OTT Forensic Watermarking with Limelight EdgeFunctions and NAGRA NexGuard

Safeguard both VOD and live OTT content from leaks and piracy


High-value video content is more accessible via online streaming platforms than ever before. During the COVID-19 crisis, with more people staying home, demand for streaming content accelerated. There is continued growth in the streaming of live sports, VOD, and the release of films New direct-to-consumer services such as online film festivals and early-release VOD services launch with all types of content.


Now more than ever, this premium content needs to be protected from piracy – a threat that can be devastating to its legitimate content owners, rights holders, and distributors alike. In this context, the ability to quickly identify content leaks is becoming increasingly critical to minimizing the damage piracy can cause and maintain revenue streams from that content.


Implementing a highly effective technique known as forensic watermarking can be critical in this effort by creating a uniquely identifiable stream for each video session, so that when a pirated copy is found it can be traced back to the original user. It is important to note that this watermark is invisible to the user and preserves the high-quality video experience, including HDR (High Dynamic Range). It is important to note that this watermark is invisible to the user and preserves the high-quality video experience including HDR (High Dynamic Range).


A technical solution, detailed hereafter in this paper, combines offerings from Limelight Networks and the NAGRA NexGuard forensic watermarking solution (“NexGuard”) to safeguard premium linear and VOD OTT content, from leaks and piracy.

"We are excited to partner with Limelight to integrate our NexGuard Streaming forensic watermarking technology with EdgeFunctions and safeguard a premium OTT provider's content from leaks and piracy. Using EdgeFunctions, we were able to quickly deploy our customized solution into Limelight's network edge locations and run them on-demand, at scale, for both VOD and live OTT watermarking workflows."

Solution Elements

The NexGuard solution runs in the Limelight EdgeFunctions serverless computing platform, which is tightly integrated with Limelight’s CDN. The NexGuard watermarking solution provides scalable, session-level identification of piracy events which can be performed efficiently using Limelight EdgeFunctions. This watermarking solution is completely server-side, and can deliver watermarked content to any type of streaming player or device and is shown in the following diagram:

watermarking solution

Key solution elements include:

  • Watermark pre-processing in the video
  • Performed by an ABR (adaptive bit rate) encoder/packager with NexGuard pre-processor support

  • JWT (JSON Web Token) creation and delivery of a watermark token to streaming video client
  • Performed by the content provider's online video platform session management subsystem according to NexGuard guidelines

  • Watermark ID Embedding per streaming session, based on a unique watermark pattern in the signed watermark token
  • Performed by a Limelight EdgeFunctions serverless instance, per NexGuard guidelines, utilizing Limelight CDN Delivery infrastructure

Limelight EdgeFunctions and CDN Operations

Limelight CDN customers with EdgeFunctions enabled can easily avail themselves of the combined NexGuard/Limelight watermarking solution by doing the following:

  • ■ Incorporating the necessary watermarking serverless edge function into their environment.
  • ■ Adjusting their CDN configuration to include it in the content delivery workflow for all traffic they want to be subject to forensic watermarking.


Once properly configured, the following workflow executes automatically to protect your content:

  1. The client requests a video segment that has a JSON Web Token (JWT) attached embedding necessary information for the NexGuard algorithm.

  2. The Limelight CDN invokes the watermarking function in EdgeFunctions

  3. This function checks and validates the JWT.
    a. If the JWT is missing or invalid, the function instructs the CDN to reject a request for the video segment.
    b. If the JWT is valid, the function evaluates its contents to instruct the CDN which prewatermarked versions (A or B) of the video segments should be delivered to the client.

  4. The CDN is delivering back to the client the requested video segments.


The solution delivers a uniquely watermarked video stream to each client, with minimal impact on latency and streaming capacity. No processing to the actual video is required at the edge, enabling a highly scalable solution for millions of users.

Seamless Integration of NexGuard Watermarking

Forensic tracking is enabled based on imperceptible video watermarking contained in the AB watermarked sequence. The hidden mark is added to the video at the time of content preparation, with either a file encoder for VOD or a linear encoder for live content. The integration is done seamlessly and provides no performance impact to existing workflows.


Any video codec may be used (e;g. H264, HEVC, VVC) and the content can be streamed in HLS or DASH, encrypted with a DRM.


Once valuable content is then distributed to consumers, the risk of theft increases, and therefore additional levels of leak detection and associated traitor-tracing measures are required to monitor content leaks on the multitude of devices that are used by today’s consumers. At an aggregate level, this also means video service operators can also identify any particular types of devices that are leak-prone alongside more granular information such as the location of the leak and the subscriber ID. This equips the video service provider with all the necessary information to traitor-trace the illicit use and can ultimately end in them revoking the subscriber’s account or pursuing legal action.


The watermark extraction is an automated process provided as a service and the steps involved are captured in the below diagram where, thanks to the watermark’s inclusion, pirate activity is detected, and the offending subscriber ID can be identified. This then allows the operator to undertake the necessary remediation action.


 watermark extraction


By nature, the proliferation of OTT means more streams, more networks, and more devices. It also means more attack points for pirates to exploit.


Consequently, watermarking plays a growing role in an overall security strategy, and in particular products such as NexGuard Streaming which have been designed to equip video service providers with a key tool in the fight against content leaks. The power of video watermarking is its ability to identify not only which affiliate and then network type the leak has been detected on but also really zoom in on the offending subscriber. This end-to-end distribution chain level of insight, when joined together with other tools and technologies such as anti-Piracy services, allows for the rapid identification of content theft and the associated traitor-tracing to enable the necessary remedial action to be taken.


Together, Limelight Networks and NAGRA have lowered the bar for content owners, distributors, and publishers,allowing them to implement a fast time-to-market watermarking solution which in turn raises the bar against leaks of their valuable VOD or live OTT content assets.


With the integration of NexGuard forensic watermarking into Limelight EdgeFunctions, video service providers can now protect both their live and VOD OTT workflows from leaks and piracy by ‘traitor-tracing’ content leaks back to the source and scan for watermarks to identify and terminate illicit content feeds.


For more information on NAGRA forensic watermarking solutions and its range of anti-piracy solutions, visit anti-piracy.nagra.com to continue the conversation.


About NAGRA NexGuard
NAGRA NexGuard forensic watermarking enables low-latency, versatile, secure, scalable content delivery with session-based watermark to help rights owners fighting piracy for both live and VOD content. NexGuard Streaming is server-side solution pre-integrated with streaming servers and CDNs, and embeds a session-specific forensic watermark for both OTT VOD and OTT live channels. It works with any OTT streaming device and client application, removing the need for any device-side integration. It scales easily to millions of concurrent sessions with CDN caching and works with all common streaming formats and DRMs. For more information, visit: Digital Anti Piracy & Forensic Watermarking Solutions | Nagra.


About Limelight EdgeFunctions
EdgeFunctions provides a customizable environment at the network edge for streamlining content workflows, performing time-sensitive decisions, and customizing user experiences. Providing this environment at the network edge offers Limelight’s low latency, on-demand scalability and high-performance network to developers. EdgeFunctions is ideal for streaming video and content delivery use cases such as personalized streaming, content protection, dynamic ad insertion, A/B testing, and image manipulation. For more information, visit EdgeFunctions Serverless Compute or contact us.