本页介绍了如何对转码内容进行加密。Transcoder API 不会直接创建或管理加密密钥或许可。您必须使用第三方数字版权管理 (DRM) 提供商才能使用这些功能。为媒体创建加密密钥后，使用 Secret Manager 将这些密钥传递给 Transcoder API。
加密设置在 JobConfig 设置中指定。Transcoder API 会使用提供的加密设置转码内容。输出清单包含在您选择的媒体播放器中解密内容所需的信息。
受支持的配置
| 流式传输协议 | 容器 | DRM 系统 | 加密方案 |
|---|---|---|---|
| HLS | TS | ClearKey | aes128 |
| HLS | TS | FairPlay | sampleAes |
| HLS | fMP4 | FairPlay | 仅限 mpegCenc cbcs |
| MPEG-DASH | fMP4 | Widevine | mpegCenc cenc 或 cbcs |
| MPEG-DASH | fMP4 | PlayReady | mpegCenc cenc 或 cbcs |
将加密密钥添加到 Secret Manager
在开始之前，请使用您选择的第三方 DRM 提供商创建加密密钥。
Transcoder API 要求您的 Secret 包含以下 JSON 格式的加密密钥以及其他必要信息。
如需了解每个字段的说明，请参阅 DRM 协议文档。请注意，您需要将蛇形命名法转换为驼峰式大小写，以便使用 JSON 格式。
示例 JSON
{ "encryptionKeys": [ { // Key for FairPlay configuration. "keyId": "d569cb35bd0548c7a99d92feb381df13", "key": "f1967daca83e81f38d80aa741e7b32c2", "iv": "8d80aa741e7b32c2f1967daca83e81f3", "keyUri": "skd://d569cb35bd0548c7a99d92feb381df13", "matchers": [ { "muxStreams": ["ts_fairplay"] } ] }, { // Key for Widevine configurations. "keyId": "44ec248b048c43a6a6ee58a752c6f9f8", "key": "f1967daca83e81f38d80aa741e7b32c2", "keyUri": "skd://44ec248b048c43a6a6ee58a752c6f9f8", "matchers": [ { "muxStreams": [ "fmp4_widevine_cenc_video", "fmp4_widevine_cenc_audio", "fmp4_widevine_cbcs_video", "fmp4_widevine_cbcs_audio" ] } ] }, { // Key for PlayReady configurations. "keyId": "8beed229709f480bb6004ec0f33e82d1", "key": "ad20cd838f354dcc8a77c443d08ff09f", "keyUri": "skd://8beed229709f480bb6004ec0f33e82d1", "matchers": [ { "muxStreams": [ "fmp4_playready_cenc_video", "fmp4_playready_cenc_audio", "fmp4_playready_cbcs_video", "fmp4_playready_cbcs_audio" ] } ] }, { // Key for all ClearKey configurations. "keyId": "3d9dccb479c64adbb6e514790caa7822", "key": "my-key", // A URI that the media player can access "keyUri": "https://example.com/keys/my-key.bin", "iv": "8d80aa741e7b32c2f1967daca83e81f3" // No `matchers` field. This is the default key to use when none of the keys above match. } ] } 如果您的加密配置（例如 FairPlay）需要显式初始化向量 (IV)，但未包含该向量，则该 API 将使用 keyId 的值作为 iv 的值。
如需添加和配置加密密钥，请执行以下操作：
使用上述 JSON 数据，按照创建 Secret 中的步骤将加密密钥添加到 Secret Manager。
为您的 Secret 配置 IAM 权限，以便 Transcoder API 可以访问 Secret 内容。为此，请向
service-PROJECT_NUMBER@gcp-sa-transcoder.iam.gserviceaccount.com服务账号授予secretmanager.secretAccessor角色（这与服务账号如何访问您的 Cloud Storage 存储分区类似）。找到您创建的 Secret 版本的资源名称（例如
projects/PROJECT_NUMBER/secrets/SECRET_ID/versions/VERSION_ID）。您需要此名称才能配置 Transcoder API 作业。对于 ClearKey 配置，
keyUri字段必须引用媒体播放器有权访问的 URI。执行以下操作：运行以下命令，使用密钥创建二进制文件：
echo "my-key" | xxd -r -p > my-key.bin将文件上传到公共 URI。如需使用 Cloud Storage，请参阅使用 Google Cloud 控制台发现对象存储空间。
创建作业
加密设置使用 JobConfig 级别 encryptions 数组中的对象指定。系统会为每个不同的配置分配一个唯一标识符 (id)。每个 muxStream 都使用标识符来指明要使用哪种加密配置，或者省略该字段以保持未加密状态。
JSON 格式
{ // Other JobConfig settings. "encryptions": [ { // Identifier for this encryption configuration, to be specified in muxStream(s). "id": string, // Configuration for secrets stored in Google Secret Manager. "secretManagerKeySource": { // The name of the Secret Version containing the encryption key. // `projects/{project}/secrets/{secret_id}/versions/{version_number}` // Using {version_number} of `latest` is not supported. "secretVersion": string }, // DRM system(s) that will be used. At least one must be specified. If a DRM system // is omitted, it will be considered disabled. "drmSystems": { // Widevine configuration. "widevine": {}, // FairPlay configuration. "fairplay": {}, // PlayReady configuration. "playready": {}, // ClearKey configuration. "clearkey": {} }, // Union field encryption_mode can be only one of the following: // Configuration for HLS AES-128 encryption. "aes128": {}, // Configuration for HLS SAMPLE-AES encryption. "sampleAes": {}, // Configuration for MPEG-DASH Common Encryption (MPEG-CENC). "mpegCenc": { // Specify the encryption scheme. Supported schemes: // - `cenc` - AES-CTR subsample // - `cbcs`- AES-CBC subsample pattern "scheme": string } // End of list of possible types for union field encryption_mode. } // Any other encryption configurations. ], "muxStreams": [ { // Unique identifier for the muxStream. "key": string, // Identifier of the encryption configuration for the muxStream. "encryptionId": string // … other muxStream settings. } // Other muxStreams. ], // Other JobConfig settings. } 示例（ClearKey）
以下示例在 HLS 清单中配置了 AES-128 muxStream，并在 DASH 清单中配置了 MPEG-CENC muxStream（cenc 和 cbcs）：
"elementaryStreams": [ { "key": "es_video", "videoStream": { "h264": { "profile": "main", "heightPixels": 600, "widthPixels": 800, "bitrateBps": 1000000, "frameRate": 60, }, }, }, { "key": "es_audio", "audioStream": { "codec": "aac", "channelCount": 2, "bitrateBps": 160000 } } ], "encryptions": [ { "id": "aes-128", "secretManagerKeySource": { "secretVersion": "projects/12345/secrets/key-1/versions/1" }, "drmSystems": {"clearkey": {}}, "aes128": {} }, { "id": "cenc", "secretManagerKeySource": { "secretVersion": "projects/12345/secrets/key-1/versions/1" }, "drmSystems": {"clearkey": {}}, "mpegCenc": { "scheme": "cenc" } }, { "id": "cbcs", "secretManagerKeySource": { "secretVersion": "projects/12345/secrets/key-1/versions/1" }, "drmSystems": {"clearkey": {}}, "mpegCenc": { "scheme": "cbcs" } } ], "muxStreams": [ { "key": "ts_aes128", "container": "ts", "elementaryStreams": ["es_video", "es_audio"], "segmentSettings": {"segmentDuration": "2s"}, "encryptionId": "aes-128" }, { "key": "fmp4_cenc_video", "container": "fmp4", "elementaryStreams": ["es_video"], "segmentSettings": {"segmentDuration": "2s"}, "encryptionId": "cenc" }, { "key": "fmp4_cenc_audio", "container": "fmp4", "elementaryStreams": ["es_audio"], "segmentSettings": {"segmentDuration": "2s"}, "encryptionId": "cenc" }, { "key": "fmp4_cbcs_video", "container": "fmp4", "elementaryStreams": ["es_video"], "segmentSettings": {"segmentDuration": "2s"}, "encryptionId": "cbcs" }, { "key": "fmp4_cbcs_audio", "container": "fmp4", "elementaryStreams": ["es_audio"], "segmentSettings": {"segmentDuration": "2s"}, "encryptionId": "cbcs" } ], "manifests": [ { "fileName": "manifest_aes128.m3u8", "type": "HLS", "muxStreams": ["ts_aes128"] }, { "fileName": "manifest_cenc.mpd", "type": "DASH", "muxStreams": ["fmp4_cenc_video", "fmp4_cenc_audio"] }, { "fileName": "manifest_cbcs.mpd", "type": "DASH", "muxStreams": ["fmp4_cbcs_video", "fmp4_cbcs_audio"] } ] 示例（FP/PR/Widevine）
以下示例配置了 FairPlay/SAMPLE-AES、Widevine/MPEG-CENC (cenc 和 cbcs) 和 PlayReady/MPEG-CENC (cenc 和 cbcs) muxStreams。HLS 和 DASH 清单中都包含 Widevine 和 PlayReady muxStreams。
"elementaryStreams": [ { "key": "es_video", "videoStream": { "h264": { "profile": "main", "heightPixels": 600, "widthPixels": 800, "bitrateBps": 1000000, "frameRate": 60, }, }, }, { "key": "es_audio", "audioStream": { "codec": "aac", "channelCount": 2, "bitrateBps": 160000 } } ], "encryptions": [ { "id": "fairplay", "secretManagerKeySource": { "secretVersion": "projects/12345/secrets/key-1/versions/1" }, "drmSystems": {"fairplay": {}}, "sampleAes": {} }, { "id": "widevine-cenc", "secretManagerKeySource": { "secretVersion": "projects/12345/secrets/key-1/versions/1" }, "drmSystems": {"widevine": {}}, "mpegCenc": { "scheme": "cenc" } }, { "id": "widevine-cbcs", "secretManagerKeySource": { "secretVersion": "projects/12345/secrets/key-1/versions/1" }, "drmSystems": {"widevine": {}}, "mpegCenc": { "scheme": "cbcs" } }, { "id": "playready-cenc", "secretManagerKeySource": { "secretVersion": "projects/12345/secrets/key-1/versions/1" }, "drmSystems": {"playready": {}}, "mpegCenc": { "scheme": "cenc" } }, { "id": "playready-cbcs", "secretManagerKeySource": { "secretVersion": "projects/12345/secrets/key-1/versions/1" }, "drmSystems": {"playready": {}}, "mpegCenc": { "scheme": "cbcs" } } ], "muxStreams": [ { "key": "ts_fairplay", "container": "ts", "elementaryStreams": ["es_video", "es_audio"], "segmentSettings": {"segmentDuration": "2s"}, "encryptionId": "fairplay" }, { "key": "fmp4_widevine_cenc_video", "container": "fmp4", "elementaryStreams": ["es_video"], "segmentSettings": {"segmentDuration": "2s"}, "encryptionId": "widevine-cenc" }, { "key": "fmp4_widevine_cenc_audio", "container": "fmp4", "elementaryStreams": ["es_audio"], "segmentSettings": {"segmentDuration": "2s"}, "encryptionId": "widevine-cenc" }, { "key": "fmp4_widevine_cbcs_video", "container": "fmp4", "elementaryStreams": ["es_video"], "segmentSettings": {"segmentDuration": "2s"}, "encryptionId": "widevine-cbcs" }, { "key": "fmp4_widevine_cbcs_audio", "container": "fmp4", "elementaryStreams": ["es_audio"], "segmentSettings": {"segmentDuration": "2s"}, "encryptionId": "widevine-cbcs" }, { "key": "fmp4_playready_cenc_video", "container": "fmp4", "elementaryStreams": ["es_video"], "segmentSettings": {"segmentDuration": "2s"}, "encryptionId": "playready-cenc" }, { "key": "fmp4_playready_cenc_audio", "container": "fmp4", "elementaryStreams": ["es_audio"], "segmentSettings": {"segmentDuration": "2s"}, "encryptionId": "playready-cenc" }, { "key": "fmp4_playready_cbcs_video", "container": "fmp4", "elementaryStreams": ["es_video"], "segmentSettings": {"segmentDuration": "2s"}, "encryptionId": "playready-cbcs" }, { "key": "fmp4_playready_cbcs_audio", "container": "fmp4", "elementaryStreams": ["es_audio"], "segmentSettings": {"segmentDuration": "2s"}, "encryptionId": "playready-cbcs" } ], "manifests": [ { "fileName": "manifest_fairplay.m3u8", "type": "HLS", "muxStreams": ["ts_fairplay"] }, { "fileName": "manifest_widevine_cenc.m3u8", "type": "HLS", "muxStreams": ["fmp4_widevine_cenc_video", "fmp4_widevine_cenc_audio"] }, { "fileName": "manifest_widevine_cbcs.m3u8", "type": "HLS", "muxStreams": ["fmp4_widevine_cbcs_video", "fmp4_widevine_cbcs_audio"] }, { "fileName": "manifest_widevine_cenc.mpd", "type": "DASH", "muxStreams": ["fmp4_widevine_cenc_video", "fmp4_widevine_cenc_audio"] }, { "fileName": "manifest_widevine_cbcs.mpd", "type": "DASH", "muxStreams": ["fmp4_widevine_cbcs_video", "fmp4_widevine_cbcs_audio"] }, { "fileName": "manifest_playready_cenc.m3u8", "type": "HLS", "muxStreams": ["fmp4_playready_cenc_video", "fmp4_playready_cenc_audio"] }, { "fileName": "manifest_playready_cbcs.m3u8", "type": "HLS", "muxStreams": ["fmp4_playready_cbcs_video", "fmp4_playready_cbcs_audio"] }, { "fileName": "manifest_playready_cenc.mpd", "type": "DASH", "muxStreams": ["fmp4_playready_cenc_video", "fmp4_playready_cenc_audio"] }, { "fileName": "manifest_playready_cbcs.mpd", "type": "DASH", "muxStreams": ["fmp4_playready_cbcs_video", "fmp4_playready_cbcs_audio"] } ] 确定要使用的 JSON 配置后，请照常创建作业。
监控输出
加密的输出串流包含经过修改的清单，其中包含解密内容以进行播放所需的信息。
清单示例
以下清单显示了解密关联内容所需的信息。
HLS AES-128/ClearKey
#EXTM3U #EXT-X-VERSION:7 #EXT-X-TARGETDURATION:4 #EXT-X-MEDIA-SEQUENCE:0 #EXT-X-DISCONTINUITY-SEQUENCE:0 #EXT-X-KEY:METHOD=AES-128,URI="https://example.com/keys/3d9dccb479c64adbb6e514790caa7822.bin",IV=0x8d80aa741e7b32c2f1967daca83e81f3 #EXT-X-PROGRAM-DATE-TIME:2022-10-12T20:08:22.870Z #EXTINF:2.576778 segment-0000000000.ts #EXT-X-PROGRAM-DATE-TIME:2022-10-12T20:08:25.447Z #EXTINF:2.000000 segment-0000000001.ts #EXT-X-PROGRAM-DATE-TIME:2022-10-12T20:08:27.447Z #EXTINF:2.000000 segment-0000000002.ts #EXT-X-PROGRAM-DATE-TIME:2022-10-12T20:08:29.447Z #EXTINF:2.000000 segment-0000000003.ts HLS SAMPLE-AES/FairPlay
#EXTM3U #EXT-X-VERSION:7 #EXT-X-TARGETDURATION:4 #EXT-X-MEDIA-SEQUENCE:0 #EXT-X-DISCONTINUITY-SEQUENCE:0 #EXT-X-KEY:METHOD=SAMPLE-AES,URI="skd://d569cb35bd0548c7a99d92feb381df13",KEYFORMAT="com.apple.streamingkeydelivery",KEYFORMATVERSIONS="1" #EXT-X-PROGRAM-DATE-TIME:2022-10-12T20:08:22.870Z #EXTINF:2.576778 segment-0000000000.ts #EXT-X-PROGRAM-DATE-TIME:2022-10-12T20:08:25.447Z #EXTINF:2.000000 segment-0000000001.ts #EXT-X-PROGRAM-DATE-TIME:2022-10-12T20:08:27.447Z #EXTINF:2.000000 segment-0000000002.ts #EXT-X-PROGRAM-DATE-TIME:2022-10-12T20:08:29.447Z #EXTINF:2.000000 segment-0000000003.ts DASH MPEG-CENC/Widevine
<AdaptationSet segmentAlignment="true" maxWidth="800" maxHeight="600"> <Representation mimeType="video/mp4" id="fmp4_widevine_cenc_video" codecs="avc1.4d001f"> <ContentProtection value="cenc" schemeIdUri="urn:mpeg:dash:mp4protection:2011" cenc:default_KID="44ec248b-048c-43a6-a6ee-58a752c6f9f8"/> <ContentProtection schemeIdUri="urn:uuid:edef8ba9-79d6-4ace-a3c8-27dcd51d21ed" value="Widevine"> <cenc:pssh>AAAAOHBzc2gAAAAA7e+LqXnWSs6jCfc1R0h7QAAABgSEAB3Gcrj/8kFklokiVbJMh9VmwY=</cenc:pssh> </ContentProtection> </Representation> </AdaptationSet> <AdaptationSet segmentAlignment="true" mimeType="audio/mp4" id="1" label="fmp4_widevine_cenc_audio"> <Representation id="fmp4_widevine_cenc_audio" codecs="mp4a.40.2"> <ContentProtection value="cenc" schemeIdUri="urn:mpeg:dash:mp4protection:2011" cenc:default_KID="44ec248b-048c-43a6-a6ee-58a752c6f9f8"/> <ContentProtection schemeIdUri="urn:uuid:edef8ba9-79d6-4ace-a3c8-27dcd51d21ed" value="Widevine"> <cenc:pssh>AAAAOHBzc2gAAAAA7e+LqXnWSs6jCfc1R0h7QAAABgSEAB3Gcrj/8kFklokiVbJMh9VmwY=</cenc:pssh> </ContentProtection> </Representation> </AdaptationSet> 推荐的播放器
建议使用基于 HLS.js 的播放器进行 HLS/TS 解密。建议使用基于 Shaka Player 的播放器进行 DASH/fMP4 解密。
搭载 Windows 10 且安装 Microsoft Edge 浏览器的实体机器、Xbox One（版本 1703 或更低版本）以及某些非 Windows 设备（例如智能电视）支持 PlayReady“cenc”方案。只有 Xbox One 1709 或更高版本支持 PlayReady“cbcs”方案。如需了解详情，请参阅 PlayReady 内容加密模式。