Skip to main content

Protect a video using Axinom Encoding

This article is a part of the DRM How-to Guides.

In this section, we will extend the video encoding process as described before with a DRM protection step.

DRM protection involves video encryption using a symmetric algorithm. For this, we need a secure encryption key.

Axinom Key Service fulfills this purpose - it generates encryption keys upon request.

note

The Key Service provides the encryption keys (Content Keys) to a packager to encrypt the media assets during the preparation stage.

Axinom Key Service supports a number of different protocols for key acquisition (see Key Acquisition API). However, with Axinom Encoding you don’t need to talk directly to the Key Service. Thanks to a so called "DRM Managed Mode", the Encoding Service connects to the Key Service and acquires the necessary key for you.

To apply DRM protection to a video follow these steps:

  1. Set up DRM for your environment
  2. Set DRM protection for a processing profile
  3. Run an encoding job
  4. Store the generated keyId

Set up DRM for your environment​

Enable the Mosaic DRM Service for your environment, as described under Enabling and Disabling Services.

That is all the setup you need. The Video Service then protects videos automatically: there is no management key to store and no credential to encrypt.

You can review the configuration in the Mosaic Management System at any time, under Admin Settings / DRM Service (see Configuring DRM in the Management System).

Using a DRM configuration from Axinom Portal​

If you protect videos with a DRM configuration created in Axinom Portal instead, go to My Mosaic / DRM and click "Acquire Credentials".

This creates your DRM configuration - for the License Service and for the Key Service.

Caution

Store the generated Management Keys securely. Don’t lose them - they are not recoverable (although, they can be reset by turning to Axinom Support).

You then need these values:

  • Key Service Management API URL
  • Key Service Tenant Id
  • Key Service Management Key
  • Key Service Key Seed ID.

The last two values you have to encrypt with a certificate of Axinom Encoding, so that only Axinom Encoding can access your Key Service configuration. To encrypt credentials, use Credentials Protection Tool.

In Mosaic Management System, go to Settings / Video Encoding / DRM Settings and specify these values. For more details refer to Set up Encoding Profiles, chapter DRM Settings.

Set DRM protection for a processing profile​

In Mosaic Management System, go to Settings / Video Encoding / Processing.

Create a new profile.

You can leave all properties with their default values, but set the "DRM Protection" to "Single Key".

(You can also use "Multiple Keys", but this is an advanced topic. Check documentation for its usage.)

Run an encoding job​

Now encode a video, same way as described in Encode a video using Axinom Encoding, but select your new processing profile with activated DRM.

Store the generated keyId​

Once encoding is complete, you will see Protection Key ID under the "Dash Streams" Section, among other video properties.

This is not the encryption key itself (the key is not stored anywhere for security reasons). But it is a reference to the encryption key.

With this keyId, Axinom DRM License Service can reconstruct the original encryption key. This is possible due to the usage of a so called KeySeed-model. (KeySeed-model is explained in the respective chapter of What is DRM? article.)

Play the protected video​

Now you can return to the step Play an existing DRM-protected video but use your own protected video instead:

  • Instead of the test vectors, paste an URL to your DASH manifest (from the encoded video properties).
  • In the Content Keys field paste your keyId (just the value of the keyId, it is enough).
  • Provide your Communication Key and Communication Key Id. With the Mosaic DRM Service, find them under Admin Settings / DRM Service / Communication Key; with a Portal DRM configuration, under My Mosaic / DRM.
note

If you have a legacy agreement, your environment has no DRM Service page. You find the same values in the Axinom Portal and in your configuration PDF instead, as described in Legacy agreement credentials.

If you generate an entitlement message yourself, use for it the keyId from the previous step (see Create an entitlement message).

Next steps​

See also​

Was this page helpful?