Security central processing unit management of a transcoder pipeline

• US 9,152,577 B2
• Filed: 12/06/2012
• Issued: 10/06/2015
• Est. Priority Date: 08/17/2012
• Status: Active Grant

• Current Assignee: Avago Technologies International Sales Pte Limited (Broadcom, Inc.)
• Original Assignee: Broadcom Corporation (Broadcom, Inc.)
• Inventors: Rodgers, Stephane, Dellow, Andrew, Shekhar, Shashank
• Primary Examiner(s): Shiferaw, Eleni
• Assistant Examiner(s): GIDDINS, NELSON S
• Application Number:
  US13/707,070
• Publication Number:
  US 20140053001A1
• Time in Patent Office: 1,034 Days
• Field of Search: 713/193
• US Class Current: 1/1
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 12/1441 for a range
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: H04N 19/40 using video transcoding, i.e. partial or full decoding of a coded input stream followed by re-encoding of the decoded output stream
• CPC Class Codes: H04N 19/423 characterised by memory arrangements H04N19/433 takes precedence
• CPC Class Codes: H04N 19/46 Embedding additional information in the video signal during the compression process H04N19/517, H04N19/68, H04N19/70 take precedence
• CPC Class Codes: H04N 21/234309 by transcoding between formats or standards, e.g. from MPEG-2 to MPEG-4 or from Quicktime to Realvideo conversion of standards in analog television systems H04N7/01
• CPC Class Codes: H04N 21/4402 involving reformatting operations of video signals for household redistribution, storage or real-time display details of conversion of video standards at pixel level H04N7/01; video transcoding H04N19/40; adapting incoming signals to the display format of the display terminal G09G5/005; media handling at the source in data packet switching networks H04L65/764
• CPC Class Codes: H04N 21/4408 involving video stream encryption, e.g. re-encrypting a decrypted video stream for redistribution in a home network
• CPC Class Codes: H04N 7/1675 Providing digital key or authorisation information for generation or regeneration of the scrambling sequence pseudo-random number generators in general G06F7/58

Abstract

A method for managing a transcoder pipeline includes partitioning a memory with a numbered region; receiving an incoming media stream to be transcoded; and atomically loading, using a security central processing unit (SCPU), a decryption key, a counterpart encryption key and an associated region number of the memory into a slot of a key table, the key table providing selection of decryption and encryption keys during transcoding. The atomically loading the decryption and encryption keys and the associated numbered region ensures that the encryption key is selected to encrypt a transcoded version of the media stream when the media stream has been decrypted with the decryption key and the transcoded media stream is retrieved from the associated numbered region of the memory.

Claims

1. A system for managing a transcoder pipeline, comprising:

a transcoder including a transcoder stage to generate a transcoded stream from a decrypted incoming media stream;

a decryptor connected with the transcoder, the decryptor configured to decrypt a media stream with a decryption key and send the decrypted incoming media stream to the transcoder;

a memory connected with the transcoder, the memory including a numbered region to store data from the transcoded stream;

an encryptor connected with the memory, the encryptor configured to encrypt the transcoded stream retrieved from the memory with an encryption key before transmission to a media device, the encryption key corresponding to the decryption key;

a first security central processing unit (SCPU) connected with the encryptor, the decryptor, the memory, and the transcoder, to control processing of the incoming media stream; and

a second SCPU configured to atomically load the decryption key, the encryption key, and the numbered region of the memory into a single slot of a key table stored in the memory, to associate the decryption key used by the decryptor with the corresponding encryption key used by the encryptor to encrypt the transcoded stream retrieved from the numbered region of the memory and store data of the transcoded stream into the numbered region of the memory.

2. The system of claim 1, further comprising an address checker configured to:

identify the numbered region of the memory in which data from the transcoded stream is stored; and

provide the identified numbered region to the first SCPU for confirmation of use of the corresponding encryption key by the encryptor to encrypt the transcoded stream.

3. The system of claim 2, where the first SCPU causes data of the transcoded stream to be discarded when the numbered region from which the transcoded stream is retrieved does not match the numbered region of the slot in the key table.

4. The system of claim 2, further comprising an address marker associated with the memory for marking data stored in the numbered region of the memory with the numbered region, for use by the address checker.

5. The system of claim 1, where the first SCPU operates at a first security level and the second SCPU operates at a second security level different than the first security level.

6. The system of claim 1, where the transcoder comprises a trusted processor and the first SCPU is configured to receive information from the trusted processor of the transcoder processing the media stream and from additional memory where the media stream is stored between the transcoder stages.

7. The system of claim 6, where the first SCPU is further configured to track a context of the media stream as the media stream passes through the transcoder.

8. The system of claim 1, further comprising an encoder of the transcoder, and where the first SCPU is further configured to direct the encoder to store the data of the transcoded stream into the numbered region of the memory.

9. A system for managing a transcoder pipeline, comprising:

a memory including a numbered region;

a transcoder connected with the memory, the transcoder including a transcoder stage to generate a transcoded stream from a decrypted incoming media stream, where the transcoder stage includes a processor and the transcoder includes an encoder that stores data from the transcoded stream into the numbered region of the memory;

a first security central processing unit (SCPU) configured to retrieve a decryption key, an encryption key, and the numbered region of the memory, together from a slot of a key table stored in the memory; and

a second SCPU configured to manage a context of the decrypted incoming media stream as the decrypted incoming media stream passes through the transcoder by;

receipt of information from the processor related to the decrypted incoming media stream to track a status of the media stream within the transcoder;

and

an instruction to the encoder to save data of the transcoded stream into the numbered region of the memory associated with both the decryption key and the encryption key.

10. The system of claim 9, where the status of the media stream comprises a location in memory to which the decrypted incoming media stream is saved during transcoder processing, where the first SCPU is further configured to atomically load the decryption key, the encryption key and a number of the associated numbered region of the memory into the slot of the key table in an indivisible manner.

11. The system of claim 9, further comprising:

an encryptor connected with the memory, the encryptor configured to encrypt the transcoded stream retrieved from the memory with the encryption key before transmission to a media device, the encryption key corresponding to the decryption key;

an address checker configured to;

identify the numbered region of the memory in which data from the transcoded stream is stored; and

provide the identified numbered region to the second SCPU for confirmation of use of the corresponding encryption key by the encryptor to encrypt the transcoded stream.

12. The system of claim 11, further comprising an address marker associated with the memory for marking data retrieved from a secure region of the memory with a secure region number, for use by the address checker.

13. The system of claim 9, further comprising:

an encryptor connected with the memory, the encryptor configured to encrypt the transcoded stream retrieved from the memory with the encryption key before transmission to a media device, the encryption key corresponding to the decryption key; and

where the second SCPU causes data of the transcoded stream to be discarded the numbered region from which the transcoded stream is retrieved does not match the numbered region of the slot in the key table.

14. A method for managing a transcoder pipeline, comprising:

partitioning a memory with a numbered region;

receiving an incoming media stream to be transcoded, the transcoding controlled by a first security central processing unit (SCPU); and

atomically loading, using a second security central processing unit (SCPU), a decryption key, a counterpart encryption key and an associated region number of the memory into a slot of a key table in a single indivisible operation, the key table providing selection of decryption and encryption keys during transcoding,

where atomically loading the decryption and encryption keys and the associated numbered region ensures that the encryption key is selected to encrypt a transcoded version of the media stream when the media stream has been decrypted with the decryption key and the transcoded media stream is retrieved from the associated numbered region of the memory.

15. The method of claim 14, further comprising:

decrypting the media stream with a decryptor executing the decryption key;

transcoding the decrypted media stream with a transcoder to generate the transcoded media stream;

storing the transcoded media stream in the numbered region of the memory; and

encrypting the transcoded media stream retrieved from the numbered region of the memory with an encryptor executing the encryption key.

16. The method of claim 15, further comprising:

storing the transcoded media stream to the memory; and

managing a context of the media stream within the transcoder by;

receiving information from a trusted processor of the transcoder related to the media stream to track a status of the media stream within the transcoder; and

directing an encoder to save data of the transcoded media stream into the numbered region of the memory associated with the encryption key and the decryption key in the slot of the key table.

17. The method of claim 14, further comprising:

encrypting the transcoded media stream retrieved from the numbered region of the memory with an encryptor executing the encryption key;

identifying, using an address checker, the numbered region of the memory in which the transcoded media stream is stored; and

providing the identified numbered region to the first SCPU for confirmation of use of the corresponding encryption key by the encryptor to encrypt the transcoded media stream.

18. The method of claim 17, further comprising marking data of the transcoded media stream with the numbered region where the data is stored, for use by the address checker.

19. The method of claim 17, further comprising discarding data of the transcoded media stream the numbered region from which the transcoded media stream is retrieved does not match the numbered region of the slot in the key table.