Welcome to 'This is My Architecture'.
My name is Christian and today I am joined by Jean-Paul from NAGRA.
Welcome Jean-Paul.
Hello Christian, thanks for having me.
Tell us a little bit about NAGRA.
NAGRA provides security and multiscreen user experience solutions
for the monetization of digital media.
I am in charge of the NexGuard B2C team that works on forensic watermarking products,
including on demand and live that we will discuss today.
Very good. So maybe you want to quickly explain what watermarking is.
Yes, so watermarking is a process of adding an imperceptible mark
to audio or video contents.
Its goal is to make it traceable
such that when it leaks, it can be traced back to where it came from.
A typical example is around piracy as seen for the movie or sports industry.
With other industries they face similar challenges.
I'm curious to learn more about this architecture.
Maybe you can start walking us through and what we have here.
Yes, so the architecture consists of different blocks.
The first block is the watermark preprocessing.
In this part we create two variants of the content; A and B.
These variants, they are visually identical, but they contain a distinct watermark.
The second part is the watermark embedding.
At that part we leverage the fact that content, when distributed over the internet
is typically chunked in small pieces of like two seconds.
For each piece we select either the A or the B variants.
Over time this builds a sequence that's possible to uniquely identify the session.
These two elements, we typically deploy that in a customer environment.
We have some CloudFormation to make that very easy.
There is a third component that is Detection Service.
This is really a service offered by NAGRA
and this allows you to provide content to the service
and extract the A/B sequence inserted.
Can you please explain how you identify these different players with these A/B versions?
So let me give you an example.
Let's say we have two players, for example a mobile device, your PC or connected TV.
They will first connect to a CMS, content management system,
and this content management system will actually grant access
and the player will select a content to watch.
At this point the content management system will also select the A/B sequence for each player
that will be used for that session.
For example, the first player gets A-B-A-B,
the second player gets A-B-B-A.
This information is provided as a token
and will go into the request to CloudFront.
For each request, each segment, CloudFront will use the Lambda@Edge
to insert a sequence that is encoded in that token.
Okay, so by using CloudFront and Lambda@Edge
you select which sequences of these A/B versions
are being delivered to the different players to identify them.
So why did you choose this package of CloudFront and Lambda@Edge
and what are the benefits of that?
We were looking for a scalable solution
to apply this A/B sequence during the screening session.
Lambda@Edge was a good fit and it also allowed us to leverage the CDN caching.
Other solutions like container or regular Lambda we basically not fast enough
because they were not close enough to the Edge.
Another thing is that the Lambda@Edge we have a, basically, very efficient execution
so that we add also minimal latency which is also great for live content.
For that one we're also looking now into CloudFront Functions that will scale even better than Lambda@Edge.
I can imagine that latency is a very critical factor also in regards to user experience here.
We are having DynamoDB in this space over here
so maybe you can tell us a little bit what you're using it for.
So, DynamoDB is actually for a very specific feature that we call blacklisting.
The idea is that when the detection service finds basically a certain sequence,
for example A-B-A-B, it can decide to populate DynamoDB with the session information.
At that point, the Lambda@Edge when it is queryingg the database,
when it's processing the request, can actually decide to block a certain session.
So as a result, the play-out for that player, in this case player one, would stop.
So it terminates the session.
So you have a mechanism to identify if a breach has happened
but you can also shut down the session once it has been identified.
-Exactly. -Perfect.
So, we've been learning about how you distribute the content out to the different players
and the different end users.
How do you prepare that content with these A and B versions?
So the content preparation depends a little bit on the type of content,
if it's VOD - on demand or if it's live.
In principal it's very similar and from CloudFront point of view it's identical.
If we look at VOD, the input is actually a file that will go into an S3 bucket.
This file will then go into MediaConvert.
MediaConvert is actually the part where the A/B watermark with the variants are created.
The output of MediaConvert will be those A and B versions.
This goes into the S3 bucket that then be the origin to CloudFront.
Of course there are different options.
You could use some scripting or FFMPEG.
But the benefit of this solution is that it's based in many services
that are easier to deploy and use.
And also, because you mentioned, you're deploying this via CloudFormation
automated into the customer accounts that's maybe also an easier approach
to use those managed services instead of having a complex set-up.
Exactly.
So, that was for the video on demand content, how does it work for live?
For live it's very similar but the input will be live feed.
So it will go to MediaConnect that will split the feed into two.
And then MediaLive where the encoding takes place.
We have two channels.
One channel will be the A variant, and the other channel will be the B variant.
So it's here where we insert the watermark.
Then MediaPackage will prepare it for internet distribution.
It will then be the origin for the CloudFront.
Great, so that is very interesting.
What are your plans for the future or how are you evolving this architecture?
We are currently looking into data analytics to identify early on if a session is used for piracy.
For example, a session that doesn't terminate and is a live channel continuously,
that's suspicious.
Another area is audio watermarking,
to not only protect the video content but to offer the same for the audio.
Very very interesting.
Thank you so much Jean-Paul for sharing this architecture with us today.
Thanks again for having me.
And thank you for watching 'This is My Architecture'.