‘OWIDEVINE Getting Started Widevine DRM on Devices version 1.4Contents Summary Contact Us Introduction Ecosystem Workflow - Android and Android TV Integration Workflow - Device Integration (TV, Bluray, STB, Embedded Linux) Accessing the Widevine Partner Repository CDM Source ios Android Required Building Testing Validation Widevine Client Security Levels Security Level 1 (L1) Security Level 2 (L2) Security Level 3 (L3) ‘Sample Test Content H264 HEVC pg Widevine DRM - Getting Started with Devices rev 4.6 1172872017 Reserved evo eee Page 2020, © 2017 Google, Inc. All Rightsor | 12/16/2016 | inital draft Alex Lee 0.2 | 1717/2017 | Added workflow diagram Alex Lee 03 | 1/19/2017 | Separated workflow diagrams Alex Lee 1.0 | 2/21/2017 | Updated current COM Source version Alex Lee ‘Added Android build and test information 1.1 | 2/22/2017 | Added Levelt Device Provisioning Models reference Alex Lee 1.2 | 6/23/2017 | Clarified GMS and CTS processes. Alex Lee 1.3 | 6/30/2017 | Expanded Widevine Device Security Levels section, Alex Lee 1.4 | 11/28/2017 | Updated integration workflow diagrams. Alex Lee (© 2017 Google, nc. All Rights Reserved. No oxpross or implied warrantos ao provided for herein. Al epeciicatons are subject to change and any expected future procucts, features or functionally wil be provisec on anit and when availabe basis. Note thatthe descriptions of Google's patents and other itslloctual property herein ar intended to provide ilustrave, non-exhaustive examples of some ofthe areas to which the patents and applications are currently believed to peta, and is rot intended for use ina legal proceeding to interprat or int the seope or meaning ofthe patants or ther claims, o indicate that a Google patont claim(s) is ‘materially required to perform or implement any ofthe sted items Widevine DRM - Getting Started with Devices Page 3020, rev 4.6 1172872017 (© 2017 Google, Inc. All Rights ReservedSummary This document outlines the process, documentation and of DRM client into a device or chipset platform. ns to integrate the The target audience for this document are: * Device manufacturers © Chipset vendors If you are interested in the full Widevine ecosystem, please see the Getting Started guide for content partners. Contact Us For all questions, please contact Widevine from our website - www.widevine.com. For device integratio Other. For other inquiries, select / have a general inquiry, issues, select I'm a hardware manufacturer or partner and then select Introduction Widevine DRM is Google's content protection system for premium media. It is used by major partners around the world such as Google Play, YouTube, Google Fiber, Netflix, Hulu, Amazon and much more. The focus of Widevine is to provide the best experience for viewing premium content over a digital distribution method, A license agreement is required for the use of Widevine products or services. Widevine does not assess any license fees for use of its products and services. Our architecture overview provides a comprehensive description of the technologies and standards used. The Widevine client is embedded into a device platform unless otherwise noted. Device or Platform Supported ? ‘Android 4.0 Ice Cream Sandwich - Android 4.1 and 4.2 Jellybean Widevine DRM - Getting Started with Devices Page 4020, rev 4.6 1172872017 © 2017 Google, Inc.All Rights ReservedAndroid 4.3 Jellybean MR2 Yes? Android 4.4, 5.x, 6.x and 7.x Yes Android TV Yes Apple iOS Yes! Apple TV (tv0S) : Chrome browser Yes Chrome0s (Chromebook) Yes Chromecast Yes Chromium browser Yes Chromium Embedded Framework (CEF), Electron Yes Firefox browser Yes Internet Explorer browser : Opera (browser and embedded devices) Yes Roku Yes Safari browser (desktop) : ‘Sony Playstation Yes! TV sets and Blu-ray players Yes Xbox : ‘Available as a separate client library ? On selected devices only Widevine ORM - Getting Started with Devices rev 4.6 1172872017 Reserved Page Sot20, (© 2017 Google, Inc. All RightsEcosystem Client Device The diagram above illustrates the Widevine components within the DRM ecosystem. This document is focused on the area outlined in red. Briefly, a standard Widevine device integration requires: * An implementation of OEMCrypto that complies with a specific Widevine Device Security Level. © Building the Widevine CDM Source with OEMCrypto, ‘* Obtain Widevine keyboxes for Widevine Level 1 implementations. © See Device Provisioning Models for more information about Widevine device provisioning. © See Getting Started with Device Management to request keyboxes. ‘¢ Register your device within the Widevine system (e.g. Make, Model) © See Getting Started with Device Management. © When an integration is in progress, a device entry is initially marked as FOR_TESTING. © When integration is complete, a device entry is marked as RELEASED to allow production use. |Widevine DRM - Getting Started with Devices Page 6 of 20, rev 4.6 1172872017 (© 2017 Google, Inc. All Rights ReservedWorkflow - Android and Android TV Integration Drie ‘Complete Widevine Master License ‘Agreement Dre Complete Technical ‘Assigned to Widevine TAM ‘Onboardng and documentation z Register Device For, request eybox or ‘Accesso Device Management via ee Install keybox o certificate Issues? Contact Widevine TAM \Widevine ony suppor ‘A03P mtegatens. eneree (Obtain L1 OEMCxypto from Soc For Androlé ‘Complete and submit test results Comat Anat Partet Tor review Optional. applicable ‘Team Receive 13 OEMCrypt from CT widevne’ tor sees to partner anal com Fer Android 7: Integration Complete ‘ontat Android TY Parner "com Update device record to RELEASED Begin Manufacturing For devices that will ship with Google Apps (GMS), you will need to contact the Android Partner team via www.android.com/gms. It includes Widevine as part of the integration and certification process. Response times for GMS integrations may vary and is beyond Widevine’s control. Widevine directly support Android integrations using AOSP. It is highly recommended to ensure that your AOSP integration is validated using the Compatibility Test Suite (CTS). Device testing for Widevine can be accomplished by using the ExoPlayer demo application which contain a list of Widevine test cases. L1 OEMCrypto libraries are provided by the SoC vendor for the Android device. End-to-end tests to be executed is provided by Widevine. Widevine ORM - Getting Started with Devices Page 7 of20, rev 4.6 1172872017 (© 2017 Google, Inc. All Rights ReservedAccess to the device and keybox management interface at integration widevine.com is described in the Getting Started with Device Management document. Registering the device make and model is equivalent to product.ro.manufacturer and product.ro.model. Workflow - Device Integration (TV, Bluray, STB, Embedded Linux) Dvwwire ‘Complete Widevine Master License ‘Agreement Dore Complete Technica [Assigned to Widevine TAM ‘onboarding nd documentation a Register Device ForL, request eybox or ‘Access to Device Management via oy Install keybox or certificate tssves? ‘Access to COM Source Contact Widevine TAM Repository End to-End Testing (bain L1 OEMCzypo from Soc ‘Complete and submit test results for review Optional. apliable Receive L3 OEMCrypt fom idevine| tetageation Complete Update device record to RELEASED Begin Manufactriog This category of ine client integration covers a wide variety of device platforms, across a multitude of operating systems. As such, these consumer electronic (CE) device integrations require additional consultation with the Widevine team to determine the best path forward. L1 OEMCrypto libraries are provided by the SoC vendor. L3 OEMCrypto libraries are provided by Widevine. Widevine ORM - Getting Started with Devices Page 8 of20, rev 4.6 1172872017 (© 2017 Google, Inc.All Rights ReservedIf you are unsure or have questions regarding OEMCrypto or have a different device design, please contact us. Access to the device and keybox management interface at integration. widevine.com is described in the Getting Started with Device Management document. For validation, Widevine test content urls, both clear and encrypted versions of the same files, are available at the end of this document. Widevine ORM - Getting Started with Devices Page 9 of20, rev 4.6 1172872017 (© 2017 Google, Inc. All Rights ReservedAccessing the Widevine Partner Repository The Widevine CDM client is available via a Widevine-managed code repository, per platform. The Accessing the Widevine Repository guide provides information on how to register for access to the appropriate repository. Each repository branch is self-contained: ‘* Contains documentation, code and samples organized by version. © OEMCrypto references and sample implementation, CDM Source The current version of CDM Source and OEMCrypto © CDM Source version 3.5.0 © OEMCrypto version 13 Please contact us to confirm use of earlier software versions. ios Information about how to integrate the iOS client is located within each release branch. Android Required The Widevine CDM is located under /1ibwvdrmengine CDM documentation is located under /1ibwvdrmengine/docs The Widevine CDM is required for encrypted (CENC) DASH compatibility. This is required from Android 4.4 onwards. Branch Android Version OEMCrypto Version kip Android 4.4.x OEMCrypto 8 Imp Android 5.x OEMCrypto 9 mne Android 6.x OEMCrypto 10 nyc Android 7.x OEMCrypto 11 Widevine ORM - Getting Started with Devices Page 10 of 20 rev 4.4. 1172812017 © 2017 Google, ne. All Rights Reservedoc Android 8.0 OEMCrypto 11 oc-mrt Android 8.1 OEMCrypto 11 for upgrades OEMCrypto 13 for new devices Building To build, place the widevine repo at ROOT/vendor/widevine in the AOSP tree where ROOT is the root of the AOSP tree. The build scripts for Android will automatically detect and build the Widevine CDM. For more information on building Android, see the documentation on building the AOSP project. Testing After building, to test the Widevine CDM, run “sh build_and_run_all_unit_tests.sh” located in WIDEVINE_ROOT/Libwvdrmengine/. Validation Itis recommended that your AOSP device complete CTS (Compatibility Test Suite). However, CTS does not contain any Widevine-specific tests, To exercise and validate Widevine compatibility, install the latest ExoPlayer v2 demo APK. REQUIRED - Successfully execute all items under Widevine DASH Policy Tests (GTS) RECOMMENDED - Successfully execute all items under Widevine HDCP Capabilities Tests (HDMI connection required) © OPTIONAL - These tests are sanity checks for format and codec support. 0 Widevine DASH: MP4 H264 o Widevine DASH: WebM VP9 © Widevine DASH: MP4 H265 Widevine DRM - Getting Started with Devices Page 11 of 20 rev 4.6 1172872017 (© 2017 Google, Inc. All Rights ReservedWidevine Client Security Levels The following security level definitions are used by Widevine: Security Level 1 (L1) Widevine DRM keys and decrypted content are never exposed to the host CPU. Only security hardware or a protected security co-processor uses clear key values and the media content is decrypted by the secure hardware. Key requirements of this security level: ‘* Device manufacturers must provide a secure bootloader. The chain of trust from the bootloader must extend through any software or firmware components involved in the security implementation, such as the ARM TrustZone protected application and any components involved in the enforcement of the secure video path. * The Widevine keybox must be encrypted with a device-unique secret key that is not visible to software or probing methods outside of the TrustZone. The Widevine key-box must be installed in the factory or delivered to the device using an approved secure delivery mechanism. * Device manufacturers must provide an implementation of the Widevine Level 1 OEMCrypto API that performs all key processing and decryption in a trusted environment. All content processing, cryptography, and control is performed within the Trusted Execution Environment (TEE). In some implementation models, security processing may be performed in different chips. This level of security requires factory provisioning of the Widevine keybox or requires the Widevine keybox to be protected by a device key installed at the time of manufacturing. The Device Provisioning Models document provides ad device provisioning models. This is the recommended path for any device integration as it provides the highest level of security. Security Level 2 (L2) The Widevine keys are never exposed to the host CPU. Only security hardware or a protected security co-processor uses clear key values. An AES crypto block performs the high throughput AES decryption of the media stream. The resulting clear media buffers are returned to the CPU for delivery to the video decoder. Widevine DRM - Getting Started with Devices Page 12 0f 20 rev 4.6 1172872017 © 2017 Google, Inc.All Rights ReservedPerforms cryptography (but not video processing) within the TEE: decrypted buffers are returned to the application domain and processed through separate video hardware or software. At level 2, however, cryptographic information is still processed only within the trusted execution environment. This level of security requires factory provisioning of the Widevine keybox or requires the Widevine keybox to be protected by a keybox installed at the time of manufacturing. Key requirements of this security lev ‘* Device manufacturers must provide a secure bootloader. The chain of trust from the bootloader must extend through any software or firmware components involved in the security implementation, such as the TrustZone protected application. * The Widevine keybox must be encrypted with a device-unique secret key that is not visible to software or probing methods outside of the TrustZone. ¢ The Widevine keybox must be installed in the factory or delivered to the device using an approved secure delivery mechanism. © Device manufacturers must provide an implementation of the Widevine Level 2 OEMCrypto API that performs all key processing and decryption in a trusted environment. Device manufacturers must pro\ je a bootloader that loads signed system images only. For devices that allow users to load a custom operating system or gain root privileges on the device by unlocking the bootloader, device manufacturers must support the following: * Device manufacturers must provide a bootloader that allows a Widevine keybox to be written only when the bootloader is in a locked state. * The Widevine keybox must be stored in a region of memory that is erased or is inaccessible when the device bootloader is in an unlocked state. Security Level 3 (L3) This security level relies on the secure bootloader to verify the system image. An AES cryplo block performs the AES decryption of the media stream and the resulting clear media buffers are returned to the CPU for delivery to the video decoder. Does not have a TEE on the device. Appropriate measures may be taken to protect the cryptographic information and decrypted content on host operating system. A Level 3 implementation may also include a hardware cryptographic engine, but that only enhances performance, not security. Device manufacturers must provide a bootloader that loads signed system images only. For devices that allow users to load a custom operating system or gain root privileges on the device by unlocking the bootloader, device manufacturers must support the following: Widevine DRM - Getting Started with Devices Page 13 of 20 rev 4.6 1172872017 © 2017 Google, Inc. All Rights Reserved* Device manufacturers must provide a bootloader that allows a Widevine keybox to be written only when the bootloader is in a locked state. * The Widevine keybox must be stored in a region of memory that is erased or is inaccessible when the device bootloader is in an unlocked state. This categorization generally applies to software-only client solutions. Widevine DRM - Getting Started with Devices Page 14 0f 20 rev 4.6 1172872017 © 2017 Google, Inc.All Rights ReservedSample Test Content The tables below provide sample test content in a variety of codecs and resolutions, both clear and encrypted. For encrypted content, the license URL is https: //proxy.uat..widevine.com/proxy * Playback of encrypted content will stop at 10 seconds if a nse is not delivered to the device. H264 Content Type Frames per second Clear Encrypted ‘SD and HD 24fps https://storage.googl | https: //storage. goog) eapis.con/wmedia/cle | eapis.con/wvnedia/cen ar/h264/tears/tears.m | c/h264/tears/tears.mp pd a sp 2afps https: //storage.goos] | https://storage. goog] eapis..con/wwmedia/cle | eapis.com/wvnedia/cen 240p 800kbps ac/h264/tears/tears s | c/h264/tears/tears sd 480p 2mbps — —- HD 2atps https: //storage.googl | https: //storage. goorl eapis.con/wwmedia/cle | eapis.com/wvnedia/cen 720p mbps ar/h264/tears/tears.h | c/h264/tears/tears_hd 1080p 20mbps dood sid ‘SD and HD 30fps https://storage goog] | https: //storage goog] ac/h264/30fps/tears/t | c/h264/30fps/tears/te ears.nod ars.apd sp 30fps hetes://storage.goog] | https: //storage. coor) eapis.con/wvmedia/cle | eapis.con/wvnedia/cen 240p 800kbps a6/h264/30fps/tears/t | c/h264/30fps/tears/te '480p 2mbps ears_sd.mpd arssd.mod HD 30fps hetps://storage goog) | https: //storage. goog) eapis.con/wmedia/cle | eapis.con/wvnedia/cen -720p 8mbps ar/h264/30fps/tears/t | c/h264/30fps/tears/te 1080p 20mbps ears hd.mod ars_hd.mod Widevine ORM - Getting Started with Devices rev 4.6 1172872017 Reserved Page 15 of 20 (© 2017 Google, Inc. All Rights‘SD and HD 60fps https: //storage. goog] ‘eapis. com/wmedia/cle ‘ar/h264/60fps/tears/t ears.mpd https: //storage. goog] ‘eapis..con/wvmedia/cen /h264/60fps/tears/te ars.mpd 240p 800kbps 4480p 2mbps 60fps https://storage. goog] apis. con/wmedia/cle ar/h264/60fps/tears/t ears_sd.mod https://storage. goog) apis com/wnedia/cen ‘sJh264/60fps/tears/te ars_sd.mpd HD 720p 8mbps 1080p 20mbps 60fps https: //storage. goog] apis, com/nvmedia/cle ‘ar/h264/60fps/tears/t ears_hd.mpd https: //storage. goog] ‘eapis,con/wvmedia/cen ‘c/h264/60fps/tears/te ars_hd.mod Widevine ORM - Getting Started with Devices rev 4.6 1172872017 Reserved Page 16 of 20 (© 2017 Google, Inc. All RightsHEVC Content Type Frames per second Clear Encrypted SD and HD 24fps hetes://storage.goog] | https: //storage. oor) aréhevc/tears/tears.m | c/hevc/tears/tears.mp bd d a) 24fps https: //storage.googl | https: //storage. goog] eapis.con/wwmedia/cle | eapis.com/wvnedia/cen 240p 600kbps ar/heve/tears/tears_s | c/heve/tears/tears_sd 360p 1600kbps. dood sid 4480p mbps HD 24fps https: //storage. goog) | https: //storage. goog) eapis.com/wvmedia/cle | eapis.com/wvmedia/cen ‘720p mbps ar/heve/tears/tears h | c/heve/tears/tears hd 1080p 10mbps — —- uHD 2alps https: //storage.goog] | https: //storage. oor) eapis.con/wumedia/cle | eapis.com/wvnedia/cen 2160p 2ombps. ar/heve/tears/tears_u | c/heve/tears/tears_uh hd.mpd dumpd ‘SD and HD 30fps https: //storage.googl | https: //storage. ZL eapis.con/wmedia/cle | eapis.con/wvnedia/cen ar/heve/30fps/tears/t | c/heve/30fps/tears/te ears.nod ars.mpd cS) 30fps https: //storage,zoog] | https: //storage,goor], pis.com/wwnedia/cle | eapis con/wnedia/cen 240p 600kbps ar/heve/30fps/tears/t | c/heve/30fps/tears/te 360p 1600kbps ears_sd.mod ars_sd.mod 480p 3mbps HD 30fps hittes://storage.goog) | https: //storage. goog] 720p 4mbps ardhevc/30fps/tears/t | c/heve/30fps/tears/te 1080p 10mbps ‘ears_hd.mod ars_hd.mod UHD 30fps https://storage,goog] | https: //storage, goog], eapis.con/wmedia/cle | eapis.con/wvnedia/cen 2160p 2ombps ar/heve/30fps/tears/t | c/heve/30fps/tears/te ears_uhd.mod ‘ars_uhd. mod \Widevine DRM - Getting Stared with Devices Page 17 of 20 rev 4.6 1172872017 Reserved (© 2017 Google, Inc. All RightsSD and HD 6ofps hetes://storage.goog] | https: //storage. soos) eapis.con/wymedia/cle | eapis.com/wvnedia/cen acheve/60fps/tears/t | c/heve/69fps/tears/te ears.nod asad sp 60fps hetps://storage goog) | https: //storage. goog) eapis.con/wmedia/cle | eapis.con/wvnedia/cen 240p 600kbps ar/heve/60fps/tears/t | c/heve/60fps/tears/te 4360p 1600kbps ears_sd.mpd ars_sd.mpd 480p 3mbps HD 6Ofps httns://storage.gooe) | https: //storage. coor) 720p 4mbps acshevc/S0fps/tears/t | c/heve/60fps/tears/te 1080p 10mbps sears_hd.mod ars_hdamod uxD 60fps hetps://storage goog) | https: //storage. goog) eapis.con/wmedia/cle | eapis.con/wvnedia/cen 2160p 20mbps ar/heve/60fps/tears/t | c/heve/60fps/tears/te ears_uhd.mod ars_uhd.mpd \Widevine DRM - Getting Stared with Devices Page 18 of 20 rev 4.6 1172872017 Reserved (© 2017 Google, Inc. All RightsvP9 Content Type Frames per second Clear Encrypted SD and HD 24fps hetes://storage.goog] | https: //storage. oor) ar/vp9/tears/tears.mp | c/vp$/tears/tears.mpd d sp 2atps https: //storage.googl | https: //storage. goorl eapis.con/wwmedia/cle | eapis.con/wvnedia/cen 240p 600kbps ar/vp9/tears/tears_sd | c/vp$/tears/tears_ sd. 360p 1600kbps med med HD 24fps https://storage.goos] | https: //storage. goog! 720p 4mbps. ac/up9/tears/tears td | c/vp8/tears/tears hd. 1080p Smbps — — vxD 2atps https: //storage.googl | https: //storage. goorl eapis.con/wwmedia/cle | eapis.com/wvnedia/cen 2160 20mbps ar/vpS/tears/tears uh | c/vp8/tears/tears_uhd umd fod SD and HD 30fps hetps://storage goog) | https: //storage. goog) eapis.con/wmedia/cle | eapis.com/wvnedia/cen ar/vp9/30fps/tears/te | c/vp9/30fps/tears/tea ars.mpd rs.mpd sD 30fps httos://storage.googl | https: //storage. goog) eapis.con/wmedia/cle | eapis.con/wvnedia/cen 240p 600kbps ar/vp9/30fps/tears/te | c/vp9/30fps/tears/tea 360p 1600kbps ars od.mod cs_sd.mnd HD 30fps hetes://storage.goog] | https: //storage. oor) 720p 4mbps ar/vp9/20fps/tears/te | c/vp8/30fps/tears/tea 1080p Smops arshd.opd rshd.mpd ux 30fps https://storage.googl | https: //storage. goog) eapis.con/wmedia/cle | eapis.con/wvnedia/cen 2160 20mbps ar/vp9/30fps/tears/te | c/vp9/30fps/tears/tea ‘ars_uhd.mpd s_uhd.mpd ‘SD and HD 60fps https: //storage.googl | https: //storage. goog] \Widevine DRM - Getting Stared with Devices Page 19 0f 20 rev 4.6 1172872017 Reserved (© 2017 Google, Inc. All Rightsapis. com/mmedia/cle ar/vp9/60fps/tears/te ars.mpd eapis.con/wnedia/cen cLvp8/60fps/tears/tea rs.md 240p 600kbps 360p 1600kbps 60fps hetps: //storage. goog] apis. com/wmedia/cle ar/vp9/60fps/tears/te ars_sd.mpd hetps: //storage. goog] ‘eapis.com/wvmedia/cen ‘c/vp9/60fps/tears/tea Fs_sd.mpd HD 7720p 4mbps 1080p Smbps 6ofps https: //storage. goog] ‘eapis. com/wmedia/cle ar/vp9/60fps/tears/te ars_hd.mpd https: //storage. goog] ‘eapis.con/wvmedia/cen c/vp9/60fps/tears/tea Fs_hd.mpd 2160p 20mbps 60fps hetps: //storage. goog] apis. com/mmedia/cle ar/vp9/60fps/tears/te ars_uhd.mod hetps: //storage. goog] eapis.com/wnedia/cen ‘cLvp9/60fps/tears/tea rs.uhd.mpd Widevine ORM - Getting Started with Devices rev 4.6 1172872017 Reserved Page 20 of 20 (© 2017 Google, Inc. All Rights