Secure streaming to the iPhone and iPod Touch (AES-128 - external method)

[charlie]

This forum post has moved to the following article:

http://www.wowzamedia.com/forums/content.php?60

Enjoy,
The Wowza Team

[sc4venger]

Charlie,

The links to:

Streaming to the iPhone and iPod Touch
SHOUTcast, RTSP/RTP, native RTP or MPEG-TS streaming to iPhone and iPod Touch

Seems to be broken / dead. Can you please check it out? I need to reconfigure live iphone streaming to a new server.

Thanks!

-fred

[rrlanham]

Use these instead:

vod streaming
http://www.wowzamedia.com/forums/showthread.php?t=6466

live streaming
http://www.wowzamedia.com/forums/showthread.php?t=6467

mgpeg-ts
http://www.wowzamedia.com/forums/showthread.php?t=6468

rtsp
http://www.wowzamedia.com/forums/showthread.php?t=6467

others among these:
http://www.wowzamedia.com/forums/forumdisplay.php?f=39

Richard

[Dustin013]

I am having some issues understand exactly how this works. It would seem the example is primarily created for securing live streams, however I am still new to Wowza so I could be wrong. I have a lot of questions but I guess I will start with the first question because hopefully by answering that I will have a better idea on how to proceed.

A quick bit about my current setup... I warn you it is very simple...

I have a php file called mediaplayer.php and all it does is simply link directly to the stream... so for instance when the user selects the media file they wish to stream a link is basically generated using the exact example given in the tutorials...

<a href="http://[wowza-address]:1935/vod/mp4:<? php echo $media;?>.mp4/playlist.m3u8"> Launch Video </a>

$media is being passed through the URL, so the URL would look like

http://192.168.1.101/iphone/mediapla...dia=testvideo1

I could get rid of the a href link all together and simply forward the user there like so...

<?php
ob_start();
header("Location: http://[wowza-address]:1935/vod/mp4:".$media.".mp4/playlist.m3u8");
?>

So first off, this is the example given in this post to generate a key for a given stream is...

genkey.bat iphone myStream.sdp https://mycompany.com/myStream.php

From what I have read sdp seems to be for live streams. How would I generate a key for a VOD file? Would I have to generate a key for each video file that I am streaming to secure it?

[charlie]

Let me see if this helps. The basic idea is:

1. Generate a key that is used to encrypt each of the media chunks. The key file includs a URL for the player to retrieve the key.
2. Put the key in the keys folder on the server and it's name matches the name of the media file.
3. Wowza will use the key to encrypt each of the chunks before delivery and will put the key URL in the playlist file so the player can retrieve the key to decrypt the chunks.
4. You provide a PHP script in your web server that distrubutes the key. You need to be sure you secure the key so only who you want to view the stream can get the key.

This applies to both live and video on demand streams.

Charlie

[Dustin013]

I have generated a few keys for some of the media files but I can still access them by browsing directly to them in my iphone...

(http://&#91;wowza-address]:1935/vod/mp4:.../playlist.m3u8)

Unlike the live streams, I don't see a message from Wowza saying the stream is encrypted.

Also, this raises another concern. All of the keys seem to be hardcoded into the PHP file. What if I have 200 media files I want to share? Would I need to manually create 200 key files, then hardcode those 200 keys into the php file?

I actually have over 25,000 media files that are compatible with the iPhone. Currently I use FMS 3.5 to stream the files using flash through the browser. Imagine my surprise when I found out that Wowza could stream the entire archive to the IPhone because the encodes are compatible. I am trying to make the switch from FMS 3.5 to stream to both PC users and the iPhone, but it would seem that this method is cumbersome at best when dealing with large numbers of media files that are accessed on demand. Obviously I can secure the streams the same was I do im FMS, utilizing tokens and such, but the iPhone doesn't work that way.

What method would you suggest to be the most effective for securing videos on demand streamed to the iphone when working with massive amounts of content that is changing regularly? I would love to be able to secure the videos because I could instantly switch over to Wowza. However, without being able to secure the streams in a method that is not only effective but somewhat manageable I won't be able to. Any advice whatsoever would be GREATLY appreciated.

[charlie]

For video on demand if the keys are setup properly you should see the same type of message saying the stream is protected. If you don't see the message then it is not setup properly.

Take a look at this post for a way to have the key generated dynamically:

http://www.wowzamedia.com/forums/showthread.php?t=6530

Charlie

[Dustin013]

I am still failing to see how either method would prevent link sharing for instance. If one user knows the path to generate the playlist file it will encrypt the stream but it won't keep unwanted users from gaining access would it? If they know the url to generate the playlist, it would encrypt the stream but the link to open the stream would have to include the key to decrypt the stream.

Maybe I am way off, if so please let me know... but what would keep unwanted users from viewing the stream if key was located in the playlist file?

[rrlanham]

A solution to "link sharing", if I understand what you mean, could be expiring keys. You would have to develop something involving a database and timestamps, probably.

Richard

[charlie]

Basically the key is the key. You have to figure out how to protect the key. With the chunks of media encrypted now the valuable asset is the key. So you need to invent a scheme for protecting the key. For VOD with the internal method it is possible to generate a different key for each session. So that is even more secure.

Charlie