Note: The following article is adapted from the Adobe Media Player 1.5 Content Developer Kit, available for download from the Adobe Media Player Developer Center home page.

Adobe Media Player, enabled by Flash Media Rights Management Server, provides content protections for your video content and playlists. You can also use content protections to support revenue models such as direct purchase, rental or subscription.

Flash Media Rights Management Server—together with Adobe Media Player or Adobe AIR—gives content owners and distributors the features and flexibility to develop new business models that produce new revenue streams or audiences for their digital content. Flash Media Rights Management Server with Adobe Media Player can tightly associate content with branding and advertisements for advertising-supported business models. In addition, owners and distributors can license digital assets to viewers or groups of viewers.

By offering a combination of Video Rights Management and Advertising Protection, Adobe content protection technologies ensure that your content is secure. Flash Media Rights Management Server and Adobe Media Player provide a viewer experience that is intuitive, non-intrusive, and convenient.

For an overview of content protection using Flash Media Rights Management Server, or detailed information on securing video content, see adobe.com/go/learn_FMRMS_documentation.

This article describes how content protection works in Adobe Media Player and how to encrypt content.

Content protection basics

Used in conjunction with the Flash Media Rights Management Server and Flash Media Server 3, Adobe Media Player provides two methods of content protection:

• Advertising protection: Enhanced Feeds specifying streaming and downloaded content with bundled advertisements are fortified to mitigate the viewer breaking apart playlists and ads, and circumventing your ad-based model. Implements digital signature verification of signed incoming video feeds to protect content integrity. Transparent to viewer; requires no viewer action.
• Video rights management: Securely associates downloaded content with the viewer to mitigate subsequent sharing. The viewer is required to provide credentials, such as login and password, to get access to the content.

Note: You can also protect your streaming content using Adobe protected streaming technology. With protected streaming, content is securely streamed and terminated at Adobe Media Player to mitigate unprotected local storage on a client system. If you want to implement protected streams, see adobe.com/go/learn_mp_protect.

The Adobe Media Player architecture ensures that encrypted, progressively downloaded video content that is stored on the client remains encrypted. When content is played back, Adobe Media Player ensures that the viewer has the rights to play back the content. The viewer must be online for the initial playback of a protected show, and Adobe Media Player securely stores the decryption keys locally. Any subsequent content viewings under the same license are cleared using the local decryption key until it is expired. This enables the viewer to play any purchased, downloaded content while offline.

Advertising protection

The Flash Media Rights Management Server encryption tool creates a digital signature for a media file, ensuring that encrypted FLV content plays back only from valid media files (Enhanced Feeds), and plays back only in Adobe Media Player. If the viewer modifies the media file in any way, it does not play in Adobe Media Player. Specifically, advertising included with downloadable content only plays back in Adobe Media Player. Content does not play at all if the viewer modifies advertising content or parameters in any way.

Viewers are not prompted to authenticate when they encounter encrypted content, but they receive a warning message if they tamper with protected content. In addition, the content does not play, Adobe Media Player preferences are reset to defaults, and all content in My Favorites is removed.

For example, a viewer wants to download an episode to a laptop. You have included the program segments and advertisements in the Enhanced Feed. The advertisements in the Enhanced Feed are applicable to the demographic information that the viewer provided to initiate the download. After the Enhanced Feed is fully downloaded, the viewer can watch the program offline. You can use the Flash Media Rights Management Server Automated Audit and Analytics feature to track the number of times the content is viewed, both online and offline, so that you can collect advertisement revenues. Viewer credentials are not required. You can choose to set an expiration date, after which the episode is no longer playable.

Video rights management

Video Rights Management protection lets you publish authentication-based content for playback in Adobe Media Player. When a viewer attempts to access identity-based content, Adobe Media Player prompts for viewer name and password. If the viewer selects the Remember option in the login dialog box, viewer credentials are cached. The viewer is not prompted to authenticate for additional content, published from the same server. If a viewer tampers with protected content, he receives a message warning him that his Adobe Media Player preferences are being reset to the defaults, and all content in My Favorites is being removed.

All rights-managed content has a time-based viewing license associated with it. This license determines the period of time the content is available for the viewer to view the content, when the viewer is offline. The content status icons displayed next to the video thumbnail, indicate that the content is available only for a limited time.

To enable this workflow, run the Flash Media Rights Management Server packager on the unprotected content and specify protections. The protected content is then distributed. When a viewer tries to play the content, Flash Media Rights Management Server contacts you through your service provider interface (SPI). Flash Media Rights Management Server queries whether the viewer is allowed access to your content and, if so, for how long. As such, viewer credentials are mandatory. However, Flash Media Rights Management Server also supports anonymous access. The policy determines whether anonymous access is allowed and how it is applied.

An overview of Adobe Media Player rights management architecture

Figure 1 shows the Adobe Media Player rights management architecture.

Figure 1. Adobe Media Player rights management architecture

An overview of the Advertising Protection workflow

A high-level description of the Advertising Protection workflow is as follows:

1. Assign a policy. A policy sets the rules for media playback, such as expiration dates, and number of hours a license stays cached in local memory.
2. Encrypt the media file as a single FLV (episode). During the encryption phase, the encrypted content is associated with a policy.
3. Place the FLV file on a server.
4. You create an Enhanced Feed and associated AMOD that references the protected content. The AMOD is signed so that if it is modified, the signature becomes invalid.
5. Viewer requests the episode, and the FLV is either streamed or downloaded progressively to the viewer computer.
6. Adobe Media Player detects that an encrypted file is present, and requests a decryption key from the publishing server. If the publisher is using RTMP, the key is obtained from Flash Media Server. If the file is encrypted by the Flash Media Rights Management Server utility, the license is obtained from the Flash Media Rights Management Server.
7. Server sends back the decryption key.
8. Adobe Media Player decrypts the FLV file and securely stores the decryption key according to the policy defined. For example, a policy stores the identity license on the viewer computer for further use.
9. The FLV file is played through Adobe Media Player, following the terms of your policy.
10. If the viewer wants to play the file again, Adobe Media Player retrieves the locally-saved key, confirms that the policy allows the file to be played, and plays the file. This enables offline viewing of previously viewed and authenticated files.

Note: This offline mechanism works for media files that are progressively downloaded. While streaming files employ the same Digital Rights Management protections and features, the viewer must be online, as files are streamed and not stored on the viewer computer.

An overview of the Video Rights Management workflow

A high-level description of the Video Rights Management workflow is as follows:

1. Adobe Media Player displays Content Status icons noting that a piece of content requires authentication, when the viewer finds identity-protected content.
2. The viewer selects the content that requires authentication.
3. Adobe Media Player displays a dialog box prompting the viewer to enter credentials for accessing the identity-protected content.
4. Adobe Media Player captures the various DRMStatus and DRMError events from the video playback and integrates them into the error message handling scheme of Adobe Media Player.
5. Adobe Media Player displays the online/offline availability duration during video playback.

Note: Adobe Media Player 1.1 is unable to authorize nested AMOD FLV files. Specifically, a file cannot be authorized if a signed nested AMOD contains an ID-based, encrypted FLV, and its parent AMOD is unsigned. Table 1 shows the scenarios that authorize playback.

Table 1. Authorized playback scenarios in Adobe Media Player

	Parent AMOD Signed	Parent AMOD Unsigned
Nested AMOD Signed	Playback occurs	File unauthorized
Nested AMOD Unsigned	Playback occurs	Playback occurs

About status icons for protected content

In Adobe Media Player, protected content displays both download status and content validity, in the form of status icons. For more information on status icons, see "About Content Status icons" in Understanding the Adobe Media Player experience.

Importantly, status icons also let viewers know when the offline license for downloaded content is about to expire or has expired. Viewers can re-authenticate the license by going back online. Once the lease expires, the viewer receives a warning message indicating the lease has expired. Table 2 shows each icon and the status it indicates.

Table 2. Icons and the status indicated

Icon	Indicator	Description
	Expiring soon	The episode expires soon
	Expired	The episode has expired and is no longer available

Encrypting content

Using Flash Media Rights Management Server, you can apply policies to FLV files and F4V files. Using Rights Manager, administrators can create, list, view details of, and update policies. A policy defines how viewers can view content. It is a collection of information that includes security settings, authorized viewers, and usage rights. When policies are applied, encryption and signing allow you to maintain control of your content, no matter how widely it is distributed. Encrypted FLV files are delivered using Flash Media Server or over an HTTP server, and downloaded and played in Adobe Media Player.

Using three command-line interface (CLI) tools (Rights Manager, Media Packager, and Playlist Signer) that Flash Media Rights Management Server provides, you can create policies, apply policies to video files, encrypt the files, and sign Enhanced Feeds.

The high-level steps for performing these tasks are as follows:

1. Set up the Configuration file on the computer where the Rights Management Server command-line tools are installed.
2. Create a policy by using Rights Manager; a policy ID is generated. You might need to perform this step only once or a few times; most publishers create a small number of policies and apply the same few policies to many files.
3. Add to the configuration file the policy ID of the policy you plan to use.
4. Package a file by using Media Packager. In this context, packaging a file means to encrypt and apply a policy to it.
5. Create an AMOD that points to the packaged content.
6. Sign the AMOD by using the Playlist Signer tool. The AMOD and encrypted content are then ready for deployment. For an overview of content protection using Flash Media Rights Management Server, or information on securing video content, see adobe.com/go/learn_mp_protect.

Using AMOD Signer

Using AMOD Signer, you can sign AMODs. Signatures protect content within Adobe Media Player from being tampered with, ensuring that content integrity is protected. Before using AMOD Signer, ensure that you fulfill the listed requirements and that the configuration file contains the required information. For more information, see adobe.com/go/learn_mp_protect.

AMOD Signer is installed here:

[install directory]/Adobe/FMRMS1.0/fmrms_tools/libs

AMOD Signer uses this syntax:

java -jar libs/AdobeMODSigner.jar sourcefile destfile [options]

where sourcefile is the AMOD file to sign and destfile is the signed AMOD destination file. If destfile is in a directory that is different from the source file directory, the signed AMOD is saved in this directory, using the same filename as the source file. Otherwise, ensure that sourcefile and destfile have different filenames. Adobe recommends that you store your source files in one directory and your destination (signed) files in another directory. To specify a network location, specify it as follows: \\server\folder\filename.extension

Signing AMODs

To sign a playlist, on the command line, type the following:

java -jar libs/AdobeMODSigner.jar sourcefile destfile [options]

You can specify the options shown in Table 3.

Table 3. Options for signing a playlist

Option	Description
-c	Specifies the location of the configuration file. If this option is not specified, the tool looks for the default configuration file in the working directory.
-o	If the destination file exists, overwrite that file without prompting.
-s	Turns off prompts for commands, such as the prompt to confirm whether the destination file is overwritten.
-v	Prints the version information for the tool.

Where to go from here

To learn more about implementing custom features using AMODs, see How Adobe Media Player uses SMIL.

Browse the other chapters to read more of the CDK:

• Introducing the Content Developer Kit
• Understanding the experience
• Preparing and customizing content
• Customizing your branding
• Delivering your advertising
• Measurement basics
• How Adobe Media Player uses SMIL
• Deploying the Flash Media Server Receiver application
• Additional code samples

About the author