Video Codec Access Control Using TEE Token Policies
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional approaches to implementing selective video codec access in hardware devices are either insecure due to reliance on untrusted storage or lack granularity, allowing unauthorized access and modification, and do not support per-device control.
Innovation Solution
A token-based video codec control technique using a video codec token obtained from an authorized server, managed within a trusted execution environment (TEE) to enforce codec policies securely, ensuring only authorized operations are performed on graphics hardware resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If conventional approaches store security information in readily-accessible storage locations, then ease of operation is improved, but reliability deteriorates due to susceptibility to unauthorized modification
Solution Approach 1:
The patent introduces a trusted execution environment (TEE) as an intermediary layer between the hardware codec resources and the external system. The TEE contains a secure storage location that stores codec control information (such as authorization data and security policies) in an protected manner. This intermediary structure allows the system to maintain ease of operation by providing a standardized interface while simultaneously improving reliability through cryptographic protection and isolated access control within the TEE boundary.
2Reliability
If selective codec access control is implemented, then reliability of codec resource management is improved, but device complexity increases due to additional authentication mechanisms
Solution Approach 1:
The trusted execution environment is configured to autonomously enforce codec control policies without requiring continuous external authentication. The TEE contains embedded security logic and secure storage that automatically verify authorization and manage codec resource access based on pre-loaded control information. This self-service mechanism reduces device complexity by eliminating the need for complex runtime authentication infrastructure while maintaining high reliability through hardware-rooted security guarantees.
3Adaptability or versatility
If per-device codec policy enforcement is implemented, then adaptability of codec management is improved, but manufacturing complexity increases due to individual device provisioning
Solution Approach 1:
The patent implements a universal provisioning mechanism where a single authorization application running in the trusted execution environment can manage codec policies for multiple devices. The TEE's secure storage location is designed to hold device-specific codec control information that can be programmatically configured. This universal approach allows manufacturers to provision per-device policies through automated processes rather than manual configuration, reducing manufacturing complexity while maintaining the adaptability to enforce unique codec policies on each device based on licensing or subscription models.
Data Source
AI summary
A compute device implements a technique for facilitating selective access to hardware codec resources. The compute device executes, in a trusted execution environment, firmware for controlling graphics hardware of a device that supports a plurality of video codecs. The compute device obtains codec control data specific to the device from a remote system and then configures the firmware to implement a codec policy for selectively providing access to the plurality of video codecs based on the codec control data.