Security Processing Unit Bypassing Host CPU for Set-Top Box
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing broadcast security systems face challenges in securely sending messages from a broadcast head-end to information appliance devices without relying on compromised host computers, particularly in scenarios where hacking or cloning occurs, as these systems often require intervention from untrusted host CPUs to deliver security controls.
Innovation Solution
A system and method that utilize a dedicated channel to send encrypted messages directly from the broadcast head-end to a second security processing unit, bypassing the host central processing unit, by establishing a protected memory region accessible only to security processing units and using protection hardware to control access, allowing for secure execution of instructions such as shutting down or resetting the device without host CPU intervention.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security messages are sent through the host CPU, then the system can process general data, but security is compromised when the host CPU is hacked or cloned
Solution Approach 1:
The message routing is segmented into two separate paths: a secure dedicated channel for security messages that bypasses the host CPU, and a general data path through the host CPU. This segmentation allows security-critical messages to be isolated from potential host CPU compromises while maintaining overall system functionality.
Solution Approach 2:
The transport CPU acts as an intermediary that receives messages from the head-end and determines whether to route them through the host CPU or directly to the security CPU via the dedicated channel. This intermediary mechanism enables intelligent message routing based on message type without requiring the host CPU to handle all security communications.
2Reliability
If a dedicated secure channel is established, then security messages can bypass the host CPU, but the system complexity increases
Solution Approach 1:
The dedicated channel is designed to carry both security messages and video/audio data streams through the same physical infrastructure. The transport CPU universally handles both types of traffic, routing security messages through the secure path while allowing general data to flow through the host CPU path, thereby reducing the need for completely separate communication infrastructure.
3Device complexity
If the host CPU is used for message delivery, then the system architecture remains simple, but the system is vulnerable to hacking and cloning
Solution Approach 1:
The security message delivery function is extracted from the host CPU and placed on a separate dedicated channel that communicates directly with the security CPU. This extraction removes the security-critical message delivery path from the potentially compromised host CPU environment, isolating security functions from general-purpose processing vulnerabilities.
4Reliability
If security processing is isolated from the host CPU, then security is improved, but the ease of operation decreases
Solution Approach 1:
The transport CPU automatically determines the appropriate routing path for each message based on its type, without requiring manual configuration or complex external control mechanisms. The system self-manages the routing decisions, separating security messages from general data traffic through automated identification and routing logic in the transport CPU.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Avoiding that a control message sent from a head-end to a set-top box is intercepted by a compromised host CPU in the set-top box. A transport CPU in the set-top box detects the control message and provides access of the message to a security CPU while prohibiting access of the message to the host CPU. Exclusive access to the message by the security CPU is performed either by a dedicated channel between transport CPU and security CPU or by a protected memory region access to which is only allowed to the security CPU.