Service
Cut your CAS costs
Conditional access systems (CAS) have typically been expensive for broadcast security. Gain more value from your infrastructure by saving on delivery with DRMtoday for Widevine CAS.
Replace your conventional CAS with an alternative that eliminates device royalties, proprietary STB middleware, smart cards, and vendor lock-in.
Simplify your workflow by avoiding an on-prem EMMG with our world-class key management and content entitlement service.
Based on our long-proven DRM license network, we easily scale to meet any growth with billions of deliveries each month.
facts & figures
Ready to help you save
As an early adopter, we’ve worked closely with Google to champion Widevine CAS since 2019.
Trusted by Google
Third Party Labs (3PL) member
We’re trusted to provide solutions and support for operator integrations.
Built for Android TV
Easily operate IPTV services with native Widevine Level 1 STB security.
Hollywood recognized security
DRMtoday successfully completed Cartesian’s extensive Farncombe Security Audit®.
Key facts
Dedicated service
& support
Gain a robust CAS solution backed by strong support to ensure your service runs smoothly. From entitlement delivery to device integrations, our experts address any challenge encountered along the way.
Global license delivery network
We operate a resilient multi-region server network with reliable high availability and exceptional fault tolerant redundancy.
Plug-and-play ECMG
Get running quickly by leveraging our compatible ECMG, available online or on-prem, with headend integration assistance.
Complete support
Expert 24/7 assistance with fast worldwide response to overcome challenges and up to 99.999% SLA uptime options.
Easy admin
Manage and monitor entitlement activity through our user-friendly dashboard.
Reselling & multi-tenancy
Robust multi-tenancy for resellers to oversee their customers and enterprise media groups to manage their sub-brands.
Service
Hybrid PayTV & OTT licensing
DRMtoday also empowers broadcasters with multi-DRM for OTT and IPTV services across all screens.
Key facts
Quickly deploy app-based players
As an option on top of licensing, take advantage of our PRESTOplay SDK to easily create feature-rich players with speedy app-based deployment. Any device vendor supporting Android TV’s tuner framework and MediaCas is ready for our playback technology.
Learn moreConsistent across devices
Build just one player app that runs identically across SoC and OEM hardware helping you simplify deployment, achieve consistent user experience, and reduce frontend development.
Hybrid OTT playback
Easily provide IPTV and hybrid OTT playback from a single Android TV app, avoiding development and maintenance of multiple players.
Service
Streamlined STB set up
Heavy customization is typically needed to enable traditional CAS on STBs. Working with leading OEM and SoC vendors, we’ll help you save months of integration effort with a pre-compatible Android TV and Widevine CAS approach for smooth STB operation.
Contact us to learn more
testimonial
The flexibility and extension of Castlabs’ DRMtoday cloud service and its professional services allowed us to converge our PayTV CAS and OTT DRM requirements into one single solution. Castlabs provided us strong support and confidence during the whole Widevine CAS migration process.
Stein Ivar Nilsen Video Acquisition & Distribution Manager
Get started today
We’re ready to be your partner for broadcast security – contact us to learn more.
FEATURES
Your advanced CAS features
Discover all the ways we provide comprehensive CAS protection.
Need help with something specific? Just contact us or view our consulting and custom engineering options.
Security
Widevine security level 1 to enable HD, UHD, and HDR playback experiences. |  |
| Hardware-security licensing In Trusted Execution Environments (TEE) | |
Combine multiple individual channels within a group license. A single group license can then be delivered which is valid for any channel within the group. This is useful to simplify delivery loads and improve channel change latency. | |
When a license expires a new license can be automatically available ahead of time to use. This helps to avoid playback delays and mitigates against latency when changing channels. | |
This is useful for subscription management. For example: An issued license may have a preset time limit. When it expires a STB can automatically try to renew the license. If the user still has a valid subscription then the license is renewed, and if not the request is denied. | |
Enables licenses to be downloaded on user devices for secure local offline playback. | |
| Entitlement key rotation | |
| Content key rotation | |
| Encryption modes | AES-CBC/ECB/CTR/OFB/SCTE, ATIS-IDSA, DVB-CISSA/CSA2/CSA3 |
On-prem or as a managed cloud service. | |
| Entitlement Management Message Generator (EMMG) | |
| DRM for OTT Widevine, PlayReady, FairPlay Streaming, WisePlay | Optional |
Playback use-cases
| Platform support | Android TV 9+ (11+ recommended) |
| IPTV & DVB delivery | RTP, UDP, DVB-C/S/S2/T/T2 |
| Video format | MPEG-TS |
| SD/HD/UHD/4K | |
| Pre-integrated with PRESTOplay for Android For hybrid IPTV & OTT as a single player | |
License delivery network
| Server infrastructure | Global multi-region AWS servers |
| Limitless scalability | |
| Fault-tolerant & high global availability | |
| Low-latency licensing Fast channel start times | |
| Rapid world-wide key synchronization | |
| Technical security audits by AWS | |
| Cartesian’s Farncombe Security Audit® | |
Dashboard, config, & account management
| Extensive documentation | |
| ECMG configuration Including channels & groups | |
| Configure delivery & authentication behavior | |
| Delivery logs and reporting Including user device type | |
Examples: Download delivery logs, monthly summaries | |
Examples: License delivery, user accounts, ECMG. | |
| Multi-tenancy / reseller support / client management | |
Customer support
| Customer support portal | |
| 24/7 support available (Gold SLA) | |
| Up to 99.999% SLA uptime options | |
FAQs
Have questions?
Read common questions we receive, or contact us to find more.
Here’s our high-level workflow:
- At the headend, a scrambler encrypts the source video with often changing scrambling keys (control words). This is usually performed by a headend multiplexer.
- The Simulcrypt Synchronizer (SCS) sends these control words to the Entitlement Control Message Generator (ECMG) which wraps them with another, seldom changing service key (entitlement key).
- The ECMG talks to our DRMtoday license server over HTTPS to ingest and pull entitlement keys.
- The ECMG embeds the entitlement keys together with additional metadata into an Entitlement Control Message (ECM) and sends this back to the SCS.
- The headend sends the ECM to the Android TV device with the encrypted broadcast video.
- On the STB, our Widevine CAS enabled PRESTOplay for Android player software asks DRMtoday for the entitlement key via HTTPS.
- If the customer is authorized, DRMtoday delivers Entitlement Management Messages (EMMs) which are special Widevine licenses containing the entitlement keys needed to unwrap control words. The broadcast stream can now be safely decrypted and played.
Google introduced their Widevine 3PL program authorizing trusted partners like us to offer dedicated Widevine services, implementations, and support. This allows fast and scalable deployments for solutions like Widevine CAS.
Our Widevine CAS ECMG service is DVB Simulcrypt compliant and any headend solution which uses a scrambler/multiplexer that speaks Simulcrypt should work just fine with our solution. We’ve currently integrated and deployed solutions in the past with common vendors such as Ateme, Synamedia, and Harmonic just to name a few.
Widevine CAS requires devices to be Android TV certified. It also requires OEMCrypto version 14+ along with MediaCAS library support which needs to be provided by the SOC/OEM vendor for the device. Although it can be supported on Android version 9+ devices, most current deployments use Android 11+ which we recommend.
We have extensive experience getting Widevine CAS working with devices – contact us today to discuss how we can help.
Yes! Widevine CAS uses Widevine Level 1 hardware security and ensures that all decryption and decoding on the device happens in its trust zone using a secure process. It replicates all output protection features that are provided by Widevine DRM and is trusted by all the leading studios for content protection. It also employs content key rotation and allows for wrapping key rotation as well.
Widevine CAS supports all commonly used conditional access features including, among others, channel grouping (bouquets), parental controls, and key rotation.