You’d have noticed that a lot of times videos on Netflix, Prime Video, or Disney plus are not at full resolution (1080p or 4K) on certain Android devices or Chrome browsers. One of the reasons for this is that their content is protected from piracy by Widevine DRM technology and only devices with higher security compatibility are allowed to stream the best quality content. 

You might be wondering, what Widevine is? Find out all about Widevine DRM, its security levels, compatibility, how it works, and more in this article.

What is Widevine DRM?

Widevine DRM is a widely used DRM licensing and encryption technology owned and maintained by Google. It protects your videos from being downloaded illegally on browsers such as Chrome, Firefox, and Edge. It also protects content on devices such as  Android devices, Android TV, and Chromecast. Widevine DRM is compatible with streaming by MPEG Dash and HLS.

One of the main reasons several OTT and e-learning platforms use Widevine DRM is to ensure they earn maximum revenues from their content by restricting illegal free distribution of their content due to video piracy. 

History Of Widevine DRM

Originally Widevine was a separate company from Google working on securing online videos on its own, till it was acquired by  Google.

Widevine technologies initially worked on digital rights management software which replaced smart cards based content security. This changed a lot of things as the cost of the card was removed along with the overall logistics involved with the distribution of the card. 

In 2010 Widevine was purchased by Google, in order to improve their support for media and entertainment video platforms. This further helped them speed up DRM encrypted video streaming on android with the help of adaptive streaming. 

Widevine has two different versions, i.e. classic and modular. 

Widevine Classic: 

Widevine Classic is the older version and it is only currently available for legacy devices such as older Android devices and smart TVs. It required that the content is in their proprietary .wvm format. The support for classic has now stopped as the latest devices only use the modular version of Widevine. 

Widevine Modular: 

Widevine Modular is the current version of Widevine, which is being widely used by all the Chromium-based browsers (but not Chromium) and Android-based devices. It supports the video streaming protocols such as MPEG-DASH, HLS, as well as  CMAF, CENC, and HTML5 standards such as EME(Encrypted Media Extensions) & MSE.

A Refresher On Widevine DRM

If you are someone who isn’t really clear on what DRM is, I’ll briefly explain to you what exactly DRM is and how it works. Otherwise, you can just jump on to the next section using this link. 

DRM or Digital Rights Management is a way to protect your content from any unauthorized use. You can set restrictions on the use of your video so that you have complete control over who accesses it. 

Video DRM solutions protect your content by keeping the encryption key for the content safe. Usually, even with strong encryption, videos were easily downloaded by various tools, as they were able to identify the key and used it to download the videos. With DRM, you can’t access the key as it is hidden in a BlackBox setup called CDM.  

Another key DRM is Apple’s Fairplay DRM and is used along with Widevine DRM. Find out more about video DRM and multi DRM strategy in the article linked.

Widevine DRM Security Levels: L1, L2, L3

Google Widevine DRM provides three security levels based on either the security used on hardware or software level. The three levels are Widevine L1, L2 & L3.

Before I go further into the security levels, it is important to know about TEE or Trusted Execution Environment, and how it is related to security levels. What TEE essentially does is that it makes sure that either of the decryption keys and decryption videos remains protected and can’t be stolen.

Widevine L1

Widevine L1 is the highest level of security in Widevine. Here the security is at the hardware level. Most modern Android devices support Widevine L1 but still, there are a considerable number of devices with L3 security.

Many movie platforms like Netflix purposefully restrict full HD playback to only L1 devices. This is due to the fact that L1 devices can block screen capture with 100% security in mobile apps. 

Though this decision of basing the quality of video on Widevine security level, is a sole choice of platform/content provider and there are no compulsory rules around it. Many other movie platforms and course video websites/apps provide HD playback in all security levels.

For Widevine L1, TEE does all the video decryption, decoding, and processing.

Widevine L1 uses hardware-based security features and trusted execution environments (TEE) to ensure the highest level of security against unauthorized access and content piracy.

Devices that support Widevine L1 have specialized security hardware that enables the decryption and playback of encrypted content within a secure environment. 

This makes it extremely challenging for hackers and unauthorized parties to intercept or tamper with the protected content.

This is why, Widevine L1 is being widely used to stream premium content.

Widevine L2

In Widevine L2 only video decryption happens in TEE, while video processing happens out of TEE. 

Widevine L2 is not used for mobile devices. 

Widevine L3

Widevine L3 is the first level of Widevine security. L3 Devices don’t have TEE, and the protection here is only software-based. Many old phones, especially budget phones have L3. 

It provides a moderate level of protection and is usually there on lower-end devices. Standard-definition content is usually streamed on devices using Widevine L3. Although being the least secure Widevine version, it does provide some encryption and content protection

Widevine L3 is usually available on mid-range and lower-end smartphones, older smart TVs, and other budget-friendly devices and is available to a broader audience. But with its lower security, it can be susceptible to various vulnerabilities and attacks as it lacks the hardware-backed security features of Widevine L1.  

This is why in order to address this vulnerability, content platforms usually stream their higher-quality content on Widevine L2 or Widevine L1 devices.

Widevine L1 vs L3: Difference between the two Widevine security levels

The major differences between Widevine L1 and Widevine L3 is the security and content protection they offer.

Security Level:

• Widevine L1:
  •  Widevine L1 is the highest security level.
  • Robust encryption and hardware-based security measures 
  • L1 is designed for devices that have trusted execution environments (TEE) 

• Widevine L3: 
  • Widevine L3 is the lowest security level among the Widevine options. 
  • Basic level of encryption and content protection

• Device Compatibility:
  • Widevine L1: 
    •  Widevine L1 is supported on higher-end devices with dedicated security hardware like premium smartphones, smart TVs, and certain streaming devices. 
  • Widevine L3: 
    • Widevine L3 is more widely compatible with various devices, including mid-range and lower-end smartphones, older smart TVs, and other budget-friendly devices. 
    • It can operate on a broader range of hardware since it doesn’t require specialized security hardware like Widevine L1.
• Content Resolution:
  • Widevine L1: 
    • Widevine L1 enables the playback of high-definition (HD) and 4K content with full resolution and quality.
  • Widevine L3:
    • • Widevine L3 is suitable for protecting standard-definition (SD) content and lower-quality media streams.

Google Widevine DRM Compatibility

Now that we’ve gone through the security levels and know what devices support which level of security. Let’s take a look at the overall compatibility of Widevine DRM with other devices. These are the devices that support Widevine DRM playback.
Desktop/Laptop Chrome, Firefox, Edge Browsers (Windows Version 7 & higher)

• Android Chrome, Edge, Firefox browsers. (Android Version 5 & higher)
• Android App (Android Version>5). Native Apps are supported, web view apps are not well supported.
• Android TV
• Chromecast

Widevine CDM Supports 2 billion Global Devices

There are currently 2 billion monthly active installs for Android devices, and another 2 billion active installs of the Chrome Desktop application. These stats signify that Widevine is by far the most relevant DRM system out there. Widevine DRM is an essential component of any multi-DRM strategy for premium content.

How Does Google Widevine DRM Work?

There’s a lot that goes on behind the scenes when you click ‘play’ on a video and when you are finally able to see it. 

In Widevine DRM, secure decryption is done via a series of exchanges between the Content Decryption Module and the Widevine DRM license server.  The HTML5 video player acts as a mediator for these exchanges. Although, by itself, the player cannot read the encrypted license or video.

These are the following steps that take place to decrypt a video for playback:

1. Video is received from the CDN or Content Delivery Network 

When you press the ‘play button, at first your browser’s media engine will identify whether the video is encrypted or not. After identifying it, ‘initData’ or initialization data is taken by the browser and is sent to your player.

2. Data is passed to the CDM or Content Decryption Module

After this, your video player sends the data to CDM.

3. Player receives the license request from CDM

After receiving the data from the player, CDM creates a license request and then passes the license back to the player

4. Widevine License server receives the request from the player

In the next step, the Widevine license server receives the license request from your video player.. 

5. Player receives the license from server

Upon receiving the request, the license server sends the Widevine license to the video player through an encrypted message.

6. CDM receives the license from the player

The Player then sends the license to  CDM

7. OEMCrypto Module receives the data from CDM

The OEMCrypto module then receives the data from CDM and the actual decryption happens.

8. Video player receives the video chunks from OEMCrypto Module

After the video is decrypted and decoded, it is then sent to your video player in small chunks. The viewer is able to play the video and security is also ensured. And voila, you get video playback on your device.

Now that you are aware of how Widevine DRM works, let’s have a look at its implementation. Having implemented Widevine DRM for more than 2000 customers, we can claim that

How Do The Widevine DRM Components Flow Together As A Platform?

Widevine’s DRM components work together with each other in order to provide you with an end to end solution for protecting your video content. It includes all the tools right from the content preparation stage to streaming it on any device. 

The Widevine DRM component flow starts with preparing your videos with Shaka packager for adaptive bitrate streaming. Once the videos in different quality are prepared,they are encrypted with license and are stored in the widevine license server. 

On a later stage, widevine drm license server gives the license info to the video player, whenever the encrypted video is streamed to the player via CDN.

Encrypted video is then sent to the device’s CDM( Content Decryption module), which enables the secure video playback with OEMCrypto Module.

 How does Dynamic Adaptive Streaming Work In Widevine DRM?

In the below image you will see how different segments of video play at different time based on the current bandwidth of the users. If the current bandwidth of the user is low, a chunk with lower quality will stream and as the bandwidth improves a better quality segment will be streamed. Yellow chunks are the videon chunk being played based on the bandwidth detected.

Components for Android in Widevine DRM

The flow in android is similar to the usual widevine DRM flow. The major difference is here that here low level Andoid APi methods are user. You also have the option of using Exoplayer as a sample  application, library, or reference player for A/B testing.

VdoCipher’s Widevine DRM Architecture + Streaming Setup

Widevine is Google’s video DRM architecture which enables content creators to stream protected content. Widevine is chiefly supported by devices and software running on Google’s ecosystem. On desktop devices, Widevine DRM is supported by Chrome, Firefox & Opera browsers via Widevine CDM, and is supported by Android devices. Widevine also enables the streaming of protected content via Google Chromecast and Android TV. This ensures that users have the best HD streaming experience while keeping the revenue interests of the content provider at the front.

At VdoCipher we have incorporated the Widevine architecture as part of our streaming infrastructure. It includes transcoding and encryption, adaptive streaming, and communication with the DRM server for secure decryption.

The ultimate endorsement for any Digital Rights Management system is having certifications from Hollywood studios. They have millions of dollars on the line when they make their content available via online streaming. Hollywood’s Digital Entertainment Content Ecosystem (DECE) endorses Widevine’s DRM for streaming videos. Netflix and Amazon Instant Video use Widevine DRM for streaming on Chrome and Android devices. At VdoCipher our aim is to provide a complete video streaming solution that handles everything from user experience to content protection for our users. In this blog, I detail how VdoCipher makes Widevine available for all users.

• • Video Upload – You can upload videos through the dashboard, or using our upload APIs
  • Video Processing –
    • Encoding – Videos are encoded at multiple bitrates
    • File encryption (using CENC).
    • Video File packaging and Key generation from the DRM license server
  • Video Management using APIs
  • Encrypted video files are stored on Amazon Cloudfront and Google Cloud Platform CDN Edge locations to ensure fast video streaming
  • Video player customizations
    • Player theme change
    • Overlays/buttons over video
  • Secure Video playback
    • Embed Code to generate Dynamic URLs (HTTP Post request including client secret key to get unique OTP)
    • Unique OTP is then sent by the DRM license server
    • Encrypted video file is decrypted in Browser/ Device’s trusted environment. Video is rendered via the video player, which can switch across different streams of different bitrates.
  • Dynamic watermarking to deter screen capture

Widevine is still an emerging technology. As I mentioned earlier, although ubiquitously supported by Google’s ecosystem (and Firefox), Widevine is not supported by Microsoft’s Internet Explorer or by Apple. For content creators wishing to stream across all devices and software, they need a multi-DRM strategy. At VdoCipher we provide Widevine for Chrome, Fairplay for Apple devices. This multi-DRM strategy ensures that content providers can fully rely on VdoCipher for distributing content on all devices.

Widevine CDM for Delivering the Best User Experience

No plugins are necessary because of Native Widevine CDM

VdoCipher’s implementation of Widevine DRM makes sure that videos are played on Desktop devices using the native HTML5 video player. Inherently google devices & browsers have Widevine CDM (Content Decryption Module), which allows for this hardware-based secure HTML5 playback.

Highest Quality Adaptive Streaming with DASH

• VdoCipher’s implementation of Widevine also makes use of the DASH streaming protocol. It is an open-source and widely adopted video streaming standard.  DASH ensures that the same video file can be used across all devices (with the exception of iPhone). This considerably reduces the storage requirements on Server/Content Delivery Network, as they only need to store one file container that would stream on most devices.
• The most valuable aspect of DASH protocol is adaptive playback,  to stream the best quality for given network bandwidth. In the urban locations where users watch videos, the network connections can often fluctuate wildly. This can be because the viewer may be watching while traveling, or that more people are logging in to the shared network at the same time. VdoCipher video player monitors the user’s network quality. Then it streams the best possible resolution for that given network quality.
• DASH is also used for streaming via HTTP, which is not blocked by firewalls, which is the case for streaming formats such as RTMP.

Encrypted Streaming + DRM License 

Video Encoding at multiple bitrates

As mentioned in the previous section, video streaming in urban networks requires adaptive bitrate streaming. The video encoding process optimizes the video size to deliver the highest quality at the lowest bitrate. The most popular video codecs in use today are H.264 and VP9. SD resolution streams are encoded using H.264 codec, which has the widest decoder support. On the other hand, HD resolution streams are encoded using VP9. This is done for the delivery of 1080p streams to devices such as Android TV. As of February 2018, hardware-level decryption for Widevine-encrypted streams are available for Smart TVs by the following device makers: LG (WebOS), Panasonic (FirefoxOS), Philips (AndroidTV), Samsung (Tizen), Sharp Aquos (AndroidTV), Sony Bravia (AndroidTV. Different files of different bitrate and resolutions are broken down into fragmented MP4 segments of equal length.

Videos files of different bitrates are each encrypted with CENC

In Widevine DRM each individual video track is separately encrypted, using CENC (Common encryption Scheme). CENC ensures that each video segment is encrypted only once. The keys can be reused by different supporting DRMs (such as Playready). Fairplay has not yet made this API available, thus Fairplay streams have to be separately encoded currently.

VdoCipher communicates with the Widevine license server to send the content decryption keys

On packaging and encrypting the video, the VdoCipher packager requests for content decryption keys from the Widevine DRM license server. Widevine DRM license server subsequently returns this data to VdoCipher.

The information regarding the encryption/ decryption key is then inserted to the Media Presentation Description (MPD). This information can only be understood by the black-boxed Content Decryption module inside the browser/ device.  It uses the info to prepare a  DRM license request from the Widevine license server.

Make Highly Specific DRM Licenses with VdoCipher

Using VdoCipher’s  Widevine DRM architecture, you can create highly specific DRM licenses at the time of video upload. For instance, you can limit HD Streaming only to devices that support L1 video decryption (wherein decryption and decoding are both hardware-based). You can limit devices having L3 security (Widevine CDM is limited to browser) to only SD playback. Hollywood studios and DECE often require streaming services to follow this policy, giving higher priority of security for HD video content.

Licenses also enable you to have a rental model in addition to a transaction video-on-demand model. Most Electronic Sell-Through platforms such as iTunes and Google Play Movies enable their users to either rent films for a period of time or purchase the license outright for unlimited viewings. Options to rent films tend to limit users to only view the film within a period of 48 hours from first starting playback. VdoCipher’s implementation of a DRM license enables you to customize for how long a license is valid once it has been served for the first time.

Automate Video Workflow with Developer-Friendly APIs

At VdoCipher we have designed our service to be API first. We also have a video dashboard that you can automatically use to manage your videos. Using our APIs you can automate the flow of video that you upload to our AWS servers.

Basic features we provide for automated video management are:

• Upload APIs
  • Upload videos using Dashboard
  • Import/Upload videos using API
    • HTTP PUT request to dev.vdocipher.com/api/videos with title of video
    • curl -X PUT https://dev.vdocipher.com/api/videos?title=title-of-video -H  "accept: application/json" -H "content-type: application/json" -H "Authorization: Apisecret 1234567890"
    • This returns a JSON string that includes an upload key, a playback policy and the AWS S3 bucket endpoint, to which you send an HTTP POST request with the file to be uploaded.
  • Import videos from URL through both Dashboard
  • Import videos using API
    • HTTP PUT request to dev.vdocipher.com/api/videos/importURL with url of video
    • curl -X PUT https://dev.vdocipher.com/api/videos/importUrl -H  "accept: application/json" -H "content-type: application/json" -H  "Authorization: Apisecret 12345567890" -d "{ "url": "string"}"
    • Your video would be ready for encoding, encryption and packaging
• Add and Retrieve tags using APIs:
  • GET Request to dev.vdocipher.com/api/videos/tags to retrieve list of tags for the given user account
  • POST Request to dev.vdocipher.com/api/videos/tags to bulk add tags to a group of videos
  • PUT Request to dev.vdocipher.com/api/videos/tags to set tags for a single video and to delete previous tag records
• Retrieve video-based information (including Poster image, video file size)
  • GET Request to dev.vdocipher.com/api/videos/{videoID}
  • POST Request to dev.vdocipher.com/api/videos/{videoID} to update video related information
  • PUT Request to dev.vdocipher.com/api/videos/{videoID} to upload new version of a video
• Video Pagination for retrieving a list of most popular videos

We also have advanced APIs to enable our users to automate their workflow better. These include options to custom upload poster images (thumbnail) for maximizing user click rate and update specific parameters of your videos. Please get in touch with us if you require any help in automating your video workflow.

Detailed APIs are here. 

Encrypted Video Playback with DRM License

Videos are decrypted securely in the device by Widevine CDM with an encrypted license from the DRM license server

VdoCipher player acts as a blind messenger between the Widevine DRM license server and the Content Decryption Module (CDM) (which is either hardware-based or software-based). The VdoCipher player itself does not handle any license keys at any point directly.  It gets access to the final video stream when the CDM decrypts the stream for playback. In Desktops, CDM is bundled along with browsers.  In Android phones, the CDM is part of the hardware creating a Trusted Execution Environment. Note that whether software-based or hardware-based, the Content Decryption Module is closed-source.  The video player does not know how the CDM decrypts the key. It only uses the APIs which the Widevine CDM makes available for requesting & receiving the DRM license keys.

Android Devices have the highest level of security with Encryption, Screen Capture disabled

Using the Trusted Execution Environment in Android Devices, videos are decrypted and decoded in the trusted zone of the hardware.  It only then plays on the screen. The upshot of this is that Android devices, through client apps and websites,  are protected against screen capture. Screen Capture does not work while the video is playing in android chrome or the android app.

Viewer Specific Watermark feature to deter screen capture on Desktop

Screen recording software is sometimes used to pirate video streams from desktop chrome. We have developed our custom watermarking feature which prevents videos from being pirated. This deters users from recording online videos and sharing them illicitly with their peers.

Making Available Hollywood-grade Security For Your Videos

You can rest assured that if Hollywood studios, what with their multi-million dollar deals for films with online streaming services, trust a DRM solution, they would have done their due diligence on the security of the DRM. Widevine is the service that Netflix uses for its encrypted content.

Broadly speaking, Hollywood studios limit video playback at a resolution of 720p for Widevine’s L3 profile. In the L3 profile, the decryption is software-based, and the final video is rendered by the video player itself. Studios limit HD and Ultra-HD resolutions for devices that support L1 profile, which provides hardware-based decryption, decoding, and rendering. L1 profile of Widevine DRM is supported by most Android smartphones and AndroidTV. Please get back to us if you have similar requests.

For a Free Full version 5 GB Trial with Widevine DRM, Click here.

 

Widevine DRM Glossary

Here’s a glossary of terms related to Widevine DRM

Shaka HTML5 Video player

WIth Widevine DRM you get the Shaka video player, for any platform which supports htm5. Shaka player ensures secure video playback online. Shaka player is an open-source js video player. It binds the Video Element and Widevine CDM by consuming the EME API. VdoCipher already contains a pre-integrated Shaka player in its product. 

Android player for Widevine DRM

You can develop your own native Android player using the Java Platform APIs or a web application using HTML5 and JavaScript APIs. MPEG DASH and CENC are open standards that the Android player supports. VdoCipher APIS and SDK already include DRM solution + video player for integration in Android apps.

Media Source Extensions (MSE)

They are used to parse the incoming DASH-based media streams and pass them to the playback hardware. The Media Source extension to the HTML5 Media element specification can be found at http://www.w3.org/TR/media-source/

OEMCrypto Module 

The OEMCrypto Module decrypts the content using information passed to it from the Player (and the License Server). The OEMCrypto Module is in the Trusted Layer of the device and is tied into the device hardware. It uses the encrypted license information to decrypt the media, and the media sent to the video stack

Encrypted Media Extension (EME)

Encrypted Media Extensions (EME) uses the Common Encryption format as part of the Widevine DRM end-to-end security protocol, making sure that your video can’t be downloaded. Being a W3C recommended standard, the streaming application can be used across different browser engines regardless of the DRM system in use. 

Widevine DRM Compatibility

Widevine DRM is not compatible across all devices and browsers. In fact, every DRM service has some restrictions on compatibility. Google Widevine DRM is compatible with Chrome, Firefox, Edge browsers on Desktop and Android, Chromecast, Android TV. Android phone devices come with 2 levels of Google Widevine DRM security- Level L1 & Level L3. L1 devices are compatible with higher security features than L3.

Widevine DRM License Server

Widevine DRM license server is a server setup, which is central to the encoding, encryption, and video playback system. It authenticates each and every video playback and makes sure that raw video can not be downloaded. 

Widevine DRM License

Widevine DRM license is an authentication mechanism that makes sure that your content can be only accessed according to the required security protocols. In simpler terms, Widevine DRM license is the authentication system used to play an encrypted video on a device. 

CDM (Content Decryption Module)

Widevine CDM can be considered as a BlackBox which is pre-installed in supported browsers and devices, ensuring DRM video playback. Widevine CDM ensures that the key exchange mechanism remains secure. Google Chrome and Mozilla Firefox have Widevine CDM pre-installed in them.

Android DRM

Google Widevine DRM can be considered as Android DRM. Android supports video security in online and offline videos through Google Widevine DRM. Widevine DRM ensures secure licensed decryption of videos in the Chrome, Firefox, Edge browser on Android, Android Native App and prevents video download attempts from any hacks, extensions or plugins, etc.

Chrome DRM

Google Chrome browser supports the security of online videos through Google Widevine DRM. This DRM ensures secure licensed decryption of videos in the Chrome browser and prevents video download attempted from any hacks, extensions or plugins, etc. Chrome enables Widevine through CDM (Content Decryption Module). Chrome in Desktop (Windows, Mac, Linux), and Android both support Widevine DRM.

FAQs:

How do you implement Widevine DRM?

To implement Widevine DRM, your setup needs a license server along with specific encoding, video playback, and packaging. You can build your own license server or try to get a Google license on your own if you have a large development team and lots of time on your hands or opt for a product provider like VdoCipher with widevine drm license server offering.

What is Widevine used for?

Widevine DRM is widely used to protect your videos from being downloaded illegally on browsers such as Chrome, Firefox, and Edge. It also protects content on devices such as  Android devices, Android TV, and Chromecast. Learn more about Android Video SDK to stream widevine supported content with VdoCipher.

What is Android Widevine?

Android Widevine and Widevine DRM can be considered the same thing. Widevine DRM protects content in Android for both offline and online modes. Also depending on the security level of the devices,  screen recording can be blocked.

What DRM does Netflix use?

Netflix uses a multi-DRM strategy, which includes using multiple DRM such as Widevine, Fairplay, and Playready DRM to secure videos from piracy in Android, IOS, Desktop, and Smart TVs. We have also written a separate blog explaining Netflix DRM.

How do I check my Android device’s Widevine level?

You can download and install the DRM Info app from the play store. Open the app and scroll down to the Widevine CDM section. Here, check the Security Level. You’ll either see L1 or L3.

How do I enable DRM on my browser?

To enable DRM in  Chrome, go to chrome://settings/content and enable “protected content” In Firefox, go to about:preferences and ensure “Play DRM-controlled content” is enabled, and that about: addons (in the plugins tab) Widevine is enabled.

What Is A DRM Solution?

DRM Software or DRM System is essentially a Digital Rights Management Software, which ensures that your content is only accessible by anyone you authorize. You can use Video DRM Software to make sure that your content is only accessible by the user you authorize and you can even manage the browser or devices they consume your content on.