Upgrade to Pro — share decks privately, control downloads, hide ads and more …

AVPlayerできちんとコンテンツ保護

4ef794bdea63fc6153845bb26bac38a2?s=47 Chiharu Nameki
September 19, 2021

 AVPlayerできちんとコンテンツ保護

iOSDC Japan 2021 day2, 20min Talk
https://fortee.jp/iosdc-japan-2021/proposal/889c9c50-fa76-4b54-a4f5-04ec99cc87ba

• AVPlayerについて
• HTTP Live Streamingの仕組み
• コンテンツ保護は何のため?
• AES-128による暗号化配信
• FairPlay Streaming
• マルチプラットフォームで動画ストリームを保護するには

4ef794bdea63fc6153845bb26bac38a2?s=128

Chiharu Nameki

September 19, 2021
Tweet

Transcript

  1. AVPlayerͰ͖ͪΜͱίϯςϯπอޢ ߦ໦ ઍय़ʢͳΊ͖ ͪ͸ΔʣTwitter, GitHub @Ridwy Streaming Client Team, גࣜձࣾ

    AbemaTV iOSDC JAPAN 2021, day2 (9/19)
  2. ܦྺ גࣜձࣾϐΫηϥ 2005 ~ 2015 
 TVνϡʔφʔ, Χϝϥ, ը૾ॲཧ Mac,

    iPhoneͰ஍σδΛݟΔͨΊͷΞϓϦͳͲΛ୲౰ גࣜձࣾαΠόʔΤʔδΣϯτ 2015 ~ Amebaϒϩά iOSΤϯδχΞ AbemaTV Streaming Client Team
  3. • ৽͍͠ະདྷͷςϨϏʮABEMAʯ • ΠϯλʔωοτςϨϏہʢ2015೥։ہʣ • 20Ҏ্ͷνϟϯωϧ, VOD, ଞ 
 ͞·͟·ͳࢹௌܗଶ

    • ੜதܧ΍൪૊੍࡞΋ख͕͚Δ גࣜձࣾAbemaTV
  4. Streaming Client Teamʹ͍ͭͯ • ABEMA͸ଟ͘ͷϓϥοτϑΥʔϜΛαϙʔτ 
 iPhone, Apple TV, Android,

    Android TV, Web, IPTV, … 
 • ֤ϓϥοτϑΥʔϜͷ࠶ੜΫϥΠΞϯτʹ஫ྗ͠ɺࢹௌମݧΛ୲อɾ޲্͢ Δઐ໳νʔϜ • ϓϨΠϠʔͷ࣮૷, ࢹௌ඼࣭ͷ؂ࢹ, ৽ٕज़ͷPoC
  5. ΞδΣϯμ AVPlayerͰ͖ͪΜͱίϯςϯπอޢ • AVPlayerʹ͍ͭͯ • HTTP Live Streamingͷ࢓૊Έ • ίϯςϯπอޢ͸ԿͷͨΊʁ

    • AES-128ʹΑΔ҉߸Խ഑৴ • FairPlay Streaming • ϚϧνϓϥοτϑΥʔϜͰಈըετϦʔϜΛอޢ͢Δʹ͸
  6. AVPlayer AppleͷϓϥοτϑΥʔϜͰө૾ɾԻ੠Λ࠶ੜ͢ΔϓϨΠϠʔ ϩʔΧϧͷϑΝΠϧ͚ͩͰͳ͘ɺϦϞʔτͷϑΝΠϧ΍ετϦʔϛϯά΋࠶ੜՄೳ • ϝσΟΞΛѻ͏AVFoundation.frameworkʹ࣮૷͞Ε͍ͯΔ • AVFoundation͸·ͣiOSͰ։ൃ͞Εɺ2011೥ʹMacʹҠ২ • ಈըͳͲͷٕज़ͷਐาͱͱ΋ʹݱࡏ΋׆ൃʹ։ൃ͞Ε͍ͯΔ AVFoundation

  7. HTTP Live Streaming (HLS) AVPlayerͰ࠶ੜͰ͖ΔετϦʔϛϯάܗࣜ • Live, VODͷͲͪΒʹ΋ରԠ • HTTPΛར༻͢ΔͨΊεέʔϥϏϦςΟʹ༏ΕΔ

    • Adaptive Bit Rate (ABR) 
 ճઢঢ়گʹΑΓ࠷దͳϏοτϨʔτͷετϦʔϜʹεΠονՄೳ • ࢓૊Έ্ɺ2, 3ඵҎԼͷ௿஗Ԇ഑৴͸࣮ݱग़དྷͳ͔͕ͬͨɺ 
 Low Latency HLSͷొ৔ʹΑΓෆՄೳͰ͸ͳ͘ͳͬͨ AppleʹΑͬͯ։ൃ͞ΕɺRFC8216ͱͯ͠ެ։ Android΍ϒϥ΢βͰ΋࠶ੜՄೳ ಛ௃
  8. HTTP Live Streaming M3U8 ϓϨΠϦετ ϝσΟΞηάϝϯτ 
 TS or fMP4

    ϓϨΠϠʔ͸ϓϨΠϦετͷதʹهࡌ͞Ε͍ͯΔηάϝϯτΛ্͔Β࿈ଓͯ͠࠶ੜ ରԠCODEC: 
 HEVC or H.264, 
 AAC or AC-3
  9. M3U8ϓϨΠϦετͷྫ #EXTM3U #EXT-X-TARGETDURATION:10 #EXTINF:9.009, http://media.example.com/first.ts #EXTINF:9.009, http://media.example.com/second.ts #EXTINF:3.003, http://media.example.com/third.ts

  10. Adaptive Bit Rate (ABR) ϚελʔϓϨΠϦετ = ଳҬ͝ͱͷϝσΟΞϓϨΠϦετΛෳ਺ؚΉϓϨΠϦετ #EXTM3U #EXT-X-STREAM-INF:PROGRAM-ID=1, BANDWIDTH=200000

    gear1/prog_index.m3u8 #EXT-X-STREAM-INF:PROGRAM-ID=1, BANDWIDTH=311111 gear2/prog_index.m3u8 #EXT-X-STREAM-INF:PROGRAM-ID=1, BANDWIDTH=484444 gear3/prog_index.m3u8 ετϦʔϜͷ࠷େϏοτϨʔτ (bps)
  11. Adaptive Bit Rate (ABR) ϓϨΠϠʔ͸ճઢঢ়گʹԠͯ͡࠷దͳετϦʔϜʹεΠον͠ͳ͕Β 
 ׈Β͔ͳ࠶ੜΛଓ͚Δ ి೾͕ѱ͘ͳͬͯདྷͨͧʁ 
 ௿ը࣭ʹ੾Γସ͑ͯ͠ͷ͝͏

    ͓ɺվળͯ͠དྷͨ ߴը࣭ʹ໭ͬͨʂ😃 Low High
  12. ίϯςϯπอޢ͸ԿͷͨΊʁ

  13. ίϯςϯπอޢͷඞཁੑ Ξφϩάഔମͷίϯςϯπ͸ίϐʔ͢Δͱ඼࣭͕ྼԽ͢Δ • ίϐʔͷՁ஋͕௿͍ͷͰஶ࡞ݖ؅ཧͷඞཁੑ͸ߴ͘ͳ͔ͬͨ σδλϧίϯςϯπ͸׬શͳίϐʔ͕Մೳ • ւ଑൛ͷൢച, ࡞඼ͷվม, … •

    ੍࡞ऀɾݖརऀ͕๬·ͳ͍ܗͰফඅ͞ΕΔͷΛ๷͙࢓૊Έ͕ඞཁ
  14. ΋͠ɺಈը഑৴ͰԿ΋͠ͳ͔ͬͨΒʁ URLΛ஌͍ͬͯΕ͹ಈըΛݟΒΕΔͷͰ 
 ʮ࡞඼Λߪೖͯ͠΋Β͏ʯͱ͍͏ϏδωεϞσϧ͕੒ཱ͠ͳ͍ ͓ۚͷ໰୊͚ͩͰ͸ͳ͘… • ഑৴ଆʮձһݶఆίϯςϯπΛ഑৴͠Α͏ʂʯˠ ୭Ͱ΋ݟΒΕΔΑʁ • ग़ԋऀʮxxͷ൪૊ʹग़ԋ͠·ͨ͠ʂʯˠ

    ࣮࣭ɺશੈքͰϑϦʔૉࡐԽ ͋·Γָ͘͠ͳ͍ੈք
  15. ༷ʑͳίϯςϯπอޢͷख๏ ΞΫηεํ๏Λ੍ݶ IP੍ݶ, υϝΠϯ੍ݶ, ॺ໊෇͖URL, ... ίϯςϯπΛ҉߸Խ ɹ҉߸Խ഑৴, DRM഑৴, ...

  16. DRM σδλϧίϯςϯπͷஶ࡞ݖ؅ཧٕज़ Digital Rights Management ίϯςϯπΛ҉߸Խͯ͠कΔ อޢ͞Εͨܦ࿏ͰͷΈө૾΍Ի੠Λ࠶ੜ ࡞඼͕Ͳ͏࢖ΘΕΔ΂͖͔Λنఆ͠؅ཧ͢Δ

  17. DRMͷ໰୊఺ ಛఆͷαʔϏε΍؀ڥʹґଘ • DRMίϯςϯπΛར༻Ͱ͖Δͷ͸ɺͦͷίϯςϯπΛߪೖͨ͠αʔϏεͷΈ Ͱ͋Δ͜ͱ͕ଟ͍ • ߪೖͨ͠ίϯςϯπΛӬԕʹར༻Ͱ͖Δอূ͸ͳ͍ 
 ిࢠॻ੶ͷετΞ͕Ϋϩʔζͨ͠Βʁ େྔͷίϯςϯπΛߪೖͨ͠ΞΧ΢ϯτ͸૬ଓͰ͖Δʁ

    
 ར༻ํ๏Λنఆ͢Δ΋ͷͳͷͰɺ࢖͍ʹ͘͞ʹܨ͕Γ΍͍͢ • Ωπ͗͢Ε͹੍ݶʹͳΓɺͻͲ͍৔߹͸ফඅऀͷݖརͷ৵֐ʹͳΔɻ 
 ࡞඼Λ࠷େݶʹָ͠ΊΔઃܭͰ͋Δ͜ͱ͕େ੾
  18. ࡞඼Λ࠷େݶʹָ͠ΊΔઃܭ͕େ੾

  19. ҉߸Խͷجૅ஌ࣝ ڞ௨伴҉߸ ಉ͡伴Ͱ҉߸Խɾෳ߹Խ Data 🔐

  20. ϒϩοΫ҉߸ େ͖ͳσʔλΛ҉߸Խ͢ΔࡍɺϒϩοΫʹ෼͚ͯ҉߸Խ Block 🔒 ҉߸Խͷجૅ஌ࣝ Block 🔒 Block 🔒 Block

    🔒 Block 🔒 🔑
  21. ҉߸Խͷجૅ஌ࣝ AES (Advanced Encryption Standard) • ୅දతͳڞ௨伴ϒϩοΫ҉߸ • ϒϩοΫ௕ 128bit

    • ԿϏοτͷ伴Λ༻͍Δ͔ʹΑͬͯ AES-128, AES-192, AES-256ͱදه͞ΕΔ
  22. Block Block 🔑 🔒 ҉߸Խͷجૅ஌ࣝ ϒϩοΫ҉߸ͷ҉߸ར༻Ϟʔυ CBC (Cipher Block Chaining)

    Ϟʔυ ෳ߹Խʹ͸ॳظϕΫτϧ(IV)ͱ伴͕ඞཁ IV Block Block 🔑 🔒 Block Block 🔑 🔒 ॳظϕΫτϧ XOR XOR XOR
  23. ҉߸Խͷجૅ஌ࣝ ϒϩοΫ҉߸ͷ҉߸ར༻Ϟʔυ CTR (Counter) Ϟʔυ CTR Block Block 🔑 🔒

    XOR CTR 🔒 CTR+1 Block Block 🔑 🔒 XOR CTR+1 🔒 CTR+2 Block Block 🔑 🔒 XOR CTR+2 🔒 ҉߸Խɾෳ߹Խͱ΋ʹฒྻԽ͕Մೳ
  24. ҉߸Խͷجૅ஌ࣝ ެ։伴҉߸ • ڞ௨伴҉߸͸伴Λ͍͔ʹ҆શʹ૬खʹ౉͔͕͢՝୊ 
 → ͦΕͳΒ҉߸Խͱෳ߹Խͷ伴Λผʹ͢Ε͹͍͍͡Όͳ͍ 
 ҉߸ԽͰ͖Δ͚ͩͷ伴͕όϨͯ΋໰୊ͳ͍͠ɺͳΜͳΒެ։ͯ͠΋🙆 


    • ڞ௨伴҉߸ͱൺ΂ͯॲཧ͕ॏ͍ͷͰେ༰ྔσʔλʹ͸޲͔ͳ͍ 
 → େ༰ྔσʔλΛڞ௨伴҉߸Ͱ҉߸Խͯ͠ɺ伴Λެ։伴҉߸Ͱ౉͢
  25. ҉߸Խͨ͠ετϦʔϜΛHLSͰ഑৴͢Δ

  26. AES-128ʹΑΔ҉߸Խ഑৴ ηάϝϯτશମΛAES-128 CBCϞʔυͰ҉߸Խ Segment 🔒 Segment 🔒 Segment 🔒 Segment

    🔒 #EXT-X-KEY:METHOD=AES-128,URI="伴Λऔಘ͢ΔͨΊͷ URI",IV=0x012345678901234567890123456789012
  27. • URIʹ伴ͷ৔ॴͦͷ΋ͷΛॻ͘ͱɺๅശʹʮ伴͸ςʔϒϧͷ্ʯͱுΓࢴΛͯ͠ ͍ΔΑ͏ͳ΋ͷ 
 
 伴ͷ౉͠ํʹ޻෉͕ඞཁ • 伴ͷαʔόʹೝূػೳΛ͚ͭΔ • ΧελϜεΩʔϚΛར༻ͯ͠ΞϓϦଆͰಠࣗॲཧΛߦ͏

    • etc. • εΫϦʔϯγϣοτ΍ը໘࿥ըɺϛϥʔϦϯά͸Մೳ 
 ʢඞཁͳΒΞϓϦͷίʔυͰରࡦʣ AES-128ʹΑΔ҉߸Խ഑৴
  28. AVContentKeySession ΞϓϦଆͰ伴Λऔಘ • ίϯςϯπͷ伴Λऔಘ͢ΔͨΊʹઃܭ͞ΕͨAPI • ࠶ੜը໘ʹདྷͨΒɺ͋Β͔͡ΊΩʔΛऔಘ͓ͯ͘͜͠ͱ΋Մೳ 
 → Join Timeͷվળʹ໾ཱͭ

    • METHOD=AES-128Ͱ΋ɺγϛϡϨʔλͰ͸ಈ͔ͳ͍ʁ 
 ͜ͷΫϥεొ৔લ͔Β͋ΔAVAssetResourceLoader͸ಈ͘ 
 URLProtocolͰ΋ϑοΫՄೳ WWDC18 Session 507 AVContentKeySession Best Practices ࢀߟ:
  29. session = AVContentKeySession(keySystem: .clearKey) session.setDelegate(self, queue: .global()) let asset =

    AVURLAsset(url: playlistURL) session.addContentKeyRecipient(asset) player = AVPlayer(playerItem: AVPlayerItem(asset: asset)) extension Foo: AVContentKeySessionDelegate { func contentKeySession(_ session: AVContentKeySession, didProvide keyRequest: AVContentKeyRequest) { getKey(from: keyRequest.identifier) { key in if let key = key { let response = AVContentKeyResponse(clearKeyData: key, initializationVector: nil) keyRequest.processContentKeyResponse(response) } else { keyRequest.processContentKeyResponseError(KeyError.unknown) } } } } AVContentKeySessionͰMETHOD=AES-128ͷ伴Λऔಘ͢Δྫ
  30. FairPlay StreamingʹΑΔDRM഑৴ 伴ͷ഑৴ํ๏ΛఆΊͯɺ΋ͬͱݎ࿚ʹ͠Α͏

  31. FairPlay Streaming (FPS) • AppleʹΑͬͯ։ൃ͞ΕͨಈըετϦʔϜΛอޢ͢ΔͨΊͷDRMٕज़ • AppleͷσόΠεʢ+ AirPlayରԠεϚʔτTVʣͰར༻Մೳ • ωΠςΟϒΞϓϦ

    & Safari • ηΩϡΞͳ伴ͷ഑৴ • HDCPͳͲʹରԠ͠ɺอޢ͞Εͨܦ࿏ͰͷΈө૾ɾԻ੠Λ࠶ੜ 
 εΫγϣΛࡱΔͱө૾ྖҬ͕ਅͬࠇʹͳΔ • ΦϑϥΠϯ࠶ੜ΍ϨϯλϧͷͨΊͷ࢓૊Έ͕͋Δ 
 ϏδωεϩδοΫࣗମ͸نఆ͠ͳ͍ • ແྉ
  32. FairPlayͱུ͕ͪ͠Ͱ͕͢ผ෺Ͱ͢…💦 FairPlay = iTunes StoreͷΞΠςϜʹ࢖ΘΕ͍ͯΔDRMٕज़

  33. FPSͰͷίϯςϯπͷ҉߸Խํࣜ • ίϯςφ಺ͷϏσΦΛϑϨʔϜຖɺΦʔσΟΦ͸αϯϓϧຖʹ 
 AES-128 CBCϞʔυͰ҉߸Խ • ϏσΦ͸શମͷ10%Λ҉߸Խ (encrypt:skip pattern

    of 1:9) 
 ϏσΦΛσίʔυͰ͖ͳ͘͢Δʹ͸ɺ෦෼తʹ҉߸Խ͢Ε͹े෼ #EXT-X-KEY:METHOD=SAMPLE-AES,URI="skd://key65", KEYFORMAT="com.apple.streamingkeydelivery",KEYFORMATVERSIONS="1"
  34. ίϯςϯπͷ伴Λऔಘ͢ΔྲྀΕ Apple device OS App Key server Key Security Module

    Load Key Get SPC [CKC 🔑 ] [SPC] [SPC] [CKC 🔑 ] ࣮૷Օॴ ͪ͜ΒͰ४උ Apple Provided Key Security Module (KSM) ͸ 
 ҉߸Խ͞ΕͨServer Playback ContextΛड͚औͬͯ 
 ίϯςϯπͷ伴ΛؚΉContent Key ContextΛ 
 ੜ੒ɾ҉߸Խͯ͠ฦ͢
  35. ίϯςϯπͷ伴Λऔಘ͢ΔྲྀΕ Apple device OS App Key server Key Security Module

    Load Key Get SPC [CKC 🔑 ] [SPC] [SPC] [CKC 🔑 ] ࣮૷Օॴ ͪ͜ΒͰ४උ Apple Provided • 伴Λ஌͍ͬͯΔͷ͸Key Serverͱ OSͷΈʢΞϓϦ΋஌Βͳ͍ʂʣ • ίϯςϯπ͸OSͷΧʔωϧͰෳ߹
  36. FairPlay Streaming ૊ΈࠐΈखॱ 1. Key Security ModuleΛ࣮૷ 
 ެࣜϖʔδ͔Βμ΢ϯϩʔυͰ͖ΔSDKΛར༻͠ɺ·ͣ͸։ൃ༻ͷূ໌ॻͰ࣮૷ جຊతʹެࣜͷϖʔδΛݟͯ࡞ۀΛਐΊΔ

    https://developer.apple.com/streaming/fps/ FairPlay Streaming Server SDK • Programming Guide • KSMͷϦϑΝϨϯε࣮૷ • ςετϕΫλʔʢ࣮૷͕ਖ਼͍͔֬͠ೝ͢ΔͨΊͷςετ༻σʔλʣ • ΞϓϦɾSafariͷαϯϓϧίʔυ
  37. 2. https://developer.apple.com/contact/fps/͔Β 
 FairPlay Streaming Deployment package 
 ΛϦΫΤετ FairPlay

    Streaming ૊ΈࠐΈखॱ ਖ਼͍͠໨తͰར༻͠Α͏ͱ͍ͯ͠Δ͔νΣοΫ͞ΕΔ Appleͷ୲౰ऀͱগ͠΍ΓͱΓ͢Δ͜ͱ΋
  38. 3. ແࣄঝೝ͞ΕͨΒDeployment packageͷ಺༰ʹैͬͯҎԼΛੜ੒ • FairPlay Streaming ূ໌ॻʢΞϓϦέʔγϣϯূ໌ॻʣ 
 developerͷࣝผʹར༻ •

    ূ໌ॻʹඥͮ͘private key • Application Secret key (ASk) 4. Key Security Moduleͷ࣮૷Λੜ੒ͨ͠ূ໌ॻͳͲͰΞοϓσʔτ 5. อޢίϯςϯπ४උ 6. ΞϓϦ࣮૷ 
 SDKʹؚ·ΕΔαϯϓϧίʔυHLSCatalog͕ඇৗʹࢀߟʹͳΔ FairPlay Streaming ૊ΈࠐΈखॱ
  39. SafariͰ΋ಉ༷ͷྲྀΕͰ伴ΛऔಘՄೳ Apple device EME JS Key server Key Security Module

    1. Load Key 2. Get SPC 6. [CKC 🔑 ] 3. [SPC] 4. [SPC] 5. [CKC 🔑 ] ࣮૷Օॴ ͪ͜ΒͰ४උ Apple Provided 1. 'webkitneedkey' event 2. Create keySession 3. 'webkitkeymessage' evnt with [SPC] 6. Update keySession with [CKC]
  40. FairPlay Streaming over AirPlay อޢ͞ΕͨίϯςϯπΛApple TV΍εϚʔτTVͰʂ Apple device OS App

    Key server Key Security Module Apple TVͳͲ OS Player Streamer CDN ίϯςϯπ ΞϓϦ͸ [SPC], [CKC] ΛϦϨʔ ௥Ճͷ࣮૷͸ෆཁ
  41. ϚϧνϓϥοτϑΥʔϜͰ 
 ಈըετϦʔϜΛอޢ͢Δʹ͸

  42. ͞·͟·ͳDRMγεςϜ DRMγεςϜ ఏڙ ରԠϓϥοτϑΥʔϜ PlayReady Microsoft Windows, Android, iOS Widevine

    Google Android FairPlay Streaming Apple AppleσόΠε
  43. Common Encryption (CENC) ͱDRM ίϯςϯπͷڞ௨҉߸ԽϑΥʔϚοτ DRMγεςϜ CTR CBC PlayReady ✔︎

    ✔︎ Widevine ✔︎ ✔︎ FairPlay Streaming ❌ ✔︎ 4.0Ҏ߱
  44. ετϦʔϛϯάܗࣜͱ҉߸ར༻Ϟʔυ ετϦʔϛϯάܗࣜ CTR CBC HLS ❌ ✔︎ MPEG-DASH ✔︎ ❌

    MPEG-DASH (CMAF) ✔︎ ✔︎ CENCΛར༻ͯ͠ڞ௨ͷ҉߸ԽίϯςϯπΛར༻Ͱ͖Δͱخ͍͠ 
 ετϦʔϜͷCMAFରԠɺfMP4ԽͳͲ͕ඞཁ
  45. AVPlayerͰ͖ͪΜͱίϯςϯπอޢ • AVPlayerʹ͍ͭͯ • HTTP Live Streamingͷ࢓૊Έ • ίϯςϯπอޢ͸ԿͷͨΊʁ •

    AES-128ʹΑΔ҉߸Խ഑৴ • FairPlay Streaming • ϚϧνϓϥοτϑΥʔϜͰಈըετϦʔϜΛอޢ͢Δʹ͸ Recap
  46. ࢀߟࢿྉ WWDC Sessions WWDC18 Session 507 AVContentKeySession Best Practices WWDC15

    Session 502 Content Protection for HTTP Live Streaming Apple։ൃऀ޲͚ϖʔδ HTTP Live Streaming 
 https://developer.apple.com/streaming/ FairPlay Streaming 
 https://developer.apple.com/streaming/fps/
  47. ͝੩ௌ͋Γ͕ͱ͏͍͟͝·ͨ͠ 🙇