Secure Video Transcoder Using Segmented Memory Architecture
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing transcoding solutions for video data face security vulnerabilities during the decryption and re-encryption process, making video data susceptible to unauthorized use, especially due to the high cost of using trusted and tamper-proof devices.
Innovation Solution
Implementing a secure data path where encrypted video data is decrypted and transcoded by a security processor in secure memory, inaccessible to the application processor, and then re-encrypted before returning to application memory for secure transmission.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If video data is decrypted and transcoded using traditional devices, then transcoding functionality is achieved, but security of video data is compromised during the process
Solution Approach 1:
The system separates security-critical operations from general processing by dividing the transcoding system into two distinct memory spaces: secure memory accessible only by the security processor for decryption and transcoding operations, and application memory accessible by the application processor for non-sensitive tasks. This segmentation ensures that video data remains encrypted except during controlled secure operations.
Solution Approach 2:
The security processor acts as an intermediary between the encrypted video data and the application processor. It receives encrypted video data, performs decryption and transcoding in secure memory, and returns the processed data to application memory without exposing plaintext video data to the application processor, thus maintaining security while enabling functionality.
2Reliability
If trusted and tamper-proof devices are used for secure transcoding, then security of video data is improved, but manufacturing cost increases
Solution Approach 1:
The security processor is designed to perform multiple functions including decryption, transcoding, and secure data storage in a single integrated unit. This multi-functionality eliminates the need for separate expensive tamper-proof devices for each security operation, reducing manufacturing costs while maintaining security requirements.
Solution Approach 2:
Instead of requiring physical tamper-proof hardware devices, the system uses software-based security processing in a controlled memory environment. The secure memory space acts as a virtual copy of a secure environment, providing the same security guarantees without the high manufacturing costs of physical tamper-proof devices.
3Reliability
If video data is kept encrypted throughout the process, then security is maintained, but transcoding operations cannot be performed
Solution Approach 1:
The system applies encryption selectively rather than uniformly: video data is encrypted in application memory, decrypted only in the specific secure memory location needed for transcoding, and re-encrypted after processing. This localized approach to encryption maintains security while enabling efficient transcoding operations in the secure zone without unnecessary encryption overhead.
Solution Approach 2:
The system performs decryption and transcoding operations in advance within the secure memory environment before the data leaves the secure zone. This preliminary secure processing ensures that when data is transferred to application memory, it is already in the required format and can be immediately used or re-encrypted without additional processing delays.
Data Source
AI summary
A secure transcoder assembly features a secure data path where the related crypting and coding functions are secured in the secure data path. More specifically, during transcoding the ingress (received) encrypted video data is decrypted and copied from application memory (that is accessible to the application processor) to secure memory (that is inaccessible to the application processor) by security processor(s). Once in the secured memory, this video data is transcoded. The video data, now in its transcoded form, is re-encrypted by the security processor(s) during the transfer back to application memory for egress (continued transmission). The mode for the re-encrypting may be managed by the application processor via a crypto API, and the application processor may further feature an opaque handle on the data when it is passed to the secure region.