Wowza Logo Wowza Icon
Wowza Video Sign Out
Talk to an Expert Free Trial
Wowza Video Sign Out

Wowza Community

Article: How to secure Apple HTTP Live Streaming (AES-128 - external method)

Wowza Streaming Engine
#21

I have a basic question regarding the event sequence in external method security.

I have a password protected page: http://URL1 which loads the HTML5 player in the customer’s IPhone/IPad to play http://IP:1935/application/mystream

I have script https://URL2 which returns the key generated in /keys/mystream.key generated by genkey.bat

I am trying to confirm that my server will only stream to the HTML5 player in http://URL1

Where is https://URL2 called from to prevent direct linking to http://IP:1935/application/mystream from anywhere other than http://URL1?

#22

How do you automatically generate keys for livestreams on publishing, i.e when a streamer connects and starts streaming to our wowza server (we don’t want to do anything manually)? We are using transcoding to 3 different qualities and origin-edge and plan do use nDVR in the future if that makes any difference. quote from above regarding automation: “Note: You can also use the genkey utility to generate key files. A key file with a different key is generated each time you run this utility. You can integrate this utility into an automated workflow to create many .key files for a video library.”

#23

Hello

I’m currently using VOD Stream type with External Method encryption without DRM, I have read about key rotation feature and i would like to use it, what i want to achieve is that each group of n files is encrypted using a different key. For example the first 10 ts files use a key then the next 10 ts files uses a different key.

How can i do this in my current setup ?

Thanks

#24

Hello Richard

This sounds great, but can i do it in a way where i can pre-know the encryption key that will be used for n number of ts files. Helix supports a feature where you can use a different pre-known key for every ts file.

#25

Hello Richard

I will postpone this to a later phase in the future, now i have another question. I’m using external method as i told you before, i’m streaming content from amazon s3 bucket using MediaCache addon. Now the encryption is not happening !! is MediaCache compatible with encryption? if so what should i change to make it work again.

Thanks

#26

Hello Richard

To test my work, i made a new wowza server on different server. I used out of the box Application.xml found in conf/Application.xml and followed the instructions from MediaCache User Guide:

  1. Copy lib/wms-plugin-mediacache.jar from this package into the Wowza Server folder [install-dir]/lib folder

  2. Copy conf/MediaCache.xml from this package into the[install-dir]/conf folder Wowza Server folder

  3. Create the folder [install-dir]/application/mediacache

  4. Create the folder [install-dir]/conf/mediacache and copy the [install-dir]/conf/Applications.xml into this new folder.

  5. Edit the newly copied Application.xml file and make the following changes:

a. Set the RTP/Authentication/PlayMethod to: none

b. Add the following property to the MediaReader/Properties so that the section looks like this:

randomAccessReaderClass

com.wowza.wms.plugin.mediacache.impl.MediaCacheRandomAccessReader

bufferSeekIO

true

Boolean

  1. Edit [install-dir]/conf/Server.xml and add a reference to the MediaCacheServerListener class in the section:

com.wowza.wms.plugin.mediacache.impl.MediaCacheServerListener

  1. Then in conf/MediaCache.xml i uncommented the following:

awsAccessKeyId

MyawsAccessKeyId

awsSecretAccessKey

MyawsSecretAccessKey

And in i set the to http://s3.amazonaws.com//SubFolderName/

It reads very well from amazon using this setup, now to enable external Method URL, i have only to create a key file with same mp4 file name and place it in keys directory.

Anything wrong i’m doing in here ? Maybe i should change details (, or ) in conf/mediacache/Applications.xml !!!

Thanks

#27

I’m already using it, same like the example myStream.php found in external method and inserting it in ./genkey.sh . I have checked, if i use the same config without mediacache configuration enabled in Application.xml it works like a charm but with mediacache enabled it doesn’t do encryption. Any Ideas !!

Abed Abu Dhair

#28

Hello Richard

After testing all scenarios, i found the problem was in the keys folder. I had to create a subdirectory inside the keys folder with the same name of configured MediaCacheSource and that solved the problem. For example in conf/MediaCache.xml the MediaCacheSource name used is http so you have to create keys/html and place your keys inside it.

Thanks for your support

#29

For the streams themselves or the site where i have the php file?

#30

I do not think there is a way to change this message.

Charlie

#31

Indika,

You can use HTTProviders and HTTPUTils. I.e. call and process response from HTTProvider on one Wowza server with HTTPUtils on another

Richard

#32

Indika,

AES is for encrypting Cupertino streams. Nothing to do with Wowza server to Wowza server communcations.

Here are some examples of HTTProviders:

https://www.wowza.com/docs/http-provider-code-examples-for-wowza-media-server

HTTPUtils is an API included in Wowza to load and process HTTP resources, such as HTTProviders. See the Wowza ServerSide API for more info.

Richard

#33

You just follow one of these guides:

https://www.wowza.com/docs/how-to-secure-apple-http-live-streaming-aes-128-external-method)

https://www.wowza.com/docs/how-to-use-the-internal-method-of-aes-128-encryption-to-secure-live-or-vod-streams-sent-to-apple-ios-devices-moduleencryptionhandlercupertinostreaming)

Richard

#34

Did you copy the generated keys to [wowza-install-dir]/keys folder (step 3)?

Zip up the conf and logs and keys folders, and send them to support@wowza.com.

Include a link to this thread for reference.

Richard

#35

I think you can just generate one and copy it to different stream names.

When files are in sub-folders, the path is part of the stream name. So you should include full name when generating key.

Richard

#36

Indika,

Take a look at IMediaWriterActionNotify interface:

https://www.wowza.com/docs/how-to-use-imediawriteractionnotify-to-programmatically-move-and-rename-recordings-of-live-streams

You can use onWriteComplete event handler to write a key file after each recording. You could use a template key file and just make a copy using java.io.File API

Richard

#37

Indika,

I see, my mistake. No, that event will not fire. If you are providing an upload mechanism, a php or asp page, you can do the same there: copy a template key to new file with the correct name.

Richard

#38

What is [stream-name] ? Is it a simple name like “myStream”, and you have the rtmp address of the origin in /originURL?

If so, try using a .stream file instead. Create a text file named origin.stream in the content folder:

/content/origin.stream, with contents:

rtmp://[wowza-address]:1935/liveorigin/definst/myStream

Now use stream name “origin.stream”

Richard

#39

I’m not sure. Zip up the conf, logs and keys folders and send them to support@wowza.com

If you can, delete the current access log then restart Wowza and do some tests, then send that log with /conf and /keys

Richard

#40

Don’t turn on DEBUG level logging, leave it as INFO, which is default (if you haven’t made a change there is nothing to do)

Richard

© 2007–2024 Wowza Media Systems™, LLC. All rights reserved.   Security & Privacy PolicyLegalSystem Status