Show search and navigation.

 

Studio Digital Rights Management (DRM)

Studio DRM allows you to control how and when customers may consume content with minimal changes to your existing workflow. Studio DRM provides the capability to:

DRM Solutions

Protect your digital media using one or more of the following DRM solutions:

Basic Setup

Setting up Studio DRM consists of the following steps:

  1. Studio DRM Activation

    Contact your account manager to activate Studio DRM on your account.

  2. Apple FairPlay Streaming (FPS) Only

    1. Register as a licensed content owner with Apple.
    2. Submit your FPS deployment package information via the CMS.

  3. Studio DRM

    Protect your content by enabling the Require studio approved DRM for playback and the Require a token for playback options on the desired live events, live channels, and CMS assets (as indicated below).

    Type DRMRequire studio approved DRM for playback option

    TokenRequire a token for playback option (Signed playback URLS)

    Live Event

    Live Channels

    CMS AssetsCMS assets that were encoded prior to Studio DRM activation will need to be re-ingested. (Non-slate)

    CMS Assets (Slate for Live Event or Live ChannelsDASH Only: Slate encoded prior to Studio DRM activation must be re-ingested. Additionally, disable encryption on slate via cleardash to ensure optimal performance.)

    Learn more.

     

     

  4. Studio DRM Policy

    Define a Studio DRM policy, which determines the conditions under which content may be played, via the playback URL's query string.

    Use a Studio DRM policy configuration and/or the parameter expansion capability to obfuscate your Studio DRM policy.

  5. Media Player Setup

    Configure your media player to:

    • Point to a signed playback URL for the desired live event, live channel, or CMS asset. This playback URL should include a query string that defines a Studio DRM policy.
    • Acquire a license from our license servers.

Requirements

Basic requirements are listed below.

Requirements Description

Studio DRM

Please contact your account manager if Studio DRM has not been activated on your account.

Live Slicer

Version 18052400 or higher

Live Events

Live Channels

CMS Assets

Require Studio DRM and signed playback URLs.

Disable Studio DRM and signed playback URLs on slate.

Only CMS assets that were encoded after Studio DRM activation may be secured via Studio DRM.

Please use one of the following DRM platforms / clients:

DRM Platform

ABSAdaptive Bitrate Streaming

Encryption Method

Recommended Clients

Apple FairPlay Streaming

HLS

AES-128 CBCS

iOS

Apple TV

Safari on macOSRequires macOS 10.10.3 and later.

Google Widevine DRM

MPEG-DASH

AES-128 CENCCommon Encryption

Android

Chrome

Chromecast

Firefox

Shaka Player

Exoplayer for Android

Bitmovin 8.0.1

View a complete listing.

Microsoft PlayReady

MPEG-DASH

AES-128 CENC

WindowsWindows 10 support via Windows SDK, UDP, or a web app in Microsoft Edge 16 or higher; Windows 8/8.1 support via Windows SDK; Windows 7 support via Silverlight.

Roku

Xbox One

View a complete listing.

How Does It Work?

By default, encryption is applied to all video content regardless of whether Studio DRM will be enforced. Playback of encrypted HLS/DASH content requires decryption using the Content Key through which it was encrypted. Typically, this key is securely communicated to the media player by signing the playback URL. However, this key is handled in cleartext by both the viewer's platform and player/client. As a result, it is vulnerable to compromise.

Studio DRM applies an additional level of protection by requiring a player to request a license. A license contains an encrypted Content Key and it allows the publisher to apply security policies that determine the conditions under which the content may be played. By preventing a player from directly requesting a Content Key, it allows the key exchange to typically take place in a Trusted Execution EnvironmentIdentifies a secure area in the main processor that runs parallel to the OS. This ensures confidentiality and integrity for the data loaded in this environment. (TEE). This makes it more difficult for an attacker to gain access to keys.

Ingest

Studio DRM does not introduce changes into the workflow for ingesting live or on-demand content.

Playback

Playback of Studio DRM-protected content requires the viewer's player/client to request a license from our license servers. The workflow for HLS and DASH are described below.

Basic HLS Workflow (Apple FairPlay Streaming)

ClosedLearn more.

  1. Player requests SPC message from our license server.

    Details:

    1. The player requests a manifest file in response to a request to play encrypted HLS content.
    2. Our system responds with the requested manifest file.
    3. The player requests a key from the operating system.
    4. The operating system returns an encrypted SPC message to the player.
    5. The player then submits this SPC message to our license server.
  2. Our license server identifies the Studio DRM policy for the requested content and then forwards the request, including the Studio DRM policy, to a FPS key server.
  3. If the client satisfies this policy, then the FPS key server will send an encrypted CKC message that contains the key to the player via our license server.
  4. The player then passes this CKC message to the OS to initiate playback.

Basic DASH Workflow (Google Widevine and Microsoft PlayReady)

ClosedLearn more.

  1. In response to a request to stream Studio DRM-protected content, the player submits a license request to our license server.

    Details:

    1. The player requests a manifest file in response to a request to play Studio DRM-protected content.
    2. Our system responds with the requested manifest file.
    3. In response to the manifest file, the player generates a license request and submits it to the platform security layer (e.g., MediaDRM or Encrypted Media Extensions).
    4. The platform security layer returns license request data to the player. The player will leverage this data to submit a license request to our license servers.
  2. Our license server identifies the Studio DRM policy for the requested content. If the player satisfies this policy, then a Widevine/PlayReady license will be generated and then forwarded to a Widevine or a PlayReady license server.
  3. The Widevine or PlayReady license server will then encrypt the license and then deliver it to the player via our license server.
  4. The player may then leverage this license to initiate playback.
More Information