Upgrade to Pro — share decks privately, control downloads, hide ads and more …

AVPlayerできちんとコンテンツ保護

Chiharu Nameki
September 19, 2021

 AVPlayerできちんとコンテンツ保護

iOSDC Japan 2021 day2, 20min Talk
https://fortee.jp/iosdc-japan-2021/proposal/889c9c50-fa76-4b54-a4f5-04ec99cc87ba

• AVPlayerについて
• HTTP Live Streamingの仕組み
• コンテンツ保護は何のため?
• AES-128による暗号化配信
• FairPlay Streaming
• マルチプラットフォームで動画ストリームを保護するには

Chiharu Nameki

September 19, 2021
Tweet

More Decks by Chiharu Nameki

Other Decks in Technology

Transcript

  1. ܦྺ גࣜձࣾϐΫηϥ 2005 ~ 2015 
 TVνϡʔφʔ, Χϝϥ, ը૾ॲཧ Mac,

    iPhoneͰ஍σδΛݟΔͨΊͷΞϓϦͳͲΛ୲౰ גࣜձࣾαΠόʔΤʔδΣϯτ 2015 ~ Amebaϒϩά iOSΤϯδχΞ AbemaTV Streaming Client Team
  2. Streaming Client Teamʹ͍ͭͯ • ABEMA͸ଟ͘ͷϓϥοτϑΥʔϜΛαϙʔτ 
 iPhone, Apple TV, Android,

    Android TV, Web, IPTV, … 
 • ֤ϓϥοτϑΥʔϜͷ࠶ੜΫϥΠΞϯτʹ஫ྗ͠ɺࢹௌମݧΛ୲อɾ޲্͢ Δઐ໳νʔϜ • ϓϨΠϠʔͷ࣮૷, ࢹௌ඼࣭ͷ؂ࢹ, ৽ٕज़ͷPoC
  3. ΞδΣϯμ AVPlayerͰ͖ͪΜͱίϯςϯπอޢ • AVPlayerʹ͍ͭͯ • HTTP Live Streamingͷ࢓૊Έ • ίϯςϯπอޢ͸ԿͷͨΊʁ

    • AES-128ʹΑΔ҉߸Խ഑৴ • FairPlay Streaming • ϚϧνϓϥοτϑΥʔϜͰಈըετϦʔϜΛอޢ͢Δʹ͸
  4. HTTP Live Streaming (HLS) AVPlayerͰ࠶ੜͰ͖ΔετϦʔϛϯάܗࣜ • Live, VODͷͲͪΒʹ΋ରԠ • HTTPΛར༻͢ΔͨΊεέʔϥϏϦςΟʹ༏ΕΔ

    • Adaptive Bit Rate (ABR) 
 ճઢঢ়گʹΑΓ࠷దͳϏοτϨʔτͷετϦʔϜʹεΠονՄೳ • ࢓૊Έ্ɺ2, 3ඵҎԼͷ௿஗Ԇ഑৴͸࣮ݱग़དྷͳ͔͕ͬͨɺ 
 Low Latency HLSͷొ৔ʹΑΓෆՄೳͰ͸ͳ͘ͳͬͨ AppleʹΑͬͯ։ൃ͞ΕɺRFC8216ͱͯ͠ެ։ Android΍ϒϥ΢βͰ΋࠶ੜՄೳ ಛ௃
  5. HTTP Live Streaming M3U8 ϓϨΠϦετ ϝσΟΞηάϝϯτ 
 TS or fMP4

    ϓϨΠϠʔ͸ϓϨΠϦετͷதʹهࡌ͞Ε͍ͯΔηάϝϯτΛ্͔Β࿈ଓͯ͠࠶ੜ ରԠCODEC: 
 HEVC or H.264, 
 AAC or AC-3
  6. Adaptive Bit Rate (ABR) ϚελʔϓϨΠϦετ = ଳҬ͝ͱͷϝσΟΞϓϨΠϦετΛෳ਺ؚΉϓϨΠϦετ #EXTM3U #EXT-X-STREAM-INF:PROGRAM-ID=1, BANDWIDTH=200000

    gear1/prog_index.m3u8 #EXT-X-STREAM-INF:PROGRAM-ID=1, BANDWIDTH=311111 gear2/prog_index.m3u8 #EXT-X-STREAM-INF:PROGRAM-ID=1, BANDWIDTH=484444 gear3/prog_index.m3u8 ετϦʔϜͷ࠷େϏοτϨʔτ (bps)
  7. DRMͷ໰୊఺ ಛఆͷαʔϏε΍؀ڥʹґଘ • DRMίϯςϯπΛར༻Ͱ͖Δͷ͸ɺͦͷίϯςϯπΛߪೖͨ͠αʔϏεͷΈ Ͱ͋Δ͜ͱ͕ଟ͍ • ߪೖͨ͠ίϯςϯπΛӬԕʹར༻Ͱ͖Δอূ͸ͳ͍ 
 ిࢠॻ੶ͷετΞ͕Ϋϩʔζͨ͠Βʁ େྔͷίϯςϯπΛߪೖͨ͠ΞΧ΢ϯτ͸૬ଓͰ͖Δʁ

    
 ར༻ํ๏Λنఆ͢Δ΋ͷͳͷͰɺ࢖͍ʹ͘͞ʹܨ͕Γ΍͍͢ • Ωπ͗͢Ε͹੍ݶʹͳΓɺͻͲ͍৔߹͸ফඅऀͷݖརͷ৵֐ʹͳΔɻ 
 ࡞඼Λ࠷େݶʹָ͠ΊΔઃܭͰ͋Δ͜ͱ͕େ੾
  8. ҉߸Խͷجૅ஌ࣝ AES (Advanced Encryption Standard) • ୅දతͳڞ௨伴ϒϩοΫ҉߸ • ϒϩοΫ௕ 128bit

    • ԿϏοτͷ伴Λ༻͍Δ͔ʹΑͬͯ AES-128, AES-192, AES-256ͱදه͞ΕΔ
  9. Block Block 🔑 🔒 ҉߸Խͷجૅ஌ࣝ ϒϩοΫ҉߸ͷ҉߸ར༻Ϟʔυ CBC (Cipher Block Chaining)

    Ϟʔυ ෮߸Խʹ͸ॳظϕΫτϧ(IV)ͱ伴͕ඞཁ IV Block Block 🔑 🔒 Block Block 🔑 🔒 ॳظϕΫτϧ XOR XOR XOR
  10. ҉߸Խͷجૅ஌ࣝ ϒϩοΫ҉߸ͷ҉߸ར༻Ϟʔυ CTR (Counter) Ϟʔυ CTR Block Block 🔑 🔒

    XOR CTR 🔒 CTR+1 Block Block 🔑 🔒 XOR CTR+1 🔒 CTR+2 Block Block 🔑 🔒 XOR CTR+2 🔒 ҉߸Խɾ෮߸Խͱ΋ʹฒྻԽ͕Մೳ
  11. AES-128ʹΑΔ҉߸Խ഑৴ ηάϝϯτશମΛAES-128 CBCϞʔυͰ҉߸Խ Segment 🔒 Segment 🔒 Segment 🔒 Segment

    🔒 #EXT-X-KEY:METHOD=AES-128,URI="伴Λऔಘ͢ΔͨΊͷ URI",IV=0x012345678901234567890123456789012
  12. AVContentKeySession ΞϓϦଆͰ伴Λऔಘ • ίϯςϯπͷ伴Λऔಘ͢ΔͨΊʹઃܭ͞ΕͨAPI • ࠶ੜը໘ʹདྷͨΒɺ͋Β͔͡ΊΩʔΛऔಘ͓ͯ͘͜͠ͱ΋Մೳ 
 → Join Timeͷվળʹ໾ཱͭ

    • METHOD=AES-128Ͱ΋ɺγϛϡϨʔλͰ͸ಈ͔ͳ͍ʁ 
 ͜ͷΫϥεొ৔લ͔Β͋ΔAVAssetResourceLoader͸ಈ͘ 
 URLProtocolͰ΋ϑοΫՄೳ WWDC18 Session 507 AVContentKeySession Best Practices ࢀߟ:
  13. session = AVContentKeySession(keySystem: .clearKey) session.setDelegate(self, queue: .global()) let asset =

    AVURLAsset(url: playlistURL) session.addContentKeyRecipient(asset) player = AVPlayer(playerItem: AVPlayerItem(asset: asset)) extension Foo: AVContentKeySessionDelegate { func contentKeySession(_ session: AVContentKeySession, didProvide keyRequest: AVContentKeyRequest) { getKey(from: keyRequest.identifier) { key in if let key = key { let response = AVContentKeyResponse(clearKeyData: key, initializationVector: nil) keyRequest.processContentKeyResponse(response) } else { keyRequest.processContentKeyResponseError(KeyError.unknown) } } } } AVContentKeySessionͰMETHOD=AES-128ͷ伴Λऔಘ͢Δྫ
  14. FairPlay Streaming (FPS) • AppleʹΑͬͯ։ൃ͞ΕͨಈըετϦʔϜΛอޢ͢ΔͨΊͷDRMٕज़ • AppleͷσόΠεʢ+ AirPlayରԠεϚʔτTVʣͰར༻Մೳ • ωΠςΟϒΞϓϦ

    & Safari • ηΩϡΞͳ伴ͷ഑৴ • HDCPͳͲʹରԠ͠ɺอޢ͞Εͨܦ࿏ͰͷΈө૾ɾԻ੠Λ࠶ੜ 
 εΫγϣΛࡱΔͱө૾ྖҬ͕ਅͬࠇʹͳΔ • ΦϑϥΠϯ࠶ੜ΍ϨϯλϧͷͨΊͷ࢓૊Έ͕͋Δ 
 ϏδωεϩδοΫࣗମ͸نఆ͠ͳ͍ • ແྉ
  15. FPSͰͷίϯςϯπͷ҉߸Խํࣜ • ίϯςφ಺ͷϏσΦΛϑϨʔϜຖɺΦʔσΟΦ͸αϯϓϧຖʹ 
 AES-128 CBCϞʔυͰ҉߸Խ • ϏσΦ͸શମͷ10%Λ҉߸Խ (encrypt:skip pattern

    of 1:9) 
 ϏσΦΛσίʔυͰ͖ͳ͘͢Δʹ͸ɺ෦෼తʹ҉߸Խ͢Ε͹े෼ #EXT-X-KEY:METHOD=SAMPLE-AES,URI="skd://key65", KEYFORMAT="com.apple.streamingkeydelivery",KEYFORMATVERSIONS="1"
  16. ίϯςϯπͷ伴Λऔಘ͢ΔྲྀΕ Apple device OS App Key server Key Security Module

    Load Key Get SPC [CKC 🔑 ] [SPC] [SPC] [CKC 🔑 ] ࣮૷Օॴ ͪ͜ΒͰ४උ Apple Provided Key Security Module (KSM) ͸ 
 ҉߸Խ͞ΕͨServer Playback ContextΛड͚औͬͯ 
 ίϯςϯπͷ伴ΛؚΉContent Key ContextΛ 
 ੜ੒ɾ҉߸Խͯ͠ฦ͢
  17. ίϯςϯπͷ伴Λऔಘ͢ΔྲྀΕ Apple device OS App Key server Key Security Module

    Load Key Get SPC [CKC 🔑 ] [SPC] [SPC] [CKC 🔑 ] ࣮૷Օॴ ͪ͜ΒͰ४උ Apple Provided • 伴Λ஌͍ͬͯΔͷ͸Key Serverͱ OSͷΈʢΞϓϦ΋஌Βͳ͍ʂʣ • ίϯςϯπ͸OSͷΧʔωϧͰ෮߸
  18. FairPlay Streaming ૊ΈࠐΈखॱ 1. Key Security ModuleΛ࣮૷ 
 ެࣜϖʔδ͔Βμ΢ϯϩʔυͰ͖ΔSDKΛར༻͠ɺ·ͣ͸։ൃ༻ͷূ໌ॻͰ࣮૷ جຊతʹެࣜͷϖʔδΛݟͯ࡞ۀΛਐΊΔ

    https://developer.apple.com/streaming/fps/ FairPlay Streaming Server SDK • Programming Guide • KSMͷϦϑΝϨϯε࣮૷ • ςετϕΫλʔʢ࣮૷͕ਖ਼͍͔֬͠ೝ͢ΔͨΊͷςετ༻σʔλʣ • ΞϓϦɾSafariͷαϯϓϧίʔυ
  19. 2. https://developer.apple.com/contact/fps/͔Β 
 FairPlay Streaming Deployment package 
 ΛϦΫΤετ FairPlay

    Streaming ૊ΈࠐΈखॱ ਖ਼͍͠໨తͰར༻͠Α͏ͱ͍ͯ͠Δ͔νΣοΫ͞ΕΔ Appleͷ୲౰ऀͱগ͠΍ΓͱΓ͢Δ͜ͱ΋
  20. 3. ແࣄঝೝ͞ΕͨΒDeployment packageͷ಺༰ʹैͬͯҎԼΛੜ੒ • FairPlay Streaming ূ໌ॻʢΞϓϦέʔγϣϯূ໌ॻʣ 
 developerͷࣝผʹར༻ •

    ূ໌ॻʹඥͮ͘private key • Application Secret key (ASk) 4. Key Security Moduleͷ࣮૷Λੜ੒ͨ͠ূ໌ॻͳͲͰΞοϓσʔτ 5. อޢίϯςϯπ४උ 6. ΞϓϦ࣮૷ 
 SDKʹؚ·ΕΔαϯϓϧίʔυHLSCatalog͕ඇৗʹࢀߟʹͳΔ FairPlay Streaming ૊ΈࠐΈखॱ
  21. SafariͰ΋ಉ༷ͷྲྀΕͰ伴ΛऔಘՄೳ Apple device EME JS Key server Key Security Module

    1. Load Key 2. Get SPC 6. [CKC 🔑 ] 3. [SPC] 4. [SPC] 5. [CKC 🔑 ] ࣮૷Օॴ ͪ͜ΒͰ४උ Apple Provided 1. 'webkitneedkey' event 2. Create keySession 3. 'webkitkeymessage' evnt with [SPC] 6. Update keySession with [CKC]
  22. FairPlay Streaming over AirPlay อޢ͞ΕͨίϯςϯπΛApple TV΍εϚʔτTVͰʂ Apple device OS App

    Key server Key Security Module Apple TVͳͲ OS Player Streamer CDN ίϯςϯπ ΞϓϦ͸ [SPC], [CKC] ΛϦϨʔ ௥Ճͷ࣮૷͸ෆཁ
  23. Common Encryption (CENC) ͱDRM ίϯςϯπͷڞ௨҉߸ԽϑΥʔϚοτ DRMγεςϜ CTR CBC PlayReady ✔︎

    ✔︎ Widevine ✔︎ ✔︎ FairPlay Streaming ❌ ✔︎ 4.0Ҏ߱
  24. ετϦʔϛϯάܗࣜͱ҉߸ར༻Ϟʔυ ετϦʔϛϯάܗࣜ CTR CBC HLS ❌ ✔︎ MPEG-DASH ✔︎ ❌

    MPEG-DASH (CMAF) ✔︎ ✔︎ CENCΛར༻ͯ͠ڞ௨ͷ҉߸ԽίϯςϯπΛར༻Ͱ͖Δͱخ͍͠ 
 ετϦʔϜͷCMAFରԠɺfMP4ԽͳͲ͕ඞཁ
  25. AVPlayerͰ͖ͪΜͱίϯςϯπอޢ • AVPlayerʹ͍ͭͯ • HTTP Live Streamingͷ࢓૊Έ • ίϯςϯπอޢ͸ԿͷͨΊʁ •

    AES-128ʹΑΔ҉߸Խ഑৴ • FairPlay Streaming • ϚϧνϓϥοτϑΥʔϜͰಈըετϦʔϜΛอޢ͢Δʹ͸ Recap
  26. ࢀߟࢿྉ WWDC Sessions WWDC18 Session 507 AVContentKeySession Best Practices WWDC15

    Session 502 Content Protection for HTTP Live Streaming Apple։ൃऀ޲͚ϖʔδ HTTP Live Streaming 
 https://developer.apple.com/streaming/ FairPlay Streaming 
 https://developer.apple.com/streaming/fps/