Alibaba Cloud Video Encryption (License-based Private Encryption)

Background

Optimal playback for short-form drama

1. Need for faster startup: Alibaba Cloud Video Encryption (Private Encryption) requires an extra HTTP request to fetch a playback credential and obtain video key information for decryption. This increases the first-frame load time. While this method is suitable for long-form videos where an instant start is not critical, it can create performance bottlenecks for services like short-form dramas that are sensitive to startup speed.

2. Serving a global user base: For global businesses with a widely distributed user base, such as short-form dramas for international markets, requiring each playback to request a decryption key from a central server puts high demands on network stability and can degrade the viewing experience. To balance security and performance, Alibaba Cloud introduced Alibaba Cloud Video Encryption (License-based Private Encryption). By reducing requests to the central server, this solution significantly improves playback smoothness and stability for global users.

Advantages of License-based Private Encryption

In short video and short-form drama scenarios, smooth scrolling and instant startup are critical, especially on weak networks. Alibaba Cloud Video Encryption (License-based Private Encryption) enables playback directly from the encrypted video URL, eliminating the extra HTTP request so that the playback flow matches a standard video stream while maintaining video security.

Features

Alibaba Cloud Video Encryption (Private Encryption) encrypts the video file itself. Even if downloaded, the video remains encrypted, which prevents unauthorized redistribution. This makes video encryption widely used for copyrighted online content in online education, finance, corporate training, exclusive dramas, short videos, and short-form dramas.

The Alibaba Cloud Video Encryption (Private Encryption) algorithm provides strong security for video resources. Building on this foundation, Alibaba Cloud Video Encryption (License-based Private Encryption) further improves playback startup speed.

• Each media file has a unique encryption key, which prevents a single compromised key from causing widespread security issues.

• A comprehensive license management system ensures that only licensed ApsaraVideo Player SDK applications can play the video. For more information, see Configure License.

• ApsaraVideo VOD uses envelope encryption with a ciphertext key and a plaintext key. The plaintext key is never stored and exists only in memory during the process.

• ApsaraVideo VOD provides a secure player kernel SDK.

How it works

The Alibaba Cloud Video Encryption (License-based Private Encryption) solution includes two main stages: Encrypted Transcoding and Decrypted Playback.

• Encrypted transcoding

  1. Your application backend initiates video encryption

     Your application submits a transcoding job that requires data encryption.

  2. ApsaraVideo VOD obtains the encryption key

     The ApsaraVideo VOD service generates a plaintext key and a ciphertext key using Key Management Service (KMS).

  3. The video is encrypted and transcoded

     ApsaraVideo VOD encrypts, transcodes, and outputs the video.

  4. Transcoding is complete and a notification is sent

     ApsaraVideo VOD saves the encrypted video file and sends a notification to your application.

• Decrypted playback

  1. Retrieve the playback URL

     The mobile app retrieves the encrypted video URL from your application service. You must append the parameter etavirp_nuyila=1 to the URL before passing it to the player. This parameter can be placed anywhere in the URL and is required only for MP4 files. For HLS streams, you can use the original video URL without this parameter.

     1. Example 1: https://example.aliyundoc.com/test.mp4?etavirp_nuyila=1

     2. Example 2: https://example.aliyundoc.com/test.mp4?auth_key=xxxxx&etavirp_nuyila=1

  2. Decrypt and play the video

     Alibaba Cloud provides a secure player kernel SDK that recognizes the appended parameter, validates the video's license, and uses the internal encryption key to decrypt and play the content.

Usage notes

• Alibaba Cloud Video Encryption (License-based Private Encryption) is free of charge, but the encryption process requires video transcoding, which incurs fees. For more information, see Media Asset Transcoding Billing.

• This encryption method supports only HLS and MP4 output formats. Only the ApsaraVideo Player SDK provided by ApsaraVideo VOD can decrypt and play the encrypted content.

• Audio and video files encrypted with Alibaba Cloud Video Encryption (License-based Private Encryption) can be played only using the ApsaraVideo Player SDK for iOS or Android. For more information, see Player SDK compatibility for encrypted playback.

• Playback in web players is not supported. For web-based scenarios, we recommend using HLS standard encryption.

Procedure

Prerequisites

• ApsaraVideo VOD is activated. For instructions, see Activate ApsaraVideo VOD.

• You have configured an accelerated domain name in ApsaraVideo VOD. For instructions, see Add an accelerated domain name.

• If you want to use MP4 private encryption, you must obtain a license that includes player authorization before you create a transcoding template group. Otherwise, template creation will fail with an error such as License does not exist. For more information, see Manage License.

Encrypt a video

1. Create a transcoding template group for Alibaba Cloud Video Encryption (License-based Private Encryption).

   Console

   1. Log on to the ApsaraVideo VOD console. In the left-side navigation pane, choose Configuration Management > Media Processing > Transcoding Template Groups.

   2. On the Transcoding Template Groups page, click Create Transcoding Template Group.

      The following steps show how to configure a regular transcoding template for this encryption type:

      • In the Basics section, set Encapsulation Format to HLS (.m3u8+ts) or MP4 (.mp4).

      • In the Advanced Parameters section, enable License-based Alibaba Cloud Proprietary Cryptography.

      • Configure other parameters as needed. For more information, see Transcoding templates.

   3. Click Save.

      After the template is created, you can find its ID on the Transcoding Template Groups page. Save this ID to use when you initiate an encrypted transcoding job.

   API

   When you call the AddTranscodeTemplateGroup operation, set the EncryptType parameter within the EncryptSetting object of TranscodeTemplate to specify the encryption type for the transcoding template group.

2. (Optional) Create a workflow and associate it with the encryption transcoding template group.

   A workflow lets you orchestrate media processing tasks, such as transcoding, review, and snapshotting, into a defined sequence. When triggered by a media upload or processing event, the media file is automatically processed according to the predefined task flow.

   You can add a media transcoding node that is associated with an encryption transcoding template group to a workflow. Currently, workflows can be created only on the console. For more information, see Workflows.

3. Initiate an encrypted transcoding job.

   ApsaraVideo VOD lets you trigger transcoding during media upload and processing. You can initiate a job directly from a transcoding template group or from a workflow that includes a transcoding node. For instructions, see Step 2: Initiate a transcoding job for the console method and Step 2: Initiate a transcoding job for the API method.

4. View the transcoding result.

   Asynchronous notifications

   If you have configured event notifications for ApsaraVideo VOD, you can obtain transcoding job information by listening for Single Definition Transcoding Complete or All Definitions Transcoding Complete callback messages.

   Query task status

   Console

   1. Log on to the ApsaraVideo VOD console. In the left-side navigation pane, choose Media Files > Audio/Video.

   2. On the Audio/Video page, check the Status of the target video.

      When the video Status is Normal, it indicates that the transcoding for Alibaba Cloud Video Encryption (License-based Private Encryption) is complete and successful.

   3. Click Manage in the row of the video.

   4. Click the Video URL tab. The encrypted transcoding output is labeled Alibaba Cloud Private Encryption. For the Fluent definition, the output is in M3U8 format, and the format column displays the Alibaba Cloud Private Encryption identifier.

   API

   Call the GetPlayInfo operation. The EncryptType parameter in the response indicates the encryption type of the video stream.

Play video

Videos encrypted with Alibaba Cloud Video Encryption (License-based Private Encryption) can be decrypted and played only by using the ApsaraVideo Player SDK provided by ApsaraVideo VOD.

The ApsaraVideo Player SDK supports multiple platforms, including iOS, Android, and Web (H5 and Flash), allowing you to integrate encrypted playback into your applications and websites.

• Before you use the ApsaraVideo Player SDK, you must obtain a player license. For more information, see Manage License.

• Before you integrate the SDK, review the compatibility details for encrypted playback on different platforms. For more information, see Player SDK compatibility for encrypted playback.

• For instructions on how to play encrypted videos using the ApsaraVideo Player SDK, see Play an encrypted video.