EZDRM Offers WebRTC with Robust DRM Security
The new, patent pending EZDRM WebRTC-DRM solution enables true low-latency streaming applications...
Kingsmead Security Ltd is an independent content security consultancy serving the TV and film industry. Over the last few years, we have completed many commercial engagements reviewing the security of over-the-top (OTT) streaming services, and we have observed how Digital Rights Management (DRM) is deployed around the world in free, ad-funded and subscription OTT services.
The critical message from this post is that treating DRM use as a simple checkbox item for satisfying content licensing requirements may lead to a false sense of how effective the technology can be for protecting content and protecting service revenue streams.
When correctly applied, DRM technology is an essential tool to help protect content from unauthorised use. However, our experience has shown that DRM use is not always fully considered at a service-wide level, providing an excellent opportunity for a malicious attacker to gain unauthorised access to content.
This blog provides some basic guidance for improved deployment of DRM technology in commercial video services.
There are three primary DRM systems in use for OTT content today:
These features are discussed in more detail below.
Content encryption keys are used to encrypt content. When creating and using content encryption keys, it is important to:
DRM license servers are either developed internally by the streaming operator, or more commonly provided by a third-party multi-DRM vendor. Multi-DRM vendor servers issue licenses to the client devices if authorised to do so by the streaming operator.
Multi-DRM vendor authorisation generally occurs in two ways:
Regardless of the authorisation method, streaming operators need to carefully validate all requests in order to guard against malicious attack:
If tokens are used during the authorisation process, each token should be fully validated as follows:
Some streaming operators may consider finer control over license delivery. For example, they may opt to block requests from certain device types or known/suspected malicious devices.
It is important to consider carefully how license requests are approved. Default configurations often leave services wide open to attack. Always configure the DRM license service to limit the risk of content leakage based on the unique requirements of the streaming operator.
Finally, always log DRM requests and the reason for accepting or rejecting the request. Log analysis can reveal suspicious DRM activity and allow post-mortem analysis in the event of content leakage.
Once the license is authorised, the DRM license server should create a license with appropriate constraints set. As noted above, streaming operators should not rely on defaults. Constraints will vary across services and assets but can be used to prevent common attacks such as screen scraping or HDMI recording.
Constraints to consider:
DRM can provide protection against unauthorised viewing of content, but only if applied in a systematic way within the service delivery architecture. The guidance described above ensure that a basic level of protection is achieved for all services using DRM. For streaming operators carrying premium content, further steps may be required.
In summary, always:
Kingsmead Security Ltd is an independent content security consultancy serving the TV and film industry. We aim to support content owners, streaming operators and technology vendors protect movie, sports and other premium content. We specialise in consumer content distribution and deliver a range of auditing, testing and security consulting projects to our worldwide client base.
Brian Paxton founded Kingsmead Security in 2018, bringing over 25 years’ experience in the TV and film industry to the company.
Why look anywhere else for DRM industry information?
EZDRM are your partners for a voyage around the world of DRM and content security. Sign up for regular news about the EZDRM solution, design wins, where you can meet up with the team and a commentary on industry developments that you won't find anywhere else!
The new, patent pending EZDRM WebRTC-DRM solution enables true low-latency streaming applications...
Taking full advantage of all security features available for your streaming service, especially...
EZDRM is pleased to highlight its support of the High Efficiency Stream Protocol (HESP) Alliance at...