Lab
  • DRM packaging tutorialsCourse
  • 5 things you need to know about multi-DRMCourse
  • Getting started with DoveRunner Anti PiracyCourse
  • Getting started with DoveRunner Forensic WatermarkingCourse
  • Getting started with DoveRunner Mobile App SecurityCourse
  • Getting started with DoveRunner Multi-DRMCourse
  • Getting started with DoveRunner Transcoding & PackagingCourse
  • Packaging content with the DRM CLI PackagerLesson · DRM packaging tutorials
↑↓ Navigate↵ Openesc CloseTop 8 of 33 results
한국어
Start free trial

DRM packaging and the CPIX/SPEKE API

Learn what DRM packaging is, what it outputs, and the ways to do it: packaging tools, encoder/streaming integrations, and the CPIX and SPEKE APIs.

Lesson 47 min

What is DRM packaging?

To protect content with DRM, the content data must be encrypted. The process of encrypting source content (such as an MP4 file) and converting it into the format delivered to end users (such as DASH or HLS) is called DRM content packaging. During packaging, the key used to encrypt the content is passed to the DRM key management server, which manages it securely.

Advanced Encryption Standard (AES) is the standard for encrypting multimedia. Content is encrypted with AES-128 (a 128-bit key), in CTR mode ('cenc' scheme) or CBC mode ('cbcs' scheme) depending on the client environment. (Ref. 1, Ref. 2)

DRM content reaches the user's device (by streaming or download) still encrypted. To play it, the client needs a DRM license containing the encryption key, issued by the DRM license server. The next lesson covers that client-side license integration.

What multi-DRM packaging outputs

The baseline multi-DRM output is two kinds of content, by streaming format and encryption scheme:

  • DASH (cenc): DASH content encrypted under the Common Encryption 'cenc' scheme and protected with PlayReady and Widevine. Plays in browsers such as Chrome, Edge, and Firefox, and on devices that support PlayReady or Widevine (smart TVs, set-top boxes, Android, OTT devices).
  • HLS (FairPlay): HLS content encrypted with SAMPLE-AES ('cbcs' for fMP4) and protected by FairPlay Streaming. Plays on Apple devices and in Safari.

Packaging and delivering the same content as both DASH and HLS is the way to reach the widest range of clients, including older smart TVs and older PlayReady devices.

Option: a single CMAF package

The Common Media Application Format (CMAF) lets DASH and HLS manifests share the same fMP4 segments. Because Widevine, PlayReady 4.0+, and FairPlay all support the cbcs scheme, one CMAF package encrypted with cbcs can serve all three DRMs, cutting storage and CDN cost.

The trade-off is device coverage: cbcs isn't supported on some older smart TVs and on PlayReady clients before 4.0, which still need cenc DASH content. Check DoveRunner's CMAF support table before choosing a single CMAF package.

Ways to package DRM content

Packaging tools

A standalone tool encrypts the source content on the content provider's own systems, in the cloud or on-premises. Common tools:

  • Shaka Packager: an open-source packager started by Google's Widevine team. Supports multi-DRM packaging of DASH/HLS/CMAF for both VOD and live.
  • Bento4: an open-source C++ toolkit with many multimedia features, including DASH/HLS packaging.
  • Dedicated tools from DRM vendors: DoveRunner's DRM CLI Packager is built on Shaka Packager and gets its keys through the CPIX API, so you can package DASH, HLS, or CMAF content with one command.

Encoder and streaming solution integrations

DRM packaging can also be built into commercial encoding or streaming solutions. DoveRunner Multi-DRM works with solutions such as Wowza Streaming Engine (via the DoveRunner Wowza DRM plug-in), Bitmovin Encoder, Dolby Hybrik, ATEME TITAN, and Google Cloud Live Stream API. See the packaging guides for the full list.

CPIX API

Building a separate key exchange for each DRM vendor into each solution means duplicated work for solution vendors. To reduce that, the DASH Industry Forum published the Content Protection Information Exchange Format (CPIX). The latest version is CPIX 2.4.

CPIX defines a standard interface for exchanging the encryption keys needed to apply multi-DRM during packaging, and most current encoders and packagers support it. DoveRunner's CPIX API lets any CPIX-compatible packager get keys from DoveRunner. For example, Flussonic Media Server integrates with DoveRunner this way.

SPEKE API

The Secure Packager and Encoder Key Exchange (SPEKE) API is AWS's key exchange API, built on CPIX. (Ref. 3)

  • SPEKE v1: based on CPIX 2.0, one key for all tracks
  • SPEKE v2: based on CPIX 2.3, multiple keys (for example separate keys for audio, SD, and HD tracks)

DoveRunner supports both versions, and SPEKE connects DRM to these AWS services and products:

Cloud-based packaging service

You can also hand DRM packaging to a SaaS. DoveRunner's Transcoding & Packaging service applies multi-DRM and, optionally, forensic watermarking together. Instead of running transcoding, watermark preprocessing, and DRM packaging yourself, you register the storage where the source video is uploaded, and the service generates DASH/HLS content automatically.

Summary

DRM packaging, which encrypts and protects the source content, is the first step of adopting multi-DRM. DoveRunner Multi-DRM supports every packaging method covered in this lesson, so you can pick the one that fits your environment. Contact us if you want to discuss which method suits you best.