Nimble Streamer DRM

Mandatory parameters must be included in every block, they are as follows.

• application defines space-separated list of names of applications where settings will be applied.
• type parameter defines the type of a key provider server.
• keyserver parameter defines the URL of a key server for specific key provider.

Optional parameters may be used in case when they are needed in specific cases.
By default Nimble Streamer generates unique content IDs itself, but if you need to override them you can use these parameters.

• widevine_hls_enabled = trueenables Widevine protection for HLS streams.
  Read Widevine DRM support for HLS article to learn more.
• content_id defines content ID for applications covered by current “drm” block.
• stream_name_to_content_id = truesets content ID to be generated based on individual stream names.
• content_ids defines the set of exact content IDs for each stream.
  Here’s an example.
  content_ids { stream1 = Se52m_stream1_id_0mVQ== stream2 = Se52m_stream2_id_0mVQ== stream3 = Se52m_stream3_id_0mVQ== }

Other parameters are specific to the key provider, they’ll be described in each section.

drm {
  application = live_ezdrm
  type = ezdrm
  user = [email protected]
  password = 12yourpassword34&*@#
}

Mandatory parameters define EZDRM access credentials:

• user is user name in EZDRM
• password is that user’s password

drm {
  application = live_drm
  type = axinom
  axinom_tenant_id = <Key Service Tenant ID>
  axinom_management_key = <Key Service Management Key>
  content_id = <put your Content ID here>
  content_ids {
    stream1 = 1232345-8602-11ea-b04b-7fccdabcdef2
    stream2 = 1232345-8602-11ea-b04b-7fccdabcdef3
  }
}

A specified Content ID (an UUID) is used in SPEKE request as both the Content ID (content_id) and Key ID (kid).
Multiple Key IDs for a single stream are currently not supported.
content_id is a default value for the whole application. If you want to set a specific key for a specific stream, you can use content_ids option and specify the stream-specific values.

Mandatory parameters define Axinom access credentials:

• axinom_tenant_id is Key Service Tenant ID
• axinom_management_key is Key Service Management Key
• content_id and content_ids are required for respective content encryption, see above

drm {
  application = live_drm
  type = cloud_drm
  keyserver = <SPEKE 2 API URL>
  cloud_drm_login = <basic_auth_login>
  cloud_drm_password = <basic_auth_password>
  content_id = 1232345-8602-11ea-b04b-7fccdabcdef1
  content_ids {
    stream1 = 1232345-8602-11ea-b04b-7fccdabcdef2
    stream2 = 1232345-8602-11ea-b04b-7fccdabcdef3
  }
}

Mandatory parameters define Cloud DRM access credentials:

• keyserver is SPEKE 2 API URL
• cloud_drm_login and cloud_drm_password are user and password
• content_id and content_ids are required for respective content encryption

drm {
  application = live_keyos
  type = keyos
  keyos_user_certificate_file = /home/user/keyos/conf/keyos_user.crt
  keyos_user_key_file = /home/user/keyos/conf/keyos_user.key
}

Mandatory parameters define KeyOS access credentials:

• keyos_user_certificate_file is an end user’s public x509 certificate
• keyos_user_key_file is an end user’s x509 private key file

Optional content IDs. You may set content_id and content_ids parameters like in other cases but they must be set in UUID format, e.g.
content_id = 2193eb5b-544b-1234-abcd-1e94b0f778b8

drm {
  application = live_pally
  type = pallycon
  pallycon_kms_token = yourtoken
}

Mandatory parameter define access token:

• pallycon_kms_token is a token for accessing PallyCon

drm {
  application = live_sigma
  type = sigma_drm
  sigma_drm_token = <token>
  sigma_drm_merchant_id = <merchant_id>
  sigma_drm_app_id = <app_id>
}

Mandatory parameter define access token:

• sigma_drm_token is a token to access Sigma DRM CPIX API
• sigma_drm_merchant_id is a merhant ID with Sigma DRM
• sigma_drm_app_id is an application ID with Sigma DRM

drm {
  application = live_drmtoday vod_drmtoday
  type = drmtoday

  drmtoday_user = <user_name>
  drmtoday_password = <user_password>
  drmtoday_merchant_id = <organization UUID>
  drmtoday_cpix_config_id = <CPIX config ID>

  content_id = movie
  content_ids {
    stream1 = movie1
    stream2 = movie2
  }
}

In order to get user_name and user_password, you need to create API account (without DRMToday dashboard access) in “Members / Users” section.

Organization UUID can be obtained in API endpoints in DRMToday dashboard

CPIX config ID can be created in “Configuration -> Ingest settings”

If Nimble is working in DRMToday staging environment then you need to add the following

keyserver = https://fe.staging.drmtoday.com/
drmtoday_auth_url = https://auth.staging.drmtoday.com/cas/v1/tickets

content_id / content_ids is the Asset ID in DRMToday dashboard.

drm {
  application = live_wv1 live_wv2 live_wv3
  keyserver = https://license.uat.widevine.com/cenc/getcontentkey/widevine_test
  type = widevine
  widevine_signer = widevine_test
  widevine_aes_signing_key = 1ae8ccd0e7985cc0b6203a55855a1034afc252980e970ca90e5202689f947ab9
  widevine_aes_signing_iv = d58ce954203b7c9a9a9d467f59839249
}

Mandatory parameters define Widevine-specific behavior:

• widevine_signer, widevine_aes_signing_key, widevine_aes_signing_iv

Optional parameters describe key rotation:

• key_rotation_interval parameter defines the interval for rotating keys where it’s applicable. It’s defined in seconds. If it’s set to “0”, then keys will not be rotated.
• key_count parameter defines how many keys will be taken from a key server at once for further rotation.

drm {
  application = live_vcas
  keyserver = http://key_server_ip:8058
  type = vcas_cpix
}

Optional parameters may be used in case when they are needed in specific cases.

• key_id defines key ID for applications covered by current “drm” block.
• key_ids defines the set of exact key IDs for each stream.
  Here’s an example.
  key_id = 54f7d90a-bc2f-bc9b-08d4-bbeac4ccf08b key_ids { stream1 = 7dfb3eb6-677e-11eb-a5a9-b754f57205c9 stream2 = 82ea16f4-677e-11eb-81e0-6f945b12648a }

drm {
  application = live_vcas
  keyserver = http://key_server_ip:8058
  type = vcas_cei
}

Verimatrix allows using key rotation, it’s optional:

• key_rotation_interval parameter defines the interval for rotating keys where it’s applicable. If it’s set to “0”, then keys will not be rotated.
• key_count parameter defines how many keys will be taken from a key server at once for further rotation.

Verimatrix has other optional parameters like this one:

• vcas_encoder_token parameter defines the token for certain cloud scenarios.

drm {
  application = live_aes
  type = hls_aes128
  key = 78E9A33351234FBDD0EF6C233B310F55
}

This feature has optional parameter:

• key_url parameter defines the URL for key if it’s not handled by Nimble Streamer.