PlayReady SL3000 protection with Azure Media Services

Question

Hello everybody,

Our company is currently using Azure Media Services to encrypt our media content with DRM technologies (PlayReady and Widevine).
One of the features of PlayReady is its SL3000 security level https://learn.microsoft.com/en-us/playready/overview/security-level which enforces client to decrypt content in the trusted environment.
And as far as I understand, basically it works the way that when a client sends the license request, this request is supplied with client's decoding capabilities, and the license server will only respond with valid key only if client is capable to perform decryption in trusted environment.

However we are struggling to find a way how to do it with Azure Media Services. If I search for "SL3000" term across the Azure documentation, the returned results are mainly from PlayReady documentation, and nothing from Media Services documentation that would give a hint, how it can be done.

Also reading https://learn.microsoft.com/en-us/playready/overview/security-level makes me think the SL3000 should be configured within the particular license created for some media asset. However the PlayReady license schema defined in https://learn.microsoft.com/en-us/azure/media-services/latest/drm-playready-license-template-concept?WT.mc_id=Portal-Microsoft_Azure_Support#schema has nothing related to SL3000.

Does anyone have an experience with SL3000 on Media Services? I'll appreciate for any help.

Answer 1

That is correct, the current version of Media Services key delivery and license template schema does not support SL 3000.

However, the good news is that we are currently working on SL3000 support and should be releasing it by the end of this summer. It will allow you to protect your content with SL3000 and a single key across all tracks only. So in order to be compliant with most Studio requirements, you would need to publish two separate Streaming Locators with different Keys.

For example, you would publish Streaming Locator 1 using "key1" with SL 3000 license configured for it. This would encrypt all of the tracks in your asset with SL3000. And then you would publish a second Streaming Locator 2 using "key2" with SL2000 license configured for it. In this second locator, you would want to configure a server-side asset filter to filter out the top bitrates (like 2K or 4K) that you do not wish to deliver to your clients without an SL3000 license. It will take a bit of setup, but should be fairly simple after that to apply to any assets in your AMS account library.