SECURITY CENTRAL PROCESSING UNIT MANAGEMENT OF A TRANSCODER PIPELINE

• US 20140053001A1
• Filed: 12/06/2012
• Published: 02/20/2014
• Est. Priority Date: 08/17/2012
• Status: Active Grant

• Current Assignee: Avago Technologies International Sales Pte Limited (Broadcom, Inc.)
• Original Assignee: Broadcom Corporation (Broadcom, Inc.)
• Inventors: Rodgers, Stephane, Dellow, Andrew, Shekhar, Shashank
• Granted Patent: US 9,152,577 B2
• Time in Patent Office: Days
• US Class Current: 713/193
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 12/1441 for a range
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: H04N 19/40 using video transcoding, i.e. partial or full decoding of a coded input stream followed by re-encoding of the decoded output stream
• CPC Class Codes: H04N 19/423 characterised by memory arrangements H04N19/433 takes precedence
• CPC Class Codes: H04N 19/46 Embedding additional information in the video signal during the compression process H04N19/517, H04N19/68, H04N19/70 take precedence
• CPC Class Codes: H04N 21/234309 by transcoding between formats or standards, e.g. from MPEG-2 to MPEG-4 or from Quicktime to Realvideo conversion of standards in analog television systems H04N7/01
• CPC Class Codes: H04N 21/4402 involving reformatting operations of video signals for household redistribution, storage or real-time display details of conversion of video standards at pixel level H04N7/01; video transcoding H04N19/40; adapting incoming signals to the display format of the display terminal G09G5/005; media handling at the source in data packet switching networks H04L65/764
• CPC Class Codes: H04N 21/4408 involving video stream encryption, e.g. re-encrypting a decrypted video stream for redistribution in a home network
• CPC Class Codes: H04N 7/1675 Providing digital key or authorisation information for generation or regeneration of the scrambling sequence pseudo-random number generators in general G06F7/58

Abstract

A method for managing a transcoder pipeline includes partitioning a memory with a numbered region; receiving an incoming media stream to be transcoded; and atomically loading, using a security central processing unit (SCPU), a decryption key, a counterpart encryption key and an associated region number of the memory into a slot of a key table, the key table providing selection of decryption and encryption keys during transcoding. The atomically loading the decryption and encryption keys and the associated numbered region ensures that the encryption key is selected to encrypt a transcoded version of the media stream when the media stream has been decrypted with the decryption key and the transcoded media stream is retrieved from the associated numbered region of the memory.

Claims

1. A system for managing a transcoder pipeline, comprising:

a transcoder including a transcoder stage to generate a transcoded stream from a decrypted incoming media stream;

a decryptor connected with the transcoder, the decryptor configured to decrypt a media stream with a decryption key and send the decrypted incoming media stream to the transcoder;

a memory connected with the transcoder, the memory including a numbered region to store data from the transcoded stream;

an encryptor connected with the memory, the encryptor configured to encrypt the transcoded stream retrieved from the memory with an encryption key before transmission to a media device, the encryption key corresponding to the decryption key; and

a security central processing unit (SCPU) connected with the encryptor, decryptor, memory and transcoder, the SCPU configured to atomically load the decryption key, the encryption key and the numbered region of the memory into a slot of a key table, to ensure that when the decryption key is used by the decryptor, the corresponding encryption key is used by the encryptor to encrypt the transcoded stream retrieved from the numbered region of the memory.

2. The system of claim 1, further comprising an address checker configured to:

identify the numbered region of the memory in which data from the transcoded stream is stored; and

provide the identified numbered region to the SCPU for confirmation of use of the corresponding encryption key by the encryptor to encrypt the transcoded stream.

3. The system of claim 2, where the SCPU causes data of the transcoded stream to be discarded when the numbered region from which the transcoded stream is retrieved does not match the numbered region of the slot in the key table.

4. The system of claim 2, further comprising an address marker associated with the memory for marking data stored in the numbered region of the memory with the numbered region, for use by the address checker.

5. The system of claim 1, where the SCPU comprises a first SCPU, further comprising:

a second SCPU coupled with the first SCPU for loading the decryption key, the encryption key and the numbered region into the slot of the key table, where the key table is stored in the memory.

6. The system of claim 5, where the first SCPU operates at a first security level and the second SCPU operates at a second security level different than the first security level.

7. The system of claim 1, where the transcoder comprises a trusted processor and the SCPU is configured to receive information from the trusted processor of the transcoder processing the media stream and from additional memory where the media stream is stored between the transcoder stages.

8. The system of claim 7, where the SCPU is further configured to track a context of the media stream as the media stream passes through the transcoder.

9. The system of claim 1, further comprising an encoder of the transcoder, and where the SCPU is further configured to direct the encoder to store data of the transcoded stream into the numbered region of the memory.

10. A system for managing a transcoder pipeline, comprising:

a memory including a numbered region;

a transcoder connected with the memory, the transcoder including a transcoder stage to generate a transcoded stream from a decrypted incoming media stream, where the transcoder stage includes a processor and the transcoder includes an encoder that stores data from the transcoded stream into the numbered region of the memory; and

a security central processing unit (SCPU) configured to manage a context of the decrypted incoming media stream as the decrypted incoming media stream passes through the transcoder by;

receiving information from the processor related to the decrypted incoming media stream to track a status of the media stream within the transcoder; and

directing the encoder to save data of the transcoded stream into the numbered region of the memory associated with both a decryption key and an encryption key as retrieved from a slot of a key table stored in the memory.

11. The system of claim 10, where the status of the media stream comprises a location in memory to which the decrypted incoming media stream is saved during transcoder processing, where the SCPU is further configured to atomically load the decryption key, the encryption key and the associated numbered region of the memory into the slot of a key table.

12. The system of claim 10, further comprising:

an encryptor connected with the memory, the encryptor configured to encrypt the transcoded stream retrieved from the memory with an encryption key before transmission to a media device, the encryption key corresponding to the decryption key;

an address checker configured to;

identify the numbered region of the memory in which data from the transcoded stream is stored; and

provide the identified numbered region to the SCPU for confirmation of use of the corresponding encryption key by the encryptor to encrypt the transcoded stream.

13. The system of claim 12, further comprising an address marker associated with the memory for marking data retrieved from a secure region of the memory with a secure region number, for use by the address checker.

14. The system of claim 10, further comprising:

an encryptor connected with the memory, the encryptor configured to encrypt the transcoded stream retrieved from the memory with an encryption key before transmission to a media device, the encryption key corresponding to the decryption key;

where the SCPU causes data of the transcoded stream to be discarded the numbered region from which the transcoded stream is retrieved does not match the numbered region of the slot in the key table.

15. A method for managing a transcoder pipeline, comprising:

partitioning a memory with a numbered region;

receiving an incoming media stream to be transcoded; and

atomically loading, using a security central processing unit (SCPU), a decryption key, a counterpart encryption key and an associated region number of the memory into a slot of a key table, the key table providing selection of decryption and encryption keys during transcoding,

where atomically loading the decryption and encryption keys and the associated numbered region ensures that the encryption key is selected to encrypt a transcoded version of the media stream when the media stream has been decrypted with the decryption key and the transcoded media stream is retrieved from the associated numbered region of the memory.

16. The method of claim 15, further comprising:

decrypting the media stream with a decryptor executing the decryption key;

transcoding the decrypted media stream with a transcoder to generate the transcoded stream;

storing the transcoded stream in the numbered region of the memory; and

encrypting the transcoded stream retrieved from the numbered region of the memory with an encryptor executing the encryption key.

17. The method of claim 16, further comprising:

storing the transcoded stream to the memory; and

managing a context of the media stream within the transcoder by;

receiving information from a trusted processor of the transcoder related to the media stream to track a status of the media stream within the transcoder; and

directing an encoder to save data of the transcoded stream into the numbered region of the memory associated with the encryption key and the decryption key in the slot of the key table.

18. The method of claim 15, further comprising:

encrypting the transcoded stream retrieved from the numbered region of the memory with an encryptor executing the encryption key;

identifying, using an address checker, the numbered region of the memory in which the transcoded stream is stored; and

providing the identified numbered region to the SCPU for confirmation of use of the corresponding encryption key by the encryptor to encrypt the transcoded stream.

19. The method of claim 18, further comprising marking data of the transcoded stream with the numbered region where the data is stored, for use by the address checker.

20. The method of claim 18, further comprising discarding data of the transcoded stream the numbered region from which the transcoded stream is retrieved does not match the numbered region of the slot in the key table.