HLS encryption

Limits

You can generate encrypted videos only in the M3U8 format by using HLS encryption.

Usage notes

You can select HLS encryption when you create a workflow in the MPS console. After the workflow is created, if the path of an uploaded video matches the input path specified for the workflow, the workflow is automatically triggered and the video is encrypted by using HLS encryption.

Prerequisites

Before you use the HLS encryption feature of MPS, complete the following steps:

1. Activate the required Alibaba Cloud services.

   If you have not activated MPS, OSS, KMS, RAM, and CDN, activate them first.

   1. Activate the MPS service. For more information, see Activate MPS.

   2. Activate the OSS service. For more information, see Activate OSS.

   3. Activate the KMS service. For more information, see Activate KMS.

   4. Activate RAM and grant permissions. For more information, see Create a RAM user and grant permissions.

   5. Activate the CDN service. For more information, see Activate CDN.

2. Grant MPS access to KMS.

   1. Log on to the RAM console.

   2. Click Authorize to go to the Authorize page.

   3. In the Principal search box, search for AliyunMtsDefaultRole and select the system-created role for MPS.

   4. In the search box under Permissions, search for KMS, select AliyunKMSFullAccess, and then click OK.

   After you grant the permissions, MPS can access your KMS service. When MPS receives a video encryption request, it calls a KMS API operation to obtain a data key to encrypt the video.

3. Configure the domain name and origin fetch host for the output OSS bucket. For more information, see Configure an accelerated domain name. If you have already configured them, skip this step.

   Note

   You can manually enter the public endpoint of an Alibaba Cloud OSS bucket, such as exampleBucket****.oss-cn-hangzhou.aliyuncs.com , or select an OSS bucket that you want to accelerate in the same account. Endpoints for internal access within the same region are not supported.

Configure video encryption settings

1. Create a workflow for HLS encryption.

   For more information about how to create a workflow, see Create a workflow. When you create a workflow, perform the following steps to configure the settings of video encryption:

   1. In the Encoding panel of the Encode node, click Advanced Settings.

   2. Turn on Encryption.

   3. Select HLS Standard Encryption as the encryption method and enter the uniform resource identifier (URI) of your data key (DK) in the Key URI field.

      Encryption method

      Description

      HLS Standard Encryption

      This encryption method encrypts videos based on the HLS protocol. You must keep your DK confidential. For example, you can set limits on logon cookies and referers. This encryption method provides a low level of security protection. If you select HLS encryption, you must configure the Key URI parameter. Important The Key URI parameter indicates the actual endpoint of the decryption. Example: http://127.0.0.1/decrypt.

   4. Set other parameters as needed and click OK.

   5. Click the Pen icon next to Publish.

   6. Set the Publish Type parameter to Auto. This way, each video can be played immediately after it is transcoded.

2. Upload a video to the input path specified for the created workflow to transcode and encrypt the video. For more information, see Upload videos.

   After the workflow is configured and saved, transcoding and encryption are automatically triggered when a video is uploaded to the specified path. If you want to encrypt existing videos that are uploaded to Object Storage Service (OSS) but not processed, you must specify the workflow when you submit a transcoding job. This way, the workflow is triggered and run to encrypt existing videos. For more information, see HLS encryption.

Upload a video

After you configure video encryption settings for a workflow, you can upload a video. Then, MPS automatically transcodes and encrypts the video.

1. You can upload a video in the MPS console or OSS console.

2. After a video is uploaded, the video is in the Initialized state.

   Note

   If you set the Publish Type parameter to Auto when you configure a workflow, the Initialized state is displayed in the Publish Status column that corresponds to the uploaded video. If you set the Publish Type parameter to Manual for a workflow, the Unpublished state is displayed in Publish Status column that corresponds to the uploaded video. You must set the Publish Type parameter to Auto when you configure a workflow for video encryption.

   

3. Verify that the video is automatically published after it is transcoded. The Published state is displayed in the Publish Status column that corresponds to the video. Then, you can play the video as needed.

Play an encrypted video

You can use ApsaraVideo Player or other players to play a video that is encrypted by using HLS encryption. For more information, see Perform HLS encryption and play an encrypted video.