Media #WWDC15

Content Protection 

for HTTP Live Streaming
Session 502

Roger Pantos HTTP Live Streaming Engineer

© 2015 Apple Inc. All rights reserved. Redistribution or public display not permitted without written permission from Apple.
FairPlay Streaming
Overview of FairPlay Streaming (FPS)
Overview of FairPlay Streaming (FPS)

Industrial-strength protection for your HTTP Live Streaming audio & video
Overview of FairPlay Streaming (FPS)

Industrial-strength protection for your HTTP Live Streaming audio & video
Already delivering keys in the premium content industry
Overview of FairPlay Streaming (FPS)

Industrial-strength protection for your HTTP Live Streaming audio & video
Already delivering keys in the premium content industry
Built into iOS, Apple TV, and OS X
Overview of FairPlay Streaming (FPS)

Industrial-strength protection for your HTTP Live Streaming audio & video
Already delivering keys in the premium content industry
Built into iOS, Apple TV, and OS X
Power-efficient on mobile devices
Overview of FairPlay Streaming (FPS)

Industrial-strength protection for your HTTP Live Streaming audio & video
Already delivering keys in the premium content industry
Built into iOS, Apple TV, and OS X
Power-efficient on mobile devices
Integrated with AirPlay
Overview of FairPlay Streaming (FPS)

Industrial-strength protection for your HTTP Live Streaming audio & video
Already delivering keys in the premium content industry
Built into iOS, Apple TV, and OS X
Power-efficient on mobile devices
Integrated with AirPlay
Offered under the Apple Developer Program License Agreement
Scope of FairPlay Streaming—What It Is

FairPlay Streaming is:

Scope of FairPlay Streaming—What It Is

FairPlay Streaming is:

• A secure key delivery mechanism
- Content Key is protected on the network and on the client during playback
Scope of FairPlay Streaming—What It Is

FairPlay Streaming is:

• A secure key delivery mechanism
- Content Key is protected on the network and on the client during playback
• Key delivery is transport agnostic
- Easy to integrate with existing key server infrastructure
Scope of FairPlay Streaming—What It Is

FairPlay Streaming is:

• A secure key delivery mechanism
- Content Key is protected on the network and on the client during playback
• Key delivery is transport agnostic
- Easy to integrate with existing key server infrastructure
• Requires protected HDMI for external output
Scope of FairPlay Streaming—What It Isn’t

FairPlay Streaming does NOT:

• Provide DRM rights expression or policy enforcement, or
• Provide user authentication or per-device authorization
These can be implemented separately and combined with FPS
How to Use FairPlay Streaming
What Do You Need to Do?
What Do You Need to Do?

Integrate a FairPlay Streaming Key Security Module (KSM) into your key server
What Do You Need to Do?

Integrate a FairPlay Streaming Key Security Module (KSM) into your key server
Add code to your app to relay key requests and responses
What Do You Need to Do?

Integrate a FairPlay Streaming Key Security Module (KSM) into your key server
Add code to your app to relay key requests and responses
For each HLS asset that you wish to protect:
• Generate and store a Content Key (CK) in your back-end database
• Encrypt the asset using AES Sample encryption
• Put a reference to the CK into your HLS playlist
Designing a FairPlay Streaming System

Gianpaolo Fasoli
FairPlay Streaming Engineer
Designing a FairPlay Streaming System
Designing a FairPlay Streaming System

Purpose and importance of your credentials

Designing a FairPlay Streaming System

Purpose and importance of your credentials

Building blocks and data flows
Designing a FairPlay Streaming System

Purpose and importance of your credentials

Building blocks and data flows
What we provide, what you have to build
Designing a FairPlay Streaming System

Purpose and importance of your credentials

Building blocks and data flows
What we provide, what you have to build
Integrating FPS into your Key Server
Designing a FairPlay Streaming System

Purpose and importance of your credentials

Building blocks and data flows
What we provide, what you have to build
Integrating FPS into your Key Server
Testing your Key Security Module
Designing a FairPlay Streaming System

Purpose and importance of your credentials

Building blocks and data flows
What we provide, what you have to build
Integrating FPS into your Key Server
Testing your Key Security Module
Integrating FPS into your app
Designing a FairPlay Streaming System

Purpose and importance of your credentials

Building blocks and data flows
What we provide, what you have to build
Integrating FPS into your Key Server
Testing your Key Security Module
Integrating FPS into your app
Encrypting and testing your content
FairPlay Streaming Credentials

KSM Credentials differentiate you from other FPS deployments

FairPlay Streaming Credentials

KSM Credentials differentiate you from other FPS deployments

• Playing content on a customer device requires production credentials
FairPlay Streaming Credentials

KSM Credentials differentiate you from other FPS deployments

• Playing content on a customer device requires production credentials
• You must protect your production credentials
FairPlay Streaming—Request Flow

Your App

Your Key Your Key 
 Internet AVFoundation

Database Server Delegate

FPS KSM

Existing
Provided AVFoundation
Your Implementation
FairPlay Streaming—Request Flow
1 Your app asks AVFoundation to play your protected HLS asset

Your App

Your Key Your Key 
 Internet AVFoundation

Database Server Delegate

FPS KSM
1

Existing
Provided AVFoundation
Your Implementation
FairPlay Streaming—Request Flow
2 AVFoundation will download your m3u8 playlist containing the KEY tag

Your App

Your Key Your Key 
 Internet AVFoundation

Database Server Delegate

FPS KSM

2 1

Existing
Provided AVFoundation
Your Implementation
FairPlay Streaming—Request Flow
3 AVFoundation will call your app delegate to request the key

Your App

Your Key Your Key 
 Internet AVFoundation

Database Server Delegate

FPS KSM

2 1 3

Existing
Provided AVFoundation
Your Implementation
FairPlay Streaming—Request Flow
4 Your app delegate calls AVFoundation to create an FPS Server Playback Context request

Your App

Your Key Your Key 
 Internet AVFoundation

Database Server Delegate

FPS KSM

2 1 3 4

Existing
Provided AVFoundation
Your Implementation
FairPlay Streaming—Request Flow
5 Your app delegate sends the FPS SPC to your key server

Your App
5 5
Your Key Your Key 
 Internet AVFoundation
Database Server Delegate

FPS KSM

2 1 3 4

Existing
Provided AVFoundation
Your Implementation
FairPlay Streaming—Request Flow
6 Key server unwraps the SPC with your FPS KSM and performs CK lookup

Your App
5 5
Your Key 6 Your Key 
 Internet AVFoundation
Database Server Delegate

FPS KSM

2 1 3 4

Existing
Provided AVFoundation
Your Implementation
FairPlay Streaming—Request Flow
7 After lookup, your FPS KSM wraps the content key into a Content Key Context response

Your App
5 5
Your Key 6 Your Key 
 Internet AVFoundation
Database Server Delegate
7 7

FPS KSM

2 1 3 4

Existing
Provided AVFoundation
Your Implementation
FairPlay Streaming—Request Flow
8 Your app delegate provides the CKC to AVFoundation

Your App
5 5
Your Key 6 Your Key 
 Internet AVFoundation
Database Server Delegate
7 7

FPS KSM

2 1 3 4 8

Existing
Provided AVFoundation
Your Implementation
FairPlay Streaming—Request Flow
9 Now the device can decrypt and play the content

9 Your App
5 5
Your Key 6 Your Key 
 Internet AVFoundation
Database Server Delegate
7 7

FPS KSM

2 1 3 4 8

Existing
Provided AVFoundation
Your Implementation
What Is Provided
What Is Provided

AVFoundation, including API for AVAssetResourceLoader delegate

What Is Provided

AVFoundation, including API for AVAssetResourceLoader delegate

FairPlay Streaming SDK
What Is Provided

AVFoundation, including API for AVAssetResourceLoader delegate

FairPlay Streaming SDK
• Protocol specification
What Is Provided

AVFoundation, including API for AVAssetResourceLoader delegate

FairPlay Streaming SDK
• Protocol specification
• Server reference implementation
What Is Provided

AVFoundation, including API for AVAssetResourceLoader delegate

FairPlay Streaming SDK
• Protocol specification
• Server reference implementation
• Server test vectors and validation tools
What Is Provided

AVFoundation, including API for AVAssetResourceLoader delegate

FairPlay Streaming SDK
• Protocol specification
• Server reference implementation
• Server test vectors and validation tools
• Example content
What Is Provided

AVFoundation, including API for AVAssetResourceLoader delegate

FairPlay Streaming SDK
• Protocol specification
• Server reference implementation
• Server test vectors and validation tools
• Example content
• Client example code
Integrating FPS Into Your Key Server

Your Key Server must:

• Decrypt and validate SPC request
• Lookup CK by the asset identifier
• Produce CKC response
Integrating FPS Into Your Key Server

Your Key Server must:

• KSM: Decrypt and validate SPC request
• Lookup CK by the asset identifier
• Produce CKC response
Integrating FPS Into Your Key Server

Your Key Server must:

• KSM: Decrypt and validate SPC request
• Lookup CK by the asset identifier
• KSM: Produce CKC response
Integrating FPS Into Your Key Server

Your Key Server must:

• KSM: Decrypt and validate SPC request
• Lookup CK by the asset identifier
• KSM: Produce CKC response

Implement KSM logic from scratch using protocol specification, or

Integrating FPS Into Your Key Server

Your Key Server must:

• KSM: Decrypt and validate SPC request
• Lookup CK by the asset identifier
• KSM: Produce CKC response

Implement KSM logic from scratch using protocol specification, or

Customize the C reference implementation in the SDK (language, integration)
Testing Your Key Security Module
Testing Your Key Security Module

Supplied test vectors should be used to validate correctness of responses produced

Testing Your Key Security Module

Supplied test vectors should be used to validate correctness of responses produced

• Your KSM implementation will consume test SPC request and produce response
Testing Your Key Security Module

Supplied test vectors should be used to validate correctness of responses produced

• Your KSM implementation will consume test SPC request and produce response
• Supplied tool will validate your produced CKC response
Testing Your Key Security Module

Supplied test vectors should be used to validate correctness of responses produced

• Your KSM implementation will consume test SPC request and produce response
• Supplied tool will validate your produced CKC response


Test vectors are based on non-functional development credentials
Testing Your Key Security Module

Supplied test vectors should be used to validate correctness of responses produced

• Your KSM implementation will consume test SPC request and produce response
• Supplied tool will validate your produced CKC response


Test vectors are based on non-functional development credentials
End-to-end playback test on device requires production credentials!
Integrating FPS Into Your App

Register an AVAssetResourceLoader delegate with AVAsset

Integrating FPS Into Your App

Register an AVAssetResourceLoader delegate with AVAsset

AVAssetResourceLoader delegate must:
Integrating FPS Into Your App

Register an AVAssetResourceLoader delegate with AVAsset

AVAssetResourceLoader delegate must:

• Generate the SPC

- handle shouldWaitForLoadingOfRequestedResource: for key requests
- call -[AVAssetResourceLoadingRequest streamingContentKeyRequestDataForApp:
contentIdentifier: options: error: ] to produce SPC
Integrating FPS Into Your App

Register an AVAssetResourceLoader delegate with AVAsset

AVAssetResourceLoader delegate must:

• Generate the SPC

- handle shouldWaitForLoadingOfRequestedResource: for key requests
- call -[AVAssetResourceLoadingRequest streamingContentKeyRequestDataForApp:
contentIdentifier: options: error: ] to produce SPC
• Send SPC request to your Key Server
Integrating FPS Into Your App

Register an AVAssetResourceLoader delegate with AVAsset

AVAssetResourceLoader delegate must:

• Generate the SPC

- handle shouldWaitForLoadingOfRequestedResource: for key requests
- call -[AVAssetResourceLoadingRequest streamingContentKeyRequestDataForApp:
contentIdentifier: options: error: ] to produce SPC
• Send SPC request to your Key Server
• Provide CKC response (or error) to AVAssetResourceLoadingRequest
Encrypting and Testing Your Content
Encrypting and Testing Your Content

Encrypt your content with HLS Sample Encryption

Encrypting and Testing Your Content

Encrypt your content with HLS Sample Encryption

• METHOD=SAMPLE-AES
Encrypting and Testing Your Content

Encrypt your content with HLS Sample Encryption

• METHOD=SAMPLE-AES
• KEYFORMAT=“com.apple.streamingkeydelivery”
Encrypting and Testing Your Content

Encrypt your content with HLS Sample Encryption

• METHOD=SAMPLE-AES
• KEYFORMAT=“com.apple.streamingkeydelivery”

Many 3rd-party encoders support HLS sample encryption

Encrypting and Testing Your Content

Encrypt your content with HLS Sample Encryption

• METHOD=SAMPLE-AES
• KEYFORMAT=“com.apple.streamingkeydelivery”

Many 3rd-party encoders support HLS sample encryption

To check your encryption workflow
Encrypting and Testing Your Content

Encrypt your content with HLS Sample Encryption

• METHOD=SAMPLE-AES
• KEYFORMAT=“com.apple.streamingkeydelivery”

Many 3rd-party encoders support HLS sample encryption

To check your encryption workflow
• SDK contains an example of sample-encrypted content for comparison
Encrypting and Testing Your Content

Encrypt your content with HLS Sample Encryption

• METHOD=SAMPLE-AES
• KEYFORMAT=“com.apple.streamingkeydelivery”

Many 3rd-party encoders support HLS sample encryption

To check your encryption workflow
• SDK contains an example of sample-encrypted content for comparison
• HLS mediafilesegmenter can produce encrypted content for comparison
FairPlay Streaming with AirPlay
FairPlay Streaming with AirPlay
FairPlay Streaming with AirPlay

AirPlay Video will transfer streaming operation to Apple TV

FairPlay Streaming with AirPlay

AirPlay Video will transfer streaming operation to Apple TV

No additional code needs to be written!
FairPlay Streaming with AirPlay

AirPlay Video will transfer streaming operation to Apple TV

No additional code needs to be written!
SPC request is generated by FPS on Apple TV and CKC response is for Apple TV
FairPlay Streaming with AirPlay

AirPlay Video will transfer streaming operation to Apple TV

No additional code needs to be written!
SPC request is generated by FPS on Apple TV and CKC response is for Apple TV
• Your app on the sending device relays messages between Apple TV and your key server
FairPlay Streaming with AirPlay

AirPlay Video will transfer streaming operation to Apple TV

No additional code needs to be written!
SPC request is generated by FPS on Apple TV and CKC response is for Apple TV
• Your app on the sending device relays messages between Apple TV and your key server
Provides the same level of security as local playback
FairPlay Streaming with AirPlay

AirPlay Video will transfer streaming operation to Apple TV

No additional code needs to be written!
SPC request is generated by FPS on Apple TV and CKC response is for Apple TV
• Your app on the sending device relays messages between Apple TV and your key server
Provides the same level of security as local playback
FPS content is disabled by AirPlay Mirroring, not rendered in screenshots or recordings
FairPlay Streaming in Safari on OS X
FairPlay Streaming in Safari on OS X
FairPlay Streaming in Safari on OS X

FairPlay Streaming accessed through HTML5 Encrypted Media Extensions

FairPlay Streaming in Safari on OS X

FairPlay Streaming accessed through HTML5 Encrypted Media Extensions

Key delivery code must be written in JavaScript
FairPlay Streaming in Safari on OS X

FairPlay Streaming accessed through HTML5 Encrypted Media Extensions

Key delivery code must be written in JavaScript
• Example provided with FPS SDK
FairPlay Streaming in Safari on OS X

FairPlay Streaming accessed through HTML5 Encrypted Media Extensions

Key delivery code must be written in JavaScript
• Example provided with FPS SDK
Same KSM can support both iOS clients and Safari on OS X
FairPlay Streaming in Safari on OS X

FairPlay Streaming accessed through HTML5 Encrypted Media Extensions

Key delivery code must be written in JavaScript
• Example provided with FPS SDK
Same KSM can support both iOS clients and Safari on OS X
Supports AirPlay
Integrating FPS Into Your Web Page
Integrating FPS Into Your Web Page

Set m3u8 URL as src attribute of HTML <video> tag (as usual)
Integrating FPS Into Your Web Page

Set m3u8 URL as src attribute of HTML <video> tag (as usual)
Add EventListener for ‘webkitneedkey‘ to video element:
Integrating FPS Into Your Web Page

Set m3u8 URL as src attribute of HTML <video> tag (as usual)
Add EventListener for ‘webkitneedkey‘ to video element:
Set EME CDM keySystem (video.webkitSetMediaKeys) to “com.apple.fps.1_0“
Integrating FPS Into Your Web Page

Set m3u8 URL as src attribute of HTML <video> tag (as usual)
Add EventListener for ‘webkitneedkey‘ to video element:
Set EME CDM keySystem (video.webkitSetMediaKeys) to “com.apple.fps.1_0“
Create keySession on “video/mp4” to relay messages with the keySystem
Integrating FPS Into Your Web Page

Set m3u8 URL as src attribute of HTML <video> tag (as usual)
Add EventListener for ‘webkitneedkey‘ to video element:
Set EME CDM keySystem (video.webkitSetMediaKeys) to “com.apple.fps.1_0“
Create keySession on “video/mp4” to relay messages with the keySystem
Add Event handler for ‘webkitkeymessage’ to keySession:
Integrating FPS Into Your Web Page

Set m3u8 URL as src attribute of HTML <video> tag (as usual)
Add EventListener for ‘webkitneedkey‘ to video element:
Set EME CDM keySystem (video.webkitSetMediaKeys) to “com.apple.fps.1_0“
Create keySession on “video/mp4” to relay messages with the keySystem
Add Event handler for ‘webkitkeymessage’ to keySession:
Send SPC request to your Key Server
Integrating FPS Into Your Web Page

Set m3u8 URL as src attribute of HTML <video> tag (as usual)
Add EventListener for ‘webkitneedkey‘ to video element:
Set EME CDM keySystem (video.webkitSetMediaKeys) to “com.apple.fps.1_0“
Create keySession on “video/mp4” to relay messages with the keySystem
Add Event handler for ‘webkitkeymessage’ to keySession:
Send SPC request to your Key Server
Provide CKC response to keySession.update()
Safari Request Flow

Safari

Your Key Your Key 
 Your Site

Database Server Internet
Your JS

FPS KSM

Existing
Provided EME
Your Implementation
Safari Request Flow
1 User hits Play

Safari

Your Key Your Key 
 Your Site

Database Server Internet
Your JS

FPS KSM

Existing
Provided EME
Your Implementation
Safari Request Flow
2 Your Event Listener receives ‘webkitneedkey’ message

Safari

Your Key Your Key 
 Your Site

Database Server Internet
Your JS

FPS KSM

Existing
Provided EME
Your Implementation
Safari Request Flow
3 Your Event Listener creates keySession and waits for ‘webkitkeymessage’ Event

Safari

Your Key Your Key 
 Your Site

Database Server Internet
Your JS

FPS KSM

2 3

Existing
Provided EME
Your Implementation
Safari Request Flow
4 Your ‘webkitkeymessage’ Event Handler receives message containing SPC

Safari

Your Key Your Key 
 Your Site

Database Server Internet
Your JS

FPS KSM

2 3 4

Existing
Provided EME
Your Implementation
Safari Request Flow
5 Your Event Handler sends SPC to your Key Server

Safari

Your Key Your Key 
 5 5 Your Site

Database Server Internet
Your JS

FPS KSM

2 3 4

Existing
Provided EME
Your Implementation
Safari Request Flow
6 You update keySession upon receipt of CKC response

Safari

Your Key Your Key 
 5 5 Your Site

Database Server Internet
Your JS
6 6
FPS KSM

2 3 4 6

Existing
Provided EME
Your Implementation
FairPlay Streaming 

Integration Troubleshooting
Troubleshooting

Content 

Doesn’t Play

Content 

or Key?
Troubleshooting

Content 

Doesn’t Play

KEYFORMAT=“identity”

Content 

or Key?
Troubleshooting

Content 

Doesn’t Play

Content
Content 

or Key?

• Sample level encryption

• PAT/PMT, audio setup info
• Use supported codecs
• CK rotation on HLS segments
Troubleshooting

Content 

Doesn’t Play

Content Key Delivery

Content 

or Key?

• Sample level encryption • SPC generation failure

• PAT/PMT, audio setup info • Transport
• Use supported codecs • CK lookup
• CK rotation on HLS segments • CKC processing failure
Summary of FairPlay Streaming

FairPlay Streaming provides industrial-strength content protection for HLS

Built into on iOS, Apple TV and Safari on OS X
Deeply integrated into the OS
Designed for power-efficient playback
Supports platform features such as AirPlay, external output protection, and HTML5
More Information

Documentation and Videos

FairPlay Streaming
http://developer.apple.com/streaming/fps/

Technical Support
Apple Developer Forums
http://developer.apple.com/forums

Developer Technical Support

http://developer.apple.com/support/technical
Labs

Graphics, Games
HTTP Live Streaming Lab and Media Lab B
Tuesday 11:00AM

Graphics, Games
AirPlay Lab and Media Lab B
Tuesday 3:30PM

Graphics, Games
AVKit and AV Foundation Lab and Media Lab A
Wednesday 1:30PM

Graphics, Games
AVKit and AV Foundation Lab and Media Lab B
Thursday 11:00AM

Graphics, Games
HTTP Live Streaming Lab and Media Lab C
Thursday 11:00AM