Dual virtual machine architecture for media devices

• US 7,469,346 B2
• Filed: 07/12/2004
• Issued: 12/23/2008
• Est. Priority Date: 06/27/2003
• Status: Active Grant

• Current Assignee: Disney Enterprises Incorporated (The Walt Disney Company)
• Original Assignee: Disney Enterprises Incorporated (The Walt Disney Company)
• Inventors: Watson, Scott F.
• Primary Examiner(s): Sheikh; Ayaz R
• Assistant Examiner(s): Henning; Matthew T
• Application Number:
  US10/890,009
• Publication Number:
  US 20050204126A1
• Time in Patent Office: 1,625 Days
• Field of Search: 713/150, 713/193, 380/201, 718/1, 717/148, 726/26
• US Class Current: 713/193
• CPC Class Codes: G06F 21/1064 Restricting content processing at operating system level
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 9/45504 Abstract machines for programme code execution, e.g. Java virtual machine [JVM], interpreters, emulators

Abstract

A software computing based environment for providing secured authentication of media downloaded from a network or loaded from a media player includes two peer-mode operating virtual machines. The low-level virtual machine provides decoding and decryption functions whereas the high-level virtual machine provides application level functions such as user interface, input/output.

Claims

1. A media player for providing media security protection to a medium including a boot code and a main application, the media player comprising:

a security virtual machine configured to receive and process the boot code, wherein the security virtual machine is further configured to perform security decryption and decoding functions for the media player;

an application virtual machine configured to receive the main application and process the main application, wherein the application virtual machine is further configured to perform application functions for the media player and to provide a user interface for the security virtual machine, and wherein the application virtual machine runs at a higher level than the security virtual machine; and

a processing unit configured to run the security virtual machine and the application virtual machine, the processing unit having a processing unit instruction set;

wherein the security virtual machine is further configured to support a first instruction set and the application virtual machine is further configured to support a second instruction set; and

wherein the first instruction set resembles the processing unit instruction set as both the first instruction set and the processing unit instruction set support pointers, and wherein the second instruction set does not support pointers.

2. The media player of claim 1, wherein the first instruction set is of a lower level than the second instruction set.

3. The media player of claim 1 further comprising:

an application program interface (API) permitting the security virtual machine and the application virtual machine to communicate with each other through the API.

4. The media player of claim 1, wherein the security virtual machine is further configured to load the boot code from the medium, wherein the security virtual machine is further configured to load the main application from the medium for use by the application virtual machine, and wherein the security virtual machine is further configured to start the application virtual machine.

5. The media player of claim 1, wherein the medium includes security codes, and wherein the security virtual machine is further configured to load the security codes from the medium.

6. The media player of claim 1, wherein the security virtual machine is configured to decrypt the boot code.

7. The media player of claim 1, wherein the security virtual machine is configured to deliver information related to synchronization events to the application virtual machine.

8. The media player of claim 1, wherein the security virtual machine and the application virtual machine have a peer relationship.

9. The media player of claim 1, wherein the security virtual machine does not include an exception handling capability, and wherein the application virtual machine includes the exception handling capability.

10. The media player of claim 1, wherein the security virtual machine includes a copy protection algorithm.

11. The media player of claim 1, wherein the security virtual machine has a lower impact on system resources of the media player than the application virtual machine.

12. The media player of claim 1, wherein the second instruction set does not support explicit memory management.

13. A method of providing media security protection to a media player for use with a medium including a boot code and a main application, the method comprising:

receiving the boot code using a security virtual machine running on a processing unit having a processing unit instruction set;

processing the boot code using the security virtual machine;

performing security decryption and decoding functions for the media player using the security virtual machine;

receiving the main application using an application virtual machine running on the processing unit;

processing the main application using the application virtual machine;

performing application functions for the media player using the application virtual machine;

providing a user interface for the security virtual machine using the application virtual machine, wherein the application virtual machine runs at a higher level than the security virtual machine;

wherein the security virtual machine is further configured to support a first instruction set and the application virtual machine is further configured to support a second instruction set; and

wherein the first instruction set resembles the processing unit instruction set as both the first instruction set and the processing unit instruction set support pointers, and wherein the second instruction set does not support pointers.

14. The method of claim 13,

wherein the first instruction set is of a lower level than the second instruction set.

15. The method of claim 13 further comprising:

permitting the security virtual machine and the application virtual machine to communicate with each other through an application program interface (API).

16. The method of claim 13, wherein the receiving the boot code includes loading the boot code from the medium by the security virtual machine, wherein the receiving the main application includes loading the main application horn the medium by the security virtual machine for use by the application virtual machine, and wherein the method further comprises:

starting the application virtual machine by the security virtual machine.

17. The method of claim 13, wherein the medium includes security codes, and wherein the method further comprises:

loading the security codes from the medium using the security virtual machine.

18. The method of claim 13 further comprising decrypting the boot code using the security virtual machine.

19. The method of claim 13 further comprising delivering information related to synchronization events by the security virtual machine to the application virtual machine.

20. The method of claim 13, wherein the security virtual machine and the application virtual machine have a peer relationship.

21. The method of claim 13, wherein the security virtual machine does not include an exception handling capability, and wherein the application virtual machine includes the exception handling capability.

22. The method of claim 13, wherein the security virtual machine includes a copy protection algorithm.

23. The method of claim 13, wherein the security virtual machine has a lower impact on system resources of the media player than the application virtual machine.

24. The method of claim 13, wherein the second instruction set does not support explicit memory management.

25. A media player for providing media security protection to a medium including a boot code and a main application, the media player comprising:

a security virtual machine configured to perform security decryption and decoding functions for the media player, wherein the security virtual machine is further configured to support a first instruction set;

an application virtual machine configured to receive the main application and process the main application, wherein the application virtual machine is further configured to perform application functions for the media player and to provide a user interface for the security virtual machine, wherein the application virtual machine is further configured to support a second instruction set; and

a processing unit configured to run the security virtual machine and the application virtual machine, the processing unit having a processing unit instruction set;

wherein the first instruction set resembles the processing unit instruction set as both the first instruction set and the processing unit instruction set support pointers, and wherein the second instruction set does not support pointers.

26. The media player of claim 25, wherein the security virtual machine has a lower impact on system resources of the media player than the application virtual machine.

27. The media player of claim 25, wherein the security virtual machine is further configured to load a boot code from the medium, wherein the security virtual machine is further configured to load the main application from the medium for use by the application virtual machine, and wherein the security virtual machine is further configured to start the application virtual machine.

28. The media player of claim 25, wherein the medium includes security codes, and wherein the security virtual machine is further configured to load the security codes from the medium.

29. The media player of claim 25, wherein the second instruction set does not support explicit memory management.

30. A method of providing media security protection to a media player for use with a medium including a boot code and a main application, the method comprising:

performing security decryption and decoding functions for the media player using a security virtual machine running on a processing unit having a processing unit instruction set, the security virtual machine supporting a first instruction set;

receiving the main application using an application virtual machine running on the processing unit, wherein the application virtual machine supporting a second instruction set;

processing the main application using the application virtual machine;

performing application functions for the media player using the application virtual machine; and

providing a user interface for the security virtual machine using the application virtual machine;

wherein the first instruction set resembles the processing unit instruction set as both the first instruction set and the processing unit instruction set support pointers, and wherein the second instruction set does not support pointers.

31. The method of claim 30, wherein the security virtual machine has a lower impact on system resources of the media player than the application virtual machine.

32. The method of claim 30 further comprising:

loading a boot code from the medium using the security virtual machine;

loading the main application from the medium by the security virtual machine for use by the application virtual machine; and

starting the application virtual machine using the security virtual machine.

33. The method of claim 30, wherein the medium includes security codes, the method further comprising:

loading the security codes from the medium using the security virtual machine.

34. The method of claim 30, wherein the second instruction set does not support explicit memory management.