Module-Based Memory Access Protection for DRM Data Integrity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing DRM systems face complexity and vulnerability due to the need to manage multiple codec types and memory types, leading to potential data leakage when memory access filters are tampered with.
Innovation Solution
A method and apparatus that assign protection identifiers to hardware modules based on their access needs, determining memory regions and permissions, ensuring data protection by distinguishing access types based on modules rather than memory types.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If memory access filters are used to protect DRM content by classifying memory areas and assigning protection identifiers, then data protection capability is improved, but system complexity increases due to multiple codec types and memory types requiring separate management
Solution Approach 1:
The patent segments the protection mechanism by creating separate protection identifier management for each hardware module type (video decoder, video encoder, image processor) rather than managing all memory areas uniformly. Each module type has its own protection identifier assignment rules, simplifying the overall system by dividing the complex memory protection management into manageable module-specific segments.
Solution Approach 2:
Instead of classifying memory areas and assigning protection identifiers to each memory surface (traditional approach), the patent inverts the approach by assigning protection identifiers to hardware modules and having them request access to memory regions. This reverses the classification logic from memory-centric to module-centric, reducing complexity in systems with multiple codec types.
2Adaptability or versatility
If traditional memory access filter classification is used with multiple codec types, then comprehensive memory coverage is improved, but implementation complexity increases significantly
Solution Approach 1:
The patent creates a universal protection identifier assignment mechanism that works across all hardware module types (video decoders, video encoders, image processors) without requiring separate implementation for each codec type. The memory access filter uses a unified approach where any hardware module can be assigned a protection identifier and request memory access, making the system universally applicable to diverse codec architectures while simplifying implementation.
3Reliability
If memory access requests are filtered by protection identifiers assigned to memory surfaces, then data security is improved, but vulnerability to tampering increases when the mapping table is compromised
Solution Approach 1:
The patent introduces hardware modules as intermediaries between the protection identifier system and memory access. Instead of directly mapping protection identifiers to memory surfaces (which creates tampering vulnerabilities), the hardware module acts as a mediator that requests memory access on behalf of protected content. The memory access filter verifies the hardware module's protection identifier and access permissions, creating an additional layer of security that prevents direct tampering with the protection-mem ory mapping.
Data Source
AI summary
The present disclosure relates to a memory access processing method and apparatus, a computer device, a storage medium and a computer program. The method includes: acquiring a memory access request transmitted by a hardware module, the memory access request carrying a protection identifier, an access type, and an access area corresponding to the hardware module, the hardware module being pre-assigned with the corresponding protection identifier, and a memory area that the hardware module needs to access being pre-assigned to a memory region corresponding to an access permission; determining the memory region in which the access area is located; determining whether the protection identifier corresponding to the hardware module has the access permission for a corresponding access type to the memory region; and responding to the memory access request when the protection identifier corresponding to the hardware module has the access permission for the corresponding access type to the memory region.