HLS Encryption: How to Encrypt Videos in AES-128 For HTTP Live Streaming [2021 Update]
Table of Contents
As piracy and hacking continue to increase each year, broadcasters should be concerned with securing their video content. That’s because the U.S. Chamber of Commerce estimated $29.2 billion of lost revenue from piracy.
Data breaches, unauthorized video sharing, and hacks, therefore, can be a substantial cost for many companies. That’s why protecting video content and securely delivering streams to users should be a broadcasting best practice.
First, we’ll cover what video encryption is and why it matters. Then we’ll dive into the HLS streaming protocol and how AES-128 encryption works. Finally, we’ll look at the key features necessary for a secure cloud video platform.
Table of Contents:
- What is Video Encryption?
- Why Does Protecting Video Content Matter?
- The HLS Protocol
- HLS Encryption Explained
- 4 Key Features of Secure Video Clouds
- Dacast Video Platform
What is Video Encryption?
Encryption is a method for masking data so that only authorized users can decrypt and access a file. It’s a part of cryptography, which is a field of study devoted to the secure communication of information or data.
Over the years, a multitude of encryption algorithms has been developed with varying levels of security. Most algorithms, however, scramble the data into what’s called ciphertext and require the receiving party to use a key to reassemble the data back into plaintext.
Can You Encrypt Video?
While it’s straightforward to understand the encryption of text documents, how exactly does video encryption work?
Video encryption allows broadcasters to scramble their video content using a secure algorithm and transmit the data to viewers. Authorized viewers can then decode the video and watch it.
Many broadcasters encrypt not only stored video content, but also streaming video to prevent unauthorized third parties from accessing the content in transit.
Why Does Protecting Video Content Matter?
Broadcasters usually have one or more reasons for protecting videos, from keeping sensitive information safe to implementing digital rights management or ensuring proper monetization of content.
- Sensitive Information: Many organizations use video streams for internal meetings and events that shouldn’t be available to the public. If these videos aren’t protected, the company could risk violating industry regulations or leaking information to competitors.
- Digital Rights Management: Video encryption is a critical aspect of digital rights management (DRM), which broadcasters require for a variety of reasons. For example, geographical regions—such as the People’s Republic of China (PRC)—may have specific regulations or censorship limiting who can view certain types of content.
- Monetization: Brands may have video streams at various price points that need access controls as well, such as charging more for high-definition videos or ad-free content. The ability to safely accept payment from viewers and ensure video content isn’t pirated are both crucial for monetization.
The HLS Streaming Protocol
Video streaming requires sending enormous amounts of data to viewers. RAW video files are too large, so broadcasters must encode videos into a compressed format using a codec like H.264 advanced video coding to reduce the file size.
A video stream also requires choosing a container format, which encompasses the necessary video, audio, and metadata. Most broadcasters choose the MP4 format because it’s compatible with a wide range of devices.
Finally, broadcasters need to choose a self-hosted video delivery method or private hosting. Two of the most common are the HLS streaming protocol and RTMP. These are standardized methods for transmitting video and audio data over the Internet as a continuous stream rather than a single file download.
What is HLS Streaming?
HTTP Live Streaming (HLS) is a protocol that splits video streams into chunks that are transferred and reassembled within the user’s video player. In most cases, the video player is an HTML5 or Video.js player that offers playback natively in the user’s web browser.
Pure HTML5 playback without a streaming protocol requires downloading the entire video file during initiation. That’s why it’s crucial to break down videos into smaller files so that playback can start faster and there’s less wasted data.
In contrast to RTMP, the HLS protocol leverages HTTP to transfer video content in chunks to viewers. That means broadcasters can use a standard server or video content delivery network (CDN) to store and deliver video content. With HLS streaming, broadcasters can scale their streams to reach a much larger audience without compromising on quality.
HLS streaming is used by most broadcasters because it’s the protocol supported by HTML5 players. These video players—which are built into web browsers—have become the default playback method rather than Flash. HLS streams, therefore, are supported by nearly every device from tablets to laptops and smart TVs.
What is Adaptive Bitrate Streaming?
Moreover, HLS is an adaptive bitrate streaming (ABR) protocol. That means broadcasters offer multiple variants of a particular stream at different bitrates or levels of quality.
These separate streams are split into 2 to 10-second segments and indexed in a manifest file. Then an adaptive video player can use the manifest file to choose the optimum video segment based on network conditions and the user’s device.
ABR streaming is crucial for broadcasters that want to offer the best viewing experience possible for their viewers.
HLS Encryption Explained
While there are many types of encryption algorithms, the most commonly used method for HLS is AES-128. Advanced Encryption Standard (AES) is a block cipher that encrypts and decrypts data in 128-bit blocks. Here are the basics of how AES-128 works.
How Does AES 128 Encryption Work?
The first block is encrypted using an initialization vector (IV)—or 16-byte random value—and the next block uses this to start the encryption process. Each subsequent block uses ciphertext from the preceding block for encryption in a method known as cipher block chaining (CBC).
As AES is a symmetric key algorithm, there needs to be a secret key that’s used for both encryption and decryption. That means the broadcaster encrypts the video using the key and the viewer’s browser decrypts it using the same key.
AES has seen widespread adoption because it’s straightforward to implement and safe enough for general use. The U.S. Government even uses the algorithm for encrypting sensitive data, and it’s the way most digital rights management (DRM) systems protect media.
HLS Encryption Methods
While the HLS supports AES-128 encryption, there are two different ways to implement the standard in practice.
Broadcasters can use one key to encrypt the entire video stream, but that also means the whole stream is unprotected if the secret key is intercepted by an unauthorized third party.
Alternatively, each segment of a stream can be encrypted with a different key. That way, only a few seconds of video can be accessed with each specific key. Broadcasters might choose this method if the video content their sharing is highly sensitive.
4 Key Features of Secure Video Clouds
1. AES Encryption
When it comes to AES video encryption, there is often a debate over which key length to use for AES: 128-bit or 256-bit. In general, a larger key is harder to compromise with a brute force attack, but a simple calculation shows that even a 128-bit key would take far too long to crack.
That’s why the ability to protect the secret key from unwanted third parties is far more critical than the key size. As long as the cloud platform uses at least AES-128 encryptions, the videos should be safe from brute force attacks.
Larger key sizes also require more computing power, but most modern devices can handle decrypting AES-256 without performance issues. Be sure to consider your target audience and the quality of devices they’ll use for streaming before choosing an encryption algorithm for your content.
2. Manifest File
The HLS manifest file—or M3U8 playlist—is necessary for video players to select and retrieve the right video segments for ABR streaming. In addition, the manifest file contains the secret encryption key for each video segment.
If there’s an overall AES key being used, it will appear in the manifest file as a link after the EXT-X-KEY tag. This file should be served over HTTPS and require authentication to minimize the risk of this key being exposed to eavesdroppers.
Many streaming platforms rotate these AES keys at regular intervals, so there’s a lower chance that they get compromised during streams. In general, the more frequently keys are rotated or refreshed, the more secure the video content will be.
3. HTTPS Delivery
HTTPS is a way of transferring data using HTTP (Hyper-Text Transfer Protocol) that’s secured using Secure Sockets Layer (SSL). SSL was later renamed to transport layer security (TLS), but the end goal is the same: to prevent hackers from intercepting data in transit.
With HTTPS, a server is secured using an SSL certificate that’s issued by a certificate authority (CA). When users connect to a server with a valid certificate, data transferred between the two parties will automatically be encrypted.
When using AES encryption with HLS streaming, it’s crucial to exchange the secret keys over HTTPS. That way, broadcasters can prevent man-in-the-middle attacks, where hackers intercept sensitive data—such as AES keys—while it’s being exchanged between two parties.
4. Password Protection
While many broadcasters focus on encryption, password-protected video streaming is just as important. The most common way to protect video content is by using passwords to restrict who has access to a particular piece of content. Password protection is a simple and powerful way to limit video viewership to internal employees, specific clients, or other smaller audiences.
That said, it’s a good idea to generate a secure password, change them out periodically, and follow other password protection best practices. Otherwise, the password can get leaked online, and unwanted viewers could gain access to the content.
Dacast’s Secure Video Platform
Dacast is a secure video streaming solution that supports HLS encryption for video on demand (VOD) content. That means broadcasters can deliver video content to their audience with HLS encryption taking place behind the scenes.
Moreover, Dacast relies on HTTPS to deliver video streams to viewers to prevent man-in-the-middle attacks and keep their financial information safe. This is critical for broadcasters that want to monetize their videos using the platform’s secure paywall capabilities.
Beyond HLS encryption and HTTPS, Dacast encourages broadcasters to utilize password protection for hosting their video content. Within the Dacast platform, it’s straightforward to add passwords to live streams, VOD content, or entire playlists.
Along with securing and protecting the video streams themselves, Dacast allows broadcasters to set geographic and referrer restrictions. Geographic restrictions can help prevent piracy by blacklisting certain countries where malicious actors often operate.
Similarly, referrer restrictions allow broadcasters to block well-known piracy sites or competitors from resharing video content. An HTTP referrer is metadata that identifies a website that has linked to a particular video.
Finally, Dacast offers a secure video upload feature for adding video content to the secure video hosting platform. That way, users can safely upload files in bulk or migrate an entire collection of video content with ease.
Here are more details on the many features of the Dacast platform and our commitment to video security.
If you’re looking for advanced security, monetization, and distribution tools, Dacast is a great choice.
- Content control and advanced security options
- RTMP Encoder for ingesting HLS streaming
- Low latency HTML5 channels for video streaming
- Reliable delivery via top-tier CDNs
- Adaptive multi-bitrate streaming
- Video API access on premium plans (scale and event)
- Player API access for easy integration and custom app creation
- Expo video gallery to display your live streams in an immersive video showcase
- Zoom live streaming integration for meetings and live events in real-time
- Multiple video monetization options to customize
- White-label customization capabilities
- Real-time analytics
- Mobile device support
- Live streaming and VOD packages included with all pricing plans
- Customizable HTML5 video player with embed options
- 24/7 customer support, including both email and live chat options
- Unlimited viewers and live channels
- Live stream recording capability
- Video hosting in China
- Professional features may require some time to learn
- Recommended dimensions:
- Supported aspect ratios:
- Maximum file size: Unlimited, though larger file sizes can impact viewer experience
- Maximum video length:
- Total file storage: 10 to 1,000 GB depending on the plan
- Accepted video formats: MP4 (preferred), .MOV, M4V, M2V, .AVI, MPG, .FLV, .WMV, .MKV, WebM, OGV, MXF, ASF, VOB, MTS
Dacast offers multiple pricing plans geared toward all business budgets. Here is an overview:
- Starter Plan: $39/month (includes 1,000 GB of bandwidth & 50 GB of storage)
- Event Plan: $63/month (includes 6 TB of bandwidth upfront and 50 GB of storage)
- Scale Plan: $188/month (includes 24 TB of bandwidth per year and 1 TB of storage)
Broadcasters can contact Dacast directly to learn more about custom-priced high-volume plans.
Best Use Cases
Dacast’s live streaming platform is great for:
- Live event streaming
- VOD on-demand hosting
- Streaming video for education
- Cloud-based enterprise video solutions
- Online video platform for marketing
- Video software for sales teams
Video content is invaluable for most brands, but if data gets into the wrong hands, it can be devastating. That’s why it should be the priority of every broadcaster to offer secure stream services and store video content safely using a reliable video streaming solution.
Dacast has been nominated as the best small/medium business platform in the 2019 Streaming Media Readers’ Choice Awards because of the company’s commitment to offering a robust and secure streaming video platform for its users.
At Dacast, we’re confident that the solution is ideal for broadcasters that need a secure online video platform (OVP) for their live streaming and VOD needs. That’s why we offer a risk-free trial for 30-day. Try Dacast out and see if it fits your needs for secure video delivery.
Stay up to date with our latest features and product releases