So to support Live Stream and requirement that only logged-in users are allowed, the database of the users is needed. This also means there's need for registration.
To allow only registered users to view the live stream, you need your own website with user registration, and then you need a media server or CDN which will check with your web site if token (cookie) is valid.
The below scheme is in its simplest form. Normally there's dedicated "Key Server" as with typical encryption system. Additionally the stream is also encrypted and the key server is not only checking your username / password or token but if the content owner allows you to play the stream. It would also send you the decryption key (or the license, depends on the technology used).
![Media Token](../../images/3868331245.webp)
Most media servers and CDNs support this. With HTTP servers can have custom authentication module.
If you look for technology which can do all of that look at Kaltura, they got free version as well.
Regarding HLS and DASH streams, ideally it would be:
- CDN service which checks the tokens with your Key Server (because main app server is not the one you want to query because of performance, the Key Server must have cache of tokens or dedicated scalable database).
- Your media server can have simple plugin to check for tokens
- Your HTTPd server can have custom module to check for the tokens
In case of DASH and HLS you have 1. metadata files (like m3u8 or manifests) and media fragments. All fragments are usually encoded with single AES key and the key is normally stored in the meta-data files. It's quite different for DASH as there can be optional key server.
So the solution for HLS is for example to send Cookie to every possible request and then check for that Cookie. HTTPD server has to have cache of this stuff. You could extend this method to DASH however they provide more decent mechanisms.
The current technology to protect content:
- Most live streams are using Flash Access (as flash is major platform for live stream delivery)
- There's Widevine by Google which is slowly being adopted (Android)
- Microsoft Playready
- W3C EME
- Custom token-based authentication in simplest form - and that's not a technology but a way of integration.