DRM Back-to-Basics
Selecting and Implementing the Right
Premium Content Protection
Who are we? Juan Martinez
Sr Product Manager, Irdeto
Amsterdam, Netherlands
Paul MacDougall
Solutions Architect, Bitmovin
New York, New York
Kieran Farr
VP Marketing
San Francisco, California
© 2018 Irdeto. All Rights Reserved. – www.irdeto.com
We protect our clients’ business and brand by
securing their digital assets, platforms and
applications.
© 2018 Irdeto. All Rights Reserved. – www.irdeto.com
Irdeto Rights customers
Deployments in 6 continents
Over 500 Million licenses delivered monthly
Hundreds of thousands of content protected
DRM Pain Point
● DRM is required to protect monetization models from copyright
infringement by both casual and sophisticated actors
● DRM can be complex due to challenges implementing
integrations and reaching a highly fragmented market
● Today, we propose multi-DRM as a short term solution, and
CMAF as a long term solution.
Webinar Agenda
● Introductions
● Who are you?
● What is the state of DRM today?
○ Overview of today’s workflows & challenges
○ Recent changes, offline DRM, etc
○ Example
● Changes coming to common workflows with CMAF
○ What does this mean for me?
○ Avoiding pitfalls in implementing CMAF workflows
○ Example
● What are the next steps?
● Questions?
Registration survey results
DRM Workflows Today
How Does DRM
Work?
The video content is
encrypted with a content key
System generates license
files to accompany the
content
System allows playback for
an authenticated user and
device
Implementing a
DRM Workflow
End user application
Authenticates with
Provider. Entitlement
server defines the
content the user is
entitled to watch
Your
Entitlement
Server
License
Server
End User
Implementing a
DRM Workflow
End user requests to play
content.
Your
Entitlement
Server
License
Server
End User
Implementing a
DRM Workflow
End user application
requests a license for a
particular content
Your
Entitlement
Server
License
Server
End User
Implementing a
DRM Workflow
Key is given to End User,
playback is permitted
Your
Entitlement
Server
License
Server
End User
DRM Technologies
by Provider
Widevine Modular
PlayReady
Fairplay
Widevine Modular
DRM Overview
Widevine Modular (successor to Classic)
● Google’s DRM - Extensive support for Google
ecosystem
● Supports DASH with CENC
● Supports Hardware Security (TEE)
● Can limit content quality server-side
● Rights expression/policy enforcement
● Uses AES CTR
PlayReady DRM
Overview
Microsoft PlayReady
● Microsoft DRM - broad platform support,
including many smart TVs
● Most robust rights management
● Pre-cache licenses (fine grain sunrise and
sunset of keys)
● Uses AES CTR
FairPlay DRM
Overview
Apple Fairplay
● No rights expression or policy enforcement
● Needs Key Security Module on Key Server
● Needs code to relay key requests
● Uses AES CBC
© 2018 Irdeto. All Rights Reserved. – www.irdeto.com
DRM fragmentation
Google
Widevine
Microsoft PlayReady
Apple FairPlay
SmartTV’s
Set Top
Boxes
For use in China
19
2017 Video Developer Survey | DRM Systems
Putting it All Together
© 2018 Irdeto. All Rights Reserved. – www.irdeto.com
22
Irdeto Control – Simpler integration
Operator
Irdeto ControlContent ID,
Encryption
Keys
Policies
CDN
LicensesKey Management
Multi-DRM License Servers
Content Usage Control
Authentication
+ Entitlements
Pre-integrated with
leading encoders /
packagers Available as hosted or
licensed solution
Player / Device
Multi-DRM
Maximum device reach
● Traditional (before DASH) Multi-DRM setups
need to encrypt and package the content for
each DRM separately
● DASH CENC/EME - allows key association
from different DRM’s with the same video
● Except for Apple (FairPlay with HLS on
devices & in Safari)
Recent Changes
Recent Changes
● CMAF allows a common set of encoded
video files to be used by multiple platforms
● Google and Microsoft have announced
support for CBC encryption in the Widevine
and Playready CDMs
● Offline DRM
DRM Workflows with CMAF
Current
AVC/h.264
HLS DASH
FairPlay
PlayReady,
Widevine, etc.
Apple Users Everyone else
AES-128 CBC AES-128 CTR
Separate video files on
storage/CDN
CMAF
AES-128 CBC
AVC/h.264
HLS DASH
FairPlay
PlayReady,
Widevine, etc.
Apple Users Everyone else
Only manifests (.m3u8 &
.mpd), small text files, are
replicated on storage and
CDN
Wrapping it up
● DRM is required (in many cases)
● DRM can be complex
● Multi-DRM is the current reality
● CMAF as a long term solution to simplify workflow
How do I get started?
● Start quickly using Bitmovin Encoding + Player + Irdeto
● Contact us for a free trial:
https://goo.gl/91HG5F (will also be shared via email)
○ fully-featured API integration
○ easy to build flexible and customizable workflows
○ maximum device and browser coverage
Q&A

DRM Basics With Irdeto and Bitmovin

  • 1.
    DRM Back-to-Basics Selecting andImplementing the Right Premium Content Protection
  • 2.
    Who are we?Juan Martinez Sr Product Manager, Irdeto Amsterdam, Netherlands Paul MacDougall Solutions Architect, Bitmovin New York, New York Kieran Farr VP Marketing San Francisco, California
  • 4.
    © 2018 Irdeto.All Rights Reserved. – www.irdeto.com We protect our clients’ business and brand by securing their digital assets, platforms and applications.
  • 5.
    © 2018 Irdeto.All Rights Reserved. – www.irdeto.com Irdeto Rights customers Deployments in 6 continents Over 500 Million licenses delivered monthly Hundreds of thousands of content protected
  • 6.
    DRM Pain Point ●DRM is required to protect monetization models from copyright infringement by both casual and sophisticated actors ● DRM can be complex due to challenges implementing integrations and reaching a highly fragmented market ● Today, we propose multi-DRM as a short term solution, and CMAF as a long term solution.
  • 7.
    Webinar Agenda ● Introductions ●Who are you? ● What is the state of DRM today? ○ Overview of today’s workflows & challenges ○ Recent changes, offline DRM, etc ○ Example ● Changes coming to common workflows with CMAF ○ What does this mean for me? ○ Avoiding pitfalls in implementing CMAF workflows ○ Example ● What are the next steps? ● Questions?
  • 8.
  • 9.
  • 10.
    How Does DRM Work? Thevideo content is encrypted with a content key System generates license files to accompany the content System allows playback for an authenticated user and device
  • 11.
    Implementing a DRM Workflow Enduser application Authenticates with Provider. Entitlement server defines the content the user is entitled to watch Your Entitlement Server License Server End User
  • 12.
    Implementing a DRM Workflow Enduser requests to play content. Your Entitlement Server License Server End User
  • 13.
    Implementing a DRM Workflow Enduser application requests a license for a particular content Your Entitlement Server License Server End User
  • 14.
    Implementing a DRM Workflow Keyis given to End User, playback is permitted Your Entitlement Server License Server End User
  • 15.
    DRM Technologies by Provider WidevineModular PlayReady Fairplay
  • 16.
    Widevine Modular DRM Overview WidevineModular (successor to Classic) ● Google’s DRM - Extensive support for Google ecosystem ● Supports DASH with CENC ● Supports Hardware Security (TEE) ● Can limit content quality server-side ● Rights expression/policy enforcement ● Uses AES CTR
  • 17.
    PlayReady DRM Overview Microsoft PlayReady ●Microsoft DRM - broad platform support, including many smart TVs ● Most robust rights management ● Pre-cache licenses (fine grain sunrise and sunset of keys) ● Uses AES CTR
  • 18.
    FairPlay DRM Overview Apple Fairplay ●No rights expression or policy enforcement ● Needs Key Security Module on Key Server ● Needs code to relay key requests ● Uses AES CBC
  • 19.
    © 2018 Irdeto.All Rights Reserved. – www.irdeto.com DRM fragmentation Google Widevine Microsoft PlayReady Apple FairPlay SmartTV’s Set Top Boxes For use in China 19
  • 20.
    2017 Video DeveloperSurvey | DRM Systems
  • 21.
  • 22.
    © 2018 Irdeto.All Rights Reserved. – www.irdeto.com 22 Irdeto Control – Simpler integration Operator Irdeto ControlContent ID, Encryption Keys Policies CDN LicensesKey Management Multi-DRM License Servers Content Usage Control Authentication + Entitlements Pre-integrated with leading encoders / packagers Available as hosted or licensed solution Player / Device
  • 23.
    Multi-DRM Maximum device reach ●Traditional (before DASH) Multi-DRM setups need to encrypt and package the content for each DRM separately ● DASH CENC/EME - allows key association from different DRM’s with the same video ● Except for Apple (FairPlay with HLS on devices & in Safari)
  • 24.
  • 25.
    Recent Changes ● CMAFallows a common set of encoded video files to be used by multiple platforms ● Google and Microsoft have announced support for CBC encryption in the Widevine and Playready CDMs ● Offline DRM
  • 26.
  • 27.
    Current AVC/h.264 HLS DASH FairPlay PlayReady, Widevine, etc. AppleUsers Everyone else AES-128 CBC AES-128 CTR Separate video files on storage/CDN
  • 28.
    CMAF AES-128 CBC AVC/h.264 HLS DASH FairPlay PlayReady, Widevine,etc. Apple Users Everyone else Only manifests (.m3u8 & .mpd), small text files, are replicated on storage and CDN
  • 29.
    Wrapping it up ●DRM is required (in many cases) ● DRM can be complex ● Multi-DRM is the current reality ● CMAF as a long term solution to simplify workflow
  • 30.
    How do Iget started? ● Start quickly using Bitmovin Encoding + Player + Irdeto ● Contact us for a free trial: https://goo.gl/91HG5F (will also be shared via email) ○ fully-featured API integration ○ easy to build flexible and customizable workflows ○ maximum device and browser coverage
  • 31.

Editor's Notes

  • #3 I’d like to start by introducing our guests. With me today are two experts in both video encoding and codec research: Juan bio: Juan Martinez is responsible of the OTT media protection products at Irdeto and has extensive experience in the introduction of new technologies as digitalization of TV, HD and 4K, as well as large OTT deployments. Juan has been working in global electronics and telecommunication businesses since 1999 for companies including Phillips, Liberty Global, and Acision, before joining Irdeto. (Amsterdam) Paul MacDougall - Paul is a Solutions Architect with Bitmovin. He has been live streaming video on the internet for over a decade, pioneering production and delivery techniques for fashion and sports sectors, and helping customers plan and implement video monetization workflows using both subscription models and advertising based solutions. (New York)
  • #4 Bitmovin is a provider of developer products to solve complex video problems. We have 3 primary products: a video player, video encoding and video performance analytics. Our software can be used through our API cloud offering, or on premise or in your own cloud using our containerized instances. We’re in 4 continents and growing quickly with top tier customers like the New York Times, Sling and Red Bull Media and the proud winner of a number of technology innovation awards.
  • #5 Irdeto protects their clients’ business and brand by securing their digital assets, platforms and applications. Irdeto’s products serve a wide range of industries from media & entertainment to connected transport and IoT connected industries.
  • #6 Irdeto is an international company with deployments across 6 continents with over 500 MM licenses delivered monthly.
  • #20 All this means that the DRM market has become increasingly fragmented and confusing for operators who want to reach the widest possible audience. Today we have a picture that’s constantly changing but looks something like this: There’s Widevine from Google….that’s supported by many leading browsers and devices. And Microsoft’s PlayReady…which is also widely supported 3. And if you want to reach Apple Devices you’ll need Apple FairPlay... You’ve also got legacy Flash players and Firefox that work with Adobe’s PrimeTime DRM and still some support for Marlin DRM, particularly on Set top boxes. 4. And if you want to reach consumers in China, you’ll need China DRM. Packaging, encrypting, and storing different versions of content for all these different solutions is a major overhead for Operators. Delivering different licenses to different devices is also complex. 5. One solution is MPEG DASH – an ISO standard that aims to simplify things for operators.
  • #21 From the developer report, 27% report DRM as one of the biggest pain points, Full report - https://bitmovin.com/video-dev-report/ Q: Which DRM system do you use? We see that 35% of the video developers apply some form of content protection on the streams they deliver. Whether using basic encryption, like AES-128, or Hollywood-grade DRM (Digital Rights Management) protection, like Widevine Modular and Microsoft Fairplay, content security is a necessary part of today’s video streaming business. MPEG-DASH has significantly complexities of implementing a multi-DRM workflow, applying the right DRM schema to fit the end-user device and browser.
  • #23 JWT token for authentication https://jwt.io/
  • #24 If you want to achieve maximum device reach it’s impossible to use just one DRM. MPEG-CENC is a huge improvement on the traditional Multi-DRM model as it prevents duplication by avoiding the need to create one output package for each DRM.
  • #28 CBC = Cipher Block Chaining CTR = Counter
  • #31  Irdeto can get you setup in 24 hours with an evaluation agreement
  • #32 Thanks for joining us for “DRM Back-to-Basics”