This topic covers the content protection and Digital Rights Management (DRM) options that are supported by Video Cloud.
Types of protection
Brightcove offers varying levels of protection for your content:
Access restrictions
Video Cloud provides several access restriction features that can be used to ensure that content is only played back from an authorized account and also to ensure content can only be viewed in specific geographies. These features include:
URL tokenization
URL tokenization restricts access to a resource (e.g., video rendition) by validating a “token” or similar key-value appended to the URL. The CDN (or similar system) is responsible for validating this token (generated by the player or some other mechanism), which may represent logical business rules (e.g., blanket access, geographic restrictions, IP whitelisting, file/folder access, etc.). URL tokenization is considered a simplistic approach as it is focused on video access, not the delivery of content. There is no requirement that the content itself is encrypted.
Geo-restriction of content
Video Cloud provides a geo-restriction feature that restricts access to content based on the viewer's geographic location. Geo-restrictions can be set for videos. Geo-restriction is available to Pro and Enterprise publishers for an additional fee. Contact Brightcove if you want to upgrade your account to include geo-restriction.
Basic Content Protection
Basic content encryption involves encrypting the transmission of the video stream or video packets as they are transferred over the wire. Video Cloud supports several basic content protection options:
HLS Encryption
HTTP Live Streaming (HLS) is an adaptive streaming protocol created by Apple to communicate with Macs and iOS devices. HLS encryption provides a base-level of protection against ripping of streams. The most basic implementation of HLS encrypts the media segment files and places the decryption key directly in the manifest file. If a user has access to the HLS manifest, decrypting the underlying stream is trivial. Additional schemes have been created that do a better job of hiding the key, for example, hard coding the decryption key in an application, or only allowing a single access to retrieve the key from a URL. However, HLS encryption should not be considered secure. It provides a minimal level of security over clear streams.
To learn more about protecting your content using HLS Encryption, see Protecting Videos on Devices with HLS Encryption and Content Security (DRM and HLSe) for information on how to set up HLS encryption in your custom ingest profiles.
RTMPE and SWF Verification
Real Time Messaging Protocol (RTMP) is a proprietary protocol owned by Adobe for streaming audio, video and data over the Internet between a Flash player and a server. There are several variations of RTMP, one being RTMPE, which uses Adobe's own security mechanism to wrap RTMP sessions in an encryption layer. SWF verification is a security feature in Adobe Flash Media Server that allows you to directly control which SWF files can connect to a video for streaming. It ensures that the SWF connection request is coming from the expected source, which in this case is a "certified" Brightcove player.
To learn more about protecting your content using RTMPE and SWF Verification, see Protecting Video Streams with RTMPE and SWF Verification.
DRM
Approach to DRM
Video Cloud offers broad support for DRM:
- Comprehensive support for packaging, license serving and playback
- Adaptive use of the appropriate DRM for a given device:
- Video Cloud favors native device DRMs to minimize dependency on plugins
- Video Cloud leverages standards to reduce the number of renditions necessary to deliver a cross-platform solution
Video Cloud also supports AES encryption (called HLSe). While not DRM, it’s a form of protection frequently used on platforms where DRM is not supported or where full DRM is not required
Information on adding HLS encryption to HLS renditions in your ingest profiles can be found here.
If you are interested in enabling HLSe for your account, contact your Account Manager.
Delivering DRM to Different Device Types
Desktop browsers
DRM for browsers is for desktop only. Brightcove uses MPEG-DASH and common encryption together with Widevine Modular and Microsoft PlayReady to provide DRM on the desktop. This provides a single set of assets that can be played across different browsers while leveraging the native DRM that is available with modern browsers.
DRM packages are created during the process of ingesting your videos into Video Cloud. DRM packages are defined in custom ingest profiles. For information on specifying DRM packages in an ingest profile, see Content Security (DRM and HLSe).
To discuss enabling your account for DRM, contact your Account Manager.
iOS and Android applications
The current Video Cloud DRM solution for iOS and Android devices is Widevine Classic.
DRM packages are created during the process of ingesting your videos into Video Cloud. DRM packages are defined in custom ingest profiles. For information on specifying DRM packages in an ingest profile, see Content Security (DRM and HLSe).
To discuss enabling your account for DRM, contact your Account Manager.
Other devices
MPEG-DASH is supported by many devices, including Android TV and Chromecast. Videos packaged with DRM for the desktop browser can also be played on these devices.
Many consumer electronics devices support an older form of DRM - PlayReady over Smooth Streaming
DRM packages are created during the process of ingesting your videos into Video Cloud. DRM packages are defined in custom ingest profiles. For information on specifying DRM packages in an ingest profile, see Content Security (DRM and HLSe).
Types of DRM supported
Support for DRM depends on the video format, as shown in the following table.
| Video Format | |||||
|---|---|---|---|---|---|
| MPEG-DASH | Smooth | HLS | Other | ||
| DRM type | Widevine Modular |  | |||
| Marlin | | ||||
| Playready | | | |||
| Adobe Primetime/Access[1] | HDS, RTMP | ||||
| Widevine Classic | WVC | ||||
Notes
- [1] /The Brightcove Player does not support Flash Access, just PlayReady and Widevine Modular - Adobe Primetime is for the Smart Player only.
Considerations when using DRM
- If you elect to terminate Video Cloud DRM, newly uploaded videos will not be packaged with DRM protection, and a process will begin to unpack existing DRM-packaged titles one by one. For accounts that terminate DRM protection, previously packaged videos will fail to play until they become unpackaged. After DRM termination, playback will not be impacted for both newly uploaded videos without DRM protection, and for previously DRM-protected videos once they are unpackaged.
- Video Cloud DRM-protected videos may be shared to an account that is not DRM-enabled but only after the non-DRM account is enabled for DRM playback. Contact Brightcove Support to have this done.
- DRM content protected with HDS and Adobe Primetime cannot be previewed in the legacy Studio Media module.
- HLS Encryption follows the same behavior as DRM and Media Sharing - sharees of DRM'ed accounts can playback content, so sharees of HLS Encryption-enabled accounts should be able to play back as well.
- DRM is not supported in Smart players embedding in Flash using the ActionScript publishing code.
- DRM is not maintained on videos distributed to YouTube via Video Cloud Studio distribution.
- We provide anonymous support only. Authentication in Video Cloud is supported via partnership relationships before granting access to DRM-protected content. For more information, contact Brightcove.
- After Video Cloud DRM has packaged and encrypted all renditions for a previously uploaded video, it updates the modified time and date for that video to the time when DRM protection was completed. The date and time when a video is last modified shows as the Last Updated date and time for that video in the Video Cloud Studio Media module, and as the
modified_datein the Media API. - Video Cloud DRM does not allow for setting policies that target new sources of revenue and monetization via Pay-Per-View, rental or other DRM-specific monetization policies. DRM will not impact ad play for videos.
- Remote assets do not officially support DRM protected content.
- It is possible to have multiple content protection schemes within the same account. After your account is enabled for DRM, you should contact Brightcove Support to enable this functionality.
- Adobe Primetime/Access works with the Smart Player only, and does work with Akamai HDS but preview in the Media module and image capture are not supported.