Task Preset for Azure Media Encryptor

When you run Microsoft Azure Media Services processing tasks such as encoding and encryption, you can use task preset files to store configuration settings for the tasks. The task configuration file described in this topic is used by the Windows Azure Media Encryptor processor. This processor enables you to encrypt media assets using PlayReady Protection. You would use this task when doing static encryption to protect your content with PlayReady. However, it is recommended to use dynamic encryption.

Media Services now provides a service for delivering Microsoft PlayReady licenses. To sign up for PlayReady License Delivery Service do the following:

Follow instructions described in Preview features.

In the Azure Management Portal, go to the CONTENT PROTECTION tab and add a row to the Branding Reporting table. The Media Services PlayReady license service will be enabled a few minutes after you press SAVE.

Once you sign up for PlayReady license deliver service, you can use the Azure Management Portal to configure your PlayReady license service policy. Media Services also provides APIs that let you configure the rights and restrictions that you want for the PlayReady DRM runtime to enforce when a user is trying to play back protected content. For more information, see Using PlayReady Dynamic Encryption and License Delivery Service.

You can also choose to implement your own or use a third-party provider. For more information about implementing your own PlayReady license server see: Microsoft PlayReady Overview.

Azure Media Encryptor Preset

In the PlayReady Protection task, Microsoft Smooth Streaming files (.ismv, .isma) are encrypted per the MPEG Common Encryption (CENC) specification (ISO 23001-7:2011) for use by Microsoft PlayReady and the client manifest is updated for use by Smooth Streaming clients.

To deliver MPEG DASH encrypted with PlayReady, make sure to use CENC options by setting the useSencBox and adjustSubSamples properties (described later in this topic) to true.

Copy the following configuration xml and use it to create a file named MediaEncryptor_PlayReadyProtection.xml on your local computer. Then update the configuration file with the required settings. Ask your licensing provider for the appropriate values to use.

To make the sample configuration file work with a task, provide the following values:

• A licenseAcquisitionUrl value. You must specify values for the licenseAquisitionURL setting of your PlayReady license server.

• A keyId value and a contentKey value. The keyId value can be a randomly generated guid (you can generate a guid for a keyId in code, or by using tools in Visual Studio). Key Ids must be unique and could only be associated with one content key. 

  It is recommended to use keySeedValue and keyId values to generate a contentKey value. The keySeedValue value is provided with a PlayReady license server, or for testing you can obtain a default value on the PlayReady test site. You can use the Microsoft.WindowsAzure.MediaServices.Client.CommonEncryption.GeneratePlayReadyContentKey method to generate the content key based on keySeedValue and keyId. Once you generate the content key value, add the keyId and the associated contentKey to the configuration file.

  As an alternative to using keyId and contentKey, you can add a keySeedValue directly in the configuration file. Adding keySeedValue to the configuration file should only be done for testing purposes.

  Security Note
  Using a keySeedValue in a task configuration file is not recommended for production applications. Because the key seed is used to generate content keys for your PlayReady protected content, there is a security risk involved with storing it in configuration. For production PlayReady applications, the recommended practice is to use a keyId with a generated contentKey.

If you want to test using the keySeedValue and licenseAcquisitionUrl values provided by the PlayReady test server. Use the following:.

. . . 
    <property name="keySeedValue" value="XVBovsmzhP9gRIZxWfFta3VVRPzVEWmJsazEJ46I" />
    <property name="licenseAcquisitionUrl" value="http://playready.directtaps.net/pr/svc/rightsmanager.asmx" />
. . .

The Using Static Encryption to Protect your Smooth and MPEG DASH with PlayReady topic demonstrates how to do static encryption using the Media Services PlayReady license delivery service.

<taskDefinition xmlns="https://schemas.microsoft.com/iis/media/v4/TM/TaskDefinition#">
  <name>PlayReady Protection</name>
  <id>9A3BFEAC-F8AE-41CA-87FA-D639E4D1C753</id>
  <description xml:lang="en" />
  <properties namespace="https://schemas.microsoft.com/iis/media/v4/SharedData#" prefix="sd">
    <property name="adjustSubSamples" value="true" />
    <property name="contentKey" value="" />
    <property name="customAttributes" value="" />
    <property name="dataFormats" value="h264, avc1, mp4a, vc1, wma, owma, ovc1, aacl, aach, ac-3, ec-3, mlpa, dtsc, dtsh, dtsl, dtse" />
    <property name="keyId" value="" />
    <property name="keySeedValue" value="" />
    <property name="licenseAcquisitionUrl" value="" />
    <property name="useSencBox" value="true" />
    <property name="serviceId" value="" />
  </properties>
  <inputFolder/>
  <outputFolder>Protected</outputFolder>
  <taskCode>
    <type>Microsoft.Web.Media.TransformManager.DigitalRightsManagementTask, Microsoft.Web.Media.TransformManager.DigitalRightsManagement, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35</type>
  </taskCode>
</taskDefinition>

The configuration file must conform to the syntax rules of a well formed xml file.

The following table explains the properties of the Azure Media Encryptor xml: