Content Consumption Application Security Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in detecting security compromises on devices, particularly in protecting content decryption keys from malware and unauthorized access, which can lead to revenue loss for content owners due to compromised cryptographic keys.
Innovation Solution
A system and method that implements a content consumption application to securely pass decryption keys to a media component only if certain conditions are met, including ensuring the operating system's security mechanisms have not been compromised and the application handling the keys has not been tampered with, using techniques such as checking for jailbroken devices, invalid signatures, and anti-debugging functions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If decryption keys are passed through open interfaces to media components, then content consumption functionality is enabled, but security risk increases due to potential exposure to attackers and malware
Solution Approach 1:
The patent performs security checks before passing decryption keys to media components. The content consumption application verifies that security mechanisms are intact and the application has not been tampered with before enabling key passage through open interfaces, thus preventing security exposure while maintaining functionality
Solution Approach 2:
The patent introduces an intermediary verification layer between the decryption key and media component. The content consumption application acts as a mediator that checks security conditions and controls key passage, preventing direct exposure to potentially compromised media components
2Reliability
If security checks are performed to verify operating system integrity and application tampering, then security protection is improved, but system complexity increases
Solution Approach 1:
The patent implements self-service security verification where the content consumption application checks its own integrity and the operating system's security mechanisms. The application performs hash checks on its own executable instructions and verifies security mechanisms without requiring external verification systems, thus improving security while minimizing added complexity
3Difficulty of detecting and measuring
If anti-debugging functions and hash checks are implemented to detect tampering, then detection capability is improved, but processing time increases
Solution Approach 1:
The patent performs anti-debugging checks and hash verification of executable instructions before the content consumption application begins its main operations. By conducting these detection activities in advance, the system ensures detection capability while minimizing time loss during actual content consumption
Solution Approach 2:
The patent implements efficient hash checking that quickly verifies application integrity without extensive processing. The system rushes through the verification process by comparing hash values in a single operation rather than analyzing entire instruction sets, thus improving detection capability while minimizing processing time
Data Source
AI summary
Embodiments of a system and method for detecting a security compromise on a device are described. Embodiments may be implemented by a content consumption application configured to protect content decryption keys on a device, such as a computer system (e.g., a desktop or notebook computer) or a mobile device (e.g., a smartphone or tablet). For instance, the content consumption application may be configured to provide decryption keys for respective content to a media component (or another component of the operating system) if multiple conditions have been met. For instance, in various embodiments, the content consumption application may pass the key to the media component after ensuring that i) one or more security mechanisms of the device operating system have not been compromised and ii) one or more executable instructions of the content consumption application have not been tampered (e.g., instructions corresponding to a function that handles the decryption key(s)).