DRM System Using Trusted Execution Environment for Secure Media Playback
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current digital rights management (DRM) systems for intelligent operating systems face challenges in ensuring security and adapting to multiple DRM mechanisms, particularly in intelligent television systems, where software implementation lacks effective protection and hardware implementation restricts flexibility and upgradability.
Innovation Solution
A DRM method and system utilizing a trusted execution environment (TEE) with hardware resources, internal APIs, and a security operating system, which supports multiple DRM applications by acquiring and decrypting media data through a secure cache region, allowing for legitimate content playback and output while ensuring security and adaptability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If software implementation is used for DRM functions, then the system can operate on intelligent operating systems with flexible resources, but the security protection is insufficient and attackers can easily acquire terminal private keys and content encryption keys
Solution Approach 1:
The system is divided into two separate environments: the normal intelligent operating system environment and the trusted execution environment (TEE). DRM-sensitive operations are segmented and isolated within the TEE, which has its own secure CPU, memory, and storage resources. This segmentation allows the system to maintain adaptability to intelligent operating systems while achieving high security through isolation of critical DRM functions in the TEE.
2Reliability
If hardware implementation is used for DRM functions, then the security protection is high and accepted by operators and content operators, but the hardware requirements are high and only customized operating systems can be operated
Solution Approach 1:
The trusted execution environment (TEE) acts as an intermediary between the intelligent operating system and the DRM content protection requirements. It provides hardware-level security similar to customized operating systems while maintaining compatibility with standard intelligent operating systems. The TEE mediates all DRM-sensitive operations, allowing the system to achieve high security without restricting the use of intelligent operating systems.
3Reliability
If high security chips are used with customized operating systems, then the DRM security requirements are met, but the DRM terminal agent software cannot be updated online and multiple DRM agents cannot be supported
Solution Approach 1:
The system implements dynamic DRM agent support through the TEE, which can load and execute different DRM agent software modules as needed. Unlike fixed hardware implementations, the TEE allows DRM agents to be updated online and switched dynamically based on the content requirements. This dynamic capability enables the system to meet security requirements while supporting continuous updates and multiple DRM agents.
Data Source
AI summary
A digital rights management (DRM) method for an intelligent operating system comprises: acquiring a play list of media data to be played and encrypted media data; inquiring and acquiring one or more DRM application modules, wherein the DRM application module contains an identifier of a trusted application module; requesting DRM authorization by the DRM application module from a DRM server, judging a content permission and acquiring an encrypted content encryption key (ECEK) and transmitting the ECEK to a TEE; after judging that the content permission is legitimate; decrypting the ECEK acquired by the trusted application module which is in the TEE and corresponds to the trusted application module identifier to acquire a content encryption key (CEK), and decrypting the encrypted media data by using the CEK; and storing the decrypted media data in a security cache region for decoding and outputting.