Secure Core Media Decryption via Segmented Memory
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Digital Rights Management (DRM) techniques are vulnerable to unauthorized access due to decryption keys and decrypted media assets being stored in global memory, which can be accessed by hackers.
Innovation Solution
Implementing a secure data path by using a client device with a secure core and restricted memory, where the decryption process occurs exclusively in a secure execution environment, ensuring that decryption keys and media assets are not stored in global memory, thus preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If decryption is performed in global memory using host CPU, then decryption speed and ease of operation are improved, but security deteriorates because hackers can access global memory and obtain decryption keys
Solution Approach 1:
The system divides the execution environment into two separate segments: a common execution environment (global memory accessible by host CPU) and a secure execution environment (restricted memory accessible only by secure core). The decryption key and decryption process are segmented into the secure execution environment, isolating them from the common environment where hackers could access them. This segmentation allows decryption to occur securely while maintaining operational functionality.
Solution Approach 2:
A secure core acts as an intermediary between the host CPU and the decryption process. The secure core receives decryption requests from the host, performs the actual decryption in the secure execution environment using restricted memory, and returns the decrypted data. This intermediary ensures that the decryption key never暴露在 global memory, while still allowing the host CPU to initiate and receive results from decryption operations.
2Ease of operation
If decryption key is stored in global memory, then accessibility and ease of operation are improved, but security deteriorates due to potential unauthorized access
Solution Approach 1:
The memory system is segmented into global memory (common execution environment) and restricted memory (secure execution environment). The decryption key is stored exclusively in restricted memory, which is accessible only by the secure core. This segmentation maintains the key's accessibility for authorized decryption operations while preventing unauthorized access from the common execution environment or external attackers.
Solution Approach 2:
Different memory regions have different security qualities assigned to them. Restricted memory has high security quality with access limited to the secure core, while global memory has lower security quality accessible to the host CPU and potentially other processes. The decryption key is placed in the local region (restricted memory) with the appropriate security quality to protect it from harmful factors while maintaining necessary accessibility.
Data Source
Figure 1
Figure 2
Figure 3A
AI summary
A client device for decrypting and decoding media assets through a secure data path. The client device includes a host core and global memory in a common execution environment and a secure core and restricted memory in a secure execution environment. The secure core generates a license challenge only in the context of the secure execution environment and processes a license challenge response that includes a media content decryption key only in the context of the secure execution environment. The secure core decrypts a protected media asset using the media content decryption key only in the context of the secure execution environment such that the decryption key and decrypted media asset will not be in global memory thereby protecting the media asset from unauthorized access.