licensing · content protection
Noisypeak DRM
Licenses for every screen. Multi-DRM licensing and entitlements on the pipeline that already encodes and watermarks your content.
Noisypeak DRM is the licensing and entitlement layer of the Noisypeak platform. Its license servers decide, per request, whether this viewer on this device may play this content: a FairPlay Streaming KSM for Apple devices and a Widevine license server for Android, Chrome, smart TVs and set-top boxes. Both are Noisypeak's own implementations, independent of Google's cloud. It's the service BuyDRM or EZDRM would sell you, with one difference: the encoder, the packager and the ad inserter that produce the encrypted streams are ours too. For everyone else's, CPIX / SPEKE or a custom integration plugs in any third-party packager and player.
Policies follow the industry model and cover the full range each DRM system allows: license duration and renewal, rental and playback windows, persistent licenses for offline viewing, output and device constraints, key rotation. Around the license sits the rest of the protection: JWT (RFC 7519) link tokens and access lists validated at the origin, AES-128 for the simple cases, and an inaudible forensic audio watermark per channel, territory or viewer, for the day a copy leaks.
Google is shutting down its Cloud License Service and the Proxy SDK path. Noisypeak's Widevine server does not depend on it; we migrate direct customers, and users of any other hosted or self-hosted CLS-based solution, before the date.
CPIX and SPEKE for third-party packagers and encoders; custom integration schemes where needed. Cell, Packetizer and Prism X are wired in already.
FairPlay covers iPhone, iPad, Mac, Apple TV, Safari; Widevine covers Android, Chrome, Android TV, Fire TV, Roku, Samsung, LG and most set-top boxes.
Persistent licenses for download-and-watch are part of the service.
License delivery: FairPlay and Widevine
A player asks for a license and Noisypeak DRM answers. For Apple devices that is a FairPlay Streaming key security module with your FPS certificate. For everything else it is a Widevine license server: Android, Chrome, Edge, Android TV, Fire TV, Roku, Samsung Tizen, LG webOS and set-top boxes. Both are Noisypeak's own implementations and make no call to Google's Cloud License Service, which Google retires on 13 April 2027. They run as a service in the Noisypeak Cloud, behind one API, with content keys generated and stored for every asset and channel.
The streams they unlock can come from the Noisypeak platform: Cell and Packetizer encrypt HLS (FairPlay) and DASH (Widevine via CENC) from one encode, and Prism X delivers ad-stitched streams with the protection intact. They can also come from any third-party packager and player, through CPIX / SPEKE key exchange or a custom integration scheme.
- FairPlay Streaming KSM (own implementation)
- Widevine license server (own implementation, no Google CLS dependency)
- CPIX / SPEKE for third-party packagers; custom schemes on request
- Content keys generated, stored and rotated per asset and channel
- AES-128 static key where full DRM is not required
Entitlements and policies
Entitlement is decided at license time, per request. The customer sets the rules within the range each DRM system supports, following industry practice: license duration and renewal, rental and playback windows, persistent licenses for offline viewing, output protection and device-type constraints, and key rotation on live channels. Playback links themselves are tokenised with JWT (RFC 7519) and checked at the origin, with access lists and start-over configured in memory. A leaked URL expires, and a revoked account stops at the next request.
- License duration, renewal, rental and playback windows
- Persistent (offline) licenses
- Output protection and device constraints as the DRM allows
- Key rotation on live channels
- JWT-tokenised links, access lists, start-over at the origin
Leaving Widevine CLS before April 2027
Google has announced that the Widevine Cloud License Service will be permanently shut down on 13 April 2027. Many platforms and vendors built on this free hosted endpoint, directly or through the Proxy SDK. After that date, license requests to it fail and Widevine playback stops. Noisypeak DRM never depended on it.
We move you across before the deadline: our direct customers, and operators on any other hosted or self-hosted solution that still calls CLS underneath. Keys and policies are carried over, packagers and players re-pointed through CPIX / SPEKE or the integration already in place, and both services run in parallel until the switch is verified.
- Shutdown date: 13 April 2027 (Google)
- Affected: CLS users, Proxy SDK and CAS Proxy SDK users
- Noisypeak Widevine server: independent of CLS
- Migration for direct customers and users of other CLS-based solutions
- Parallel run until verified
Forensic watermarking
Noisypeak's digital watermarking applies inaudible encrypted packets to the content so that a copy can later be identified per channel, per territory or down to a specific end-user. It can be applied to an existing content item, to a specific stream, or to an individual user copy during delivery, and can be combined with the transcoding and DRM steps of the Noisypeak Cloud. The mark is not lost when the signal is converted or compressed, and it is robust to copying including camripping.
Compared with usual embedding procedures: generating individual copies takes less time and compute; the secret watermark key is not needed to produce individually marked copies; the unmarked original can be retrieved; and because watermarks are encrypted, unauthorised third parties cannot check for their presence. Noisypeak provides the forensic tools and services to identify the source of a leak.
- Audio watermark, applied in the cloud or on premises
- Granularity: VOD asset · stream · individual user copy
- Content: HLS v2/3 · HLS v5 · DASH · Google Classic DRM (WVM)
- Survives conversion, compression and camripping
- Encrypted mark, undetectable without the key
Watermark quality
Audibility was assessed with the commercial OPERA tool implementing the PEAQ model, on 180 audio tracks: pop, classical, audio book, interview and camera recordings. The objective difference grade (ODG) scale runs from 0 (inaudible) to −4 (very annoying); the watermarked set scores a median ODG of −1.5.
- OPERA / PEAQ objective difference grades
- 180 test tracks across five content types
- Median ODG −1.5
Where it sits in the pipeline
Protection is the stage between encoding and distribution: Cell or Media2Flow encode, Packetizer or the Cell origin package and encrypt, Prism X stitches ads without breaking the encryption, and Noisypeak DRM hands out the licenses to B2B2C OTT platforms, set-top boxes, mobile, PC and smart TV. The origin serves up to 2,500 parallel streams and 20 Gb/s per node, tokens validated on every request.
Features
FairPlay KSM and Widevine license server, both Noisypeak's own implementations. One API covers every device your audience owns.
Google shuts its Cloud License Service on 13 April 2027. Our Widevine server never depended on it, and we migrate you whichever solution you are on today.
Duration, renewal, rental and playback windows, device and output constraints, key rotation. You set them within what each DRM allows, and they're decided per request.
Persistent licenses for download-and-watch are included in the service.
CPIX / SPEKE key exchange for third-party packagers and encoders, plus custom integration schemes where needed, so it works beyond Noisypeak outputs.
Cell, Packetizer and Prism X encrypt for these license servers out of the box; everyone else connects over CPIX / SPEKE.
Inaudible, encrypted audio mark per channel, territory or viewer; survives re-encoding and camripping. Forensic tools identify the source.
JWT (RFC 7519) validated at the origin on every request; access lists, start-over, time-boxed URLs.
Individual watermarked copies cost less time and compute than usual embedding, need no secret key to produce; the original is recoverable.
Watermark audibility tested with OPERA / PEAQ on 180 tracks across five content types: median ODG −1.5.
Specifications
| License delivery | |
|---|---|
| Apple | FairPlay Streaming (HLS), own KSM implementation |
| Widevine via CENC (MPEG-DASH), own license server, independent of Google CLS | |
| Key exchange | CPIX · SPEKE · custom integration schemes |
| Key-only | AES-128 static key |
| Offline | Persistent licenses supported |
| Policies | License duration and renewal · rental and playback windows · output and device constraints · key rotation (within each DRM system's range) |
| Delivery | As a service from the Noisypeak Cloud |
| Widevine CLS migration | Before 13 April 2027, for direct customers and users of other CLS-based solutions |
| Encryption and packaging | |
|---|---|
| Encryption | CENC for MPEG-DASH · FairPlay for HLS · AES-128 |
| Packaging | HLS (TS) · HLS3 · HLS7 fMP4 · MPEG-DASH from one channel |
| Where | Noisypeak Cell / UEN2 origin · Noisypeak Packetizer (NP-RPK-EMB) · Prism X output |
| Tokenization and access | |
|---|---|
| Link tokens | JWT, RFC 7519 |
| Access control | Access lists · content protection · start-over, in-memory configuration |
| Publishing auth | WebDAV authorization |
| Origin performance | Up to 2,500 parallel streams over 25 Gb/s · up to 20 Gb/s sustained over 25 Gb/s or 2×10 Gb/s LACP |
| Forensic watermarking | |
|---|---|
| Type | Audio watermark, inaudible and encrypted |
| Granularity | Per channel · per territory · per end-user (VOD asset, stream or individual user copy) |
| Content types | HLS v2/3 (audio muxed in TS) · HLS v5 (separate audio track) · DASH · Google Classic DRM (WVM) |
| Robustness | Not lost through conversion or compression · robust to copying including camripping |
| Payload | Encrypted identifying information (channel, territory or user), not detectable by unauthorised parties |
| Detection | Content owner deciphers the mark; Noisypeak forensic tools and services identify the leak source |
| Quality | OPERA / PEAQ, 180 tracks · median ODG −1.5 |
| Deployment | Noisypeak Cloud or on premises; with or without Noisypeak transcoding and DRM steps |
Where it is used
Platforms and vendors that call Google's Cloud License Service, directly or through the Proxy SDK, move to Noisypeak license servers before 13 April 2027. Both run in parallel during the move, and keys and policies are carried over.
One encrypted HLS/DASH packaging, FairPlay and Widevine licenses for every device, policies per plan.
Persistent licenses with rental or playback windows for offline viewing on phones and tablets.
JWT links and access lists control who can open a protected stream at the origin.
Per-user watermarked copies identify the account behind a pirated stream, even after camripping.
Talk to us about Noisypeak DRM
We handle evaluation in the Noisypeak cloud, deployment on premises or in a public cloud, integration and support. One team covers the whole pipeline.