HLS encryption

The following table describes the parameters in the sample code that you can customize.

Parameter	Description
region	The region ID. The region of the KMS service must be the same as the region where your ApsaraVideo VOD video is stored. For example, for China (Shanghai), set this parameter to cn-shanghai. For more information about other region IDs, see ApsaraVideo VOD region IDs.
AccessKey	The AccessKey pair (AccessKey ID and AccessKey secret) of your Alibaba Cloud account or RAM user. For more information, see Create an AccessKey pair.
httpserver	The port number on which you want to start the service.

import com.aliyuncs.DefaultAcsClient;
import com.aliyuncs.exceptions.ClientException;
import com.aliyuncs.http.ProtocolType;
import com.aliyuncs.vod.model.v20170321.DecryptKMSDataKeyRequest;
import com.aliyuncs.vod.model.v20170321.DecryptKMSDataKeyResponse;
import com.aliyuncs.profile.DefaultProfile;
import com.sun.net.httpserver.Headers;
import com.sun.net.httpserver.HttpExchange;
import com.sun.net.httpserver.HttpHandler;
import com.sun.net.httpserver.HttpServer;
import com.sun.net.httpserver.spi.HttpServerProvider;
import org.apache.commons.codec.binary.Base64;
import java.io.IOException;
import java.io.OutputStream;
import java.net.HttpURLConnection;
import java.net.InetSocketAddress;
import java.net.URI;import java.util.regex.Matcher;
import java.util.regex.Pattern;
public class HlsDecryptServer {
    private static DefaultAcsClient client;
    static {
        // The KMS region, which must be the same as the video's region.
        String region = "";
        // The AccessKey pair for accessing KMS.
        // An AccessKey pair of an Alibaba Cloud account has permissions on all API operations. We recommend that you use a RAM user to call API operations or perform routine O&M.
        // We strongly recommend against hard-coding the AccessKey ID and AccessKey secret in your project code. Doing so may lead to the leakage of the AccessKey pair and compromise the security of all resources in your account.
        // This example demonstrates how to authenticate API requests by reading the AccessKey pair from environment variables. Before running the sample code, configure the ALIBABA_CLOUD_ACCESS_KEY_ID and ALIBABA_CLOUD_ACCESS_KEY_SECRET environment variables.
        String accessKeyId = System.getenv("ALIBABA_CLOUD_ACCESS_KEY_ID");
        String accessKeySecret = System.getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET");
        client = new DefaultAcsClient(DefaultProfile.getProfile(region, accessKeyId, accessKeySecret));
    }
    /**
     * Description:
     * 1. Receives a decryption request to get the ciphertext and user token.
     * 2. Calls the KMS decrypt operation to get the plaintext key.
     * 3. Returns the Base64-decoded plaintext key.
     */
    public class HlsDecryptHandler implements HttpHandler {
        /**
         * Handles the decryption request.
         * @param httpExchange
         * @throws IOException
         */
        public void handle(HttpExchange httpExchange) throws IOException {
            String requestMethod = httpExchange.getRequestMethod();
            if ("GET".equalsIgnoreCase(requestMethod)) {
                // Verify the token's validity.
                String token = getMtsHlsUriToken(httpExchange);
                boolean validRe = validateToken(token);
                if (!validRe) {
                    return;
                }
                // Get the ciphertext from the URL.
                String ciphertext = getCiphertext(httpExchange);
                if (null == ciphertext)
                    return;
                // Decrypt the key from KMS and perform Base64 decoding.
                byte[] key = decrypt(ciphertext);
                // Set the header.
                setHeader(httpExchange, key);
                // Return the Base64-decoded key.
                OutputStream responseBody = httpExchange.getResponseBody();
                responseBody.write(key);
                responseBody.close();
            }
        }
        private void setHeader(HttpExchange httpExchange, byte[] key) throws IOException {
            Headers responseHeaders = httpExchange.getResponseHeaders();
            responseHeaders.set("Access-Control-Allow-Origin", "*");
            httpExchange.sendResponseHeaders(HttpURLConnection.HTTP_OK, key.length);
        }
        /**
         * Calls the KMS decrypt operation and Base64-decodes the plaintext.
         * @param ciphertext
         * @return
         */
        private byte[] decrypt(String ciphertext) {
            DecryptKMSDataKeyRequest request = new DecryptKMSDataKeyRequest();
            request.setCipherText(ciphertext);
            request.setProtocol(ProtocolType.HTTPS);
            try {
                DecryptKMSDataKeyResponse response = client.getAcsResponse(request);
                String plaintext = response.getPlaintext();
                System.out.println("PlainText: " + plaintext);
                // Note: Base64 decoding is required.
                return Base64.decodeBase64(plaintext);
            } catch (ClientException e) {
                e.printStackTrace();
                return null;
            }
        }
        /**
         * Gets the ciphertext parameter from the URL.
         * @param httpExchange
         * @return
         */
        private String getCiphertext(HttpExchange httpExchange) {
            URI uri = httpExchange.getRequestURI();
            String queryString = uri.getQuery();
            String pattern = "CipherText=(\\w*)";
            Pattern r = Pattern.compile(pattern);
            Matcher m = r.matcher(queryString);
            if (m.find())
                return m.group(1);
            else {
                System.out.println("Not Found CipherText Param");
                return null;
            }
        }
          /**
         * Verifies the token's validity. This is required for M3U8 encryption and rewrite.
         * @param token
         * @return
         */
        private boolean validateToken(String token) {
            if (null == token || "".equals(token)) {
                return false;
            }
            //TODO: Implement your token validation logic here.
            return true;
        }
        /**
         * Gets the token parameter. This is required for M3U8 encryption and rewrite.
         *
         * @param httpExchange
         * @return
         */
        private String getMtsHlsUriToken(HttpExchange httpExchange) {
            URI uri = httpExchange.getRequestURI();
            String queryString = uri.getQuery();
            String pattern = "MtsHlsUriToken=(\\w*)";
            Pattern r = Pattern.compile(pattern);
Matcher m = r.matcher(queryString);
            if (m.find())
                return m.group(1);
            else {
                System.out.println("Not Found MtsHlsUriToken Param");
                return null;
            }
        }
    }
    /**
     * Starts the service.
     *
     * @throws IOException
     */
    private void serviceBootStrap() throws IOException {
        HttpServerProvider provider = HttpServerProvider.provider();
        // The listening port can be customized. The server can accept up to 30 concurrent requests.
        HttpServer httpserver = provider.createHttpServer(new InetSocketAddress(8099), 30);
        httpserver.createContext("/", new HlsDecryptHandler());
        httpserver.start();
        System.out.println("hls decrypt server started");
    }
    public static void main(String[] args) throws IOException {
        HlsDecryptServer server = new HlsDecryptServer();
        server.serviceBootStrap();
    }}

Workflow

• The player parses the EXT-X-KEY tag in the M3U8 file to obtain the decryption key URI. This URI corresponds to the value of the DecryptKeyUri parameter in EncryptConfig.

• To restrict unauthorized access, the player must include authentication information (passed in the MtsHlsUriToken parameter) in the request to the decryption endpoint.

• The player automatically requests the decryption endpoint to get the key, decrypts the TS files, and then plays the video.

Example

• If the playback URL is https://demo.aliyundoc.com/encrypt-stream****-hd.m3u8, the request must include the MtsHlsUriToken parameter.

• Final request URL: https://demo.aliyundoc.com/encrypt-stream****-hd.m3u8?MtsHlsUriToken=<token>

• Decryption URL: https://demo.aliyundoc.com?CipherText=ZjJmZGViNzUtZWY1Mi00Y2RlLTk3MTMtOT****

• Final decryption request URL: https://demo.aliyundoc.com?CipherText=ZjJmZGViNzUtZWY1Mi00Y2RlLTk3MTMtOT****&MtsHlsUriToken=<token>

The following table describes the parameters in the sample code that you can customize.

Parameter	Description
region	The region ID. The region of the KMS service must be the same as the region where your ApsaraVideo VOD video is stored. For example, for China (Shanghai), set this parameter to cn-shanghai. For more information about other region IDs, see ApsaraVideo VOD region IDs.
AccessKey	The AccessKey pair (AccessKey ID and AccessKey secret) of your Alibaba Cloud account or RAM user. For more information, see Create an AccessKey pair.
httpserver	The port number on which you want to start the service.

import com.aliyuncs.DefaultAcsClient;
import com.aliyuncs.exceptions.ClientException;
import com.aliyuncs.http.ProtocolType;
import com.aliyuncs.profile.DefaultProfile;
import com.aliyuncs.vod.model.v20170321.DecryptKMSDataKeyRequest;
import com.aliyuncs.vod.model.v20170321.DecryptKMSDataKeyResponse;
import com.sun.net.httpserver.Headers;
import com.sun.net.httpserver.HttpExchange;
import com.sun.net.httpserver.HttpHandler;
import com.sun.net.httpserver.HttpServer;
import com.sun.net.httpserver.spi.HttpServerProvider;
import org.apache.commons.codec.binary.Base64;
import java.io.IOException;
import java.io.OutputStream;
import java.net.HttpURLConnection;
import java.net.InetSocketAddress;
import java.net.URI;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
public class HlsDecryptServerNoToken {
    private static DefaultAcsClient client;
    static {
        // The KMS region, which must be the same as the video's region.
        String region = "cn-beijing";
        // The AccessKey pair for accessing KMS.
        // An AccessKey pair of an Alibaba Cloud account has permissions on all API operations. We recommend that you use a RAM user to call API operations or perform routine O&M.
        // We strongly recommend against hard-coding the AccessKey ID and AccessKey secret in your project code. Doing so may lead to the leakage of the AccessKey pair and compromise the security of all resources in your account.
        // This example demonstrates how to authenticate API requests by reading the AccessKey pair from environment variables. Before running the sample code, configure the ALIBABA_CLOUD_ACCESS_KEY_ID and ALIBABA_CLOUD_ACCESS_KEY_SECRET environment variables.
        String accessKeyId = System.getenv("ALIBABA_CLOUD_ACCESS_KEY_ID");
        String accessKeySecret = System.getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET");
        client = new DefaultAcsClient(DefaultProfile.getProfile(region, accessKeyId, accessKeySecret));
    }
    /**
     * Description:
     * 1. Receives a decryption request to get the ciphertext.
     * 2. Calls the KMS decrypt operation to get the plaintext key.
     * 3. Returns the Base64-decoded plaintext key.
     */
    public class HlsDecryptHandler implements HttpHandler {
        /**
         * Handles the decryption request.
         * @param httpExchange
         * @throws IOException
         */
        public void handle(HttpExchange httpExchange) throws IOException {
            String requestMethod = httpExchange.getRequestMethod();
            if ("GET".equalsIgnoreCase(requestMethod)) {
                // Get the ciphertext from the URL.
                String ciphertext = getCiphertext(httpExchange);
                System.out.println(ciphertext);
                if (null == ciphertext)
                    return;
                // Decrypt the key from KMS and perform Base64 decoding.
                byte[] key = decrypt(ciphertext);
                // Set the header.
                setHeader(httpExchange, key);
                // Return the Base64-decoded key.
                OutputStream responseBody = httpExchange.getResponseBody();
                responseBody.write(key);
                responseBody.close();
            }
        }
        private void setHeader(HttpExchange httpExchange, byte[] key) throws IOException {
            Headers responseHeaders = httpExchange.getResponseHeaders();
            responseHeaders.set("Access-Control-Allow-Origin", "*");
            httpExchange.sendResponseHeaders(HttpURLConnection.HTTP_OK, key.length);
        }
        /**
         * Calls the KMS decrypt operation and Base64-decodes the plaintext.
         * @param ciphertext
         * @return
         */
        private byte[] decrypt(String ciphertext) {
            DecryptKMSDataKeyRequest request = new DecryptKMSDataKeyRequest();
            request.setCipherText(ciphertext);
            request.setProtocol(ProtocolType.HTTPS);
            try {
                DecryptKMSDataKeyResponse response = client.getAcsResponse(request);
                String plaintext = response.getPlaintext();
                System.out.println("PlainText: " + plaintext);
                // Note: Base64 decoding is required.
                return Base64.decodeBase64(plaintext);
            } catch (ClientException e) {
                e.printStackTrace();
                return null;
            }
        }
        /**
         * Gets the ciphertext parameter from the URL.
         * @param httpExchange
         * @return
         */
        private String getCiphertext(HttpExchange httpExchange) {
            URI uri = httpExchange.getRequestURI();
            String queryString = uri.getQuery();
            String pattern = "CipherText=(\\w*)";
            Pattern r = Pattern.compile(pattern);
            Matcher m = r.matcher(queryString);
            if (m.find())
                return m.group(1);
            else {
                System.out.println("Not Found CipherText Param");
                return null;
            }
        }
    }
    /**
     * Starts the service.
     *
     * @throws IOException
     */
    private void serviceBootStrap() throws IOException {
        HttpServerProvider provider = HttpServerProvider.provider();
        // The listening port can be customized. The server can accept up to 30 concurrent requests.
        HttpServer httpserver = provider.createHttpServer(new InetSocketAddress(8099), 30);
        httpserver.createContext("/", new HlsDecryptHandler());
        httpserver.start();
        System.out.println("hls decrypt server started");
    }
    public static void main(String[] args) throws IOException {
        HlsDecryptServerNoToken server = new HlsDecryptServerNoToken();
        server.serviceBootStrap();
    }}

Workflow

• The player parses the EXT-X-KEY tag in the M3U8 file to obtain the decryption key URI, which corresponds to the value of the DecryptKeyUri parameter in the EncryptConfig.

• The player automatically requests the decryption endpoint to get the key, decrypts the TS files, and then plays the video.

Example

• Playback URL: https://demo.aliyundoc.com/encrypt-stream****-hd.m3u8

• Final request URL: https://demo.aliyundoc.com/encrypt-stream****-hd.m3u8

• Decryption URL: https://demo.aliyundoc.com?CipherText=ZjJmZGViNzUtZWY1Mi00Y2RlLTk3MTMtOT****

• Final decryption request URL: https://demo.aliyundoc.com?CipherText=ZjJmZGViNzUtZWY1Mi00Y2RlLTk3MTMtOT****