ApsaraVideo VOD：HLS標準加密

下述Java範例程式碼中，您需要按實際情況變更的參數如下：

參數	傳入值
region	地區標識，要求KMS服務的地區和點播視訊所在的地區保持一致。例如華東2（上海），填寫cn-shanghai，其他地區標識請參見點播地區標識。
AccessKey	傳入阿里雲帳號或RAM使用者的AccessKey ID和AccessKey Secret，擷取方法請參見建立AccessKey。
httpserver	根據需求選擇服務啟動的連接埠號碼。

import com.aliyuncs.DefaultAcsClient;
import com.aliyuncs.exceptions.ClientException;
import com.aliyuncs.http.ProtocolType;
import com.aliyuncs.vod.model.v20170321.DecryptKMSDataKeyRequest;
import com.aliyuncs.vod.model.v20170321.DecryptKMSDataKeyResponse;
import com.aliyuncs.profile.DefaultProfile;
import com.sun.net.httpserver.Headers;
import com.sun.net.httpserver.HttpExchange;
import com.sun.net.httpserver.HttpHandler;
import com.sun.net.httpserver.HttpServer;
import com.sun.net.httpserver.spi.HttpServerProvider;
import org.apache.commons.codec.binary.Base64;
import java.io.IOException;
import java.io.OutputStream;
import java.net.HttpURLConnection;
import java.net.InetSocketAddress;
import java.net.URI;import java.util.regex.Matcher;
import java.util.regex.Pattern;
public class HlsDecryptServer {
    private static DefaultAcsClient client;
    static {
        //KMS的地區，必須與視頻對應地區
        String region = "";
        // 訪問KMS的授權AccessKey資訊
        // 阿里雲帳號AccessKey擁有所有API的存取權限，建議您使用RAM使用者進行API訪問或日常營運。
        // 強烈建議不要把AccessKey ID和AccessKey Secret儲存到工程代碼裡，否則可能導致AccessKey泄露，威脅您帳號下所有資源的安全。
        // 本樣本通過從環境變數中讀取AccessKey，來實現API訪問的身分識別驗證。運行程式碼範例前，請配置環境變數ALIBABA_CLOUD_ACCESS_KEY_ID和ALIBABA_CLOUD_ACCESS_KEY_SECRET。
        String accessKeyId = System.getenv("ALIBABA_CLOUD_ACCESS_KEY_ID");
        String accessKeySecret = System.getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET");
        client = new DefaultAcsClient(DefaultProfile.getProfile(region, accessKeyId, accessKeySecret));
    }
    /**
     * 說明：
     * 1、接收解密請求，擷取密文密鑰和使用者令牌Token
     * 2、調用KMS decrypt介面擷取清除金鑰
     * 3、將清除金鑰Base64 decode返回
     */
    public class HlsDecryptHandler implements HttpHandler {
        /**
         * 處理解密請求
         * @param httpExchange
         * @throws IOException
         */
        public void handle(HttpExchange httpExchange) throws IOException {
            String requestMethod = httpExchange.getRequestMethod();
            if ("GET".equalsIgnoreCase(requestMethod)) {
                //校正token的有效性
                String token = getMtsHlsUriToken(httpExchange);
                boolean validRe = validateToken(token);
                if (!validRe) {
                    return;
                }
                //從URL中取得密文密鑰
                String ciphertext = getCiphertext(httpExchange);
                if (null == ciphertext)
                    return;
                //從KMS中解密出來，並Base64 decode
                byte[] key = decrypt(ciphertext);
                //設定header
                setHeader(httpExchange, key);
                //返回Base64 decode之後的密鑰
                OutputStream responseBody = httpExchange.getResponseBody();
                responseBody.write(key);
                responseBody.close();
            }
        }
        private void setHeader(HttpExchange httpExchange, byte[] key) throws IOException {
            Headers responseHeaders = httpExchange.getResponseHeaders();
            responseHeaders.set("Access-Control-Allow-Origin", "*");
            httpExchange.sendResponseHeaders(HttpURLConnection.HTTP_OK, key.length);
        }
        /**
         * 調用KMS decrypt介面解密，並將明文Base64 decode
         * @param ciphertext
         * @return
         */
        private byte[] decrypt(String ciphertext) {
            DecryptKMSDataKeyRequest request = new DecryptKMSDataKeyRequest();
            request.setCipherText(ciphertext);
            request.setProtocol(ProtocolType.HTTPS);
            try {
                DecryptKMSDataKeyResponse response = client.getAcsResponse(request);
                String plaintext = response.getPlaintext();
                System.out.println("PlainText: " + plaintext);
                //注意：需要Base64 decode
                return Base64.decodeBase64(plaintext);
            } catch (ClientException e) {
                e.printStackTrace();
                return null;
            }
        }
        /**
         * 從URL中擷取密文密鑰參數
         * @param httpExchange
         * @return
         */
        private String getCiphertext(HttpExchange httpExchange) {
            URI uri = httpExchange.getRequestURI();
            String queryString = uri.getQuery();
            String pattern = "CipherText=(\\w*)";
            Pattern r = Pattern.compile(pattern);
            Matcher m = r.matcher(queryString);
            if (m.find())
                return m.group(1);
            else {
                System.out.println("Not Found CipherText Param");
                return null;
            }
        }
          /**
         * 校正令牌有效性 M3U8標準加密改寫必備
         * @param token
         * @return
         */
        private boolean validateToken(String token) {
            if (null == token || "".equals(token)) {
                return false;
            }
            //TODO 業務方實現令牌有效性校正
            return true;
        }
        /**
         * 擷取Token參數 M3U8標準加密改寫必備
         *
         * @param httpExchange
         * @return
         */
        private String getMtsHlsUriToken(HttpExchange httpExchange) {
            URI uri = httpExchange.getRequestURI();
            String queryString = uri.getQuery();
            String pattern = "MtsHlsUriToken=(\\w*)";
            Pattern r = Pattern.compile(pattern);
            Matcher m = r.matcher(queryString);
            if (m.find())
                return m.group(1);
            else {
                System.out.println("Not Found MtsHlsUriToken Param");
                return null;
            }
        }
    }
    /**
     * 服務啟動
     *
     * @throws IOException
     */
    private void serviceBootStrap() throws IOException {
        HttpServerProvider provider = HttpServerProvider.provider();
        //監聽連接埠可以自訂，能同時接受最多30個請求
        HttpServer httpserver = provider.createHttpServer(new InetSocketAddress(8099), 30);
        httpserver.createContext("/", new HlsDecryptHandler());
        httpserver.start();
        System.out.println("hls decrypt server started");
    }
    public static void main(String[] args) throws IOException {
        HlsDecryptServer server = new HlsDecryptServer();
        server.serviceBootStrap();
    }}

流程

• 播放器解析M3U8檔案中的EXT-X-KEY標籤，擷取解密密鑰URI，該URI對應加密配置 EncryptConfig中的DecryptKeyUri參數值。

• 為限制非法訪問，播放器需攜帶認證資訊（通過MtsHlsUriToken參數傳遞）請求解密介面。

• 播放器自動請求解密介面擷取密鑰，解密加密的TS檔案後正常播放。

樣本

• 視頻的播放地址為：https://demo.aliyundoc.com/encrypt-stream****-hd.m3u8，則請求時需要攜帶MtsHlsUriToken參數傳入

• 最終請求地址為：https://demo.aliyundoc.com/encrypt-stream****-hd.m3u8?MtsHlsUriToken=<令牌>

• 解密地址為：https://demo.aliyundoc.com?CipherText=ZjJmZGViNzUtZWY1Mi00Y2RlLTk3MTMtOT****

• 最終解密請求地址為：https://demo.aliyundoc.com?CipherText=ZjJmZGViNzUtZWY1Mi00Y2RlLTk3MTMtOT****&MtsHlsUriToken=<頒發的令牌>

下述Java範例程式碼中，您需要按實際情況變更的參數如下：

參數	傳入值
region	地區標識，要求KMS服務的地區和點播視訊所在的地區保持一致。例如華東2（上海），填寫cn-shanghai，其他地區標識請參見點播地區標識。
AccessKey	傳入阿里雲帳號或RAM使用者的AccessKey ID和AccessKey Secret，擷取方法請參見建立AccessKey。
httpserver	根據需求選擇服務啟動的連接埠號碼。

import com.aliyuncs.DefaultAcsClient;
import com.aliyuncs.exceptions.ClientException;
import com.aliyuncs.http.ProtocolType;
import com.aliyuncs.profile.DefaultProfile;
import com.aliyuncs.vod.model.v20170321.DecryptKMSDataKeyRequest;
import com.aliyuncs.vod.model.v20170321.DecryptKMSDataKeyResponse;
import com.sun.net.httpserver.Headers;
import com.sun.net.httpserver.HttpExchange;
import com.sun.net.httpserver.HttpHandler;
import com.sun.net.httpserver.HttpServer;
import com.sun.net.httpserver.spi.HttpServerProvider;
import org.apache.commons.codec.binary.Base64;
import java.io.IOException;
import java.io.OutputStream;
import java.net.HttpURLConnection;
import java.net.InetSocketAddress;
import java.net.URI;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
public class HlsDecryptServerNoToken {
    private static DefaultAcsClient client;
    static {
        //KMS的地區，必須與視頻對應地區
        String region = "cn-beijing";
        //訪問KMS的授權AccessKey資訊
        // 阿里雲帳號AccessKey擁有所有API的存取權限，建議您使用RAM使用者進行API訪問或日常營運。
        // 強烈建議不要把AccessKey ID和AccessKey Secret儲存到工程代碼裡，否則可能導致AccessKey泄露，威脅您帳號下所有資源的安全。
        // 本樣本通過從環境變數中讀取AccessKey，來實現API訪問的身分識別驗證。運行程式碼範例前，請配置環境變數ALIBABA_CLOUD_ACCESS_KEY_ID和ALIBABA_CLOUD_ACCESS_KEY_SECRET。
        String accessKeyId = System.getenv("ALIBABA_CLOUD_ACCESS_KEY_ID");
        String accessKeySecret = System.getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET");
        client = new DefaultAcsClient(DefaultProfile.getProfile(region, accessKeyId, accessKeySecret));
    }
    /**
     * 說明：
     * 1、接收解密請求，擷取密文密鑰和令牌Token
     * 2、調用KMS decrypt介面擷取清除金鑰
     * 3、將清除金鑰base64decode返回
     */
    public class HlsDecryptHandler implements HttpHandler {
        /**
         * 處理解密請求
         * @param httpExchange
         * @throws IOException
         */
        public void handle(HttpExchange httpExchange) throws IOException {
            String requestMethod = httpExchange.getRequestMethod();
            if ("GET".equalsIgnoreCase(requestMethod)) {
                //從URL中取得密文密鑰
                String ciphertext = getCiphertext(httpExchange);
                System.out.println(ciphertext);
                if (null == ciphertext)
                    return;
                //從KMS中解密出來，並Base64 decode
                byte[] key = decrypt(ciphertext);
                //設定header
                setHeader(httpExchange, key);
                //返回base64decode之後的密鑰
                OutputStream responseBody = httpExchange.getResponseBody();
                responseBody.write(key);
                responseBody.close();
            }
        }
        private void setHeader(HttpExchange httpExchange, byte[] key) throws IOException {
            Headers responseHeaders = httpExchange.getResponseHeaders();
            responseHeaders.set("Access-Control-Allow-Origin", "*");
            httpExchange.sendResponseHeaders(HttpURLConnection.HTTP_OK, key.length);
        }
        /**
         * 調用KMS decrypt介面解密，並將明文base64decode
         * @param ciphertext
         * @return
         */
        private byte[] decrypt(String ciphertext) {
            DecryptKMSDataKeyRequest request = new DecryptKMSDataKeyRequest();
            request.setCipherText(ciphertext);
            request.setProtocol(ProtocolType.HTTPS);
            try {
                DecryptKMSDataKeyResponse response = client.getAcsResponse(request);
                String plaintext = response.getPlaintext();
                System.out.println("PlainText: " + plaintext);
                //注意：需要base64 decode
                return Base64.decodeBase64(plaintext);
            } catch (ClientException e) {
                e.printStackTrace();
                return null;
            }
        }
        /**
         * 從URL中擷取密文密鑰參數
         * @param httpExchange
         * @return
         */
        private String getCiphertext(HttpExchange httpExchange) {
            URI uri = httpExchange.getRequestURI();
            String queryString = uri.getQuery();
            String pattern = "CipherText=(\\w*)";
            Pattern r = Pattern.compile(pattern);
            Matcher m = r.matcher(queryString);
            if (m.find())
                return m.group(1);
            else {
                System.out.println("Not Found CipherText Param");
                return null;
            }
        }
    }
    /**
     * 服務啟動
     *
     * @throws IOException
     */
    private void serviceBootStrap() throws IOException {
        HttpServerProvider provider = HttpServerProvider.provider();
        //監聽連接埠可以自訂，能同時接受最多30個請求
        HttpServer httpserver = provider.createHttpServer(new InetSocketAddress(8099), 30);
        httpserver.createContext("/", new HlsDecryptHandler());
        httpserver.start();
        System.out.println("hls decrypt server started");
    }
    public static void main(String[] args) throws IOException {
        HlsDecryptServerNoToken server = new HlsDecryptServerNoToken();
        server.serviceBootStrap();
    }}

流程

• 播放器解析M3U8檔案中的EXT-X-KEY標籤，擷取解密密鑰URI，該URI對應加密配置 EncryptConfig中的DecryptKeyUri參數值。

• 播放器自動請求解密介面擷取密鑰，解密加密的TS檔案後正常播放。

樣本

• 視頻的播放地址為：https://demo.aliyundoc.com/encrypt-stream****-hd.m3u8

• 最終請求地址為：https://demo.aliyundoc.com/encrypt-stream****-hd.m3u8

• 解密地址為：https://demo.aliyundoc.com?CipherText=ZjJmZGViNzUtZWY1Mi00Y2RlLTk3MTMtOT****

• 最終解密請求地址為：https://demo.aliyundoc.com?CipherText=ZjJmZGViNzUtZWY1Mi00Y2RlLTk3MTMtOT****