Beating the Pirates: A Custom Content-Protection Protocol for a Closed Video Platform
Secure Video LMS · Axoten Innovations · Role: Solutions Architect & founding engineer
Built on standard cryptography — not homemade. A word before the story, because “custom protocol” rightly makes good engineers nervous: I did not reinvent cryptography. The scheme stands on proven, industry-standard primitives — Elliptic-Curve Diffie–Hellman (ECDH) key exchange, multi-layered encryption, and strong authentication — and it follows established security best practices throughout. Rolling your own cipher is a cardinal sin; I didn’t commit it. What’s custom is the delivery and packaging layer that sits on top of that standard foundation. The cryptography is deliberately boring and battle-tested. The engineering is in how content is streamed and gated — not in the math.
A note on this write-up: the decisions, reasoning, and engineering here are entirely mine — the polished prose is not. I fed my own notes and solution to an AI to turn them into something readable, because I’d rather ship the story than spend hours wordsmithing it. I’m a software engineer, not a writer, and I’d sooner be upfront about that than pretend otherwise.
The decision in one line
The heart of this project wasn’t code — it was a threat-model decision: for a closed, whitelisted audience, fighting piracy with standard, widely-tooled formats is a losing game, so I kept the standard cryptography and made the transport proprietary — changing the shape of the lock while keeping the proven metal. Here’s how I got there.
The setup
Late 2020. Covid, curfew, classrooms shut. Sri Lanka’s massive private-tuition industry — the machine that preps students for the A/L exams — had nowhere to go. An institute came to us with an order: build them a Learning Management System, fast.
We shipped the first release in weeks: courses, lessons, attendance, payments, and video streaming. For video we made the pragmatic call — embed a third-party host. It offloaded our bandwidth, saved months of work, and got students learning again.
Within days, full lessons were circulating in Telegram groups. That kicked off an eight-month arms race that ended with me designing a custom streaming protocol — and it’s the work I’m proudest of.
flowchart LR A["Third-party embed"] -->|links scraped| B["Native apps"] B -->|"sniffing + TLS MITM"| C["Custom protocol<br/>(standard crypto inside)"] C -->|holds| D["~95% blocked"] style C fill:#4a9eff,stroke:#4a9eff,color:#fff style D fill:#1f7a3d,stroke:#1f7a3d,color:#fff
The arms race (why every standard fix failed)
Each defense fell for the same reason, and spotting that pattern was the whole insight.
- Round 1 — the trivial leak. Open the network tab, copy the video URL, paste into a free downloader. Because the video lived on a third party, we had zero visibility and zero control — no logs, nothing to even detect.
- Stopgap — move into apps. We ported playback into mobile and desktop clients to make link-extraction harder. It bought time; it also cost us (in-app video playback in 2021 was fragile). Then the attackers escalated: first packet sniffing, then full HTTPS interception — installing their own trusted root certificate and routing the app through a proxy (a textbook man-in-the-middle) to decrypt the TLS traffic and lift the stream URLs.
Every round, the attackers won with off-the-shelf tools — and the HTTPS-interception step proved something important: transport security alone was never going to be enough.
The decision — and the reasoning behind it
The team was ready to give up. The only “real” answer was industry-standard DRM — and the institute rejected it on cost, with sharp logic: “Netflix has DRM and new releases are pirated the day they drop. Why pay a fortune for something that doesn’t even stop the pros?”
They were right. So I stopped trying to make the lock stronger and started asking a different question. The reasoning, step by step:
1 · Identify the real limitation. Every tool we’d tried failed because the technology was common. There are entire online communities and ready-made tools dedicated to breaking exactly these standard formats. The problem was never cryptographic strength — it was ubiquity. Standard = tooled = beatable by a teenager.
2 · Understand the actual audience. This wasn’t Netflix. It was a closed, whitelisted platform — only enrolled A/L students could ever touch it. A niche of a niche. That completely reshapes the threat model: the realistic attacker is a casual student with a downloader, and the global piracy community has zero incentive to invest real effort into cracking something only used by Sri Lankan tuition students. There’s no payoff.
3 · Make the call. If the audience is closed and the value-to-an-attacker is near-zero, then being “standard” isn’t a virtue — it’s a liability, because standard is precisely what the tools target. So: keep the proven cryptography, but wrap it in a proprietary streaming and packaging protocol that no off-the-shelf tool understands. Change the shape of the lock; keep the battle-tested metal inside.
4 · Ground it in fundamentals (non-negotiable). Custom packaging, standard security underneath — ECDH key exchange, multi-layered encryption, authentication, and security best practices. The proprietary layer is obscurity as one layer of defense, never the foundation. If the custom layer were ever fully understood, the cryptography still has to hold on its own. That discipline is what separates this from “homemade DRM.”
This is also the direct answer to the HTTPS-interception attack: because the content is encrypted independently of the transport, an attacker who fully MITMs the TLS channel — their own root certificate, their own proxy — still recovers nothing usable. Protection that lives only at the transport layer dies the moment someone installs a trusted root cert; ours doesn’t depend on the channel being private.
5 · Define success honestly. The goal was never “unbreakable.” It was “not worth breaking.” Success = the attacker’s effort must exceed the attacker’s payoff. Concretely: no off-the-shelf tool works, casual downloading stops, and the economics hold for years.
Why it worked
Against that bar, it delivered. There was nothing on the internet to copy-paste an attack from, and no incentive for anyone skilled to build one — cracking a niche protocol used only by A/L students earns them nothing. The attack economics collapsed. They went after the encryption keys and failed; the standard-crypto foundation held exactly as designed.
The honest limit
No protection is absolute, and I won’t pretend otherwise. The scheme defeats every off-the-shelf tool and casual attack — but a determined specialist with deep low-level skills eventually found a theoretical edge (exactly one person did, a university researcher — it takes that level of effort). That’s the ceiling of this approach, and I know precisely where it sits.
So rather than chase an unwinnable 100%, we treated the last sliver as a different problem and layered on deterrence-and-detection — at a high level: digital watermarking, steganographic tracing, and analytics-driven monitoring. The philosophy shifted from “make it impossible” to “make it pointless, and make offenders traceable.”
Result: ~95% of unauthorized downloads and screen recordings eliminated — and the remaining fraction pushed into effort no ordinary user would ever attempt.
Where it landed
- Became the flagship product of Axoten, now maintained by a full team.
- Runs on iOS, Android, and Windows, with built-in live streaming.
- Serves roughly 500–1,000 TB of video bandwidth per month.
- Scaled to 20,000+ users and 5,000–10,000 concurrent viewers.
- The custom protocol still holds today, years later. I stay on as Technical Consultant.
This isn’t a demo — it’s in production. Several institutes run their learning platforms on the system I architected:
Why I keep this one close
I built this in the pre-ChatGPT era. No AI pair-programmer, no Stack Overflow answer waiting — some of the questions I hit had no answers at all. Reading the media-codec internals felt like reading quantum physics. It was just me and the compiler, night after night, until it worked.
A curfew order for a stopgap LMS turned into a custom streaming protocol — standard cryptography, proprietary delivery — that outlived every attack thrown at it. That’s the work I point to when someone asks what I can do with a hard problem and no map.