Netflix uses a DRM (Digital Rights Management) technology named Widevine by Google.
Widevine isn't just a tool, but it's a whole architecture that makes sure that only authorized users and trusted devices can access the video content.
Pre-requisite →
1. Trusted Execution Environment (TEE)
It's a small place in your system where all the sensitive information resides. It is separate from your OS, so even if the OS is hacked, the information still remains secure here. It has its own secure processing and storage. Things like DRM keys, fingerprint data, and payments are handled here.
2. Security levels
Every device can be classified into 3 security levels.
a) L1 (Highest Trust)
In this, the key never leaves the TEE. All the operations happen inside the secure hardware.
It supports →
4K / UHD / HDR streaming
b) L2 (Middle Ground)
In this, the keys and decryption happen inside the TEE, but the video decoding happens outside the secure environment.
It supports →
HD quality
c) L3 (Software only)
There is no usage of TEE at all. Everything is handled in the OS memory.
It supports →
SD quality
3. Asymmetric encryption
In normal encryption and decryption, the message can be locked and unlocked only by a single key. But asymmetric encryption is like →
- Encryption → by the public key
- Decryption → by the private key
This type of encryption is used to securely transfer a message in an insecure environment such that only the authorized user (the one with the private key) can see the message.
Architecture →
Its whole architecture looks like this →
Encrypted video → License request → Key approval → Secure decryption → Playback
Now we will deep dive into each step in detail.
1. Encrypted Video
Even before the user clicks on anything, Netflix takes the raw video and encrypts it using algorithms like AES. Then it breaks it down into small encrypted chunks and stores it in CDNs (Content Delivery Networks).
2. License request
When you open the website, the browser initializes Widevine in your system.
First, it checks the device compatibility → L1, L2, or L3.
Then it decides the maximum resolution → 4K, HDR, 1080p, etc.
Then a request is sent to the server which includes →
- Content ID
- Device info
- Security compatibility
This request is securely generated and sent to the license server.
3. Key approval
The server verifies the request. If the verification fails, the request is rejected.
After verification, the server sends back the decryption key of the content. The decryption key is not raw; it is securely wrapped so that it can only be accessed inside the TEE and remains protected.
4. Secure decryption
The TEE gets the encrypted content key (CEK) from the server and decrypts it securely inside the TEE.
5. Playback
Encrypted video chunks are fetched from the CDN. The TEE decrypts the video chunks with the help of the CEK.
Then the video is decoded and sent to the display.