Designing a License Server: Key Rotation, Session Binding, and the Offline Edge Case

The license server is where DRM stops being a spec and starts being an attack surface. Issue licenses too loosely and anyone with a stolen URL watches for free; too strictly and paying users get black screens on legitimate devices. The design is a careful compromise between leak-proof and usable.

The License Request Lifecycle

[Player boots] → [EME generateRequest] → [License Server]
                                              │
                    ┌─────────────────────────┼─────────────────────────┐
                    │                         │                         │
                    ▼                         ▼                         ▼
              [Session valid?]          [Device allowed?]         [Concurrent limit?]
                    │                         │                         │
                    └─────────────────────────┴─────────────────────────┘
                                          │
                                          ▼
                                   [Issue license]
                                   key + policy + expiry

Three checks happen before a key ever leaves the server — and skipping any one opens a hole.

The Three Checks That Matter

Check	What It Stops	The Mistake to Avoid
Session binding	Sharing a license URL to friends	Letting the license live longer than the session
Device binding	Credential sharing across devices	Unlimited licenses per account
Concurrency limit	Account sharing at scale	Only checking at login, not at playback

Session binding is the one that matters most for piracy: a license URL shared to a Discord server is worthless if it expires in 5 minutes and is bound to the original session’s fingerprint.

Key Rotation — The Hard Part

Rotating encryption keys mid-stream is where DRM pipelines break. The pattern:

1. Keys live in a key management service (KMS) — not on the license server itself.
2. The license server fetches the current key for a given content_id at request time.
3. Key rotation happens on a schedule (e.g., hourly), and in-flight licenses aren’t invalidated — they expire naturally.

The failure mode is a key rotation that drops active licenses — viewers get mid-playback failures. Rotation must be forward-only: new requests get the new key, existing sessions ride out their expiry.

The Offline Edge Case

Offline playback (downloaded content that plays without a network connection) is the one place DRM has to relax. The license is issued persistently — a long-lived key stored in the device’s secure enclave. The trade-off:

• Short persistent license (hours) — safer, requires frequent check-ins.
• Long persistent license (days) — usable offline, but a stolen device has stolen keys.

“Every DRM leak starts with a license that lived too long. Rotation, expiry, and session binding aren’t features — they’re the only things standing between ‘licensed’ and ‘shared publicly’.”

License request handlers, key-rotation schedules, and the session-binding schemas are in the license server architecture guide.