How to prevent illegal file transfer or copying of video files from a PC?

Question

I have developed a windows desktop application using VB.NET. My applications main purpose is to play videos. I have some videos which has copyrights on them, that are not suppose to be distributed or transfered without authorized permission.

I am looking for a way of preventing those videos from being copied or transfered. I am going to install this application on many PC's in places and cities. My biggest worry is how to protect those videos from illegal transfer or distribution.

I know that many giant companies has spent billions of dollars on how to prevent the privacy of their products but still they cant prevent it... So I am not expecting that I can get 100% solution on this, but still I want to protect it as much as I can.

I am listing down some of my ideas to prevent the videos from being copied. Let me know if I am wrong anywhere.

1. Is there any way that i can make a PC only run my application - no other application at all, no one can see the desktop or open the start menu or a command prompt or Windows explorer or anything? When the PC starts, only my application will start and from my application the PC can be shut down.

2. Can I create my own video format for these video files, which cant be converted to a normal video file just by changing its extension?

3. I have tried to add these videos as resource files in my Visual Studio project, but I can not add videos that has a file size over 500 MB. I have much bigger files than that.

4. Can I convert these videos to Flash files and add some code to it, so these files can run only on my machine not on any other machine?

Any kind of suggestions or solutions or guidance are welcome.

Answer 1

As you state in the question, doing this in a foolproof way is technically impossible. For the video to be displayed on the screen it must somehow reside somewhere in the RAM on the computer, be transfered to the monitor and then displayed there. From all these points the video could be extracted. Possible ways include:

• Copied from RAM.
• Recorded with screen capture program.
• Recorded with hardware designed to record output from video port.
• Screen filmed with an ordinary video camera.

What you can do is to make it harder for people to copy the videos. What all such efforts have in common is that they are breakable. If your videos are a high value targets, sooner or later anybody with basic googling skills will be able to copy the videos. But if your user group is small, non technical and/or not motivated, even a thin veil of protection might be enough.

This is called Digital Rights Management (DRM).

So how would you go about doing it? I would use an ordinary video format, and then encrypt it (for instance with AES). When a video is played, you decrypt it in RAM (so that the decrypted video never touch the hard drive) and play it. Apart from the thing mentiones about, this is vulnerable to the encryption key being extracted from wherever you store it.

So where do you store the encryption key? The easiest way is to just have it hard coded into the source code of your program. However, that means that anyone who copy the program and the videos will be able to play them. You could play around with different solutions where the key is hidden (in some obscure file, in a weird place in the registry) or where every installation of the program is distributet with its own encryption key that decrypts the universal encryption key that in turn decrypts the videos. In the end it is all security through obscurity anyway.

Or - and this is the easiest solution if it is possible - you just distribute the videos through an existing distributor that already has its own DRM in place.

EDIT: User billc.cn has some examples of existing DRM schemes that you can use in his answer. I would strongly recommend you to consider those before trying to roll your own.

Answer 2

Do not roll your own DRM scheme. The industry have tried and failed so many times that a homebrew solution will stand little chance.

It would be better to "stand on the shoulders of giants" and use existing DRM solutions. Windows Media Rights Management and PlayReady are good solutions. The latter supports HDCP and are used by mainstream premium content distributors like Netflix and Amazon.

These solutions takes care of the theoretical, software and hardware aspects of a DRM solution and provides licenses to DRM-related patents, etc. that you'll undoubtedly need.

Obviously, you'll have to pay money to license these solutions and maintain some infrastructure to keep them running. Whether this is worth it depends on the value of the contents you're trying to protect.

Answer 3

As mentioned, its impossible to prevent capture of the displayed video - even in the worst case, the user can record the video on a smartphone or using a fixed camera (as some pirate movies do when they are recorded at the cinema)

What you can do then is to shift the protection from stopping copying, to prosecuting copiers. You can embed watermarks in the video, watermarks generated uniquely per PC or user. These are not usually visible to the human eye (but could be) but can be read by careful inspection of the video frame data. This means that if you find a copy of your video, you can tell who showed it (or who it was assigned to) and deal with them in whatever fashion you choose.

Answer 4

This is a problem of trying to protect what you want to provide. It's impossible to do, but you can make it difficult.

Probably the best approach would be to encrypt the files. But at the end, you give all the data for a person to run on a computer they have full access to. Since it will play the video at some times, it means the keys will be available in the code, or in the memory.

The problem will also occur with a computer as you describe in 1. Even if this was possible, the files are available in some format to the user at some point, and reverse engineering this can be done.

2 suffers the same problem, there is but a finite way to do videos. Even if you develop your own codec and container format, these can be reversed engineered.

As for 3/4, resources are files from which you can extract data.

As a rule on computers, what can be seen can be duplicated.

Answer 5

I know that many giant companies has spent billions of dollars on how to prevent the privacy of their products but still they cant prevent it... So I am not expecting that I can get 100% solution on this, but still I want to protect it as much as I can.

You've already got your answer, you just don't realize it. "As much as you can" is "not at all."

Why? Because the Internet.

You need to keep the Internet in mind to realize just exactly how ridiculously stacked against you the deck is in this endeavor. Because the Internet exists, because the World Wide Web has been established worldwide, all it takes is any one person, anywhere in the world, to crack your protection even once, and then upload the crack, and the entire world has access to it. This is the problem at the heart of your (entirely correct) observation that many companies spend more money than you'll ever see in your life to prevent piracy, without success.

DRM does not work. Period. And worse than not working, it makes things worse, because it introduces a failure mode to the system. DRM doesn't simply lock people out if they're not authorized; it locks people out if they cannot prove to the satisfaction of the DRM code that they are authorized. Those are two very different things even if your code doesn't contain any bugs (and how confident are you of that, really?) because it frequently means that if the user isn't connected to the Internet, or if anything goes wrong at the server, or with the network along the way, or if you go out of business, your customers lose access to content that they legitimately bought and paid for.

What this does is set up a set of perverse incentives, where a hacked copy does not simply provide your product to users without paying for it; it provides a better product, one that is not encumbered by the problems DRM brings. When you add protection to your content, you are creating a positive incentive for people to want to crack it that would not exist otherwise!

If you want people to pay for your content, there is only one way to achieve it, and it's with basic economics, not with code. A person will buy something if they perceive that the value it provides to them is greater than the price they're being asked to pay for it.

It's really that simple.

Answer 6

Windows Embedded with the UI disabled would be a first step.

Then you could:

• Disable the network
• Epoxy all open ports
• Remove the floppy drive (do these still exist)

As all have said already, 100% is impossible, but if you look at each possible entry point and close it you can get close.

Instead of the epoxy method you can setup a USB whitelist to only accept your thumb drive, and an application whitelist would also be possible to prevent sideloading of screen capture software.

Short of welding the monitor cable in though, a pass-through device would still be able to be inserted inline.

To bypass the file size limit you could possibly break up the video into smaller parts and play them as a playlist.