Track specific rules

Configuring track-specific security levels

Widevine is available in varying level of security. Higher the security of content often results in fewer devices that it can play on. The usual solution is to serve different quality to different devices. The high-resolution tracks are the most valuable and need maximum security. With the track-specific configuration, it is possible to have the highest requirement of security for the best quality streams.

Naming video streams during encoding

When using shaka-packager to encrypt your video and create widevine-compatible dash streams, shaka-packager automatically assigns a label to each stream. There are 5 labels:

• AUDIO
• SD
• HD
• UHD1
• UHD2

Note that these labels does not have meaning of their own. They just define the association between a track and it's encryption keys. If there are video tracks with 300,400,500 and 600p height, you can still call all of them HD and UHD.

Video can have any number of streams, but there are only 5 keys associated with a content-id. One of these keys is for audio. If there are more than 4 video streams, group those video streams into 4 sets. Shaka-packager does this grouping internally if labels were not specified in command.

Sample shaka-packager command for setting up drm-labels.

packager \
  in=./media-files/vorbis_audio.webm,stream=audio,output=./media-files/audio_enc.webm,drm_label=AUDIO \
  in=./media-files/vp9_4k.webm,stream=video,output=./media-files/video_enc_4k.webm,drm_label=UHD2 \
  in=./media-files/vp9_2k.webm,stream=video,output=./media-files/video_enc_2k.webm,drm_label=UHD1 \
  in=./media-files/vp9_FHD.webm,stream=video,output=./media-files/video_enc_FHD.webm,drm_label=HD \
  in=./media-files/vp9_HD.webm,stream=video,output=./media-files/video_enc_HD.webm,drm_label=HD \
  in=./media-files/vp9_mobile.webm,stream=video,output=./media-files/video_enc_mobile.webm,drm_label=SD \
  --enable_widevine_encryption \
  --key_server_url https://license.vdocipher.com/content-keys/wv/________ \
  --content_id ___________ \
  --signer __________ \
  --aes_signing_key __________________ \
  --aes_signing_iv ________ \
  --clear_lead 0 \
  --mpd_output ./media-files/stream.mpd

Consult official shaka-packager docs for more information about this command.

If not using shaka-packager, note the response of the content-key API. The response of the content-key API contains an array of objects for each key. Each of those objects also has a track-type. Each video stream will use the keys for which the label matches the track.

Specify track rules with the licensing API

Track-specific security levels is defined using the licenseRules parameter of the licensing API. If you have previously used offline setup in Android or iOS, you might already have used this parameter to specify rental-duration.

To recap, licensingAPI is where you use crypto algorithms to generate a unique URL for a video session. You specify the content id of the video and create a hash using your secret license-key. All this is encoded into a URL which can be passed to the client (website or mobile app) for playback in exoplayer, AVPlayer or dash-player on web.

Example in Nodejs:

const contentAuthObj = {
  contentId: CONTENT_ID,
  expires: timestamp + 900,
  licenseRules: JSON.stringify({
    dashTrackRules: [
      {type: 'AUDIO', level: 1},
      {type: 'SD', level: 1},
      {type: 'HD', level: 3},
      {type: 'UHD1', level: 3},
      {
        type: 'UHD2',
        level: 3,
        hdcp: 'HDCP_NO_DIGITAL_OUTPUT',
      },
    ],
  }),
};

dashTrackRules will contain an array of objects with three parameters

1. type: string which must be one of the 5 defined types
2. level: integer from 1 through 5 to represent different EME security levels
3. hdcp: string which must be one of the 5 values defined in table below.

Definition	EME Level	Widevine Device Security Level
SW_SECURE_CRYPTO	1	3
SW_SECURE_DECODE	2	3
HW_SECURE_CRYPTO	3	2
HW_SECURE_DECODE	4	1
HW_SECURE_ALL	5	1

With widevine L1 (i.e. EME level 4 and 5), you can also specify a hdcp restriction parameter. Note the below table for different hdcp enforcement options and how it affects playback.

HDCP Parameter	(applies to) WV Security Level	Description
HDCP_NONE	3	HDCP not specified
HDCP_V1	1	Enforce HDCP 1.x Playback not allowed if Client does not report HDCP 1.x or better.
HDCP_V2	1	Enforce HDCP 2.0 Playback not allowed if Client does not report HDCP 2.0 or better.
HDCP_V2_1	1	Enforce HDCP 2.1 Playback not allowed if Client does not report HDCP 2.1 or better.
HDCP_V2_2	1	Enforce HDCP 2.2 Playback not allowed if Client does not report HDCP 2.2 or better.
HDCP_NO_DIGITAL_OUTPUT	1	No digital output allowed, including HDCP. Internal display only.