System and method for improving the efficiency of protecting multiple content processing

Abstract

The present invention provides a system and method for improving the efficiency of protecting multiple content processing, wherein the system includes one or more hardware IPs (intellectual property); a first IP among the one or more IPs is associated with multiple access identities; the storage device includes multiple different areas, each of which registers the access of one of the multiple access identities as allowed access; the method includes: selecting one of the multiple access identities for processing a first content, and the first IP uses the selected access identity to access the storage device during the processing of the first content; and selecting another access identity among the multiple access identities for processing a second content, and the first IP uses the selected another access identity to access the storage device during the processing of the second content. The implementation of the embodiments of the present invention can improve the efficiency of protecting multiple content processing.

Description

Technical Field

[0001] The present invention relates to the technical field of content protection, and more particularly to a method and system for improving the efficiency of protecting a multi-content process. Background Art

[0002] Various user devices, including (but not limited to) mobile phones, smart phones, laptop computers, tablet computers, telematic devices, game consoles, set-top boxes, wearable devices, smart speakers and televisions have become indispensable in modern daily life and are often used to process normal content and secure content. Secure content may include (but not limited to) authorized, copyrighted, paid, digital rights management (DRM) protected software, articles, documents, photos, images, media streams, audio and video; may also include keys and certificates for encryption and / or decryption, digital signatures, digital certificates and digital authentication; and may further include personal information, private information, confidential information, sensitive information and / or critical information, such as personally identifiable information (PII), digitized biometrics and trade secrets. Normal content may be non-secure content, not secure content.

[0003] UE (User Equipment) includes a storage device and one or more hardware intellectual property (Intellectual Property, IP). A subset of the IP (one or some IPs) may be a processor IP for implementing a secure CPU (central processing unit) and a non-secure CPU, and the remaining IPs may be peripheral IPs for performing specific hardware operations, such as data encryption and / or decryption, media encoding and / or decoding, video / audio demultiplexing and / or multiplexing, etc. The storage device may have multiple ranges, including secure areas and non-secure areas. By accessing the non-secure area of ​​the storage device, the non-secure CPU runs an untrusted OS (operating system) to form an untrusted execution environment that allows the execution of untrusted programs (applications). By accessing the secure area of ​​the storage device (and the non-secure area if necessary), the secure CPU runs a trusted OS to form a trusted execution environment, thereby allowing the execution of trusted programs (applications). Typically, the UE works in an untrusted execution environment, and utilizes a trusted execution environment when secure content is involved. One, some or all of the hardware IPs may be used in conjunction with a secure CPU and one or more storage device areas to form a secure content path for processing secure content, for example, forming a secure media path (SMP) for processing secure media content (e.g., decrypting and decoding protected video media content to obtain clear frames and / or audio tracks). On the other hand, one, some or all of the hardware IPs may be used in conjunction with a non-secure CPU and one or more areas of a storage device to form a non-secure content path to process non-secure content (e.g., DRM-free media content). In order to meet multi-tasking requirements, modern UEs need to meet coexistence requests for processing multiple contents, for example, requests to display multiple media contents in multiple coexistence windows, respectively. In response to such requests, the UE forms multiple content paths and switches between multiple content paths to process multiple contents. When the UE organizes multiple content paths to implement multi-content processing for processing multiple contents, since one, some or all of the multiple contents may be secure content, the UE must also protect the multiple content processing; for example, the UE needs to maintain storage device isolation between content paths for processing different contents so that the first content processed by the first content path is not exposed to the second content path for processing the second content, and the second content is not exposed to the first content path. Since the multiple content paths include a secure content path involving a secure CPU and a non-secure path involving a non-secure CPU, the UE must frequently switch between the non-secure CPU and the secure CPU to meet the coexistence requests for processing multiple contents. However, the traditional way of organizing secure content paths and non-secure content paths will result in communication overhead between the non-secure CPU and the secure CPU. Summary of the invention

[0004] The present invention relates to a method and system for improving the efficiency of protecting a multi-content process, and more specifically, to a method and system for improving the efficiency by enabling each content processing hardware intellectual property (Intellectual Property, IP) to have multiple access identities that respectively allow access to different storage device ranges, and when processing different contents among multiple contents, using different access identities to respectively access the storage devices.

[0005] The object of the present invention is to provide a system (for example, Figure 1a 200) method (for example, Figure 1b or 300 in 1c) to improve the efficiency of protecting multiple content processing. The system can be connected to a storage device (e.g., Figure 1a 220) and may include one or more hardware IPs for content processing (e.g., Figure 1a ip[1] to ip[N] in ). One of the one or more IPs (for ease of description, referred to as the "first IP") (for example, Figure 1a ip[n] in Figure 1c Any one of ip[1] to ip[3], Figure 2a In ip[a1] or ip[n5], Figure 2b ip[n5'] in Figure 3 ip[n6] or Figure 4 ip[n7]) can be associated with multiple access identities (for example, Figure 1a aid[n]_1 to aid[n]_K in, Figure 1c A storage device may include multiple different areas (for example, Figure 1c sr1 to sr4), each of the regions may be configured to register access by one of the plurality of access identities as permitted access (e.g., Figure 1c 301 in which region sr1 may register the writing of access identity aid[1]_1 as allowed, and region sr3 may register the writing of access identity aid[1]_2 as allowed). The method may include: selecting one of the plurality of access identities for processing the first content (e.g., Figure 1b or 303 in 1c), and when the first IP uses the selected access identity to access the storage device when processing the first content (for example, Figure 1bor 305 in 1c); selecting another of the multiple access identities to handle the second content (e.g., Figure 1b or 307 in 1c), and when the first IP is processing the second content, it uses another selected access identity to access the storage device (for example, Figure 1b or 309 in 1c).

[0006] In one embodiment, the method may further include: between processing the first content and the second content (eg, Figure 1b or 305 and 309 in 1c), without reconfiguring the allowed access registered for each of the said areas.

[0007] In one embodiment, the method may further include: when one of the plurality of access identities is selected, a non-secure CPU (e.g., Figure 1a 240) in to determine which access identity to select.

[0008] In one embodiment (e.g., Figure 1b or 1c), each of the regions may be controlled by a security CPU (e.g., Figure 1a 230) is configured to register access of one of the multiple access identities as allowed access (e.g., Figure 1b or 301 in 1c).

[0009] In one embodiment (e.g., Figure 2a ), the one or more IPs may further include a device coupled to the first IP (eg, Figure 2a ip[n5]) of the previous IP (e.g. Figure 2a ip[a1] in). The previous IP can be associated with multiple previous IP access identities (e.g., aid[a1]_1 to aid[a1]_K), and one of the multiple previous IP access identities can be selected. Each of the multiple access identities (e.g., aid[n5]_k) can be bound to one of the multiple previous IP access identities (e.g., aid[a1]_q). The method may further include: when selecting one of the multiple access identities, selecting an access identity bound to the selected previous IP access identity. In one embodiment, the access identity bound to the selected previous IP access identity can be selected without the intervention of the secure CPU and regardless of whether and how the non-secure CPU indicates.

[0010] In one embodiment (e.g., Figure 2b ), one or more IPs may further include a device coupled to the first IP (eg, Figure 2b ip[n5']) of the succeeding IP (for example, Figure 2b ip[b1] in ), and the method may further include: when one of the multiple access identities (for example, aid[n5']_k) is selected, the selected access identity is propagated to the subsequent IP, and when the subsequent IP accesses the storage device, the selected access identity is used.

[0011] In one embodiment (e.g., Figure 3 ), the one or more IPs may further include a device coupled to the first IP (eg, Figure 3 ip[n6]) of multiple previous IPs ( Figure 3 ip[c1] to ip[c2] in the first IP). Each access identity (e.g., aid[n6]_k) of the first IP can be associated with one of multiple security levels (e.g., L[1] to L[M]). Each of the previous IPs can be associated with multiple corresponding access identities, and one of the multiple corresponding access identities can be selected; each of the corresponding access identities can be associated with one of the multiple security levels. The method may further include: when selecting one of a plurality of access identities (e.g., aid[n6]_1 to aid[n6]_K), when the previous IPs (e.g., ip[c1] to ip[c2]) select corresponding access identities (e.g., aid[c1]_k1 to aid[c2]_k2) respectively associated with security levels (e.g., L[m1] to L[m2]), selecting the access identity (e.g., aid[n6_k3]) according to the security levels (e.g., L[m1] to L[m2]) associated with the corresponding access identities (e.g., aid[c1]_k1 to aid[c2]_k2) selected by the plurality of previous IPs. In one embodiment, the method may further include: when selecting one of a plurality of access identities, applying a predefined rule to the security levels (e.g., L[m1] to L[m2]) associated with the corresponding access identities selected by the plurality of previous IPs to evaluate a resultant security level, and selecting an access identity associated with the resultant security level.

[0012] In one embodiment (e.g., Figure 4 ), each of the access identities may be associated with one of a plurality of security levels, the first content may be associated with one of a plurality of security levels, and the method may further include: when selecting one of the plurality of access identities for processing the first content, selecting the access identity according to the security level associated with the first content. In one embodiment, the method may further include: when selecting one of the plurality of access identities for processing the first content, selecting an access identity having a security level that is the same as the security level associated with the first content.

[0013] The object of the present invention is to provide a system with improved efficiency in protecting multiple content processing (eg, Figure 1a 200 in ). The system may include one or more hardware IPs for content processing (e.g., Figure 1a ip[1] to ip[N] in ). A subset of one or more hardware IPs may implement a secure CPU (e.g., 230) and a non-secure CPU (e.g., 240). The system may include multiple different areas (e.g., Figure 1c One of the one or more IPs (for ease of description, referred to as the "first IP") (for example, Figure 1a ip[n] in Figure 1c Any one of ip[1] to ip[3], Figure 2a In ip[a1] or ip[n5], Figure 2b ip[n5'] in Figure 3 ip[n6] or Figure 4 ip[n7]) can be associated with multiple access identities (for example, Figure 1a The security CPU may be arranged to: in response to a coexistence request for processing the first content and the second content, configure a plurality of areas of the storage device so that each of the plurality of areas may register access of one of a plurality of access identities as permitted access. The first IP may be configured to: select one of a plurality of access identities for processing the first content, and access the storage device using the selected access identity during processing the first content; and select another access identity from the plurality of access identities for processing the second content, and access the storage device using the selected another access identity during processing the second content.

[0014] In one embodiment, the security CPU may be further arranged not to reconfigure the registered allowed access of each of said regions between processing of the first content and the second content.

[0015] In one embodiment (e.g., Figure 1c ), the non-secure CPU may be arranged as follows: Figure 1c ip[2] in (in) selects one of multiple access identities, indicating which of the multiple access identities the IP should select.

[0016] In one embodiment (e.g., Figure 2a ), one or more IPs may further include a device coupled to the first IP (eg, Figure 2a ip[n5]) of the previous IP (for example, Figure 2aip[a1] in ). The previous IP can be associated with multiple previous IP access identities (e.g., aid[a1]_1 to aid[a1]_K) and can be arranged to select one of the multiple previous IP access identities. Each of the multiple access identities (e.g., aid[n5]_k) is bound to one of the multiple previous IP access identities (e.g., aid[a1]_q). The first IP (e.g., ip[n5]) can be further arranged to: when one of the multiple access identities is selected, select the access identity bound to the selected previous IP access identity. In one embodiment, the first IP can also be arranged to: when one of the multiple access identities is selected, determine which access identity to select without intervention by the secure CPU and regardless of whether and how the non-secure CPU indicates.

[0017] In one embodiment (e.g., Figure 2b ), the system may further include an internal link (500b), and the one or more IPs may further include a subsequent IP (e.g., ip[b1]) coupled to the first IP (e.g., ip[n5']) through the internal link. The internal link may be arranged to: when the IP selects one of the multiple access identities, propagate the selected access identity to the subsequent IP. When the subsequent IP accesses the storage device, the subsequent IP may be arranged to use the selected access identity.

[0018] In one embodiment (e.g., Figure 3 ), the one or more IPs may further include a device coupled to the first IP (eg, Figure 3 ip[n6] in ) (for example, Figure 3ip[c1] to ip[c2] in ). Each of the multiple access identities can be associated with one of multiple security levels (e.g., L[1] to L[M]). Each of the previous IPs can be associated with multiple corresponding access identities, and can be arranged to select one of the multiple corresponding access identities; each of the multiple corresponding access identities can be associated with one of the multiple security levels. The first IP can also be arranged to: when selecting one of the multiple access identities, select the access identity according to the security level (e.g., L[m1] to L[m2]) associated with the selected corresponding access identities of the multiple previous IPs (e.g., aid[c1]_k1 to aid[c2]_k2). In one embodiment, the first IP can also be arranged to: when selecting one of the multiple access identities, apply the predefined rules to the security levels (e.g., L[m1] to L[m2]) associated with the selected corresponding access identities of the multiple previous IPs to evaluate the final security level, and select the access identity associated with the final security level. In one embodiment, the first IP may also be arranged to: when selecting one of the plurality of access identities, determine which access identity to select without intervention by the secure CPU and regardless of whether and how the non-secure CPU indicates.

[0019] In one embodiment (e.g., Figure 4 ), each of the plurality of access identities may be associated with one of a plurality of security levels, the first content may be associated with one of a plurality of security levels, and the first IP (eg, Figure 4 ip[n7]) in may also be arranged to: when selecting one of a plurality of access identities for processing the first content, select an access identity associated with a security level that is the same as the security level associated with the first content. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1a A system is described according to an embodiment of the present invention;

[0021] Figure 1b According to an embodiment of the present invention, a flow chart is described, and the flow chart can be applied to Figure 1a The system in is used to protect multiple content processing;

[0022] Figure 1c Depicted Figure 1b An example of a flowchart shown in ; and

[0023] Figure 2a , 2b, 3 and 4 depict multiple IPs according to an embodiment of the present invention. DETAILED DESCRIPTION

[0024] Certain words are used in the specification and claims to refer to specific components. It should be understood by those skilled in the art that hardware manufacturers may use different terms to refer to the same component. The specification and claims do not use differences in names as a way to distinguish components, but use differences in the functions of components as the criteria for distinction. "Including" and "including" mentioned throughout the specification and claims are open-ended terms, so they should be interpreted as "including but not limited to". "Substantially" means that within an acceptable error range, those skilled in the art can solve the technical problem within a certain error range and basically achieve the technical effect. In addition, the term "coupled" includes any direct and indirect electrical connection means. Therefore, if the text describes a first device coupled to a second device, it means that the first device can be directly electrically connected to the second device, or indirectly electrically connected to the second device through other devices or connection means. The following is a preferred way to implement the present invention, the purpose of which is to illustrate the spirit of the present invention rather than to limit the scope of protection of the present invention. The scope of protection of the present invention shall be subject to the definition of the claims.

[0025] The following description is the best embodiment of the present invention. These descriptions are used to illustrate the general principles of the present invention and should not be used to limit the present invention. The scope of protection of the present invention should be determined based on the claims of the present invention.

[0026] Figure 1a A hardware system 200 is depicted according to an embodiment of the present invention. The system 200 may be arranged in a UE 202, and may include an interconnect 204, an access checker 210, and N (one or more) hardware IPs ip[1] to ip[N] for content processing. The interconnect 204 may be one or more buses, the IPs ip[1] to ip[N] may be coupled to the interconnect 204, and the access checker 210 may be coupled between the interconnect 204 and a storage device 220. A subset of the IPs ip[1] to ip[N] (e.g., ip[n1] or more) may be processor IPs to implement a secure CPU 230 and a non-secure CPU 240, and the remaining IPs in the IPs ip[1] to ip[N] may be peripheral IPs for specific hardware operations, including, for example, data encryption and / or decryption, media encoding and / or decoding, video / audio demultiplexing and / or multiplexing, signal processing, graphics (image and / or video) processing, deep learning model training and / or execution, etc.

[0027] In one embodiment, one or more processor IPs may provide two different hardware circuits to respectively implement the secure CPU 230 and the non-secure CPU 240; in a different embodiment, one or more processor IPs may provide a common hardware circuit that switches between a secure state and a non-secure state to operate as a secure CPU 230 and a non-secure CPU 240.

[0028] In one embodiment, the system 200 may be integrated in a semiconductor chip (e.g., Silicon OnChip (SoC)), and the memory device 220 may be an external DRAM (dynamic random access memory device) formed by one or more memory device chips. The memory device 220 may have one or more regions ( Figure 1a 20), including one or more secure areas and one or more non-secure areas. By accessing the non-secure area of ​​the storage device 220, the non-secure CPU 240 can run an untrusted OS (not shown) to form an untrusted execution environment that allows the execution of untrusted programs (applications, not shown). By accessing the secure area (and non-secure area, if necessary) of the storage device 220, the secure CPU 230 can run a trusted OS (not shown) to form a trusted execution environment that allows the execution of trusted programs (applications, not shown). Generally, the system 200 can operate in an untrusted execution environment, and a trusted execution environment can be utilized when secure content is involved. One, some or all of the IPs ip[1] to ip[N] can cooperate with one or more areas of the storage device 220 to form a content path for processing content. For example, an SMP is formed to process secure media content (e.g., decrypting and decoding protected video content to obtain clear frames and / or audio tracks).

[0029] According to the present invention, each IP ip[n] (n=1 to N) can be associated with K (greater than one) access identities aid[n]_1 to aid[n]_K. Each IP ip[n] can select one of the access identities aid[n]_1 to aid[n]_K, and use the selected access identity and the address of the storage device 220 through the access checker 210, and the access checker 210 can determine whether to allow access based on whether the address is within the area where the access of the selected access identity is registered as allowed access. For example, IP ip[n] may choose to use access identity aid[n]_k1 (k1 is one of 1 to K) to read the address of storage device 220; in response, access checker 210 may allow the read if the address is located in an area where the read of access identity aid[n]_k1 has been registered as allowed access, and deny the read if the address is located in an area where the read of access identity aid[n]_k1 has been registered as not allowed access (or the address is located in an area where the read of access identity aid[n]_k1 has not been registered as allowed access). For security and content protection, the permissions of the security area (registered allowed access and disallowed access) can only be configured by the security CPU 230. By accessing storage device 220, each IP ip[n] can obtain (obtain or extract, etc.) data to be processed, buffer data being processed and / or store processed data.

[0030] Combination Figure 1a , Figure 1b Flowchart 300 is depicted according to an embodiment of the present invention. When there are multiple coexistence requests for processing multiple contents (eg, when UE 202 is requested to display multiple media streams in multiple coexistence windows simultaneously), system 200 ( Figure 1a ) The flowchart 300 may be used to protect multiple content processing. For simplicity and convenience of explanation, it is assumed that there are two coexistence requests for processing two contents (a first content and a second content).

[0031] like Figure 1b As shown, in step 301, in response to a request to process the coexistence of the first content and the second content, the security CPU 230 may configure a plurality of different regions of the storage device 220 so that each of the plurality of regions may register access (read and / or write) of the access identity aid[n]_k as permitted access. For example, the first region of the plurality of regions may register access of the access identity aid[n]_1 as permitted, the second region of the plurality of regions may register access of the access identity aid[n]_2 as permitted, and so on.

[0032] In step 303, in order to process the first content, each IP ip[n] may select an access identity aid[n]_k1 (k1 is one of 1 to K).

[0033] At step 305, IPs ip[1] to ip[N] may process the (i)th portion of the first content, wherein during the processing, each IP ip[n] may access the storage device 220 using the selected access identity aid[n]_k1. After processing the (i)th portion of the first content, the flowchart 300 may proceed to step 307.

[0034] In step 307, in order to process the second content, each IP ip[n] may select another access identity aid[n]_k2 (k2 is one of 1 to K, and k2 is not equal to k1).

[0035] At step 309, IPs ip[1] to ip[N] may process the (j)th portion of the second content, wherein during the processing, each IP ip[n] may use the selected access identity aid[n]_k2 to access the storage device 220. After processing the (j)th portion of the second content, the flowchart 300 may iterate back to step 303 to start another cycle of steps 303, 305, 307, and 309 to process other portions of the first content and the second content.

[0036] Combination Figure 1a and 1b , Figure 1c An example of applying the flowchart 300 to three IPs ip[1] to ip[3] is depicted, where each IP ip[n] (n=1 to 3) can be associated with two access identities aid[n]_1 and aid[n]_2. Figure 1c As shown, in step 301, the security CPU 230 ( Figure 1a) can configure regions sr1 to s4 of storage device 220 so that: region sr1 can register the writing of access identity aid[1]_1 and the reading of access identity aid[2]_1 as allowed, and can register any access (read or write) of other access identities (aid[1]_2, aid[2]_2, aid[3]_1, and aid[3]_2) as not allowed; region sr2 can register the reading and writing of access identity aid[3]_1 as allowed, and can register any access (read or write) of other access identities (aid[1]_1, aid[1]_2, aid[2]_1, aid[2]_2, and aid[3]_2) as not allowed. region sr3 may register the writing of access identity aid[1]_2 and the reading of access identity aid[2]_2 as allowed, and may register any access (reading or writing) of other access identities (aid[1]_1, aid[2]_1, aid[3]_1, and aid[3]_2) as not allowed; and region sr4 may register the reading and writing of access identity aid[3]_2 as allowed, and may register any access (reading or writing) of other access identities (aid[1]_1, aid[1]_2, aid[2]_1, aid[2]_2, and aid[3]_1) as not allowed. Note that although the two access identities aid[n]_1 and aid[n]_2 are associated with the same IP ip[n], the configuration of the security CPU 230 may configure them to be allowed in two different regions instead of in the same region. There may be no region that allows different access identities aid[n]_1 to aid[n]_K for the same IP ip[n]. For example, if Figure 1c As shown, although access identities aid[1]_1 and aid[1]_2 are associated with the same IP ip[1], they can be allowed in two different zones sr1 and sr3 respectively. In general, for two different access identities aid[n]_k1 and aid[n]_k2 of the same IP ip[n], in the zone where access identity aid[n]_k1 is allowed, access identity aid[n]_k2 may not be allowed, and in the zone where access identity aid[n]_k2 is allowed, access identity aid[n]_k1 may not be allowed.

[0037] In step 303, in order to process the (i)th part of the first content, IPs ip[1], ip[2] and ip[3] may select access identities aid[1]_1, aid[2]_1 and aid[3]_1, respectively.

[0038] In step 305, IPs ip[1], ip[2], and ip[3] may process the (i)th part of the first content. During the processing, IPs ip[1], ip[2], and ip[3] may access the storage device 220 using the selected access identities aid[1]_1, aid[2]_1, and aid[3]_1, respectively. Since the writing of access identity aid[1]_1 and the reading of access identity aid[2]_1 are allowed within the sr1 region, the writing and reading of access identity aid[3]_1 are allowed within the sr2 region, that is, IPs ip1[1] to ip[3] may cooperate with regions sr1 and sr2 to form a first content path (e.g., SMP) for processing the first content. For example, IPip[1] can obtain data from part (i) of the first content (e.g., extract encrypted and encoded video frames and / or audio tracks), and write the obtained data to area sr1 using access identity aid[1]_1; IP ip[2] can read data from area sr1 using access identity aid[2]_1, and perform operations on the read data (e.g., decrypt and decode the encrypted and encoded video frames and / or audio tracks to obtain clear video frames and / or audio tracks), and then output the final data to IPip[3]. When IP ip[3] performs further operations on the data from IP ip[2] (e.g., performing image enhancement, color adjustment and / or audio equalization, etc.), IP ip[3] can use access identity aid[3]_1 to read and write to area sr2.

[0039] In step 307, in order to process the (j)th part of the second content, IPs ip[1], ip[2] and ip[3] may select access identities aid[1]_2, aid[2]_2 and aid[3]_2, respectively.

[0040] In step 309, IPs ip[1], ip[2], and ip[3] may process the (j)th portion of the second content. During the processing, IPs ip[1], ip[2], and ip[3] may access the storage device 220 using access identities aid[1]_2, aid[2]_2, and aid[3]_2, respectively. Since writing of access identity aid[1]_2 and reading of access identity aid[2]_2 are permitted within the sr3 region, and writing and reading of access identity aid[3]_2 are permitted within the sr4 region, IPs ip1[1] to ip[3] may cooperate with regions sr3 and sr4 to form a second content path for processing the second content.

[0041] Since the first content path (step 305) and the second content path (step 309) can utilize different areas of the storage device 220, the flowchart 300 can achieve storage device isolation between the processing of the first content and the second content. According to the present invention, because each IP ip[n] has multiple access identities aid[n]_1 to aid[n]_K, the flowchart 300 may only require the security CPU 230 to configure the area authority once (in step 301) to allow different access identities aid[n]_k1 and aid[n]_k2 of the same IP ip[n] to be allowed in different areas, respectively. Then, the flowchart 300 can achieve storage isolation between the processing of different contents by selecting different access identities aid[n]_k1 and aid[n]_k2 of each IP ip[n] (steps 303 and 307) (steps 305 and 309). Therefore, the flowchart 300 may not require the security CPU 230 to repeatedly reconfigure the area authority between the processing of different contents. In other words, when looping through steps 303, 305, 307 and 309, the area rights configured in step 301 may remain unchanged. Therefore, the flowchart 300 according to the present invention may improve the efficiency of the process of protecting multiple contents.

[0042] The security CPU 230 may not be involved in selecting the access identity in steps 303 and 307. For steps 303 and 307, each IP ip[n] may have its own identity decision mechanism to determine which of the access identities aid[n]_1 to aid[n]_K to select, and the identity decision mechanism may not require intervention by the security CPU 230. Different IPs in IP ip[1] to ip[N] may use different identity decision mechanisms or the same identity decision mechanism.

[0043] In one embodiment, IP ip[n2] (n2 is one of 1 to N, not shown) among IP ip[1] to ip[N] may adopt an identity determination mechanism indicated by a non-secure CPU. Since IP ip[n2] may be associated with access identities aid[n2]_1 to aid[n2]_K, the non-secure CPU 240 may determine which of the access identities aid[n2]_1 to aid[n2]_K should be selected in step 303 / 307 for processing the first / second content in step 305 / 309; for example, the non-secure CPU 240 may determine and instruct IP ip[n2] to select which of the access identities aid[n2]_1 to aid[n2]_K in steps 303 and 307. In one embodiment, IP ip[n2] may be a memory device 220 ( Figure 1a ) to obtain the IP of the data to be processed by IP ip[n2]. For example, Figure 1cThe IP ip[2] in the example may adopt the identity determination mechanism indicated by the non-secure CPU: the non-secure CPU 240 may instruct the IP ip[2] to select the access identity aid[2]_1 to process the first content in step 303, and to select the access identity aid[2]_2 to process the second content in step 307. Similarly, Figure 1c The IP ip[1] in the flowchart 300 may also adopt the identity determination mechanism indicated by the non-secure CPU. Figure 1b Or 1c) when looping between processing of the first content (step 305) and processing of the second content (step 309), the non-secure CPU 240 may repeatedly instruct IP ip[n2] to switch between two different access identities of access identities aid[n2]_1 to aid[n2]_K (steps 303 and 307).

[0044] The non-secure CPU 240 may be hacked and maliciously instruct IP ip[n2] to select an incorrect access identity among the access identities aid[n2]_1 to aid[n2]_K, which can only destroy content processing but not content protection. Figure 1c In the example, after IP ip[1] writes the data of the first content to region sr1 using access identity aid[1]_1 in step 305, the non-secure CPU 240 may attempt to expose region sr1 to the second content path formed in step 309 by maliciously instructing IP ip[2] to select the wrong access identity aid[2]_1 (instead of aid[2]_2) in step 307 (IP ip[1] selects access identity aid[1]_2)), because region sr1 allows reading of access identity aid[2]_1. However, since region sr1 may be a secure region configured by the secure CPU 230 in step 301, the non-secure CPU 240 still cannot access region sr1, and content protection can therefore remain intact, and because IP ip[2] cannot read data from the correct region sr3 through the wrong access identity aid[2]_1, the second content path in step 309 may not function as expected.

[0045] Combination Figure 1a to Figure 1c , Figure 2a According to an embodiment of the present invention, IP ip[1] to ip[N]( Figure 1a ) in two IPs ip[a1] and ip[n5] (where a1 and n5 are two different numbers from 1 to N). IP ip[n5] may be coupled to IP ip[a1] via an internal link (e.g., bus) 500a. Data processed by IP ip[n5] may be generated by IP ip[a1] and may be transmitted through link 500a instead of through storage device 200 ( Figure 1a ) is sent from IP ip[a1] to IP ip[n5]. Under such a link arrangement, IP ip[n5] can adopt a binding identity determination mechanism. Since IP ip[n5] can be associated with access identities aid[n5]_1 to aid[n5]_K, and IP ip[a1] can be associated with access identities aid[a1]_1-aid[a1]_K, there is a preset binding relationship, which binds each of the access identities aid[n5]_k (k=1 to K) to one of the access identities aid[a1]_1 to aid[a1]_K; for example, each of the access identities aid[n5]_k can be bound to the access identity aid[a1]_q (q is one of 1 to K). In step 303 / 307, when IP ip[a1] selects access identity aid[a1]_q (q is one of 1 to K), link 500a can notify IP ip[n5] of the access identity aid[a1]_q selected by IP ip[a1], and then IP ip[n5] can select access identity aid[n5]_k bound to access identity aid[a1]_q of IP ip[a1]. In one embodiment, IP ip[n5], link 500a and IP ip[a1] can cooperate to implement the binding identity decision mechanism, so in step 303 / 307, IP ip[n5] can be determined without the need for security CPU 230( Figure 1a )’s intervention, and selects its access identity regardless of whether and how the non-secure CPU 240 instructs.

[0046] exist Figure 1c In the example shown, IP ip[3] can obtain the data to be processed from IP ip[2] via the internal link, so the link arrangement between IP ip[2] and ip[3] is similar to Figure 2a The link arrangement between IP ip[a1] and ip[n5] is shown. Therefore, similar to Figure 2a IP ip[n5] in Figure 1c The IP ip[3] in the example may adopt a binding identity decision mechanism. For example, the access identities aid[3]_1 and aid[3]_2 of IP ip[3] may be bound to the access identities aid[2]_1 and aid[2]_2 of IP ip[2] respectively; in step 303, IP ip[2] selects the access identity aid[2]_1, so IP ip[3] may select the access identity aid[3]_1 bound to the access identity aid[2]_1. In step 307, IP ip[2] selects the access identity aid[2]_2, so IP ip[3] may select the access identity aid[3]_2 bound to the access identity aid[2]_2.

[0047] Combination Figures 1a to 1c , Figure 2b According to an embodiment of the present invention, IP ip[1] to ip[N]( Figure 1a ) in two IPs ip[n5'] and ip[b1] (where n5' and b1 are two different values ​​from 1 to N). IP ip[b1] may be coupled to IP ip[n5'] via an internal link (e.g., bus) 500b; data to be processed by IP ip[b1] may come from IP ip[n5'], and the data may be transmitted via link 500b instead of storage device 220 ( Figure 1a ) is sent from IP ip[n5'] to IP ip[b1]. Under this link arrangement, IP ip[b1] can adopt a propagation identity decision mechanism: since IP ip[n5'] can be associated with access identities aid[n5']_1 to aid[n5']_K, in step 303 / 307, when IP ip[n5'] selects access identity aid[n5']_k (k is one of 1 to K), link 500b can propagate the selected access identity aid[n5']_k to IP ip[b1], and in step 305 / 309, when IP ip[b1] accesses storage device 220, IP ip[b1] can use the access identity aid[n5']_k of IP ip[n5'] as its own access identity. In one embodiment, the propagation identity determination mechanism can be implemented by IP ip[b1], link 500b and ip[n5'] in cooperation, so that in step 303 / 307, IP ip[b1] can determine the access identity without intervention from the security CPU 230 and regardless of whether and how the non-security CPU 240 instructs.

[0048] exist Figure 1c In the example shown, IP ip[3] can obtain the data to be processed from IP ip[2] via the internal link, so the link arrangement between IP ip[2] and ip[3] is similar to Figure 2b The link arrangement between IP ip[n5'] and ip[b1] is shown. Therefore, similar to Figure 2b IP ip[b1] in Figure 1cThe IP ip[3] in the example may adopt a propagation identity decision mechanism: in step 303, when IP ip[2] selects access identity aid[2]_1, link 500b may propagate access identity aid[2]_1 to IP ip[3], so that IP ip[3] may use access identity aid[2]_1 as access identity aid[3]_1; in step 305, when IP ip[3] accesses storage device 220, it may use access identity aid[2]_1; in step 307, when IP ip[2] selects access identity aid[2]_2, link 500b may propagate the selected access identity aid[2]_2 to IP ip[3], so that IP ip[3] may inherit access identity aid[2]_2 as access identity aid[3]_2; in step 309, when IP ip[3] accesses storage device 220, it may use access identity aid[2]_2. To implement the propagation identity decision mechanism, in step 301( Figure 1c ), the security CPU 230 may configure region sr2 to register the read and write of access identity aid[2]_1 as permitted, and configure region sr4 to register the read and write of access identity aid[2]_2 as permitted.

[0049] Combination Figure 1a and 1b middle, Figure 3 According to an embodiment of the present invention, IP ip[1] to ip[N]( Figure 1a ) in IP ip[n6] (n6 is one of 1 to N). IP ip[n6] can be coupled to one or more other IPs ip[c1] to ip[c2] in ip[1] to ip[N] through one or more internal links. For IP ip[n6], the one or more other IPs ip[c1] to ip[c2] can be regarded as the previous one or more IPs, which can jointly generate data to be processed by IP ip[n6], and can send the generated data to IP ip[n6] through the internal link. Under such a link arrangement, IP ip[n6] can adopt the security priority identity decision mechanism described below. Previously, each IP ip[c] among IP ip[c1] to ip[c2] can be associated with access identities aid[c]_1 to aid[c]_K, and IP ip[n6] can be associated with access identities aid[n6]_1 to aid[n6]_K; in addition, each of the access identities aid[c1]_k to aid[c2]_k and aid[n6]_k (k=1 to K) can be further associated with one of multiple security levels L[1] to L[M].

[0050] In step 303 / 307 ( Figure 1b) If the previous IPs ip[c1] to ip[c2] select access identities aid[c1]_k1 to aid[c2]_k2 respectively associated with security levels L[m1] to L[m2], then the IP ip[n6] can select one of the secure access identities aid[n6]_1 to aid[n6]_K according to the security levels L[m1] to L[m2] associated with the selected access identities aid[c1]_k1 to aid[c2]_k2 of the previous IPs ip[c1] to ip[c2]. For example, the IP ip[n6] can apply a predefined rule to the security levels L[m1] to L[m2] associated with the selected access identities aid[c1]_k1 to aid[c2]_k2 to evaluate a final security level L[m3] (not shown), and then select the access identity aid[n6]_k3 associated with the final security level L[m3]. For example, the IP ip[n6] can apply a maximum lookup rule to the security levels L[m1] to L[m2] to identify the highest security level L[m3] among the security levels L[m1] to L[m2] (i.e., L[m3]=max(L[m1],…,L[m2])), and then select the access identity aid[n6]_k3 associated with the identified highest security level L[m3].

[0051] As an example, in one embodiment, a video module IP ip[c1] that can be used to process protected video content can select an access identity aid[c1]_2 associated with a high security level L[2] to access the storage device 220 to process secure media content to obtain a clear frame to be displayed in a window; an IP ip[c2] that can be a window manager can select an access identity aid[c2]_1 associated with a low security level L[1] (L[1]<L[2]) to access the storage device 220 to generate a normal image of a drop-down menu; then, an IP ip[n6] that can be an image mixer can select a secure access identity aid[n6]_2 associated with the highest security level L[2] to access the storage device 220 to overlay the drop-down menu on the clear frame, so that the clear frame of the secure content can still be protected.

[0052] In one embodiment, the security priority identity decision mechanism can be implemented by the IP ip[n6] in combination with the previous IPs and related links, so that in steps 303 / 307, the IP ip[n6] can select its own access identity without the intervention of the secure CPU 230 and regardless of whether and how the non-secure CPU 240 indicates.

[0053] Combined Figure 1a and 1b , Figure 4According to an embodiment of the present invention, IP ip[n7] is shown. IP ip[n7] can adopt a content-related identity decision mechanism. IP ip[n7] can be associated with multiple access identities aid[n7]_1 to aid[n7]_K, and each access identity aid[n7]_k (k=1 to K) can be associated with one of multiple security levels; for example, access identity aid[n7]_1 can be associated with security level 1, and access identity aid[n7]_2 can be associated with security level 0. Each content processed by IP ip[n7] can be associated with one of multiple security levels. In step 303, if the first content is associated with the first security level in the security level, IP ip[n7] can select an access identity that is also associated with the first security level in the security level. Similarly, in step 307, if the second content is associated with the second security level in the security level, IP ip[n7] can select an access identity that is also associated with the second security level in the security level. In other words, when selecting one of the plurality of access identities aid[n7]_1 to aid[n7]_K to process content, IP ip[n7] can select an access identity having the same security level as that of the content.

[0054] In one embodiment, the content (e.g., the first content and / or the second content) processed by IP ip[n7] may be provided by a content receiver 700 coupled to IP ip[n7]. For example, in one embodiment, the content receiver 700 may be a High-Definition Multimedia Interface (HDMI) receiver. The content receiver 700 may analyze whether the content is protected by digital content protection (e.g., DRM or HDCP (High-bandwidth Digital Content Protection)); if the content is protected by digital content protection, the content may have a higher security level; if the content is not protected by digital content protection, the content may have a lower security level. The content receiver 700 may notify IP ip[n7] of the security level associated with the content. Figure 4 As shown, IP ip[n7] can implement a content-related identity decision mechanism through a simple logic circuit (e.g., selecting multiplexer 702), so in step 303 / 307 IP ip[n7] can select its own access identity without intervention from the secure CPU 230 and regardless of whether and how the non-secure CPU 240 instructs.

[0055] In summary, according to the present invention, each IP used for content processing can have different access identities that are allowed in different areas of the storage device, and select and use different access identities to access the storage device when cycling between the processing of multiple contents. According to the present invention, each IP can use its own identity determination mechanism to determine which access identity to use, and the identity determination mechanism may not involve the security CPU, so when cycling between the processing of multiple contents, the IP of the present invention can quickly and frequently switch between different access identities, so the efficiency of protecting multi-content processing can be effectively improved.

[0056] Although the present invention is disclosed as above with preferred embodiments, it is not intended to limit the scope of the present invention. Any person skilled in the art may make some changes and modifications without departing from the spirit and scope of the present invention. Therefore, the protection scope of the present invention shall be determined by the definition of the claims.

Claims

1. A method for improving the efficiency of protecting multiple content processing in a system, the system cooperating with a storage device and comprising one or more hardware intellectual property rights for content processing, a subset of the one or more hardware intellectual property rights being used to implement a secure CPU and a non-secure CPU; characterized in that, A first intellectual property of the one or more hardware intellectual properties is associated with a plurality of access identities; the storage device comprises a plurality of different regions, each of the regions being configured to register access by one of the plurality of access identities as permitted access; the method comprising: The first intellectual property selects one of the plurality of access identities for processing the first content, and during the processing of the first content, the first intellectual property accesses the storage device using the selected access identity; and The first intellectual property selects another access identity from the plurality of access identities for processing the second content, and during the processing of the second content, the first intellectual property accesses the storage device using the selected another access identity; wherein the security CPU configures each of the areas to register access of one of the multiple access identities as allowed access, and between the first intellectual property processing the first content and the second content, the security CPU does not reconfigure the registered allowed access of each of the areas.

2. The method for improving the efficiency of protecting multiple content processing according to claim 1, characterized in that: Also includes: When selecting one of the plurality of access identities, the non-secure CPU determines which access identity to select.

3. The method for improving the efficiency of protecting multiple content processing according to claim 1, characterized in that: The one or more hardware intellectual property rights also include a previous intellectual property right coupled to the first intellectual property right; The previous intellectual property is associated with a plurality of previous intellectual property access identities for selecting one of the plurality of previous intellectual property access identities; Each access identity of the plurality of access identities is bound to one of the plurality of prior intellectual property access identities; and The method further comprises: When one of the plurality of access identities is selected, an access identity is selected that is bound to the selected previous intellectual property access identity.

4. The method for improving the efficiency of protecting multiple content processing according to claim 3, characterized in that: The selection of an access identity bound to a selected prior intellectual property access identity is performed without intervention by the secure CPU and regardless of whether and how the non-secure CPU directs.

5. The method for improving the efficiency of protecting multiple content processing according to claim 1, characterized in that: The one or more hardware intellectual property rights also include a subsequent intellectual property right coupled to the first intellectual property right; the method further includes: When one of the plurality of access identities is selected, the selected access identity is propagated to the subsequent intellectual property, and the subsequent intellectual property accesses the storage device using the selected access identity.

6. The method for improving the efficiency of protecting multiple content processing according to claim 1, characterized in that: The one or more hardware intellectual property rights also include a plurality of previous intellectual property rights coupled to the first intellectual property right; Each access identity of the plurality of access identities is associated with one of a plurality of security levels; Each of said prior intellectual property rights is associated with a plurality of corresponding access identities and is configured to select one of said plurality of corresponding access identities; each of said corresponding access identities is associated with one of said plurality of security levels; and The method further comprises: When selecting one of the plurality of access identities, an access identity is selected based on a security level associated with the selected corresponding access identity of the plurality of previous intellectual property.

7. The method for improving the efficiency of protecting multiple content processing according to claim 1, characterized in that: The one or more hardware intellectual property rights also include a plurality of prior intellectual property rights coupled to the intellectual property rights; Each access identity of the plurality of access identities is associated with one of a plurality of security levels; Each of said prior intellectual property rights is associated with a plurality of corresponding access identities and is configured to select one of said plurality of corresponding access identities; each of said corresponding access identities is associated with one of said plurality of security levels; and The method further comprises: When one of the plurality of access identities is selected, applying predefined rules to the security levels associated with the selected corresponding access identities of the plurality of previous intellectual property rights to evaluate a resulting security level, and An access identity is selected that is associated with the final security level.

8. The method for improving the efficiency of protecting multiple content processing according to claim 1, characterized in that: Each access identity of the plurality of access identities is associated with one of a plurality of security levels; The first content is associated with one of the plurality of security levels; and The method further comprises: When selecting one of the plurality of access identities for processing the first content, the access identity is selected based on the security level associated with the first content.

9. A system for improving the efficiency of protecting multiple content processing, characterized in that: include: One or more hardware intellectual property rights for content processing, a subset of the one or more hardware intellectual property rights is used to implement a secure CPU and a non-secure CPU; wherein: The system cooperates with a storage device including a plurality of different areas; A first intellectual property of the one or more hardware intellectual properties is associated with a plurality of access identities; The security CPU configures each of the regions to register access by one of the plurality of access identities as permitted access; and The first IP is arranged as: selecting one of the plurality of access identities for use in processing a first content, and accessing the storage device using the selected access identity during processing of the first content; and selecting another access identity of the plurality of access identities for processing second content, and accessing the storage device using the selected another access identity during processing of the second content; The security CPU is further arranged to not reconfigure the registered allowed access of each of the areas between the first intellectual property processing the first content and the second content.

10. The system for improving the efficiency of processing multiple contents according to claim 9, wherein: The non-secure CPU is arranged to, when the first intellectual property selects one of the plurality of access identities, instruct the first intellectual property which one of the plurality of access identities to select.

11. The system for improving the efficiency of processing multiple contents according to claim 9, characterized in that: The one or more hardware intellectual property rights also include a previous intellectual property right coupled to the first intellectual property right; The previous intellectual property is associated with a plurality of previous intellectual property access identities for selecting one of the plurality of previous intellectual property access identities; Each access identity of the plurality of access identities is bound to one of the plurality of prior intellectual property access identities; and The first intellectual property is further arranged to, when selecting one of the plurality of access identities, select an access identity that is bound to a selected previous intellectual property access identity.

12. The system for improving the efficiency of processing multiple contents according to claim 11, characterized in that: The first IP is also arranged as: When selecting one of the plurality of access identities, which access identity is selected is determined without intervention of the secure CPU and regardless of whether and how the non-secure CPU indicates.

13. The system for improving the efficiency of protecting multiple content processing according to claim 9, further comprising an internal link, characterized in that: The one or more hardware intellectual property rights also include a subsequent intellectual property right coupled to the first intellectual property right; The internal link is arranged to: when the first intellectual property selects one of the plurality of access identities, propagate the selected access identity to the subsequent intellectual property; and The subsequent intellectual property is arranged to access the storage device using the selected access identity.

14. The system for improving the efficiency of processing multiple contents according to claim 9, characterized in that: The one or more hardware intellectual property rights also include a plurality of prior intellectual property rights coupled to the intellectual property rights; Each access identity of the plurality of access identities is associated with one of a plurality of security levels; Each of said prior intellectual property rights is associated with a plurality of corresponding access identities and is configured to select one of said plurality of corresponding access identities; each of said corresponding access identities is associated with one of said plurality of security levels; and The first IP is also arranged as: When selecting one of the plurality of access identities, an access identity is selected based on a security level associated with the selected corresponding access identity of the plurality of previous intellectual property.

15. The system for improving the efficiency of processing multiple contents according to claim 14, characterized in that: The first IP is also arranged as: When selecting one of the plurality of access identities, which access identity is selected is determined without intervention of the secure CPU and regardless of whether and how the non-secure CPU indicates.

16. The system for improving the efficiency of processing multiple contents according to claim 9, characterized in that: The one or more hardware intellectual property rights also include a plurality of previous intellectual property rights coupled to the first intellectual property right; Each access identity of the plurality of access identities is associated with one of a plurality of security levels; Each of said prior intellectual property rights is associated with a plurality of corresponding access identities and is configured to select one of said plurality of corresponding access identities; each of said corresponding access identities is associated with one of said plurality of security levels; and The first IP is also arranged as: When one of the plurality of access identities is selected, applying predefined rules to the security levels associated with the selected corresponding access identities of the plurality of previous intellectual property rights to evaluate a resulting security level, and An access identity is selected that is associated with the final security level.

17. The system for improving the efficiency of processing multiple contents according to claim 9, characterized in that: Each access identity of the plurality of access identities is associated with one of a plurality of security levels; The first content is associated with one of the plurality of security levels; and The first IP is also arranged as: When selecting one of the plurality of access identities for processing the first content, an access identity associated with a security level that is the same as the security level associated with the first content is selected.

Images