Design a DRM-Heavy Media Portal

Problem statement

Design a DRM-heavy media portal: a subscription video platform whose entire premium catalog is encrypted end to end, where every playback starts by acquiring a short-lived license from a license server that verifies entitlements, device trust, territory, and concurrency before releasing a content key. The portal must ingest and package studio content, encrypt it with per-title or per-period keys, publish HLS and MPEG-DASH manifests, serve segments through a CDN, and enforce licensing policy on every device — phones, TVs, browsers, consoles, set-top boxes — across Widevine, FairPlay Streaming, and PlayReady.

This is not a generic video site with a paywall. The content is licensed from studios under contracts that carry security obligations: MPAA-aligned content-security practices, Trusted Partner Network assessments, per-territory windows, and audit rights. A single leaked key can surface a $200M tentpole on piracy mirrors within minutes, so the design treats key material the way a bank treats cash: generated in hardware, wrapped at every hop, cached only inside protected boundaries, rotated on schedule, and revoked with a rehearsed playbook.

Why the problem is distinctive

A normal API can tolerate an auth outage by failing requests. A DRM portal has a sharper constraint: the license server sits on the critical path of every playback start and every key renewal, yet the media itself flows through a CDN that must never see a content key in the clear. The design therefore separates license issuance from media delivery. Delivery is a cacheable, eventually available read path measured in terabits. Licensing is a low-latency cryptographic write path measured in milliseconds, where every request is an authorization decision: who is asking, on what device, with what security level, in what territory, against how many concurrent streams.

The problem requires encrypted media segments with a license acquisition flow, device authentication or fingerprinting, short-lived or rotating session keys, multi-DRM support, leak-resistant security, large concurrency, low license latency, and geoblocking or concurrency limits.

Public operating baseline versus design assumptions

The category operates at enormous public scale. Netflix reports roughly 302 million paid memberships as of its Q1 2025 results and has disclosed viewing on the order of 16-17 billion hours per quarter in its 2024 earnings reports; its Open Connect program states that around 95% of that traffic is served from appliances embedded inside ISP networks, and its engineering posts describe per-title encryption with Widevine and PlayReady licenses bound to device hardware keys. Disney announced 10 million Disney+ signups in the first 24 hours of its November 2019 launch, and the Disney+ portfolio including Hotstar passed 160 million subscriptions during 2022 per Disney earnings. Amazon disclosed more than 200 million users watching Prime Video in 2021. Akamai has reported aggregate platform peaks around 167 Tbps in 2022, dominated by video. These are cited public figures used as context.

For capacity planning this answer explicitly assumes a mature portal with 60 million subscribers, 18 million DAU, 8 million concurrent streams at peak, and 45 million playback sessions per day with a 5x event multiplier. Every uncited number in this answer is a stated design assumption, target, budget, or illustrative threshold.

The four architectural planes

1. Content plane: ingest, transcode, encrypt, package, sign manifests, publish catalog and per-territory windows.
2. License plane: entitlements, device attestation, key management, license issuance, renewal, revocation, and concurrency control.
3. Delivery plane: CDN distribution of manifests and encrypted segments, ABR ladders, watermark variants, multi-CDN failover.
4. Governance plane: anti-piracy monitoring, forensic watermark tracing, key-incident response, studio audit evidence, and compliance records.

A strong answer keeps the planes separate: a CDN failure degrades delivery without exposing a key; a license-plane outage can fall back to unexpired cached licenses without weakening entitlement policy; a piracy incident triggers watermark tracing and key rotation without touching the packaging pipeline.