How to setup DRM Protection with Azure Media Services to prevent screen capture

Question

:)

My goal is to host videos with Widevine and PlayReady DRM protection to prevent screen capture like Netflix. Only authorized users should be able to receive licenses to watch the videos.

I'm struggling to get started.

What I've tried:

• play the "PlayReady (dynamic/SWT)" sample on https://ampdemo.azureedge.net/ but the video is removed or something
• read Microsoft docs, but there is no simple step-by-step guide on how to create a DRM protected video on Azure portal and try it out in the Azure Media Player
• I tried creating a content key policy with DRM encryption and no tokens, this I could play in the Azure Media Player on the demo site, but it was possible to perform a screen capture

I'd say I understand the big picture as shown in this diagram from Microsoft docs:

Can someone please help me to get started?

Answer 1

There is (sadly) a trade-off between availability and protection.

With DRM there are hardware-level and software-level options.

Generally software DRM is much more vulnerable to screen capturing. But it's more widely available. Hardware-based DRM has protections built in against it. But, yes, it's less widely available.

For Widevine, you only get hardware DRM in devices that support L1 (security level 1). So that is generally devices that Google (owner of Widevine) controls or approves. High-end Android smartphones generally do. But it depends on the make/model of phone. Then you have smart TVs and Chromebooks. You can limit screen capture in those devices.

But devices that only support Widevine L3 don't protect against screen capturing. However not supporting L3 (to protect against screen capturing) means you don't support a large section of browsers (like desktop Chrome and Firefox). And so limiting access to your content. Since Chrome and Firefox combined have the majority of the browser market.

You mention Netflix and actually their solution is a trade-off. They do support L3 devices and so their content is vulnerable to screen-capturing. Which is why they limit the resolution to max 720p on those devices. To watch Netflix in full HD/UHD you need a device with hardware DRM. So to replicate what they do, you would need to package your videos using multi-track and so different keys per track. So different security levels can be applied for the UHD track than for the SD one.

Since Netflix has billions of dollars to throw at any problem, you can be pretty sure what they do is the best solution available.

Playready can block screen recording in Edge (Windows 10). Microsoft controls both the DRM and browser there. But Edge less popular than Chrome/Firefox. The trade-off again if you target Edge-only.

Then the other main DRM is Fairplay. That's an Apple DRM and since Apple controls the whole ecosystem, you get hardware-support by default. Macs, iPhones, iPads. But you don't mention that so I assume that's not a target market.

It's certainly not simple!

Answer 2

It's a complex subject indeed. Which language are you using? We have some basic streaming with DRM samples in our .NET samples. It shows how to do basic encryption, license settings, content key policy and how to generate a test JWT token. In real production, you would need to build the auth flow to generate the proper JWT token needed for your clients.

https://github.com/Azure-Samples/media-services-v3-dotnet-tutorials/tree/master/AMSV3Tutorials/EncryptWithDRM

I also recently updated the Node/Typescript DRM sample in this branch https://github.com/Azure-Samples/media-services-v3-node-tutorials/tree/updatedNodeSDK/AMSv3Samples/StreamFilesWithDRMSample

You do need to have some knowledge of the Widevine and or PlayReady SDKs though - that is where all of the settings and values for the license come from.