v-manual-encrypt

1. First, configure the following in [POLYV Console] → [Settings] → [Encryption Settings]:

2. After saving the above settings, you also need to add the ts and sign parameters to the playback code on the page. When a mobile web browser requests m3u8, the ts and sign parameters will be appended to the m3u8 URL. The POLYV cloud platform will validate these parameters upon receipt. If validation passes, the correct decryption key file link is returned to the client. Otherwise, unauthorized access to the key will result in a 400 error response.

3. PHP Example Code

Parameter Description:

• $secretkey (The account secretkey, available in Console → Settings → API Interface)
• $vid (The video ID, which can be found in the video list)
• $ts = time()*1000; (The ts parameter is a 13-digit millisecond timestamp, or a 10-digit second-level timestamp with three additional zeros appended)
• $sign = md5($secretkey.$vid.$ts); (The sign parameter is the MD5 hash of the concatenated string of secretkey, vid, and ts in order)

<?php
$vid = "e2e84a738354402a52ce81aeab4e3067_e";
$secretkey= "7UagtQOq2A";
$ts=time()*1000;  //10位的秒级时间戳，后面加多3个0，最后为13位的数值
   
$hash = md5($secretkey.$vid.$ts);
?>
  
<script src='https://player.polyv.net/script/polyvplayer.min.js'></script>
<div id='plv_e2e84a738354402a52ce81aeab4e3067_e'></div>
<script>
var player = polyvObject('#plv_e2e84a738354402a52ce81aeab4e3067_e').videoPlayer({
    'width':'600',
    'height':'485',
    'vid' : 'e2e84a738354402a52ce81aeab4e3067_e',
    'ts':'<?php echo $ts; ?>',
    'sign':'<?php echo $hash; ?>'
});
</script>

Since mobile web uses the HTML5 <video> tag to invoke the device's native player for video playback, the decryption key must be transmitted via HTTP to the native player. When the key's permission is set to "Open Authorization," the key is permanently valid and does not require the timestamp ts and signature sign for access. When the key's permission is set to "Web Authorization," the timestamp ts and signature sign are required to access the key correctly. The ts and sign for web encryption are single-use.

Unlike mobile web, when playing encrypted video on a PC web page, the key does not need to be transmitted via HTTP. During playback, POLYV's Flash player uses its internal decryption algorithm to decrypt and play the encrypted video, eliminating concerns about key transmission and exposure.

Setting [Web Authorization] offers more playback options, including playback on mobile web pages, but its encryption strength is weaker than [App Authorization]. To ensure better security for video file encryption, it is generally recommended to use [App Authorization] for mobile encryption.

4. The principle of the "Web Authorization" process for the decryption key is illustrated below: