber loyalty, and grow new revenues.
Broadpeak is the project leader and contributes technical and industrial expertise in CDN, video streaming, servers and virtualization, and high-performance systems. The project will build upon the software stacks included Broadpeak’s CDN products (AdvancedCDN and Edgepeak/HPC).
Almond is a medium-sized company specialized in cybersecurity and information systems. Almond is an agile, high-performance “one-stop-shop”, offering combined expertise in cyber, cloud and infrastructures. In particular, Almond provides technical expertise in security, auditing, and testing. Almond acquired Amossys in 2023.
In the project Almond will provide its Cyber Range solution M&NTIS (https://mantis-platform.io/) – an emulation and security testing platform – to evaluate the security and anti-piracy features developed in the project.
The University of Rennes, through IRISA’s WIDE team, contributes cutting-edge technical expertise in the field of operating systems and distributed learning. In particular, the WIDE team brings its experience in building an application-based Direct-Server-Return (DSR) solution. The WIDE team also contributes its ability to communicate and disseminate knowledge, particularly through academic conferences.
Sponsors and financing institutions
The project is supported and accompanied by the pole Images&Réseaux.
The project received the financial support of the EU, Région Bretagne and BPI France.
