withsoon
N
Security7/14

Netflix System Design

Security & DRM

~5 min read

Interview angle: Security comes up in two contexts — DRM (content protection, studio contracts) and data privacy (PII, GDPR). Know the DRM flow end-to-end and be able to explain why signed URLs + device-bound licenses prevent URL sharing.

DRM License Flow

How Netflix prevents content piracy while keeping under 500ms playback startup.

1
Client

User clicks Play. Client sends POST /playback/session with deviceId and drmScheme (WIDEVINE/FAIRPLAY/PLAYREADY).

2
Playback Service

Validates JWT, checks entitlement, acquires concurrency slot. Passes device fingerprint to DRM Service.

3
DRM Service

Verifies device registration. Generates Content Encryption Key (CEK) lookup from HSM. Creates license token signed with private key.

4
Playback Service

Returns signed manifest URL + DRM license URL to client. DRM license URL is also signed and short-lived.

5
Client

Fetches manifest from CDN. Discovers encrypted segments. Sends license challenge to DRM license URL.

6
DRM Service

Validates license challenge token + device fingerprint. Wraps CEK in device TEE public key. Returns license blob.

7
Client TEE

Unwraps CEK inside Trusted Execution Environment. Decrypts video segments locally. CEK never leaves the TEE.

DRM FAILS CLOSED: No license = no CEK = no decryption = black screen. Studio contracts prohibit any plaintext fallback. This is the one place where user experience is legally subordinate to content protection.

Security Controls

Authentication & Authorization

▸JWT (RS256) with 15-minute access token TTL
▸Refresh token stored in HttpOnly cookie, 30-day TTL, device-bound
▸Redis revocation list for instant invalidation (device theft, account compromise)
▸OAuth2-compatible flow for social login (Google, Apple, Facebook)
▸Authorization: profile-level permissions enforced at API layer, not client

Signed CDN URLs

▸Manifest URL = HMAC-SHA256(canonical_url + expiry + client_ip_hash, secret_key)
▸TTL = 6 hours — long enough for a feature film; short enough to limit URL sharing
▸URL binding: optional IP-range binding for extra theft protection
▸CDN validates signature before serving any response — no bypass possible
▸Segment URLs are also signed — sharing the manifest doesn't expose raw video

Device Registration & Limits

▸Each device generates a unique device fingerprint on first registration
▸Device is registered to account; max 5 registered devices per plan (varies)
▸Concurrency limit (simultaneous streams) enforced at Redis layer — atomic Lua script
▸Device management UI lets users deregister unused devices
▸Suspicious device activity (rapid country hops) triggers step-up authentication

Session Hijack Protection

▸Access tokens are device-bound: contain deviceId claim. Cross-device reuse rejected.
▸IP anomaly detection: token used from unusual geography triggers re-auth prompt
▸Short token TTL (15 min) limits the damage window of a stolen token
▸Concurrent session detection: >plan limit triggers notification + forced sign-out
▸Redis revocation list allows immediate invalidation of compromised sessions

PII & Data Privacy

▸PII fields (email, IP, device IDs) are pseudonymized before entering the data lake
▸Hashed profile IDs used in analytics; mapping table access-controlled
▸Event data minimization: only fields necessary for the use case are included
▸GDPR right-to-erasure: deletion request propagates to Cassandra, S3, and search index
▸Data retention policies: raw event data 90 days, curated data 2 years, billing records 7 years

Credential Stuffing & Abuse Prevention

▸Rate limiting: 5 login attempts per IP per minute; 20 per hour
▸CAPTCHA triggered after 3 consecutive failures
▸Credential stuffing detection: bot fingerprinting, request rate analysis
▸Compromised password detection: check against Have I Been Pwned database on login
▸Household enforcement: location-based signals detect account sharing across households

Audit Logging & Compliance

▸All admin/content-ops actions are audit-logged with user, action, timestamp, and IP
▸Immutable audit log stored in S3 with write-once retention policy
▸Billing changes trigger audit event: old state, new state, initiator
▸DRM license issuances logged: device, title, timestamp, region
▸Compliance with GDPR (EU), CCPA (California), COPPA (children's content)

Common Interviewer Questions

Q: How do you prevent URL sharing to bypass DRM?
Signed manifest URLs with short TTL (6h) + HMAC-SHA256. Segments are also encrypted — even with the URL, segments can't be decrypted without the DRM license, which is device-bound.
Q: What happens if a user's access token is stolen?
15-minute TTL limits the damage. Immediate revocation via Redis revocation list. If device theft, user can deregister device from UI — invalidates all tokens for that device.
Q: How do you handle GDPR deletion requests?
Propagate deletion to Cassandra (profile + watch history), S3 (pseudonymized event data), search index, and CDN cache invalidation. PII hashing in the lake means most events become unanonymizable anyway.
Q: Why does DRM fail closed instead of open?
Studio licensing contracts require it. Content cannot be accessed without a valid device-bound license. This is a legal obligation, not a technical preference.
Q: How do you enforce concurrent stream limits?
Redis Lua script atomically: check current_count < plan_limit, INCR, SADD(sessionId), set TTL=36s. Heartbeat renews TTL. Atomic execution prevents race conditions.
📋 Say This In Interview
Netflix content security has two layers. Control plane: JWT auth (15-min TTL), entitlement check, concurrency check via atomic Redis Lua. After authorization, the client gets a signed manifest URL (HMAC-SHA256, 6h TTL) and a DRM license URL. Data plane: video segments are AES-128 encrypted. The Content Encryption Key is device-bound via the DRM license — it lives in the device's TEE and can never be extracted. Even if someone captures the CDN URL, they can't decrypt the segments without the device-bound license.
Last reviewed June 2026 · By Prasoon ParasharNumbers are interview assumptions, not real Netflix internal figures.
Was this tab useful for interview prep?