Supporting PlayReady video playback in Roku

We recently got a requirement from one of our studio clients – an ability to play DRM content on Roku. This entails not just selecting the appropriate DRM, but also built the complete supporting infrastructure. In context of our platform, this meant the following:

1) Selecting the appropriate DRM format

2) Ensure that only EMS-authorized users could play the content

3) Keep the License Key server and the key exchange interaction hidden from the prying eyes

Since Roku does not support Widevine, PlayReady was the way to go. While testing the device capabilities, we discovered that older Roku devices (Roku-1) did not have any support for PlayReady. Further investigation revealed that we needed a firmware version of at least 4.7 for PlayReady to work. So even Roku2 and Roku3 devices which did not have updated firmware, would not get this content. However, for our client, limiting the solution to Roku 2 and 3 was an acceptable price to pay to get a strong DRM capability.

Adding to our challenges listed above, it turns out that Roku only supports direct PlayReady licensing, i.e., it expects the licensing server URL to be specified directly. This is in direct contradiction to one of our requirements of shielding the license key server. Secondly, Roku does not allow any custom authentication data to be added to the request. For us, that was mandatory to authenticate the user and device before allowing them to retrieve the license key. Thirdly, PlayReady logic is entirely implemented in firmware – so we have no way of knowing exactly when the license request is being sent in the playback sequence.

To solve this problem, we came up with a three-way proxy architecture. The proxy served as the rendezvous point for Roku, EMS, and the License server. To circumvent the limitation of Roku’s PlayReady implementation in adding authentication data to the CustomData field in Playready request, we set the Proxy to act as License Server for the app. We also added user authentication data to the proxy server URL as a query-string. Thus the proxy had access to the PlayReady request content via the request itself and the authentication data via processing the query-string. Now proxy has the ability to validate the authentication data with EMS and also the ability to proxy PlayReady request/response to the License Server. The integration works seamlessly with Roku!