HLS Encryption: How to Protect Videos and Keep Your Digital Content Secure

hls encryption for video

As piracy and hacking continue to increase each year, broadcasters should be concerned with securing their video content. That’s because the U.S. Chamber of Commerce estimated $29.2 billion of lost revenue from piracy in 2019.

Data breaches, unauthorized video sharing, and hacks, therefore, can be a substantial cost for many companies. That’s why protecting video content and securely delivering streams to users should be a broadcasting best-practice.

First, we’ll cover what video encryption is and why it matters. Then we’ll dive into the HLS streaming protocol and how AES encryption works. Finally, we’ll look at the key features necessary for a secure video cloud platform.

Table of Contents:

  • What is Video Encryption?
  • Why Does Protecting Video Content Matter?
  • The HLS Protocol
  • HLS Encryption Explained
  • 4 Key Features of Secure Video Clouds
  • Dacast Video Platform
  • Conclusion

What is Video Encryption?

video encryption
Encryption helps hide sensitive data from unauthorized users.

Encryption is a method for masking data so that only authorized users can decrypt and access a file. It’s a part of cryptography, which is a field of study devoted to the secure communication of information or data.

Over the years, a multitude of encryption algorithms has been developed with varying levels of security. Most algorithms, however, scramble the data into what’s called ciphertext and require the receiving party to use a key to reassemble the data back into plaintext.

Can You Encrypt Video?

While it’s straightforward to understand the encryption of text documents, how exactly does video encryption work?

Video encryption allows broadcasters to scramble their video content using a secure algorithm and transmit the data to viewers. Authorized viewers can then decode the video and watch it.

Many broadcasters encrypt not only stored video content, but also streaming video to prevent unauthorized third-parties from accessing the content in transit.

Why Does Protecting Video Content Matter?

Broadcasters usually have one or more reasons for protecting videos, from keeping sensitive information safe to implementing digital rights management or ensuring proper monetization of content.

  • Sensitive Information: Many organizations use video streams for internal meetings and events that shouldn’t be available to the public. If these videos aren’t protected, the company could risk violating industry regulations or leaking information to competitors.
  • Digital Rights Management: Video encryption is a critical aspect of digital rights management (DRM), which broadcasters require for a variety of reasons. For example, geographical regions—such as the People’s Republic of China (PRC)—may have specific regulations or censorship limiting who can view certain types of content. 
  • Monetization: Brands may have video streams at various price points that need access controls as well, such as charging more for high-definition videos or ad-free content. The ability to safely accept payment from viewers and ensure video content isn’t pirated are both crucial for monetization.

The HLS Protocol

hls protocol
Most of today’s broadcasters use the HLS protocol to stream videos.

Video streaming requires sending enormous amounts of data to viewers. RAW video files are too large, so broadcasters must encode videos into a compressed format using a codec like H.264 to reduce the file size.

A video stream also requires choosing a container format, which encompasses the necessary video, audio, and metadata. Most broadcasters choose the MP4 format because it’s compatible with a wide range of devices.

Finally, broadcasters need to choose a streaming protocol like HLS or RTMP. These are standardized methods for transmitting video and audio data over the Internet as a continuous stream rather than a single file download.

What is HLS Streaming?

HTTP Live Streaming (HLS) is a protocol that splits video streams into chunks that are transferred and reassembled within the user’s video player. In most cases, the video player is an HTML5 or Video.js player that offers playback natively in the user’s web browser.

Pure HTML5 playback without a streaming protocol requires downloading the entire video file during initiation. That’s why it’s crucial to break down videos into smaller files so that playback can start faster and there’s less wasted data. 

In contrast to RTMP, the HLS protocol leverages HTTP to transfer video content in chunks to viewers. That means broadcasters can use a standard server or content delivery network (CDN) to store and deliver video content. With HLS streaming, broadcasters can scale their streams to reach a much larger audience without compromising on quality.

HLS streaming is used by most broadcasters because it’s the protocol supported by HTML5 players. These video players—which are built into web browsers—have become the default playback method rather than Flash. HLS streams, therefore, are supported by nearly every device from tablets to laptops and smart TVs.

What is Adaptive Bitrate Streaming?

Moreover, HLS is an adaptive bitrate streaming (ABR) protocol. That means broadcasters offer multiple variants of a particular stream at different bitrates or levels of quality.

These separate streams are split into 2 to 10-second segments and indexed in a manifest file. Then an adaptive video player can use the manifest file to choose the optimum video segment based on network conditions and the user’s device.

ABR streaming is crucial for broadcasters that want to offer the best viewing experience possible for their viewers.

HLS Encryption Explained

Advanced Encryption Standard (AES)
AES is the most common way to encrypt HLS streams.

While there are many types of encryption algorithms, the most commonly used method for HLS is AES-128. Advanced Encryption Standard (AES) is a block cipher that encrypts and decrypts data in 128-bit blocks. Here are the basics of how AES-128 works.

How Does AES 128 Encryption Work?

The first block is encrypted using an initialization vector (IV)—or 16-byte random value—and the next block uses this to start the encryption process. Each subsequent block uses ciphertext from the preceding block for encryption in a method known as cipher block chaining (CBC).

As AES is a symmetric key algorithm, there needs to be a secret key that’s used for both encryption and decryption. That means the broadcaster encrypts the video using the key and the viewer’s browser decrypts it using the same key.

AES has seen widespread adoption because it’s straightforward to implement and safe enough for general use. The U.S. Government even uses the algorithm for encrypting sensitive data, and it’s the way most DRM systems protect media.

HLS Encryption Methods

While the HLS supports AES-128 encryption, there are two different ways to implement the standard in practice.

Broadcasters can use one key to encrypt the entire video stream, but that also means the whole stream is unprotected if the secret key is intercepted by an unauthorized third-party.

Alternatively, each segment of a stream can be encrypted with a different key. That way, only a few seconds of video can be accessed with each specific key. Broadcasters might choose this method if the video content their sharing is highly sensitive.

4 Key Features of Secure Video Clouds

video cloud
There are a number of features that make a video cloud secure.

Many companies use a video cloud platform to host their video content and share it with their intended audience. Here are four security features to look for in a video hosting platform.

1. AES Encryption

There is often a debate over which key length to use for AES: 128-bit or 256-bit. In general, a larger key is harder to compromise with a brute force attack, but a simple calculation shows that even a 128-bit key would take far too long to crack.

That’s why the ability to protect the secret key from unwanted third-parties is far more critical than the key size. As long as the cloud platform uses at least AES-128 encryptions, the videos should be safe from brute force attacks.

Larger key sizes also require more computing power, but most modern devices can handle decrypting AES-256 without performance issues. Be sure to consider your target audience and the quality of devices they’ll use for streaming before choosing an encryption algorithm for your content.

2. Manifest File

The HLS manifest file—or M3U8 playlist—is necessary for video players to select and retrieve the right video segments for ABR streaming. In addition, the manifest file contains the secret encryption key for each video segment. 

If there’s an overall AES key being used, it will appear in the manifest file as a link after the EXT-X-KEY tag. This file should be served over HTTPS and require authentication to minimize the risk of this key being exposed to eavesdroppers.

Many platforms rotate these AES keys at regular intervals, so there’s a lower chance that they get compromised during streams. In general, the more frequently keys are rotated or refreshed, the more secure the video content will be.

3. HTTPS Delivery

HTTPS is a way of transferring data using HTTP (Hyper-Text Transfer Protocol) that’s secured using Secure Sockets Layer (SSL). SSL was later renamed to transport layer security (TLS), but the end goal is the same: prevent hackers from intercepting data in transit.

With HTTPS, a server is secured using an SSL certificate that’s issued by a certificate authority (CA). When users connect to a server with a valid certificate, data transferred between the two parties will automatically be encrypted.

When using AES encryption with HLS streaming, it’s crucial to exchange the secret keys over HTTPS. That way, broadcasters can prevent man-in-the-middle attacks, where hackers intercept sensitive data—such as AES keys—while it’s being exchanged between two parties.

4. Password Protection

password protection
Cloud video security features for private live streaming include geographic and referrer restrictions, password protection, and payment security.

While many broadcasters focus on encryption, video protection is just as important. The most common way to protect video content is by using passwords to restrict who has access to a particular piece of content. Password protection is a simple and powerful way to limit video viewership to internal employees, specific clients, or other smaller audiences. 

That said, it’s a good idea to generate a secure password, change them out periodically, and follow other password protection best-practices. Otherwise, the password can get leaked online, and unwanted viewers could gain access to the content.

Dacast Online Video Platform

dacast live streaming
Dacast’s Video Streaming Software is the leading Online Video and Hosting Platform, which utilizes HLS encryption for secure video delivery worldwide.

Dacast is a secure video streaming solution that supports HLS encryption for video on demand (VOD) content. That means broadcasters can deliver video content to their audience over HLS with AES encryption taking place behind the scenes.

Moreover, Dacast relies on HTTPS to deliver video streams to viewers to prevent man-in-the-middle attacks and keep their financial information safe. This is critical for broadcasters that want to monetize their videos using the platform’s secure paywall capabilities.

Beyond AES encryption and HTTPS, Dacast encourages broadcasters to utilize password protection for their video content. Within the Dacast platform, it’s straightforward to add passwords to live streams, VOD content, or entire playlists.

Along with securing and protecting the video streams themselves, Dacast allows broadcasters to set geographic and referrer restrictions. Geographic restrictions can help prevent piracy by blacklisting certain countries where malicious actors often operate. 

Similarly, referrer restrictions allow broadcasters to block well-known piracy sites or competitors from resharing video content. An HTTP referrer is a metadata that identifies a website that has linked to a particular video.

Finally, Dacast offers a secure video upload feature for adding video content to the online video hosting platform. That way, users can safely upload files in bulk or migrate an entire collection of video content with ease.


encrypted video streaming
Encrypted video streaming is essential to delivering your video content securely to only the desired audience.

Video content is invaluable for most brands, but if data gets into the wrong hands, it can be devastating. That’s why it should be the priority of every broadcaster to offer secure streams and store video content safely using a reliable video streaming solution.

Dacast has been nominated as the best small/medium business platform in the 2019 Streaming Media Readers’ Choice Awards because of the company’s commitment to offering a robust and security online video platform for its users.

At Dacast, we’re confident that the solution is ideal for broadcasters that need a secure online video platform (OVP) for their live streaming and VOD needs. That’s why we offer a risk-free trial for 30-day. Try Dacast out and see if it fits your needs for secure video delivery.


Leave a Reply

Your email address will not be published. Required fields are marked *