There are two main technical solutions for integrating ChinaDRM client into set-top boxes:
1) Plugin method: The system layer (such as MediaDRM Service) integrates DRM client plugins, and the applications use the system standard interface (such as MediaDRM) to call the DRM Plugin. The MediaPlayer and MediaCodec Based Player both should support DRM.
2) APP method: Integrate DRM client SDK within the application, without relying on system DRM capabilities.

The strategy for deploying DRM Client on set-top boxes is as follows:
1) For live-network set-top boxes (usually without TEE high security enabled), OS software level DRM plugins can be deployed through ROM update(if OTA is achievable). Chip and set-top box manufacturers generate new versions of ROM and distribute it to the set-top box through OTA. Before the ROM upgrade is completed, The APP Method is used, without relying on the system's DRM capabilities.
2) For newly manufactured set-top boxes, use the Plugin Method.TEE high security and DRM plugin both should be deployed by default.

Applications can adopt an adaptive strategy of selecting DRM clients through querying whether the system layer supports DRM plugin by the system standard API(such as MediaDRM) . If it supports, the terminal's built-in capabilities can be used directly, and if not, the APP's built-in client SDK capabilities can be used.

The workflow for IPTV set-top boxe to support ChinaDRM capability is as follows:
1) SOC manufacturer completes chip certification: integrates DRM client according to hardware level security and Plugin Method(MediaPlayer and MediaCodec Based Player both support DRM), and completes DRM Runtime Environment security assessment (ChinaDRM Lab provides assessment services).
2) Set-top box manufacturers complete device certification: compile and deploy DRM clients to the set-top box, burn DRM device certificates (testing), complete set-top box IPTV network access testing (DRM part), complete device(set-top box) security evaluation (ChinaDRM Lab provides evaluation services), and obtain an "evaluation filing number".
3) Multi party completion of business integration testing: Set-top box/video and audio service platform and other parties jointly complete the DRM integration testing.
4) Set-top box manufacturers produce set-top boxes: Set-top box manufacturers purchase DRM device certificates from the DRM Trust Authority(DTA) with the "evaluation filing number", burn the DRM device certificates on the set-top box production line, and supply them to the set-top box purchaser.

Please refer to standards, extensions are an object, where drmServerInfos is an array object.
"extensions":{
"drmServerInfos":[…],
"authenticationData":"base64 string"
}

OCSP response field is optional for license response message. The DRM client should not force the license response message to include the OCSP response field. If the OCSP response field is included in the license response message, the DRM client should check the signature of the OCSP response and judge whether the server certificate status is valid. If the OCSP response signature check fails or the server certificate status is invalid, the license response should be considered illegal.