ApsaraVideo VOD:HLS encryption

The following table describes the parameters in the sample Java code that you need to change based on your requirements.

import com.aliyuncs.DefaultAcsClient;
import com.aliyuncs.exceptions.ClientException;
import com.aliyuncs.http.ProtocolType;
import com.aliyuncs.vod.model.v20170321.DecryptKMSDataKeyRequest;
import com.aliyuncs.vod.model.v20170321.DecryptKMSDataKeyResponse;
import com.aliyuncs.profile.DefaultProfile;
import com.sun.net.httpserver.Headers;
import com.sun.net.httpserver.HttpExchange;
import com.sun.net.httpserver.HttpHandler;
import com.sun.net.httpserver.HttpServer;
import com.sun.net.httpserver.spi.HttpServerProvider;
import org.apache.commons.codec.binary.Base64;
import java.io.IOException;
import java.io.OutputStream;
import java.net.HttpURLConnection;
import java.net.InetSocketAddress;
import java.net.URI;import java.util.regex.Matcher;
import java.util.regex.Pattern;
public class HlsDecryptServer {
    private static DefaultAcsClient client;
    static {
        // The region of KMS, which must be the same as the video's region.
        String region = "";
        // AccessKey information for accessing KMS.
        // An AccessKey pair of an Alibaba Cloud account has full permissions on all API operations. We recommend that you use a RAM user to call API operations or perform routine O&M.
        // To protect your resources, do not hardcode the AccessKey ID and AccessKey secret in your project code. Leaked AccessKey pairs may compromise the security of all your resources.
        // This example demonstrates how to use environment variables to obtain the AccessKey pair for identity verification. Before you run the code, configure the ALIBABA_CLOUD_ACCESS_KEY_ID and ALIBABA_CLOUD_ACCESS_KEY_SECRET environment variables.
        String accessKeyId = System.getenv("ALIBABA_CLOUD_ACCESS_KEY_ID");
        String accessKeySecret = System.getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET");
        client = new DefaultAcsClient(DefaultProfile.getProfile(region, accessKeyId, accessKeySecret));
    }
    /**
     * Notes:
     * 1. Receive a decryption request to get the ciphertext key and user token.
     * 2. Call the KMS decrypt API to get the plaintext key.
     * 3. Return the Base64-decoded plaintext key.
     */
    public class HlsDecryptHandler implements HttpHandler {
        /**
         * Handle the decryption request.
         * @param httpExchange
         * @throws IOException
         */
        public void handle(HttpExchange httpExchange) throws IOException {
            String requestMethod = httpExchange.getRequestMethod();
            if ("GET".equalsIgnoreCase(requestMethod)) {
                // Validate the token.
                String token = getMtsHlsUriToken(httpExchange);
                boolean validRe = validateToken(token);
                if (!validRe) {
                    return;
                }
                // Get the ciphertext key from the URL.
                String ciphertext = getCiphertext(httpExchange);
                if (null == ciphertext)
                    return;
                // Decrypt from KMS and Base64 decode.
                byte[] key = decrypt(ciphertext);
                // Set the header.
                setHeader(httpExchange, key);
                // Return the Base64-decoded key.
                OutputStream responseBody = httpExchange.getResponseBody();
                responseBody.write(key);
                responseBody.close();
            }
        }
        private void setHeader(HttpExchange httpExchange, byte[] key) throws IOException {
            Headers responseHeaders = httpExchange.getResponseHeaders();
            responseHeaders.set("Access-Control-Allow-Origin", "*");
            httpExchange.sendResponseHeaders(HttpURLConnection.HTTP_OK, key.length);
        }
        /**
         * Call the KMS decrypt API and Base64 decode the plaintext.
         * @param ciphertext
         * @return
         */
        private byte[] decrypt(String ciphertext) {
            DecryptKMSDataKeyRequest request = new DecryptKMSDataKeyRequest();
            request.setCipherText(ciphertext);
            request.setProtocol(ProtocolType.HTTPS);
            try {
                DecryptKMSDataKeyResponse response = client.getAcsResponse(request);
                String plaintext = response.getPlaintext();
                System.out.println("PlainText: " + plaintext);
                // Note: The plaintext needs to be Base64-decoded.
                return Base64.decodeBase64(plaintext);
            } catch (ClientException e) {
                e.printStackTrace();
                return null;
            }
        }
        /**
         * Get the ciphertext key parameter from the URL.
         * @param httpExchange
         * @return
         */
        private String getCiphertext(HttpExchange httpExchange) {
            URI uri = httpExchange.getRequestURI();
            String queryString = uri.getQuery();
            String pattern = "CipherText=(\\w*)";
            Pattern r = Pattern.compile(pattern);
            Matcher m = r.matcher(queryString);
            if (m.find())
                return m.group(1);
            else {
                System.out.println("Not Found CipherText Param");
                return null;
            }
        }
        
          /**
         * Validate the token. This is required for M3U8 encryption and rewrite.
         * @param token
         * @return
         */
        private boolean validateToken(String token) {
            if (null == token || "".equals(token)) {
                return false;
            }
            //TODO: Implement your own token validation logic.
            return true;
        }
        /**
         * Get the Token parameter. This is required for M3U8 encryption and rewrite.
         *
         * @param httpExchange
         * @return
         */
        private String getMtsHlsUriToken(HttpExchange httpExchange) {
            URI uri = httpExchange.getRequestURI();
            String queryString = uri.getQuery();
            String pattern = "MtsHlsUriToken=(\\w*)";
            Pattern r = Pattern.compile(pattern);
            Matcher m = r.matcher(queryString);
            if (m.find())
                return m.group(1);
            else {
                System.out.println("Not Found MtsHlsUriToken Param");
                return null;
            }
        }
    }
    /**
     * Start the service.
     *
     * @throws IOException
     */
    private void serviceBootStrap() throws IOException {
        HttpServerProvider provider = HttpServerProvider.provider();
        // The listening port can be customized. It can handle up to 30 requests simultaneously.
        HttpServer httpserver = provider.createHttpServer(new InetSocketAddress(8099), 30);
        httpserver.createContext("/", new HlsDecryptHandler());
        httpserver.start();
        System.out.println("hls decrypt server started");
    }
    public static void main(String[] args) throws IOException {
        HlsDecryptServer server = new HlsDecryptServer();
        server.serviceBootStrap();
    }}

Workflow

• The player parses the EXT-X-KEY tag in the M3U8 file to obtain the decryption key URI. This URI corresponds to the value of the DecryptKeyUri parameter in EncryptConfig.

• To prevent unauthorized access, the player must include authentication information (passed in the MtsHlsUriToken parameter) when it requests the decryption endpoint.

• The player requests the decryption endpoint to get the key, decrypts the TS files, and plays the video.

Example

• If the video playback URL is https://demo.aliyundoc.com/encrypt-stream****-hd.m3u8, you must include the MtsHlsUriToken parameter in the request.

• The final request URL is: https://demo.aliyundoc.com/encrypt-stream****-hd.m3u8?MtsHlsUriToken=<token>

• The decryption URL is: https://demo.aliyundoc.com?CipherText=ZjJmZGViNzUtZWY1Mi00Y2RlLTk3MTMtOT****

• The final decryption request URL is: https://demo.aliyundoc.com?CipherText=ZjJmZGViNzUtZWY1Mi00Y2RlLTk3MTMtOT****&MtsHlsUriToken=<issued token>

The following table describes the parameters in the sample Java code that you need to change based on your requirements.

import com.aliyuncs.DefaultAcsClient;
import com.aliyuncs.exceptions.ClientException;
import com.aliyuncs.http.ProtocolType;
import com.aliyuncs.profile.DefaultProfile;
import com.aliyuncs.vod.model.v20170321.DecryptKMSDataKeyRequest;
import com.aliyuncs.vod.model.v20170321.DecryptKMSDataKeyResponse;
import com.sun.net.httpserver.Headers;
import com.sun.net.httpserver.HttpExchange;
import com.sun.net.httpserver.HttpHandler;
import com.sun.net.httpserver.HttpServer;
import com.sun.net.httpserver.spi.HttpServerProvider;
import org.apache.commons.codec.binary.Base64;

import java.io.IOException;
import java.io.OutputStream;
import java.net.HttpURLConnection;
import java.net.InetSocketAddress;
import java.net.URI;
import java.util.regex.Matcher;
import java.util.regex.Pattern;

public class HlsDecryptServerNoToken {

    private static DefaultAcsClient client;
    static {
        // The region of KMS, which must be the same as the video's region.
        String region = "cn-beijing";
        // AccessKey information for accessing KMS.
        // An AccessKey pair of an Alibaba Cloud account has full permissions on all API operations. We recommend that you use a RAM user to call API operations or perform routine O&M.
        // To protect your resources, do not hardcode the AccessKey ID and AccessKey secret in your project code. Leaked AccessKey pairs may compromise the security of all your resources.
        // This example demonstrates how to use environment variables to obtain the AccessKey pair for identity verification. Before you run the code, configure the ALIBABA_CLOUD_ACCESS_KEY_ID and ALIBABA_CLOUD_ACCESS_KEY_SECRET environment variables.
        String accessKeyId = System.getenv("ALIBABA_CLOUD_ACCESS_KEY_ID");
        String accessKeySecret = System.getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET");
        client = new DefaultAcsClient(DefaultProfile.getProfile(region, accessKeyId, accessKeySecret));
    }
    /**
     * Notes:
     * 1. Receive a decryption request to get the ciphertext key and token.
     * 2. Call the KMS decrypt API to get the plaintext key.
     * 3. Return the Base64-decoded plaintext key.
     */
    public class HlsDecryptHandler implements HttpHandler {
        /**
         * Handle the decryption request.
         * @param httpExchange
         * @throws IOException
         */
        public void handle(HttpExchange httpExchange) throws IOException {
            String requestMethod = httpExchange.getRequestMethod();
            if ("GET".equalsIgnoreCase(requestMethod)) {

                // Get the ciphertext key from the URL.
                String ciphertext = getCiphertext(httpExchange);
                System.out.println(ciphertext);
                if (null == ciphertext)
                    return;
                // Decrypt from KMS and Base64 decode.
                byte[] key = decrypt(ciphertext);
                // Set the header.
                setHeader(httpExchange, key);
                // Return the base64decode key.
                OutputStream responseBody = httpExchange.getResponseBody();
                responseBody.write(key);
                responseBody.close();
            }
        }
        private void setHeader(HttpExchange httpExchange, byte[] key) throws IOException {
            Headers responseHeaders = httpExchange.getResponseHeaders();
            responseHeaders.set("Access-Control-Allow-Origin", "*");
            httpExchange.sendResponseHeaders(HttpURLConnection.HTTP_OK, key.length);
        }
        /**
         * Call the KMS decrypt API and Base64 decode the plaintext.
         * @param ciphertext
         * @return
         */
        private byte[] decrypt(String ciphertext) {

            DecryptKMSDataKeyRequest request = new DecryptKMSDataKeyRequest();
            request.setCipherText(ciphertext);
            request.setProtocol(ProtocolType.HTTPS);
            try {
                DecryptKMSDataKeyResponse response = client.getAcsResponse(request);
                String plaintext = response.getPlaintext();
                System.out.println("PlainText: " + plaintext);
                // Note: The plaintext needs to be Base64-decoded.
                return Base64.decodeBase64(plaintext);
            } catch (ClientException e) {
                e.printStackTrace();
                return null;
            }
        }

        /**
         * Get the ciphertext key parameter from the URL.
         * @param httpExchange
         * @return
         */
        private String getCiphertext(HttpExchange httpExchange) {
            URI uri = httpExchange.getRequestURI();
            String queryString = uri.getQuery();
            String pattern = "CipherText=(\\w*)";
            Pattern r = Pattern.compile(pattern);
            Matcher m = r.matcher(queryString);
            if (m.find())
                return m.group(1);
            else {
                System.out.println("Not Found CipherText Param");
                return null;
            }
        }
    }

    /**
     * Start the service.
     *
     * @throws IOException
     */
    private void serviceBootStrap() throws IOException {
        HttpServerProvider provider = HttpServerProvider.provider();
        // The listening port can be customized. It can handle up to 30 requests simultaneously.
        HttpServer httpserver = provider.createHttpServer(new InetSocketAddress(8099), 30);
        httpserver.createContext("/", new HlsDecryptHandler());
        httpserver.start();
        System.out.println("hls decrypt server started");
    }
    public static void main(String[] args) throws IOException {
        HlsDecryptServerNoToken server = new HlsDecryptServerNoToken();
        server.serviceBootStrap();
    }}

Workflow

• The player parses the EXT-X-KEY tag in the M3U8 file to obtain the decryption key URI, which is the value of the DecryptKeyUri parameter in EncryptConfig.

• The player requests the decryption endpoint to get the key, decrypts the TS files, and plays the video.

Example

• The playback URL for the video is: https://demo.aliyundoc.com/encrypt-stream****-hd.m3u8

• The final request URL is: https://demo.aliyundoc.com/encrypt-stream****-hd.m3u8

• The decryption URL is: https://demo.aliyundoc.com?CipherText=ZjJmZGViNzUtZWY1Mi00Y2RlLTk3MTMtOT****

• The final decryption request URL is: https://demo.aliyundoc.com?CipherText=ZjJmZGViNzUtZWY1Mi00Y2RlLTk3MTMtOT****