Advanced Download Token Authentication Script

I have a file download website. I have a download script right now, but it's not very secure. Some of the files are large (3-4gb), so running the file through PHP to hide the url address won't work with 100,000k+ users. We've tried that. I'm using SLIM, PHP, Litespeed. My current download script uses tokens to redirect to the direct download url, but after that the url is exposed. I'm also using htaccess 403 protection to prevent direct access but there is no "real" token system in place. My script also checks ip address to prevent users from downloading too many files at once, but this doesn't work too well either. 1. I want a real token system applied to the download url that cannot be found or scrapped, that is linked to their ip address, whatever and last 15-20 minutes. 2. I want a download management system that will work with huge traffic and lots of requests, preventing files above 500MB from being downloaded concurrently (no more than 2 files concurrently. I've been told there's a possibility of using running the downloads through litespeed and htaccess to hide the url and use a real token system to verify.