Marlin DRM support

[jakubvojacek]

Hello,

are you planning to add support for Marlin DRM http://www.marlin-community.com? By my understanding, it should be somewhat similar to playready and widevine.

Thank you

[zshenker]

@jakubvojacek If you can generate your own PSSH seems like you should be able to do this now with DASH CENC with raw key. https://google.github.io/shaka-packager/html/tutorials/raw_key.html

[jakubvojacek]

@zshenker thank you, I will look into that.

[kqyang]

Thanks, @zshenker.

@jakubvojacek Let us know if you have any questions with using raw key. I am also curious what will be the use case for Marlin DRM. Is there any device supporting Marlin DRM only?

[jakubvojacek]

@kqyang we are planning to use marlin for ios (using expressplay SDK). I have tried raw key before when testing clear key encryption and it worked. Not very experienced with DRM's, terminology and usage (pssh generation, etc, ...) but trying to learn it slowly

[jakubvojacek]

@zshenker I started doing some testing and unfortunately it is not playing yet. Before I bring this to Expressplay support, can you please confirm whether I am packaging it correctly?

I am using raw key with 2 pssh, one for widevine and one for marlin

/usr/bin/packager  'in=udp://239.100.200.2:1234?interface=172.16.128.42&reuse=1,stream=0,bandwidth=400000,init_segment=ct24-9_video_640_360_400.mp4,segment_template=video_640_360_400/ct24-9-$Number$.mp4' 'in=udp://239.100.200.2:1234?interface=172.16.128.42&reuse=1,stream=1,bandwidth=700000,init_segment=ct24-9_video_640_360_700.mp4,segment_template=video_640_360_700/ct24-9-$Number$.mp4' 'in=udp://239.100.200.2:1234?interface=172.16.128.42&reuse=1,stream=2,bandwidth=1000000,init_segment=ct24-9_video_720_405_1000.mp4,segment_template=video_720_405_1000/ct24-9-$Number$.mp4' 'in=udp://239.100.200.2:1234?interface=172.16.128.42&reuse=1,stream=3,language=cs, init_segment=ct24-9_audio_cs.mp4,segment_template=audio_cs/ct24-9-$Number$.mp4' --time_shift_buffer_depth 15000 --hls_playlist_type LIVE --hls_master_playlist_output ct24-9.m3u8 --mpd_output ct24-9.mpd --fragment_duration 3.2 --segment_duration 3.2  --suggested_presentation_delay 5 --min_buffer_time 3.2 --minimum_update_period 5 --default_language=cs \
--enable_raw_key_encryption \
--keys label=:key_id=01070F940A341FCFDCB5BF2D7819111D:key=6AB84DDB7997B6BC3C180A7F72439CC1 \
--pssh 000000417073736800000000EDEF8BA979D64ACEA3C827DCD51D21ED00000021121001070F940A341FCFDCB5BF2D7819111D1A0D7769646576696E655F746573740000003470737368010000001077EFECC0B24D02ACE33C1E52E2FB4B0000000101070F940A341FCFDCB5BF2D7819111D00000000

I am generating pssh for widevine with

python pssh-box.py --widevine-system-id --key-id 01070F940A341FCFDCB5BF2D7819111D --provider widevine_test --hex

and for marlin with

python pssh-box.py --common-system-id  --key-id 01070F940A341FCFDCB5BF2D7819111D --hex

the widevine seems to be working because I can play the content with expressplay widevine license server. But with Marlin, it is not. Testing marlin is a bit harder since its not supported in web browsers. I am therefore testing in their sample android app where I can supply the MPD and marlin license server. It is not playing but not displaying any error either. Any idea or should I get in touch with their support.

Thank you for your support

[kqyang]

@jakubvojacek This does not generate a marlin PSSH.

python pssh-box.py --common-system-id  --key-id 01070F940A341FCFDCB5BF2D7819111D --hex

You'll need to approach Marlin's support to have them generate Marlin PSSHs for you. Another option is to add Marlin pssh generation support to pssh-box.py tool or to Shaka Packager directly. We'll need someone, who is familiar with Marlin specification, help on this then.

And FYI. Widevine actually has an iOS SDK as well. You can contact Widevine if you want to know more about it.

[jakubvojacek]

@kqyang I tried updating pssh-box.py to support marlin according to their specs but I was just now in touch with their support and they're saying that their players do not support PSSH boxes and we shouldnt bother. Will keep this thread updated in case of any reply from their side.

Thank you

[kqyang]

@jakubvojacek Thanks for the info! I don't know much about Marlin, but I thought they are "CENC" compatible - which means that PSSH is used to fetch the license. I am curious how their player work if PSSH is not used / supported.

[jakubvojacek]

@kqyang as far as I have been told, they require that

<ContentProtection schemeIdUri="urn:uuid:5E629AF5-38DA-4063-8977-97FFBD9902D4">
                <mas:MarlinContentIds>
                    <mas:MarlinContentId>urn:marlin:kid:01070F940A341FCFDCB5BF2D7819111D</mas:MarlinContentId>
                </mas:MarlinContentIds>
            </ContentProtection>

is present in the MPD. Will keep you posted once i hear from them.

Thank you

[kqyang]

@jakubvojacek If a Marlin PSSH is provided to Shaka Packager, right now packager will generate something like this in MPD:

<ContentProtection value="cenc" schemeIdUri="urn:mpeg:dash:mp4protection:2011" cenc:default_KID="{key id in GUID format}"/>
<ContentProtection schemeIdUri="urn:uuid:5E629AF5-38DA-4063-8977-97FFBD9902D4">
  <cenc:pssh>{marlin pssh in base64}</cenc:pssh>
</ContentProtection>
{content protection element for other DRMs if provided}

The mechanism of carrying PSSH in MPD follows DASH specification (23009-1:2014). It seems to carry the same amount of information as above. Is this not supported by Marlin player?

[jakubvojacek]

Yes, I have already some content generated that has PSSH box looking just like that and I submitted a ticket to them and the response was

1. you don’t have to use PSSH box with Marlin as it gets ignored anyhow. 

hoping to hear from them tomorrow so will get back to you, once again, thank you

[jakubvojacek]

So after another talk with their support I got an answer

Ok I can see the CENC pssh elements in your manifest like
cenc:psshAAAANHBzc2gBAAAAXmKa9TjaQGOJd5f/vZkC1AAAAAEBBw+UCjQfz9y1vy14GREdAAAAAA==</cenc:pssh>

However, these are not conformant to Marlin spec., as the spec refers to pssh boxes as extensions to the fragmented MP4 format. Such boxes like 'marl' or 'kid' may be inserted directly inside the fMP4 CENC format.
We usually not recommend this option as adding Marlin to existing content would require complete repackaging of the content.

Now, on the ExpressPlay SDKs, they do support Marlin pssh signaling. However, they still require the MPD Marlin signaling like I shared before

<!-- Marlin --> 
<ContentProtection schemeIdUri="urn:uuid:5E629AF5-38DA-4063-8977-97FFBD9902D4"> 
<mas:MarlinContentIds>  <mas:MarlinContentId>urn:marlin:kid:000102030405060708090a0b0c0d0e0f</mas:MarlinContentId> 
</mas:MarlinContentIds> 
</ContentProtection>

Actually, this is the only addition you need to add support for Marlin. You don't need any pssh box in the fMP4 files at all.

quite confused. becuase from what I understood from the message, to add support for marlin, we can ecrypt the content with widevine for example, add the marlin signaling in the MPD and it should work.

[kqyang]

@jakubvojacek Thanks for the info. Yes, it is confusing.

Can you try adding a Marlin ContentProtection element manually to the DASH manifest generated by Shaka Packager, to see if it works?

<!-- Marlin --> 
<ContentProtection schemeIdUri="urn:uuid:5E629AF5-38DA-4063-8977-97FFBD9902D4"> 
<mas:MarlinContentIds>  <mas:MarlinContentId>urn:marlin:kid:000102030405060708090a0b0c0d0e0f</mas:MarlinContentId> 
</mas:MarlinContentIds> 
</ContentProtection>

We can then consider supporting it in our manifest generation code.

[jakubvojacek]

@kqyang tested today and it really works, all I had to do was to add xmlns:mas="urn:marlin:mas:1-0:services:schemas:mpd" into the MPD tag and

  <!-- Marlin --> 
<ContentProtection schemeIdUri="urn:uuid:5E629AF5-38DA-4063-8977-97FFBD9902D4"> 
<mas:MarlinContentIds>  <mas:MarlinContentId>urn:marlin:kid:abba271e8bcf552bbd2e86a434a9a5d9</mas:MarlinContentId> 
</mas:MarlinContentIds> 
</ContentProtection>

I was able to replay the content using their app then (sample working MPD https://goo.gl/bs7Yz5). Could you please consider adding this to the mpd?

Thank you

[kqyang]

@jakubvojacek Cool. I have one more question: Is the key id specified in "urn:marlin:kid:abba271e8bcf552bbd2e86a434a9a5d9" the same as the key id you provided to Shaka Packager in --keys?

[jakubvojacek]

@kqyang yes, the packager command to generate this MPD before adding marlin stuff was

packager  'in=test5.mkv_288.mp4,stream=video,init_segment=video/test5.mkv_video_288.mp4,segment_template=video/288/video_288_test5.mkv-$Number$.mp4' 'in=test5.mkv_audio_eng_92.mp4,stream=audio,language=eng,init_segment=audio/test5.mkv_audio_eng_92.mp4,segment_template=audio/eng_92/audio_eng_92_test5.mkv-$Number$.mp4' --mpd_output test5.mkv.mpd --generate_static_mpd --fragment_duration 3.2 --segment_duration 3.2 --default_language=eng-und  \
--enable_raw_key_encryption \
--keys label=:key_id=abba271e8bcf552bbd2e86a434a9a5d9:key=69eaa802a6763af979e8d1940fb88392 \
--pssh 000000407073736800000000edef8ba979d64acea3c827dcd51d21ed000000201a0d7769646576696e655f74657374220f7465737420636f6e74656e74206964

[kqyang]

Thanks @jakubvojacek. Added to v2.3 milestone for now. You are welcome to contribute if you know C++ coding. Here is where you need to touch: https://github.com/google/shaka-packager/blob/37d4ff017f16163bbdd467a6b121968b5c40c97e/packager/mpd/base/mpd_utils.cc#L331 and https://github.com/google/shaka-packager/blob/37d4ff017f16163bbdd467a6b121968b5c40c97e/packager/mpd/base/xml/xml_node.cc#L220 if you are interested.

[jakubvojacek]

had a class of C in the uni but never really did anything, more of a PHP developer here. But will take a look and see whether I could try something, thank you

[nibredy]

Hi guys, this is Nicolas from Intertrust. I'd like to add an (important) note here:

Is the key id specified in "urn:marlin:kid:abba271e8bcf552bbd2e86a434a9a5d9" the same as the key id you provided to Shaka Packager in --keys

Yes, the same Key Id needs to be used here,
AND
all the letters need to be in lower case.

For example, something like "urn:marlin:kid:ABBA271e8bcf552bbd2e86a434a9a5d9" is not conformant and will cause issue to the Marlin client.

[kqyang]

Thanks @jakubvojacek.

@nibredy Thanks for the info!

[sridhard]

Any update on this? I am also looking for the marlin support in shaka packager.

Currently intrust/expressplay(The creator of marlin) suggest to use bentoo4 tools for packaging content. MArlin content can be packaged together with widevine and playready.

Shaka packager need to support packaging of marlin content together with widevine and playready

@jakubvojacek @kqyang any update on this work?

[kqyang]

@sridhard We don't have resource to work on this right now. It is planned for milestone v2.3, i.e. in Q3 this year.

You are also welcomed to contribute if you are interested. See my previous post for details.

[kqyang]

@nibredy Is there a public document on DASH MPD format for Marlin?

Judging from the sample XML provided by @jakubvojacek, it seems like it supporting having multiple mas:MarlinContentId under mas:MarlinContentIds. Can you confirm?

<ContentProtection schemeIdUri="urn:uuid:5E629AF5-38DA-4063-8977-97FFBD9902D4"> 
<mas:MarlinContentIds>  <mas:MarlinContentId>urn:marlin:kid:abba271e8bcf552bbd2e86a434a9a5d9</mas:MarlinContentId> 
<mas:MarlinContentId>...</mas:MarlinContentId> 
<mas:MarlinContentId>...</mas:MarlinContentId> 
</mas:MarlinContentIds> 
</ContentProtection>

Also, does Marlin support signaling in HLS?

Thanks.

[vladimir-kazakov]

@kqyang, you can access Marlin DRM docs at http://www.marlin-community.com. Registration is needed, but it's quick and free. Answers to your questions can be found in the "Marlin Adaptive Streaming Specification" (both Simple and Full profiles), which can be accessed through: (the website's main menu) Develop > Downloads > Specifications > Marlin Broadband.

This specification explains how to use Marlin with DASH and HLS, and describes the format of the PSSH box (Marlin system ID (it differs from those that can be specified in MPD) and PSSH data).

[kqyang]

Thanks @vladimir-kazakov!

[kqyang]

@jakubvojacek @sridhard Marlin is now supported. Let us know if you see any problems. Thanks.

[jakubvojacek]

Thank you, will test 👍

[sridhard]

@kqyang

1. Can you please give the command to generate marlin content. Like how to generate PSSH and the commands

2. Marlin support cenc. Can we add marlin, widevine and playready headers in one content and support all 3 DRM?

[sridhard]

@kqyang As per the docs below is the command for multiple DRM system:
$ packager
in=h264_baseline_360p_600.mp4,stream=audio,output=audio.mp4,drm_label=AUDIO
in=h264_baseline_360p_600.mp4,stream=video,output=h264_360p.mp4,drm_label=SD
in=h264_main_480p_1000.mp4,stream=video,output=h264_480p.mp4,drm_label=SD
in=h264_main_720p_3000.mp4,stream=video,output=h264_720p.mp4,drm_label=HD
in=h264_high_1080p_6000.mp4,stream=video,output=h264_1080p.mp4,drm_label=HD
--enable_raw_key_encryption
--keys label=AUDIO:key_id=f3c5e0361e6654b28f8049c778b23946:key=a4631a153a443df9eed0593043db7519,label=SD:key_id=abba271e8bcf552bbd2e86a434a9a5d9:key=69eaa802a6763af979e8d1940fb88392,label=HD:key_id=6d76f25cb17f5e16b8eaef6bbf582d8e:key=cb541084c99731aef4fff74500c12ead
--protection_systems Widevine,PlayReady
--mpd_output h264.mpd

1. Just adding marlin in protection_systems is enough to support marlin?
2. For widevine I think content-id is required in PSSH. How to give content-id in this command
3. for playready do we need to give license acquition url?

[kqyang]

Can you please give the command to generate marlin content. Like how to generate PSSH and the commands

You can add Marlin to --protection_systems flag. It will not generate a Marlin PSSH as it is not needed; instead, it will include necessary signaling for Marlin protection system in the DASH manifest.

Marlin support cenc. Can we add marlin, widevine and playready headers in one content and support all 3 DRM?

Yes, you can use --protection_systems Marlin,Widevine,Playready.

Just adding marlin in protection_systems is enough to support marlin?

Yes. Of course, you need a working Marlin client and Marlin license server.

For widevine I think content-id is required in PSSH. How to give content-id in this command

content-id is not really required by Widevine. In Widevine PSSH, both key-ids and content-id are optional, but one of them must be present.

PSSH generated with --protection_systems uses key-ids but not content-id.

If your Widevine license server requires content-id, you cannot use --protection_systems to generate Widevine PSSH. You can use a combination of --pssh and --protection_systems to provide custom PSSHs and have Shaka Packager to generate other protection-systems.

for playready do we need to give license acquition url?

It is optional. License acquisition url can be provided to the player explicitly.

[sridhard]

@kqyang thanks for explanation.

I will test marlin in 2-3 days.

Can you please tell me when is the planned next release of shaka packager which will include this feature(marlin)?

[sridhard]

Hi,

Below is the entry added for marlin in the mpd file generated by shaka-packager:

      <ContentProtection schemeIdUri="urn:uuid:5e629af5-38da-4063-8977-97ffbd9902d4">
        <mas:MarlinContentIds>
          <mas:MarlinContentId>urn:marlin:kid:F3C5E0361E6654B28F8049C778B23946</mas:MarlinContentId>
        </mas:MarlinContentIds>
      </ContentProtection>

As per @nibredy in the above comments

Hi guys, this is Nicolas from Intertrust. I'd like to add an (important) note here:

Is the key id specified in "urn:marlin:kid:abba271e8bcf552bbd2e86a434a9a5d9" the same as the key id you provided to Shaka Packager in --keys

Yes, the same Key Id needs to be used here,
AND
all the letters need to be in lower case.

For example, something like "urn:marlin:kid:ABBA271e8bcf552bbd2e86a434a9a5d9" is not conformant and will cause issue to the Marlin client.

Below is the entry added for marlin in other tools:

<ContentProtection schemeIdUri="urn:uuid:5E629AF5-38DA-4063-8977-97FFBD9902D4">
        <mas:MarlinContentIds>  <mas:MarlinContentId>urn:marlin:kid:fcabef00000000000042230100018539</mas:MarlinContentId>
        </mas:MarlinContentIds>
      </ContentProtection>

@kqyang can you please check this. I think for marlin the keyid should be in lowercase.

[kqyang]

I think for marlin the keyid should be in lowercase.

@sridhard Thanks for catching that! Will fix soon.

v2.3 which includes this feature will be released at around December 1st 2018.

[sridhard]

@kqyang thanks