Secure OS Media Decoding via Header Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional digital rights management (DRM) systems face limitations in protecting video content, particularly due to vulnerabilities in complex software decoders that can be attacked, leading to potential exposure and theft of encrypted media information.
Innovation Solution
A secure operating system (OS) is employed to decrypt only the header information of encrypted media, limiting the exposure of sensitive data and maintaining the rest of the media information in an encrypted form, thereby protecting it from unauthorized access by providing secure access to decoding hardware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional DRM systems use media pipelines with complex software decoders to decrypt and process encrypted media, then the media can be decoded and played back, but the complex software code creates security vulnerabilities that can be attacked and lead to exposure of encrypted media information
Solution Approach 1:
The patent segments the media data into header information and payload data, decrypting only the header portion in the secure environment while keeping the payload encrypted. This allows the software decoder to receive necessary control information from headers without exposing the actual media content, thus maintaining decoding functionality while reducing security risks.
Solution Approach 2:
The patent extracts only the necessary header information from the encrypted media stream and sends it to the software decoder, while keeping the main media payload encrypted and stored in the secure environment. This extraction approach minimizes the exposure of sensitive data to potentially vulnerable software components.
2Productivity
If the software decoder is given access to decrypted media data for processing, then decoding can be performed, but the exposed data increases the risk of data leaks and attacks on the media pipeline
Solution Approach 1:
The patent applies partial action by decrypting and exposing only the necessary header portion of the media data to the software decoder, rather than decrypting the entire media stream. This partial decryption provides enough information for the decoder to function while minimizing the exposure window for potential attacks.
Solution Approach 2:
The patent implements local quality by applying different encryption states to different parts of the media data - the header information is decrypted and made accessible to the software decoder, while the payload data remains encrypted. This creates localized security zones within the data structure.
3Reliability
If all media information is kept encrypted to maintain security, then data protection is maximized, but the software decoder cannot access necessary information for control and decoding operations
Solution Approach 1:
The patent introduces an intermediary mechanism where the secure environment acts as a mediator between the encrypted media payload and the software decoder. The secure environment decrypts and processes the header information, then provides necessary control information to the decoder without exposing the actual media content, enabling decoder control while maintaining security.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed herein are representative embodiments of tools and techniques for facilitating decoding of protected media information using a secure operating system. According to one exemplary technique, encoded media information that is encrypted is received at a secure process of a secure operating system of a computing system. At least a portion of the encoded media information that is encrypted is decrypted in the secure process. The portion of the encoded media information includes header information. Additionally, the header information is sent from the secure operating system to a software decoder for control of decoding hardware. The software decoder is included in a process for an application. Also, the decoding hardware is securely provided access to the encoded media information for decoding of the encoded media information to produce decoded media information.