FairPlay Streaming: Delivering Protected AV1 Video

Apple’s FairPlay Streaming (FPS) technology secures premium video playback across Apple devices using robust digital rights management (DRM) integrated into HTTP Live Streaming (HLS). With the addition of hardware-accelerated AV1 decoding in Apple Silicon, FairPlay Streaming manages protected AV1 assets by combining standard HLS packaging, Common Encryption (CENC) using the CBCS scheme, and secure hardware-based key exchange. This article examines the technical workflow required to package, license, and decrypt protected AV1 video streams using FairPlay.

AV1 Packaging and Encryption

FairPlay Streaming requires AV1 content to be encapsulated within fragmented MP4 (fMP4) containers, which serve as media segments within an HLS stream.

Content protection relies on the Common Encryption (CENC) standard using the cbcs protection scheme (AES-128 in Cipher Block Chaining with 10% pattern protection). In an AV1 stream, the video payload consists of Open Bitstream Units (OBUs). When encrypting AV1:

• The container isolates the AV1 OBUs within mdat boxes.
• Uncompressed headers and critical metadata (such as Sequence Headers and Frame Headers) remain in the clear to allow decoders to parse structural properties.
• The video data (Tile Group OBUs or Frame OBUs) is encrypted using AES-CBC with specific crypt and skip byte patterns, matching the cbcs profile required by Apple platforms.

HLS Manifest Signaling

To deliver protected AV1 streams, the HLS multivariant (master) playlist must properly declare both the AV1 codec and the FairPlay DRM parameters:

1. Codec Declaration: The CODECS attribute in the #EXT-X-STREAM-INF tag specifies the AV1 profile, level, and tier using standard naming conventions (for example, codecs="av01.0.08M.10").
2. Key Tag: The media playlists must declare the FairPlay DRM key specification using the #EXT-X-KEY tag.
3. Key Attributes: The tag specifies METHOD=SAMPLE-AES, KEYFORMAT="com.apple.streamingkeydelivery", and KEYFORMATVERSIONS="1", along with a URI pointing to the application's license acquisition endpoint or key identifier.

This signaling enables the AVPlayer framework to identify that the upcoming AV1 video segments require a FairPlay-compliant decryption key before playback can begin.

Key Exchange and License Workflow

The delivery and playback workflow follows the standard FairPlay Streaming protocol:

1. Initialization Data: When playback starts, AVPlayer reads the encryption metadata (such as the sinf and pssh boxes in the fMP4 initialization segment) and requests an encrypted Server Playback Context (SPC) from the device’s Secure Enclave.
2. License Request: The host application captures the SPC and forwards it to the content provider’s Key Security Module (KSM) alongside the asset ID and user authorization tokens.
3. CKC Generation: The KSM unwraps the SPC using its private key, retrieves the appropriate AV1 content decryption key from the Key Management System, and packages it into an encrypted Content Key Context (CKC).
4. License Delivery: The application passes the CKC back to AVPlayer, which loads it directly into the secure hardware pipeline.

Secure Hardware Decryption and Playback

Once the CKC is delivered to the operating system, FairPlay manages the decryption and decoding entirely inside isolated hardware:

• Hardware Boundary: On supported devices (such as devices featuring the A17 Pro chip, M3 family, or later), the hardware-accelerated AV1 decoder is directly linked to the Secure Enclave.
• Key Decryption: The AV1 content key is extracted inside secure memory and is never exposed to user-space applications or system memory.
• Decoding Pipeline: The encrypted AV1 OBUs are streamed directly into the hardware decoder. The hardware decrypts the cbcs blocks and decodes the AV1 frames within protected memory buffers.
• Display Output: The decoded video frames are sent through a protected display pipeline (enforcing HDCP over external connections) to prevent unauthorized capture or interception.