Radiant Media Player

DASH DRM



Last updated on May 6, 2017.


DASH DRM documentation sections:


Supported DASH DRM

Radiant Media Player supports for the following DRM for DASH streaming:

Our DRM implementation relies on Encrypted Media Extensions (EME) support in the browser. Complementary to EME support a browser must have a compatible Content Decryption Module (CDM) to decrypt the DRM content.

You an use either one DRM or a combination of multiple DRM for wider browser support. The player will automatically pick the correct DRM for the targeted browser based on information provided within the DASH manifest and player settings.


Supported browsers for DASH DRM

See our compatibility table for a list of browsers where DASH DRM is supported with Radiant Media Player.

On iOS for example DASH is not supported. We recommend using HLSe (AES-128 encrypted HLS) where DASH is not supported for maximum content security on a wide range of devices.

In order to provide decent browser coverage you are most likely going to have to use a multi-DRM approach. Combining Widevine and Playready is a common standard in the industry for DASH DRM.


Player configuration


General consideration

It ain't rocket science - following the below guidelines should help you get started with DASH DRM rapidly.

First we recommend you to go through our general DASH documentation for a better understanding of available options for DASH streaming with Radiant Media Player.

To play DRM-protected content with DASH, the player only needs to know one basic thing: the URL(s) of its license server(s). Various configuration options are available to support custom & advanced use-cases and are described below.


Choosing a Key System

Radiant Media Player is key-system-agnostic, meaning it does not prefer any key systems over any others. We use EME to ask the browser what it supports, and make no assumptions. If the browser supports multiple key systems, the first supported key system in the DASH manifest is used. The interoperable encryption standard that DRM vendors are implementing is called Common Encryption (CENC). Some DASH manifests don't specify any particular key system at all, but instead state that any CENC system will do:

<ContentProtection schemeIdUri="urn:mpeg:dash:mp4protection:2011" value="cenc"/>

If this is the only <ContentProtection> element in the manifest, Radiant Media Player will try all key systems it knows. If the browser supports it and you configured a license server URL for it, we'll use it.


Player settings

dashDrm: Object

This is where we feed the player the license server URL and other DRM-related options. The dashDrm setting supports 3 properties:

dashDrm.servers: Object

This is where license server URLs are passed to the player. Example for a combination of Widevine, PlayReady & Clear Key license servers:

dashDrm: {
  servers: {
    'com.widevine.alpha': 'https://foo.bar/drm/widevine',
    'com.microsoft.playready': 'https://foo.bar/drm/playready',
    'org.w3.clearkey': 'http://foo.bar/drm/clearkey'
  }
}
dashDrm.clearKeys: Object

The EME specification requires browsers to support a common key system called "Clear Key". Clear Key uses unencrypted keys to decrypt CENC content, and can be useful for diagnosing problems and testing integrations. To configure Clear Key, use the configuration field dashDrm.clearKeys and provide a map of key IDs to content keys (both in hex). Example:

dashDrm: {
  clearKeys: {
    'deadbeefdeadbeefdeadbeefdeadbeef': '18675309186753091867530918675309',
    '02030507011013017019023029031037': '03050701302303204201080425098033'
  }
}
dashDrm.advanced: Object

We have several advanced options available to give you access to the full EME configuration. The configuration field dashDrm.advanced is an object mapping key system IDs to their advanced settings. For example, to require hardware security in Widevine:

dashDrm: {
  servers: {
    'com.widevine.alpha': 'https://foo.bar/drm/widevine'
  },
  advanced: {
    'com.widevine.alpha': {
      'videoRobustness': 'HW_SECURE_ALL',
      'audioRobustness': 'HW_SECURE_ALL'
    }
  }
}

Refer to this Google documentation page for a list of supported properties in the dashDrm.advanced object.

Full player example with Widevine DRM (works on latest Chrome, Firefox or Opera). This example makes use of license header authentication - see next section for complete documentation on this setting.

Examples throughout this page are provided by 3rd-party - availability may change - use your own test vectors for best results.

<!-- Include Radiant Media Player JavaScript file in your <body> or <head> -->
<script src="https://cdn.radiantmediatechs.com/rmp/v4/latest/js/rmp.min.js"></script>
<!-- Set up your wrapper div with its unique id -->
<div id="rmpPlayer"></div>
<!-- Set up player configuration options -->
<script>
var bitrates = {
  dash: '//media.axprod.net/TestVectors/v7-MultiDRM-SingleKey/Manifest.mpd'
};
var settings = {
  licenseKey: 'your-license-key',
  bitrates: bitrates,  
  delayToFade: 3000,
  width: 640,
  height: 360,
  poster: 'https://www.radiantmediaplayer.com/images/poster-rmp-showcase.jpg',
  dashDrm: {
    servers: {
      'com.widevine.alpha': '//drm-widevine-licensing.axtest.net/AcquireLicense'
    }
  },
  dashRequestConfiguration: {
    license: {
      headers: {
        'X-AxDRM-Message': 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ2ZXJzaW9uIjoxLCJjb21fa2V5X2lkIjoiYjMzNjRlYjUtNTFmNi00YWUzLThjOTgtMzNjZWQ1ZTMxYzc4IiwibWVzc2FnZSI6eyJ0eXBlIjoiZW50aXRsZW1lbnRfbWVzc2FnZSIsImtleXMiOlt7ImlkIjoiOWViNDA1MGQtZTQ0Yi00ODAyLTkzMmUtMjdkNzUwODNlMjY2IiwiZW5jcnlwdGVkX2tleSI6ImxLM09qSExZVzI0Y3Iya3RSNzRmbnc9PSJ9XX19.4lWwW46k-oWcah8oN18LPj5OLS5ZU-_AQv7fe0JhNjA' 
      }
    }
  }
};
var elementID = 'rmpPlayer';
var rmp = new RadiantMP(elementID);
rmp.init(settings);
</script>

License server authentication

Your license server may require some form of authentication so that it only delivers licenses to paying users. In this section we're going to use various license server endpoints that require various forms of authentication. If you need live example to test your set up you can refer to this Google documentation page.

We provide support for 3 authentication modes: header authentication, parameter authentication & cookie authentication

Authentication is provided through the dashRequestConfiguration player setting. You can refer to our DASH streaming documentation page for more information as this setting may also be used outside DRM context.

Header authentication

In this case your license server requires a specific header value to deliver a license. If you try to use it without setting the authentication header, you will see Error code 6007 in the player logs, which means LICENSE_REQUEST_FAILED. The JavaScript console will show you a failed HTTP request with HTTP status code 401 (Unauthorized), and playback will hang when you get to the encrypted part of the stream.

To provide header authentication we will use the player dashRequestConfiguration setting as follows:

dashRequestConfiguration: {
  license: {
    headers: {
      'CWIP-Auth-Header': 'VGhpc0lzQVRlc3QK'
    }
  }
}

Full player example - this example is provided for Widevine DRM - test in Chrome:

<!-- Include Radiant Media Player JavaScript file in your <body> or <head> -->
<script src="https://cdn.radiantmediatechs.com/rmp/v4/latest/js/rmp.min.js"></script>
<!-- Set up your wrapper div with its unique id -->
<div id="rmpPlayer"></div>
<!-- Set up player configuration options -->
<script>
var bitrates = {
  dash: '//storage.googleapis.com/shaka-demo-assets/sintel-widevine/dash.mpd'
};
var settings = {
  licenseKey: 'your-license-key',
  bitrates: bitrates,  
  delayToFade: 3000,
  width: 640,
  height: 360,
  poster: 'https://www.radiantmediaplayer.com/images/poster-rmp-showcase.jpg',
  dashDrm: {
    servers: {
      'com.widevine.alpha': '//cwip-shaka-proxy.appspot.com/header_auth'
    }
  },
  dashRequestConfiguration: {
    license: {
      headers: {
        'CWIP-Auth-Header': 'VGhpc0lzQVRlc3QK'
      }
    }
  }
};
var elementID = 'rmpPlayer';
var rmp = new RadiantMP(elementID);
rmp.init(settings);
</script>
Parameter authentication

Now, we'll try authentication using URL parameters. In this case the license server endpoint requires a specific URL parameter to deliver a license. If you try to use it without setting the parameter, you will see Error code 6007 (LICENSE_REQUEST_FAILED) in player logs just as before with header authentication.

Again to provide parameter authentication we will use the player dashRequestConfiguration setting as follows:

dashRequestConfiguration: {
  license: {
    parameters: '?CWIP-Auth-Param=VGhpc0lzQVRlc3QK'
  } 
}

Full player example - this example is provided for Widevine DRM - test in Chrome:

<!-- Include Radiant Media Player JavaScript file in your <body> or <head> -->
<script src="https://cdn.radiantmediatechs.com/rmp/v4/latest/js/rmp.min.js"></script>
<!-- Set up your wrapper div with its unique id -->
<div id="rmpPlayer"></div>
<!-- Set up player configuration options -->
<script>
var bitrates = {
  dash: '//storage.googleapis.com/shaka-demo-assets/sintel-widevine/dash.mpd'
};
var settings = {
  licenseKey: 'your-license-key',
  bitrates: bitrates,  
  delayToFade: 3000,
  width: 640,
  height: 360,
  poster: 'https://www.radiantmediaplayer.com/images/poster-rmp-showcase.jpg',
  dashDrm: {
    servers: {
      'com.widevine.alpha': '//cwip-shaka-proxy.appspot.com/param_auth'
    }
  },
  dashRequestConfiguration: {
    license: {
      parameters: '?CWIP-Auth-Param=VGhpc0lzQVRlc3QK'
    }
  }
};
var elementID = 'rmpPlayer';
var rmp = new RadiantMP(elementID);
rmp.init(settings);
</script>
Cookie authentication

Now, let's try using cookies for authentication. In this case the license server endpoint requires a specific cookie to deliver a license. If you try to use it without setting the parameter, you will see Error code 6007 (LICENSE_REQUEST_FAILED) in player logs. Cookies are set by a server to be returned to that server, and are not sent by the JavaScript application. So to set the required cookie value for this test example, point your browser to the server's set_cookie page. Cookies are considered "credentials" by the browser's XmlHttpRequest API, and credentials may not be sent cross-origin unless: explicitly requested by the application AND explicitly allowed by the destination server. Our cookie_auth the license server endpoint sends back headers that allow credentialed requests, so we also need to tell the player to send credentials cross-site

Again to provide cookie authentication we will use the player dashRequestConfiguration setting as follows:

dashRequestConfiguration: {
  license: {
    credentials: true
  } 
}

Full player example - this example is provided for Widevine DRM - test in Chrome:

<!-- Include Radiant Media Player JavaScript file in your <body> or <head> -->
<script src="https://cdn.radiantmediatechs.com/rmp/v4/latest/js/rmp.min.js"></script>
<!-- Set up your wrapper div with its unique id -->
<div id="rmpPlayer"></div>
<!-- Set up player configuration options -->
<script>
var bitrates = {
  dash: '//storage.googleapis.com/shaka-demo-assets/sintel-widevine/dash.mpd'
};
var settings = {
  licenseKey: 'your-license-key',
  bitrates: bitrates,  
  delayToFade: 3000,
  width: 640,
  height: 360,
  poster: 'https://www.radiantmediaplayer.com/images/poster-rmp-showcase.jpg',
  dashDrm: {
    servers: {
      'com.widevine.alpha': '//cwip-shaka-proxy.appspot.com/cookie_auth'
    }
  },
  dashRequestConfiguration: {
    license: {
      credentials: true
    } 
  }
};
var elementID = 'rmpPlayer';
var rmp = new RadiantMP(elementID);
rmp.init(settings);
</script>

DASH DRM with AES-128 HLS fallback

When using a combined Widevine/PlayReady DRM approach with DASH streaming modern browser support should be fairly good. However on iOS or macOS Safari where DASH or Widevine/PlayReady are not supported you can use HLSe (AES-128 encrypted HLS) to reach those devices. We provide a convenient player setting dashDrmUseAesHlsFallback so that the player can automatically fallback to AES-128 HLS where DASH DRM is not supported. This setting is a boolean defaulting to false.

Usage example for dashDrmUseAesHlsFallback setting

<!-- Include Radiant Media Player JavaScript file in your <body> or <head> -->
<script src="https://cdn.radiantmediatechs.com/rmp/v4/latest/js/rmp.min.js"></script>
<!-- Set up your wrapper div with its unique id -->
<div id="rmpPlayer"></div>
<!-- Set up player configuration options -->
<script>
var bitrates = {
  dash: '//media.axprod.net/TestVectors/v7-MultiDRM-SingleKey/Manifest.mpd',
  // here is our AES-128 HLS fallback
  hls: 'https://d1swr4916zvh4g.cloudfront.net/media/rmp-segment/bbb-abr-aes/playlist.m3u8'
};
var settings = {
  licenseKey: 'your-license-key',
  bitrates: bitrates,  
  delayToFade: 3000,
  width: 640,
  height: 360,
  poster: 'https://www.radiantmediaplayer.com/images/poster-rmp-showcase.jpg',
  // here we tell the player it should use AES-128 HLS fallback when DASH DRM is not available
  dashDrmUseAesHlsFallback: true,
  dashDrm: {
    servers: {
      'com.widevine.alpha': '//drm-widevine-licensing.axtest.net/AcquireLicense',
      'com.microsoft.playready': '//drm-playready-licensing.axtest.net/AcquireLicense'
    }
  },
  dashRequestConfiguration: {
    license: {
      headers: {
        'X-AxDRM-Message': 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ2ZXJzaW9uIjoxLCJjb21fa2V5X2lkIjoiYjMzNjRlYjUtNTFmNi00YWUzLThjOTgtMzNjZWQ1ZTMxYzc4IiwibWVzc2FnZSI6eyJ0eXBlIjoiZW50aXRsZW1lbnRfbWVzc2FnZSIsImtleXMiOlt7ImlkIjoiOWViNDA1MGQtZTQ0Yi00ODAyLTkzMmUtMjdkNzUwODNlMjY2IiwiZW5jcnlwdGVkX2tleSI6ImxLM09qSExZVzI0Y3Iya3RSNzRmbnc9PSJ9XX19.4lWwW46k-oWcah8oN18LPj5OLS5ZU-_AQv7fe0JhNjA' 
      }
    }
  }
};
var elementID = 'rmpPlayer';
var rmp = new RadiantMP(elementID);
rmp.init(settings);
</script>

ExpressPlay multi-drm example (using ExpressPlay tokens)

ExpressPlay is a Radiant Media Player technology alliance partner.

dashDrm: {
  servers: {
    'com.widevine.alpha': 'https://wv.test.expressplay.com/hms/wv/rights/?ExpressPlayToken=AQAAAw3paXgAAABQspzLNQNh4hZbd8PGRZI0HqY47W8g4G8-y_3XjUuYCQkbT1RCyHha0YJmqoed_HxdPaqOgETYKRhqV-bbQc61IlNRjmC3YKA-XWQbM0fdeMyXIt44CeXileOMh6ngDkjwJWpIWw',
    'com.microsoft.playready': 'https://pr.test.expressplay.com/playready/RightsManager.asmx?ExpressPlayToken=AQAAAw3pWtgAAABgs-tivO_PM27AQvSjxG2CiJrtQ1MFfcIGvu2VYvd0ZSVJ7tE_48I2GJYNZLd8hwWTxwW1t3as0lkV3Ac-4fKwe3GZLe2eNpvHoRnjbej52rrFlKDbnoGthCD8PkR75tguGxBMMuxICQcUmBD52QzrL8xIuOw'
  }
}

Currently unsupported DRM-related features

The following features are not currently implemented but could be in the near future based on feedback and customer usage.


Supported DRM service providers

Radiant Media Player should work with any standard compliant DRM service providers that can encrypt media content with Widevine and/or PlayReady DRM. Below are some example of services that we have tested and that our customers have successfully used with Radiant Media Player:

Based on the solution your DRM service provider offer you may also need a solution to package your content for DASH. Wowza Streaming Engine supports on-the-fly DASH CENC encryption for on demand and live content via the PlayReady and Widevine DRM systems.