ApsaraVideo VOD provides data encryption, data isolation, and data leak prevention to help protect your data from security risks in the cloud.
Data encryption
Disk encryption after data writing
Secure download
You can download videos to your local device in secure download mode. Downloaded videos are encrypted by Alibaba Cloud and can be played only by using ApsaraVideo Player. You must use key files to decrypt the videos before playback. For more information, see Secure download.
Data transfer encryption
HLS encryption
HTTP Live Streaming (HLS) encryption uses AES-128 to encrypt video content and supports all HLS-compatible players. HLS encryption requires Key Management Service (KMS) and the token service. This method is widely used in fields that require high security, such as online education and TV shows. For more information, see HLS encryption.
Server-side encryption
Alibaba Cloud proprietary cryptography
Alibaba Cloud proprietary cryptography encrypts video data. Downloaded video files are encrypted to prevent unauthorized redistribution, video leakage, and hotlinking. Compared with HLS encryption, Alibaba Cloud proprietary cryptography is more secure and easier to use. For more information, see Alibaba Cloud proprietary cryptography.
Comprehensive encryption solution
Commercial DRM encryption
ApsaraVideo VOD offers industry-wide digital rights management (DRM) encryption. DRM encryption is powered by Apple FairPlay and Google Widevine. You can add and manage DRM certificates and enable DRM encryption in the ApsaraVideo VOD console to protect your copyrighted video content. For more information, see DRM encryption.
Data isolation
Region isolation
Media resources and configurations in ApsaraVideo VOD are region-bound. You cannot process media resources across regions. For example, if you activate ApsaraVideo VOD in the China (Shanghai) region, you cannot process media files stored in the China (Beijing) region.
Region isolation facilitates data storage and helps enterprises comply with local regulatory requirements, adapt to local culture, and retrieve data from the nearest data center or server. This reduces latency and improves user experience.
After you activate ApsaraVideo VOD, the system allocates a VOD bucket to each region. After you enable a VOD bucket in a region, you can upload and manage media resources in that region. For more information, see Manage storage buckets.
Application isolation
ApsaraVideo VOD provides the multi-application service. You can create multiple applications and isolate media data and configurations across different applications. This allows you to separate environments, business lines, and channels.
The multi-application service supports isolation only for media upload, audio and video playback, media management, and callbacks.
The multi-application service is available only to users in the whitelist. To use the multi-application service, submit a request on Yida. For more information, see Overview.
Data leak prevention
Image or text watermarks
You can add image or text watermarks to videos to assert video copyright, promote brands, or improve brand recognition. This also helps prevent data leakage. For more information, see Video watermark.
Digital watermarks
You can add invisible copyright or user-tracing watermarks to videos for copyright protection and leakage tracing. Digital watermarks help prevent and trace data leakage. For more information, see Digital watermarks.
Security risks of source file URLs
ApsaraVideo VOD does not verify the login status of the requester. If a video is not protected by Alibaba Cloud proprietary cryptography, anyone who obtains the source file URL can directly play or download the video without any identity verification.
Differences between source file URLs and transcoded file URLs
|
URL type |
How to obtain |
Authentication |
Direct access |
|
Source file URL |
|
Signed OSS URL (time-limited) |
Accessible directly |
|
Transcoded file URL |
|
Configurable |
Subject to configured authentication |
The Encrypt field in the response of GetPlayInfo indicates whether Alibaba Cloud proprietary cryptography is enabled for the stream: when Encrypt is 0, the URL can be accessed directly; when Encrypt is 1, the video can be played only by using a playback credential (a video ID and a PlayAuth value) together with ApsaraVideo Player.
Recommendations
Enable Alibaba Cloud proprietary cryptography for sensitive content. Videos protected by proprietary cryptography can be played only by using a playback credential together with ApsaraVideo Player.
Do not expose source file URLs to end users. Use
GetMezzanineInfoonly for internal archiving and troubleshooting.Combine business-side authentication, URL signing, and Alibaba Cloud proprietary cryptography for defense in depth.