DRMtoday Sessions
In this live demo, a paying end-user watches alongside a pirate who exploits a vulnerable device to remove DRM and redistribute an unprotected copy. As the content keys rotate, the pirate must keep obtaining new licenses to stay on air.
Start the demo: three end-users join the pirate’s stream. Then take down the pirate’s session: its audience loses playback once the keys already obtained and buffered video run out, while the legitimate end-user keeps watching.
How DRM Sessions and CDN binding work together
Akamai checks a CDN Access Token (CAT) bound to the client’s TLS connection. When it requests proof of possession, a re-encrypted segment makes the client request a license. DRMtoday validates the DRM session token against the client’s DRM identity before issuing that license.
Can a stolen session play on another device?
Playback runs on a TLS-bound CDN Access Token; when the CDN revalidates, the license request carries a DRM session token bound to the client identity.
Illustrated walkthrough of the validated flow — not a live attempt.
1 / 6
Copied CAT + DRM session tokens
Another device copies the session credentials.
The authorized client has a CDN Access Token (CAT) for requesting video and DRM session tokens for requesting licenses. Another device copies these credentials, without obtaining a new authorization of its own.