Securing Premium Video Content
Streaming services like Netflix, Disney+, and HBO must prevent unauthorized stream hotlinking, credential sharing, and content piracy. Video security employs three layered tiers: Signed URLs/Cookies at the CDN edge, Token Authentication, and Hardware Digital Rights Management (DRM).
Security Layers
- Signed CDN URLs & Cookies: Generates time-limited signed URLs or cookies validated by the CDN edge (CloudFront uses RSA or ECDSA key-pair signatures; other CDNs, such as Akamai token auth, use HMAC tokens). Prevents unauthorized users from embedding video chunks on external websites.
- AES-128 Chunk Encryption: Video segments are encrypted with AES-128. Players fetch a decryption key from an authorized key server over HTTPS. This is clear-key encryption: every authorized client receives the key, so it is not DRM.
- Hardware-backed DRM (Widevine, FairPlay, PlayReady): Supported device security levels can keep keys and parts of the decode path in protected hardware and can require output protection. Capability varies by device, and DRM raises extraction cost rather than preventing screen recording or external capture.
The license service is a runtime dependency: if it is unavailable, an authorized viewer may have encrypted segments but no usable key. Define license expiry, offline playback, key rotation, revocation, retry behavior, and what quality may degrade on devices without the required hardware security level.
Worked example: layering protection for a movie
- Entitlement: the user presses play; the playback API checks subscription, region and concurrent-stream limits (for example 2 streams), then issues a short-lived playback token.
- Manifest and segments: the API returns a manifest URL plus a signed cookie scoped to /title/123/* that expires in 4 hours. The CDN validates the signature on every request without calling your servers.
- Encryption: segments were packaged once with Common Encryption (CENC); using the cbcs scheme with CMAF lets one set of files serve FairPlay, Widevine and PlayReady.
- License: the player's CDM reads the key ID from the stream, generates a license request, and the app forwards it with the playback token to the license server, which returns keys wrapped for that CDM with rules: expiry in 48 hours for a rental, HD only on hardware-backed security levels, HDCP required for external displays.
- Playback: decryption happens inside the CDM. On Android, Widevine L1 does it in a trusted execution environment; L3 is software-only, and services commonly cap L3 devices to standard definition.
Layers compared
| Layer | Stops | Does not stop | Cost |
|---|---|---|---|
| Signed URLs or cookies | Hotlinking, casual sharing of links after expiry | Anyone with a valid cookie downloading segments | Low; validated at the edge |
| HLS AES-128 clear-key | Passive interception, CDN-level copying | An authorized client extracting the key | Low |
| DRM with software CDM | Most casual ripping | Skilled attackers; screen capture | Licensing, license servers, packaging |
| DRM with hardware security and HDCP | Most digital extraction of HD and 4K | Camera capture of the screen | Device fragmentation, support load |
| Forensic watermarking | Nothing directly; identifies the leaking account | Leaks themselves | Per-session variant delivery |
Failure modes
- License server outage: new playbacks fail even though the CDN is healthy. Run it multi-region, cache entitlement decisions, and allow persistent licenses for downloaded content.
- Live key rotation: rotate keys periodically for live streams and signal new key IDs ahead of use, so players can request licenses before the switch.
- Clock skew: devices with wrong clocks reject valid expiry windows; allow a small grace period.