Function Introduction

HLS standard encryption rewriting functionality refers to CDN nodes rewriting the #EXT-X-KEY tag after fetching the content of the M3U8 file from the origin. It adds encryption algorithm, key URI address, and authentication parameter information. When the client player receives the rewritten M3U8 file, it identifies the corresponding TS file as encrypted based on the #EXT-X-KEY tag. At this point, it will request the key content from the key URI address with authentication parameters, decrypt the TS data content based on the encryption algorithm and obtained key, and achieve video playback, ultimately achieving content copyright protection through HLS encryption.

Background Information

In video playback scenarios, preventing hotlinking and protecting copyright are usually of great concern. The HLS protocol provides a standard encryption scheme.

The HLS protocol uses many tags, which exist in the M3U8 index file. Among them, the #EXT-X-KEY tag is used to indicate whether TS files are encrypted. If this tag is present and not empty, it means the TS file is encrypted, and the client player needs to decrypt it before playback.

Common formats of the #EXT-X-KEY tag are: #EXT-X-KEY:METHOD=AES-128,URI="http://www.example.com/hls.key?token=xxx".

Its meaning is: using the AES-128 algorithm, the key is obtained through http://www.example.com/hls.key?token=xxx. After downloading the TS video in the M3U8 index file, it is decrypted using the AES-128 algorithm and the corresponding key for playback.

The technical principle of the entire process is as follows:

The client player sends a request to the CDN server, such as: http://www.example.com/test.m3u8?token=xxx.
The CDN server performs token authentication on the request. After authentication passes and if there is no cache, it fetches the original M3U8 file content from the origin and rewrites its body part, inserting the following content into the tag, and finally returns it to the client player: #EXT-X-KEY:METHOD=AES-128,URI="http://www.example.com/hls.key?token=xxx".
The client player downloads the M3U8 file and parses the EXT-X-KEY tag, then sends a request to http://www.example.com/hls.key?token=xxx.
The www.example.com server performs authentication, then returns the key information to the client player.
The client player continues to parse the M3U8 file and downloads the corresponding TS file content.
The client player decrypts the downloaded TS file content based on the AES-128 algorithm and the obtained key information for playback.

To prevent illegal clients from obtaining the decryption key based on the plaintext authentication address in M3U8, the following suggestions are provided:

The address for obtaining the key should be transmitted securely using HTTPS encryption to prevent the key from being hijacked during transmission.
The process of obtaining the key should undergo strict authentication. When the client player requests it, it should carry authentication parameters. The server should verify the legitimacy of the request. After authentication, it returns the key file.
It is best to encrypt the key itself. Even if the client player obtains the key, it also needs to obtain the decryption key of the key to use the key normally, thereby ensuring that only specific players can play encrypted TS content.
As part of the entire anti-hotlinking copyright protection solution, it is best to also do hotlinking authentication for TS file links. eSurfing Cloud CDN supports processing additions, deletions, and modifications to TS file URLs or parameters in M3U8, and supports inheriting authentication parameters from M3U8, so that the TS files corresponding to M3U8 also have the same authentication properties.

Applicable Scenarios

If a video website uses the HLS protocol and has strong requirements for copyright protection and preventing hotlinking, it can use encryption for TS files on the origin, coupled with the CDN's HLS standard encryption rewriting functionality, and combine it with strict authentication policies to achieve copyright protection for HLS videos.

Configuration Instructions

Currently, this feature does not support self-service activation by customers. If you need to use it, please contact our customer support team via hotline (852)31000000 or email global.noc@chinatelecomglobal.com.

Please provide the following information:

Parameter	Description and Example
Encryption Algorithm	The encryption algorithm for TS files, default is AES-128.
Key Address	The address for obtaining the encryption key of TS files, generally under the same acceleration domain, such as http://www.example.com/hls.key.
Key Address Authentication Parameters	Authentication parameters in the key address for obtaining the encryption key of TS files, default is the authentication parameters of the corresponding M3U8; if there are multiple parameter names in the M3U8, specify the specific parameter name.
Whether to Rewrite TS Files	Whether the TS file list in M3U8 needs to add authentication parameters. If so, please specify the specific authentication parameter key and value information to be added.

Content Delivery Network

HLS standard key override