When you watch a film on a subscription platform, the video reaching your device is encrypted. The player can decrypt it only after obtaining a licence from a server, and only inside a controlled environment. This set of technologies goes by the name of DRM (Digital Rights Management). Understanding how it works is useful to anyone building video services, to anyone choosing a platform for paid courses or content, and to anyone who simply wants to know why a video plays on one device and not on another.
Encryption and DRM are not the same thing
It helps to separate two levels.
- Plain encryption: video segments are encrypted with a key, and the player downloads it from an address. HLS, for example, provides AES-128 segment encryption. It protects content in transit, but anyone who obtains the key can decrypt everything.
- DRM: the key is never handed to the application in the clear. It is issued inside a licence that only a protected module on the device can open, with rules on duration, permitted resolution and authorised devices.
The main systems
| System | Developer | Where it is found |
|---|---|---|
| Widevine | Chrome, Firefox, Android, many smart TVs | |
| FairPlay | Apple | Safari, iOS, iPadOS, macOS, Apple TV |
| PlayReady | Microsoft | Edge, Windows, Xbox, many smart TVs |
No single system covers every device. This is why a service wanting to reach everyone must support at least two or three.
Common encryption: CENC
Encrypting the same video three times, once per system, would be costly. The Common Encryption standard (CENC) defines a shared way of encrypting fragmented MP4 files: content is encrypted once and each DRM system supplies its own licence for the same key. There are two main schemes, cenc (AES in CTR mode) and cbcs (AES in CBC mode with pattern-based partial encryption); the latter is the one FairPlay also supports, and together with the CMAF format it lets you serve every device from a single set of segments.
The path of a playback
- The player downloads the manifest, which states that the content is encrypted and with which systems.
- The player determines which DRM system is available on the device.
- The DRM module generates a licence request containing information about the device.
- The request reaches the licence server, normally via the publisher's service, which checks whether the user is entitled to watch the content.
- The server returns a licence with the encrypted key and the usage rules.
- The DRM module decrypts the segments and passes them to the decoder, ideally without the clear video ever being accessible to the rest of the system.
EME: DRM in browsers
In browsers, the link between the web page and the DRM module goes through the Encrypted Media Extensions (EME), an interface standardised by the W3C. The player's JavaScript code never sees the keys: it merely passes messages between the module, called a CDM (Content Decryption Module), and the licence server.
Security levels
DRM systems distinguish protection levels. In Widevine's case:
- L1: decryption and decoding happen in a protected hardware execution environment;
- L3: everything happens in software, with weaker protection.
Many services allow the highest resolutions only at the most secure levels. This is why the same subscription may offer 4K on the TV but a lower resolution in a browser on a computer.
HDCP: the last stretch
DRM protects the video up to the device. The final stretch, the cable between player and screen, is protected by HDCP. If a TV, projector or splitter does not support the required HDCP version, the content may be shown at reduced resolution or not shown at all.
What it means for publishers
For anyone distributing courses, conferences or restricted videos, full DRM is not always necessary. The options range from simple to complex:
- signed, expiring links on the CDN, which prevent the address from being shared;
- AES segment encryption with keys issued only to authenticated users;
- visible or invisible watermarking with the user's identifier, which discourages redistribution;
- multi-system DRM through a licensing service provider.
DRM adds cost and complexity and can create compatibility problems, for example with less common browsers or older devices. It should be chosen according to the real value of the content and contractual requirements, not out of habit.
The limits
No DRM is unbreakable: the video has to be shown, and what is shown can be recorded. DRM raises the cost and difficulty of copying, makes the source traceable and satisfies rights holders' requirements, but it is not an absolute guarantee.
In short
- Encryption protects transport; DRM also controls the key, the device and usage rules.
- Widevine, FairPlay and PlayReady cover different ecosystems: several systems are needed.
- CENC and CMAF let you encrypt once for all systems.
- In browsers, DRM runs through EME and a CDM module.
- For much content, signed links, encryption and watermarking are enough.
