Method and apparatus for building a hardware root of trust and providing protected content processing within an open computing platform
First Claim
1. A client computing system comprising:
- a media browser to receive a playback request of requested content from a user;
one or more processor cores, at least one of the one or more processor cores to execute a media player application,the media player application to obtain encrypted content corresponding to the requested content from a service provider server coupled to the client computing system over a network,wherein the encrypted content includes a plurality of encrypted slices and a plurality of non-encrypted headers corresponding to the plurality of encrypted slices; and
a security processor to;
provide attestation and key management operations;
provide a hardware-based root of trust between the client computing system and the service provider server;
obtain an encryption key associated with the encrypted content from the service provider server for decryption of the encrypted content; and
decrypt the encrypted content including the plurality of encrypted slices; and
a graphics engine to;
decode each of the plurality of slices to generate a corresponding plurality of decoded slices;
re-encrypt the plurality of decrypted slices to generate corresponding re-encrypted content; and
pass the re-encrypted content to a display over a protected display interface.
1 Assignment
0 Petitions
Accused Products
Abstract
A system architecture provides a hardware-based root of trust solution for supporting distribution and playback of premium digital content. In an embodiment, hardware root of trust for digital content and services is a solution where the basis of trust for security purposes is rooted in hardware and firmware mechanisms in a client computing system, rather than in software. From this root of trust, the client computing system constructs an entire media processing pipeline that is protected for content authorization and playback. In embodiments of the present invention, the security of the client computing system for content processing is not dependent on the operating system (OS), basic input/output system (BIOS), media player application, or other host software.
-
Citations
18 Claims
-
1. A client computing system comprising:
-
a media browser to receive a playback request of requested content from a user; one or more processor cores, at least one of the one or more processor cores to execute a media player application, the media player application to obtain encrypted content corresponding to the requested content from a service provider server coupled to the client computing system over a network, wherein the encrypted content includes a plurality of encrypted slices and a plurality of non-encrypted headers corresponding to the plurality of encrypted slices; and a security processor to; provide attestation and key management operations; provide a hardware-based root of trust between the client computing system and the service provider server; obtain an encryption key associated with the encrypted content from the service provider server for decryption of the encrypted content; and decrypt the encrypted content including the plurality of encrypted slices; and a graphics engine to; decode each of the plurality of slices to generate a corresponding plurality of decoded slices; re-encrypt the plurality of decrypted slices to generate corresponding re-encrypted content; and pass the re-encrypted content to a display over a protected display interface. - View Dependent Claims (2, 3, 4, 5, 6)
-
-
7. A method comprising:
-
receiving, by a media browser of a client computing system, a playback request of requested content from a user; obtaining, by a media player application executed on one or more processor cores of the client computing system, encrypted content corresponding to the requested content from a service provider server coupled to the client computing system over a network, wherein the encrypted content includes a plurality of encrypted slices and a plurality of non-encrypted headers corresponding to the plurality of encrypted slices; providing, by a security processor of the client computing system, attestation and key management operations; providing, by the security processor, a hardware-based root of trust between the client computing system and the service provider server; obtaining, by the security processor, an encryption key associated with the encrypted content from the service provider server for decryption of the encrypted content; decrypting, by the security processor, the encrypted content including the plurality of encrypted slices; decoding, by a graphics engine of the client computing system each of the plurality of slices to generate a corresponding plurality of decoded slices; re-encrypting, by the graphics engine, the plurality of decrypted slices to generate corresponding re-encrypted content; and passing, by the graphics engine, the re-encrypted content to a display over a protected display interface. - View Dependent Claims (8, 9, 10, 11, 12)
-
-
13. One or more non-transitory computer-readable media comprising a plurality of instructions stored thereon that, when executed, causes a client computing device to:
-
receive, by a media browser of the client computing system, a playback request of requested content from a user; obtain, by a media player application executed on one or more processor cores of the client computing system, encrypted content corresponding to the requested content from a service provider server coupled to the client computing system over a network, wherein the encrypted content includes a plurality of encrypted slices and a plurality of non-encrypted headers corresponding to the plurality of encrypted slices; provide, by a security processor of the client computing system, attestation and key management operations; provide, by the security processor, a hardware-based root of trust between the client computing system and the service provider server; obtain, by the security processor, an encryption key associated with the encrypted content from the service provider server for decryption of the encrypted content; decrypt, by the security processor, the encrypted content including the plurality of encrypted slices; decode, by a graphics engine of the client computing system each of the plurality of slices to generate a corresponding plurality of decoded slices; re-encrypt, by the graphics engine, the plurality of decrypted slices to generate corresponding re-encrypted content; and pass, by the graphics engine, the re-encrypted content to a display over a protected display interface. - View Dependent Claims (14, 15, 16, 17, 18)
-
Specification