Google's Widevine DRM Architecture Overview defines three security levels. However, the Azure Media Services documentation on the Widevine license template outlines
five security levels (client robustness requirements for playback).
Google Widevine defines both sets of security levels. The difference is in usage level: architecture or API. The five security levels are used in the Widevine API. The Azure Media Services Widevine license service deserializes the content_key_specs object, which
contains security_level, and passes it to the Widevine global delivery service. The following table shows the mapping between the two sets of security levels.
Security levels defined in the Widevine architectureSecurity levels used in the Widevine API Security Level 1: All content processing, cryptography, and control are performed within the Trusted Execution Environment (TEE). In some implementation models, security processing might be performed in different chips.security_level=5: The cryptography, decoding, and all handling of the media (compressed and uncompressed) must be handled within a hardware-backed TEE. security_level=4: The cryptography and decoding of content must be performed within a hardware-backed TEE. Security Level 2: Cryptography (but not video processing) is performed within the TEE. Decrypted buffers are returned to the application domain and processed through separate video hardware or software. At Level 2, however, cryptographic information is still processed only within the TEE.security_level=3: The key material and cryptographic operations must be performed within a hardware-backed TEE. Security Level 3: There's no TEE on the device. Appropriate measures can be taken to protect the cryptographic information and decrypted content on the host operating system. A Level 3 implementation might also include a hardware cryptographic engine, but that enhances only performance, not security.security_level=2: Software cryptography and an obfuscated decoder are required. security_level=1: Software-based white-box cryptography is required.