HARDWARE-BASED OUTPUT PROTECTION OF MULTIPLE VIDEO STREAMS

• US 20090290709A1
• Filed: 05/21/2008
• Published: 11/26/2009
• Est. Priority Date: 05/21/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: SCHNELL, PATRIK, PRONOVOST, STEVE, MACDONALD, DONALD SCOTT
• Granted Patent: US 8,393,008 B2
• Time in Patent Office: Days
• US Class Current: 380/200
• CPC Class Codes: G11B 20/00086 Circuits for prevention of unauthorised reproduction or copying, e.g. piracy indicating unauthorised use of record carriers in general G11B23/28; scrambling for television signal recording H04N5/913; network architectures or network protocols for network security H04L63/00; cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
• CPC Class Codes: G11B 20/0021 involving encryption or decryption of contents recorded on or reproduced from a record carrier
• CPC Class Codes: G11B 20/00507 wherein consecutive physical data units of the record carrier are encrypted with separate encryption keys, e.g. the key changes on a cluster or sector basis
• CPC Class Codes: G11B 20/10527 Audio or video recording; Data buffering arrangements G11B20/12 - G11B20/18 take precedence
• CPC Class Codes: G11B 2020/1062 Data buffering arrangements, e.g. recording or playback buffers
• CPC Class Codes: G11B 2220/61 wherein solid state memory is used for storing A/V content storing computer data in solid state memories G06F
• CPC Class Codes: H04N 21/4325 by playing back content from the storage medium reproduction of recorded television signals H04N5/76; reproduction of recorded television signals H04N9/79
• CPC Class Codes: H04N 21/4405 involving video stream decryption
• CPC Class Codes: H04N 21/835 Generation of protective data, e.g. certificates protecting software against unauthorised usage in a vending or licensing environment G06F21/10

Abstract

Computer-readable media, computerized methods, and computer systems for managing dynamic allocation of one or more protected memory segments for storing content of secure data are provided. Initially, the secure data is recognized as being carried by a media stream being communicated from a media-reading device. One or more protected target segments and protected target segments are instantiated, where these protected memory segments are protected from illicit access by hardware-based rules. Regions of hardware memory are dynamically allocated to hold these protected memory segments and the secure data is iteratively written thereto. The protected source segments are associating with the media stream based on a license attached thereto, while the protected target segments are associating with presentation devices based on a standard of output protection supported thereby. Accordingly, the protected source segments are mapped to the protected target segments according to whether the license encompasses the standard of the output protection.

Claims

1. One or more computer-readable media having computer-executable instructions embodied thereon that, when executed, perform a method for providing hardware-based output protection of multiple video streams, the method comprising:

receiving streaming media from one or more media-reading devices;

identifying portions of the streaming media as secure data;

detecting a mode of encryption applied to the secure data;

executing a data-management process to protect the secure data, wherein the data-management process comprises;

(1) dynamically allocating a region of memory to provide one or more protected source segments, wherein each of the one or more protected source segments is associated with the streaming media from each of the one or more media-reading devices; and

(2) temporarily writing the secure data to the one or more associated protected source segments;

applying a standard of output protection to the secure data based on the mode of encryption initially applied to the secure data; and

evicting the secure data to one or more presentation devices.

2. The one or more computer-readable media of claim 1, the method further comprising:

recognizing types of the one or more presentation devices;

enumerating capabilities or limitations of the one or more presentation devices based on the recognized types;

applying a standard of output protection to the streaming media from each of the one or more media-reading device based on the capabilities or the limitations of the one or more presentation devices.

3. The one or more computer-readable media of claim 2, the method further comprising:

dynamically allocating a region of memory to provide one or more protected target segments, wherein each of the one or more protected target segments is associated with the each of the one or more presentation devices;

temporarily writing the secure data to the one or more associated protected target segments for conveyance to the associated one or more presentation devices.

4. The one or more computer-readable media of claim 3, wherein temporarily writing the secure data to the one or more associated protected target segments comprises:

pushing the secure data from the one or more protected source segments to the one or more protected target segments according to a rate of flow of the streaming media, wherein the secure data in the one or more protected target segments is visible to the one or more presentation devices; and

wherein the secure data in the one or more protected target segments and the one or more protected source segments is protected by a set of hardware-based rules; and

scanning out the secure data to the one or more presentation devices for rendering.

5. The one or more computer-readable media of claim 4, the method further comprising:

identifying a protected source segment of the one or more protected source segments allocated for holding the secure data associated with a particular mode of encryption;

identifying a protected target segment of the one or more protected target segments allocated for conveying the secure data with a particular standard of the output protection applied thereto;

determining whether the particular mode of encryption corresponds with the particular standard of the output protection applied to the secure data; and

if determined to correspond, correlating the identified protected source segment with the identified protected target segment via a hardware mapping scheme.

6. The one or more computer-readable media of claim 5, wherein determining whether the particular mode of encryption corresponds with the particular standard of the output protection applied to the secure data comprises:

identifying at least one license defining the mode of encryption applied to the secure data; and

verifying whether the standard of output protection is encompassed by the license.

7. The one or more computer-readable media of claim 5, wherein identifying a protected target segment of the one or more protected target segments allocated for conveying the secure data with a particular standard of the output protection applied thereto comprises:

receiving a selection of a particular presentation device of the one or more presentation devices for rendering a media stream of the streaming media; and

dynamically allocating a protected target segment to scan out the media stream to the selected presentation device.

8. The one or more computer-readable media of claim 7, the method further comprising:

determining whether the standard of output protection associated with the selected presentation device is encompassed by at least one license attached to the streaming media being evicted to the selected presentation device; and

disallowing pushing the secure data to the protected target segment allocated for the selected presentation device if the determination indicates the standard of output protection is not encompassed by the license.

9. The one or more computer-readable media of claim 7, the method further comprising:

querying the one or more presentation devices to detect which media stream of the streaming media is being evicted to each of the one or more presentation devices;

updating the hardware mapping scheme based on the query;

re-correlating each of the one or more protected source segments with each of the one or more identified protected target segments based on the updated hardware mapping scheme.

10. The one or more computer-readable media of claim 1, the method further comprising:

establishing a unique session key according to the mode of encryption applied to the secure data transmitted in the streaming media from a media-reading device transmitting in parallel with the one or more media-reading devices;

dynamically manipulating the region of memory to initiate a protected source segment in conjunction with managing the one or more protected source segments;

deciphering the secure data from the media-reading device utilizing the unique session key; and

temporarily writing the deciphered secure data to the initiated protected source segment.

11. The one or more computer-readable media of claim 1, the method further comprising allowing non-secure data to be freely copied to the one or more protected source segments for rendering on the one or more presentation devices.

12. The one or more computer-readable media of claim 4, wherein protecting the secure data by the set of hardware-based rules comprises:

detecting an attempt to copy the secure data of the streaming media to a location other than the identified protected source segment of the one or more protected source segments allocated for holding the secure data; and

conditionally limiting access the streaming media by altering the copied secure data to render a null presentation when processed by the one or more presentation devices.

13. The one or more computer-readable media of claim 4, wherein protecting the secure data by the set of hardware-based rules comprises:

detecting an unauthorized attempt to copy the secure data from the identified protected target segment of the one or more protected target segments allocated for conveying the secure data to an associated presentation device of the one or more presentation devices;

conditionally limiting access the identified protected target segment by altering the copied secure data to render a null presentation when processed by the one or more presentation devices other than the associated presentation device.

14. The one or more computer-readable media of claim 4, wherein protecting the secure data by the set of hardware-based rules comprises:

detecting an unauthorized attempt to copy the secure data from a protected source segment of the one or more protected source segments to a location other than a correlating protected target segment of the one or more protected target segments, as indicated by the hardware mapping scheme;

conditionally limiting access the protected source segment by altering the copied secure data to render a null presentation when processed by the one or more presentation devices.

15. A computer system for managing a mapping between a plurality of protected source segments and a plurality of protected target segments, the system comprising:

an application to receive media streaming from media-reading devices and to identify secure data within the streaming media;

a memory manager component to dynamically allocate protected source segments within system memory or video memory for, at least temporarily, writing the secure data received within the streaming media and to dynamically allocate protected target segments within system memory or video memory for, at least temporarily, writing the secure data pushed from the protected source segments;

one or more presentation devices to render the streaming media;

a policy manager component to manage the streaming media from the protected source segments to the protected target segments;

wherein said policy manager is configured to associate the protected source segments with the streaming media based on detected modes of encryption applied to the streaming media, and associating the protected target segments with the one or more presentation devices based on standards of output protection that are supported by the one or more presentation devices, and wherein said policy manger is further configured to map the protected source segments to the protected target segments according to whether the modes of encryption correspond with the standards of the output protection; and

a mapping interface component for at least temporarily maintaining the mapped protected source segments to the protected target segments on a hardware mapping scheme accessible to a graphics processing unit (GPU).

16. The system of claim 15, wherein the memory manager is further configured to:

determine a rate of flow of the streaming media; and

dynamically manipulate a region of the video memory or the system memory allocated for the protected source segments according the rate of flow.

17. The system of claim 15, further comprising the protected source segments to:

temporarily store the secure data of the media streams associated thereto, wherein the mode of encryption of the media streams is deciphered precedent to entering the protected source segments such that the stored secure data is decrypted information; and

push the decrypted information to the protected target segments as mapped to the protected source segments.

18. The system of claim 15, wherein the policy manager component is further configured to:

query the protected target segments to verify which of the one or more presentation devices are evicting the secure data therefrom; and

updating the hardware mapping scheme to reflect results of the query.

19. A computerized method for managing dynamic allocation of one or more protected memory segments for content of secure data, the method comprising:

recognizing a media stream being communicated from a media-reading device, wherein recognizing comprises;

(1) identifying secure data within the media stream; and

(2) detecting mode of encryption applied to the streaming media;

dynamically allocating protected source segments within system memory or video memory for, at least temporarily, writing the secure data received within the streaming media

associating the one of the protected source segments with the media stream based on the detected mode of encryption;

identifying a standard of output protection of the media stream that is supported by a presentation device selected for receiving the media stream;

dynamically allocating a protected target segment within system memory or video memory for, at least temporarily, writing the secure data pushed from the protected source segments;

associating one of the protected target segments with the presentation device based on the standard of output protection that is applied by the protected target segments; and

evicting the media stream to the presentation device such that the secure data is rendered thereby.

20. The method of claim 19, further comprising mapping the associated protected source segment to the associated protected target segment according to whether the mode of encryption corresponds with the standard of the output protection.