Watermark preprocessing with Transcoding & Packaging

What is watermark preprocessing?

Preprocessing runs during video encoding. It inserts watermark values (0 and 1) into the unencrypted source frames and produces two encoded variants of the same video (A/B). The watermark is encrypted with a secret key unique to each content service provider, so nobody outside can extract it.

You can preprocess in several ways:

• Transcoding & Packaging (TnP) service: DoveRunner's managed service transcodes, preprocesses, and DRM-packages in one job
• Preprocessor library: a C++ library you integrate into your own encoder
• FFmpeg filter: a plug-and-play FFmpeg video filter module
• Hybrik: a preprocessor for the Dolby Hybrik transcoding service

This lesson uses TnP, the easiest option. You don't run any encoder yourself: you register S3 storage, create one job in DoveRunner Console, and get a stream that is both watermark-preprocessed and DRM-protected. See the Watermark Preprocessing guide for the other options.

Before you start

• DoveRunner account: a trial or paid plan for Transcoding & Packaging, Multi-DRM, and Forensic Watermarking
• AWS S3 buckets: in Seoul (ap-northeast-2) or Oregon (us-west-2), with an access key ID and secret key that can read and write them
• Source video: an MP4 file longer than 5 minutes, with H.264 (AVC) or H.265 (HEVC) video and AAC or AC3 audio

1. Choose the service region

Log in to DoveRunner Console and go to Content Security > Transcoding & Packaging > Settings. Set Packaging Service Region to Seoul or Oregon, whichever is closer to the AWS region you use. TnP jobs run in this region. If you need a different region, contact DoveRunner support.

2. Create S3 buckets and upload the source

In your AWS account:

1. Create two S3 buckets in the same region as the TnP service region, one for input and one for output (this lesson uses dr-lab-input and dr-lab-output).
2. Upload the source MP4 to the input bucket.
3. Create an IAM user with read and write access to both buckets, and issue an access key for it.

3. Register input and output storage

In DoveRunner Console, go to Transcoding & Packaging > Storages. Register the input and output buckets with the access key ID and secret key of the IAM user. Both buckets then appear in the storage list with their region.

4. Create the job

Go to the TnP Job Create page. The wizard has six steps.

Step 1: Job type

Select Transcode & Forensic Watermark & DRM. The output is preprocessed for forensic watermarking and packaged with Multi-DRM, so you can use it for both integrations.

Step 2: Input and output

Enter a job name and a content ID, select the input storage and the source video path, then select the output storage.

Output Directory Path is required. Enter a short folder name such as output, even if you don't need extra folder structure. TnP adds the content ID below this folder on its own, so if you type the content ID here, it appears twice in the path.

Step 3: Video

Select DASH and HLS as the streaming formats. TnP proposes an ABR ladder (bitrate and resolution per rendition) based on the source video, and you can keep the defaults for this lesson.

Packaging both formats covers every major browser:

• DASH: Widevine and PlayReady, for Chrome and Edge
• HLS: FairPlay, for Safari

CMAF can cover all three DRMs in a single package, but that setup is covered in a separate tutorial.

Step 4: Audio and captions

TnP detects the tracks inside the source file. For a single MP4 with one AAC track, select the language of that track (for example, English).

Step 5: DRM options

Leave Audio Track Encryption, Multi-Key, and Multi-Manifest disabled and Clear Lead at 0 seconds. These advanced options are covered in later lessons.

Step 6: Review and start

The review screen shows every setting from the previous steps. Check it, then select Start Job.

5. Track the job

The job appears in Job History with a job ID right away. Its status moves from Queued through transcoding, segmenting, and copying, and you can follow each stage on the job detail page.

6. Check the packaged output

When the job finishes, open the output bucket in the S3 console. The output is stored under this path:

wm-contents/
└── <Output Directory Path>/
    └── <content ID>/
        ├── 0/
        │   ├── dash/stream.mpd
        │   └── hls/master.m3u8
        └── 1/
            ├── dash/stream.mpd
            └── hls/master.m3u8

The 0 and 1 folders are the two watermark variants (A/B), and each contains a DRM-packaged DASH and HLS stream. In the next lesson, these variants are combined per viewer session to embed the watermark at delivery time.

For the full content security integration, see DoveRunner Docs.