1. Content Encryption
Media is split (DASH/HLS) and encrypted using AES (128/CTR) with a Content Encryption Key (CEK).
2. Packaging & Metadata
Manifests (MPD/M3U8) carry DRM data like KIDs and PSSH to identify the DRM system.
3. Playback Initialization
The client detects encrypted media and loads a CDM via EME. JavaScript never sees keys.
4. License Request
The CDM sends a license challenge with device info, KIDs, and nonces to the server.
5. License Response
The server validates access and returns encrypted CEKs with usage rules, signed.
6. Secure Decryption
Keys decrypt inside secure hardware (TEE). Plain media never enters normal RAM.
7. Output Protection
Decrypted frames use secure paths to display. HDCP blocks external capture.
