--- title: "Encrypt DRM content" slug: "drm-contents-encryption" tags: ["Click Multi DRM", "Media"] updated: 2026-09-17T10:12:36Z published: 2026-09-17T10:12:36Z canonical: "api.ncloud-docs.com/drm-contents-encryption" --- > ## Documentation Index > Fetch the complete documentation index at: https://api.ncloud-docs.com/llms.txt > Use this file to discover all available pages before exploring further. # Encrypt DRM content Available in Classic and VPC You can apply DRM encryption to content via the CPIX API. The CPIX API is an API implemented based on the Content Protection Information Exchange Format (CPIX) standard defined by the DASH Industry Forum. It defines the key interoperability specifications required for applying multi-DRM during the media content packaging process. Using the CPIX API, you can easily integrate encoder/transcoder solutions supporting CPIX-based key interoperability with DoveRunner (formerly PallyCon) multi-DRM. Note For more information on integrating the Live Station service, see [Create Live Station channel](/docs/en/media-livestation-channel-channelcreate). ## CPIX API-based DRM content encryption The following describes how to apply DRM content encryption using the CPIX API. | Type | Path | Description | | --- | --- | --- | | DoveRunner CPIX API | [DoveRunner CPIX API integration guide](https://doverunner.com/docs/en/content-security/multi-drm/packaging/cpix-api/#doverunner-cpix-api-client) | CPIX API implemented by DoveRunner (formerly PallyCon), enabling multi-DRM application when integrated with encoder/transcoder solutions. Also utilized for integration with Flussonic Media Server. | | SPEKE API | [SPEKE guide](https://docs.aws.amazon.com/speke/latest/documentation/the-speke-api-v2.html) | CPIX API implemented by AWS Elemental, pre-integrated with DoveRunner to enable multi-DRM application in AWS Elemental MediaPackage and MediaConvert | | ATEME NEA-DVR CPIX API | [ATEME NEA-DVR guide](https://doverunner.com/docs/en/content-security/multi-drm/packaging/cpix-api/#ateme-nea-dvr-cpix-api) | CPIX API implemented by Anevia (now acquired by ATEME), pre-integrated with the NEA-DVR solution for multi-DRM application | Note - The DoveRunner (formerly PallyCon) CPIX API client provides pre-implemented CPIX client modules for each major development language. - Each module generates XML-formatted request data for communication with the KMS server and provides a feature to interpret response data. ### DoveRunner CPIX API specifications The DoveRunner (formerly PallyCon) CPIX API client supports the following specifications. | Item | Specification | Description | | --- | --- | --- | | Development language | C++, C#, Java, Python | Sample code for each language according to the development environment for DRM packaging integration | | DRM type | Widevine, PlayReady, FairPlay, NCG, HLS_NCG | - NCG: DoveRunner's proprietary DRM specification, used when encrypting the entire target file for packaging - HLS_NCG: Method for re-encrypting the key of HLS content encrypted with AES-128 according to the NCG specification | | Encryption method | CENC, CBC1, CENS, CBCS | Specify CENC or CBCS, depending on the AES encryption method supported by the client platform. | | Track type | ALL_TRACKS, AUDIO, SD, HD, UHD1, UHD2 | Use to apply different encryption keys for each track when packaging multiple keys. | #### Multi-DRM encryption type The following describes the encryption methods for DRM content. | Encryption method | Protocol | DRM type | Encryption algorithm | Supported devices | | --- | --- | --- | --- | --- | | DRM | HLS | - FairPlay: DRM technology specification provided by Apple that encrypts each HLS segment with AES-CBC | AES-CBC | Mac/iOS Safari browser, iOS/iPadOS/tvOS app, HLS HTML5 | | DRM | DASH | - PlayReady: DRM technology provided by Microsoft, encrypted with AES-128 in accordance with the Common Encryption specification - Widevine: DRM technology provided by Google, encrypted with AES-128 in accordance with the Common Encryption specification | CENC (Common Encryption) | MS Edge, IE11, Chrome, Firefox, Opera DASH HTML5 | ## One Click Multi DRM scenario The following describes a usage scenario for the One Click Multi DRM service. 1. Encrypt DRM content. 2. Request a DRM license from the client (player). The request requires content configuration information such as `contentId` and `drmType`. 3. Play the DRM content using the license issued to the client. Caution The One Click Multi DRM service issues licenses with playback and security rules applied according to the policies set on the site. Therefore, if the requested license information does not match the encrypted DRM content information, playback may be restricted or fail. ## Live content DRM encryption The following describes how to encrypt DRM for live content. ### When using Live Station The following describes how to encrypt the DRM for live content when using Live Station. 1. Create a site using One Click Multi DRM. 2. Create a channel in the **Live Station > Channel Management** menu. - When creating, select the site created in Step 1 under the **Multi DRM** field. ### When not using Live Station The following describes how to encrypt the DRM for live content when not using Live Station. 1. Call the content DRM encryption API by combining the following items. - URL: API-specific key request URL (e.g., DoveRunner (formerly PallyCon) CPIX API or SPEKE API) - Additional URI: KMS token obtained via the One Click Multi DRM site details 2. Obtain the encryption data for content encryption via the API response. 3. Apply the obtained DRM encryption information to a third-party encoder/transcoder/packager integration solution. Note The following describes the DRM encryption information obtained from the CPIX API response. | Field | Description | | --- | --- | | `key_id_hex`, `key_id_b64`, `key_hex`, `key_b64`, `iv_hex`, `iv_b64` | Hexadecimal or Base64-encoded key ID, key, and IV values | | `pssh` | PSSH data (including headers) used by PlayReady or Widevine | | `pssh_payload_only` | Payload portion of PSSH data, excluding headers | | `key_uri` | URI parameter value contained in the `#EXT-X-Key` tag of an HLS m3u8 file with FairPlay DRM applied | ## VOD content DRM encryption The following describes how to encrypt the DRM for VOD content. ### When using VOD Station The following describes how to encrypt the DRM for VOD content when using VOD Station. 1. Create a site using One Click Multi DRM. - When using an external DRM service, you can skip this step. 2. Create a channel in the **VOD Station > Channel** menu. - When creating, apply one of the following to the **Multi DRM** field. - One Click Multi DRM - **DRM site**: Select an enabled DRM site. - **Content ID**: Unique identifier of the content to be played (used during DRM packaging) - Example: `drm-contents` - External DRM - **DRM type**: Select the DRM type to use. - **Content ID**: Unique identifier of the content to be played (included in the CPIX API request body (XML)) - Example: `drm-contents` - **DRM system ID**: Unique identifier of the DRM system (included in the CPIX API request body (XML)) - Depending on the selected DRM type, one or two system IDs are required. Make sure to enter each on a separate line. - Example: `9A04F079-9840-4286-AB92-E65BE0885F95`, `EDEF8BA9-79D6-4ACE-A3C8-27DCD51D21ED` - **DRM key URL**: CPIX API request URL - Enter according to the DRM provider's encryption key request format. - Example: `https://kms.example.com/cpix/v1/key/ujllldopmquy==` Caution DRM encryption through VOD Station supports only CPIX v1. ### When not using VOD Station The following describes how to encrypt the DRM for VOD content when not using VOD Station. 1. Call the content DRM encryption API by combining the following items. - URL: API-specific key request URL (e.g., DoveRunner (formerly PallyCon) CPIX API or SPEKE API) - Additional URI: KMS token obtained via the One Click Multi DRM site details 2. Obtain the encryption data for content encryption via the API response. 3. Apply the obtained DRM encryption information to a third-party encoder/transcoder/packager integration solution. #### Request The following describes the request format using the DoveRunner (formerly PallyCon) CPIX API. - Request URL - `POST https://kms.pallycon.com/v1/cpix/pallycon/getKey/{kmsToken}` - Request headers - See [One Click Multi DRM request headers](/docs/en/one-click-multi-drm-api-overview#%EC%9A%94%EC%B2%AD%ED%97%A4%EB%8D%94). - Request body | Field | Type | Required | Description | | --- | --- | --- | --- | | `cpix:CPIX` | Object | Required | Root element of the CPIX document containing content keys and DRM system information | | └ `cpix:ContentKeyList` | Object | Required | Container element defining the list of content keys | | └ `cpix:ContentKey` | Object | Required | Individual content key information with the `kid` (key ID) attribute | | └ `cpix:DRMSystemList` | Object | Required | Container element defining the list of DRM systems | | └ `cpix:DRMSystem` | Object | Required | Information for each DRM system with `kid` (key ID) and `systemId` (DRM system identifier) attributes | - Request example ``` curl --location --request POST 'https://kms.pallycon.com/v1/cpix/pallycon/getKey/{kmsToken}' \ --header 'x-ncp-apigw-timestamp: {Timestamp}' \ --header 'x-ncp-iam-access-key: {Access Key}' \ --header 'x-ncp-apigw-signature-v2: {API Gateway Signature}' \ --header 'Content-Type: application/xml' \ --header 'x-ncp-region_code: KR' \ --data ' ' ``` #### Response The following describes the response format using the DoveRunner (formerly PallyCon) CPIX API. - Response body | Field | Type | Required | Description | | --- | --- | --- | --- | | `cpix:CPIX` | Object | - | Root element of the CPIX document containing content ID (CID) keys and DRM system information | | └ `cpix:ContentKeyList` | Object | - | Container element defining the list of content keys | | └ `cpix:ContentKey` | Object | - | Individual content key information with `kid` (key ID) and `explicitIV` (initialization vector) attributes - The `kid` value is newly generated from `KMS`, separate from the value entered in the request data. The key and IV are returned in Base64 form. | | └ `cpix:Data` | Object | - | Element containing the content key data | | └ `pskc:Secret` | Object | - | Element containing the secret data of the content key | | └ `pskc:PlainValue` | String | - | Base64-encoded content key value | | └ `cpix:DRMSystemList` | Object | - | Container element defining the list of DRM systems | | └ `cpix:DRMSystem` | Object | - | Information for each DRM system with `kid` (key ID) and `systemId` (DRM system identifier) attributes | | └ `cpix:ContentProtectionData` | String | - | Payload portion of Base64-encoded PSSH data with header removed | | └ `cpix:PSSH` | String | - | Base64-encoded PSSH data (including header) | - Response example ``` SzC1qc1cEpyFU6t/lL7Byw== qAUAAAEAAQCeB...A= AAACwnBzc2gAAAAAmgTweZhAQoarkuZb4IhflQAAAqKiAgAAAQABAJgCPABXAFIATQBIAEUAQQBEAEUAUgAgAHgAbQBsAG4AcwA9ACIAaAB0AHQAcAA6AC8ALwBzAGMAaABlAG0AYQBzAC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvAEQAUgBNAC8AMgAwADAANwAvADAAMwAvAFAAbABhAHkAUgBlAGEAZAB5AEgAZQBhAGQAZQByACIAIAB2AGUAcgBzAGkAbwBuAD0AIgA0AC4AMAAuADAALgAwACIAPgA8AEQAQQBUAEEAPgA8AFAAUgBPAFQARQBDAFQASQBOAEYATwA+ADwASwBFAFkATABFAE4APgAxADYAPAAvAEsARQBZAEwARQBOAD4APABBAEwARwBJAEQAPgBBAEUAUwBDAFQAUgA8AC8AQQBMAEcASQBEAD4APAAvAFAAUgBPAFQARQBDAFQASQBOAEYATwA+ADwASwBJAEQAPgBQAEgAWABxAEUAdQBjAGoAQQByAHgARQBkAEwASwA1AGQAcwBRADcANgB3AD0APQA8AC8ASwBJAEQAPgA8AEMASABFAEMASwBTAFUATQA+AC8ARgA3AEIAMQBmAEgAMgBlADAAYwA9ADwALwBDAEgARQBDAEsAUwBVAE0APgA8AEwAQQBfAFUAUgBMAD4AaAB0AHQAcABzADoALwAvAHQAZQBzAHQAdABvAGsAeQBvAC4AcABhAGwAbAB5AGMAbwBuAC4AYwBvAG0ALwByAGkALwBwAGwAYQB5AHIAZQBhAGQAeQAvAGwAaQBjAGUAbgBzAGUATQBhAG4AYQBnAGUAcgAuAGQAbwA8AC8ATABBAF8AVQBSAEwAPgA8AC8ARABBAFQAQQA+ADwALwBXAFIATQBIAEUAQQBEAEUAUgA+AA== qAUAAAEAAQCeB...A= AAAAVXBzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAADUIARIQEup1PCPnvAJEdLK5dsQ76xoMaW5rYWVudHdvcmtzIg1jcGl4LXRlc3QtY2lkKgJIRA== ```