With custom integration, some CA systems can be migrated to handle encryption processing within AWS. In many cases, you may simply choose to use the CA system already located in your uplink location, encrypting video streams just before they are distributed via satellite or other distribution network. In addition, if you are distributing your content with entitlements in AWS Elemental MediaConnect, you can use SPEKE (Secure Packager and Encoder Key Exchange) for key exchange. SPEKE is an open API specification that streamlines the way supported CAS systems integrate with MediaConnect. You can encrypt the Statmux for MediaLive video that is shared using entitlements and control the permissions of content sent to your distribution partners. This enables you to build complex workflows with more granular and sophisticated conditional rights management, including time-based access, black-outs, and many other rules-based requirements.