SCPU Key Table Management for Transcoder Pipeline Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In systems on a chip (SOC) used for transcoding media streams, there is a risk of unauthorized access and misappropriation due to the complexity of decryption and encryption processes, where third parties can manipulate encryption keys, leading to potential unauthorized copying of media content.
Innovation Solution
Implementing a multi-security CPU system with a small, highly secure SCPU (security CPU-A) for managing root keys and encryption/decryption processes, and a larger SCPU (security CPU-B) for digital rights management and transcoder management, using a secure communications bus and secure memory to ensure proper key management and data flow, preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single CPU manages the transcoder pipeline, then device complexity is reduced, but security reliability deteriorates due to potential unauthorized access and key manipulation
Solution Approach 1:
The system divides the security management function into two separate CPUs: a first SCPU dedicated to high-security root key management and a second SCPU for transcoder pipeline management. This segmentation isolates critical security functions from general transcoder control, preventing unauthorized access while maintaining modular architecture.
Solution Approach 2:
The first SCPU acts as an intermediary between secure key storage and the transcoder pipeline. It securely provides decryption keys to the second SCPU without exposing root keys to the transcoder management logic, thereby mediating security requirements while enabling functional separation.
2Ease of operation
If root keys are stored in accessible memory for transcoder management, then ease of operation improves, but security against unauthorized access deteriorates
Solution Approach 1:
The system segments key storage and access into two levels: root keys are stored in secure, restricted memory accessible only by the first SCPU, while transcoder management keys are stored in accessible memory for the second SCPU. This segmentation enables operational ease for transcoder control while protecting root keys from unauthorized access.
Solution Approach 2:
The first SCPU serves as an intermediary that securely retrieves root keys from protected storage and provides derived decryption keys to the second SCPU. This mediation allows the second SCPU to operate with ease using accessible keys while the root keys remain protected from direct access.
Data Source
AI summary
A method for managing a transcoder pipeline includes partitioning a memory with a numbered region; receiving an incoming media stream to be transcoded; and atomically loading, using a security central processing unit (SCPU), a decryption key, a counterpart encryption key and an associated region number of the memory into a slot of a key table, the key table providing selection of decryption and encryption keys during transcoding. The atomically loading the decryption and encryption keys and the associated numbered region ensures that the encryption key is selected to encrypt a transcoded version of the media stream when the media stream has been decrypted with the decryption key and the transcoded media stream is retrieved from the associated numbered region of the memory.