Integration of untrusted framework components with a secure operating system environment

• US 9,338,522 B2
• Filed: 12/14/2012
• Issued: 05/10/2016
• Est. Priority Date: 10/18/2012
• Status: Active Grant

• Current Assignee: Avago Technologies International Sales Pte Limited (Broadcom, Inc.)
• Original Assignee: Broadcom Corporation (Broadcom, Inc.)
• Inventors: Rajgopal, Narayan, Kellerman, Marcus C., Erickson, David
• Primary Examiner(s): SHANG, ANNAN Q
• Application Number:
  US13/715,395
• Publication Number:
  US 20140115623A1
• Time in Patent Office: 1,243 Days
• Field of Search: 725/28, 725131-134, 725139-142, 709217-232
• US Class Current: 1/1
• CPC Class Codes: H04N 21/443 OS processes, e.g. booting an STB, implementing a Java virtual machine in an STB or power management in an STB
• CPC Class Codes: H04N 21/4437 Implementing a Virtual Machine [VM] virtual machines in general G06F9/45533
• CPC Class Codes: H04N 21/835 Generation of protective data, e.g. certificates protecting software against unauthorised usage in a vending or licensing environment G06F21/10

Abstract

A set top box or like device incorporating an untrusted software framework as a client of a secure operating system kernel. The software framework may comprise, for example, an Android framework supported by an underlying Linux operating system environment having a secure kernel. The software framework can be executed using a variety of process isolation techniques depending on performance and isolation requirements. A secure access client/server interface may also be provided to support interactions between the untrusted software framework (and applications utilizing the untrusted software framework) and secure or trusted portions of the device. The secure access interface can be configured to perform operations such as handle validation, heap pointer validation, non-pointer parameter validation, heap isolation, and resource release relating to terminated processes. In further embodiments, a software framework aggregator is used to support a plurality of additional software frameworks for use in the set top box.

Claims

1. A media processing device having software and hardware resources for performing media delivery operations, comprising:

processing circuitry;

a secure operating system environment, the secure operating system environment executed by the processing circuitry;

a software framework, the software framework providing application programming interface functionality to support compatible applications; and

a secure access interface configured to regulate communications between the secure operating system environment and the software framework, and to provide restricted access to at least a portion of the software and hardware resources for performing media delivery operations, the secure access interface comprising;

a secure access server incorporated in the secure operating system environment, the secure access server configured to provide access to the secure operating system environment; and

a plurality of secure access clients configured to interface with the secure access server, each secure access client having respective access rights to the secure operating system environment via the secure access server, first access rights providing full access to the secure operating system environment for a first application and second access rights providing limited access, relative to the first access rights, to the secure operating system environment for a second application.

2. The media processing device of claim 1, the secure access interface configured to utilize process isolation for applications executed via the software framework.

3. The media processing device of claim 1, the secure access interface performing at least one operation selected from the group consisting of:

handle validation, heap pointer validation, non-pointer parameter validation, heap isolation, or resource release relating to unused resources.

4. The media processing device of claim 1, the secure access server executed as a secure kernel module, and at least one of the plurality of secure access clients incorporated in the software framework.

5. The media processing device of claim 4, wherein communications between the secure access server and the at least one of the plurality of secure access clients occur, at least in part, through inter-process communication calls.

6. The media processing device of claim 1, wherein the secure operating system environment comprises a Linux-based operating system kernel.

7. The media processing device of claim 1, wherein the software framework comprises at least one version of an Android framework.

8. The media processing device of claim 1 configured as a set top box device, the media processing device further comprising a set top box application executed by the processing circuitry in the secure operating system environment for performing media delivery operations, wherein communications between the set top box application and software framework occur, at least in part, via the secure access interface.

9. The media processing device of claim 8, the secure operating system environment comprising a privileged operating system environment to perform secure media processing operations, the secure operating system environment further configured to establish a restricted operating system environment,

the set top box application executed in the privileged operating system environment and the software framework executed in the restricted operating system environment.

10. The media processing device of claim 1, further comprising:

a software framework aggregator to support a plurality of additional software frameworks, the secure access interface further configured to regulate communications between the secure operating system environment and the software framework aggregator.

11. A method used in a media delivery device having a secure operating system kernel environment including a secure access server configured to provide access to services provided by the secure operating system kernel environment, and an untrusted software framework providing application programming interface functionality, comprising:

establishing a privileged operating system environment to perform secure media processing operations supported by the secure operating system kernel environment;

establishing a restricted operating system environment to support the untrusted software framework, the restricted operating system environment utilizing process isolation and including

at least one of a plurality of secure access clients configured to interface with the secure access server, each of the plurality of secure access clients having respective access rights to the secure operating system kernel environment via the secure access server, first access rights providing access to the secure operating system kernel environment for a first application and second access rights providing limited access, relative to the first access rights, to the secure operating system kernel environment for a second application; and

executing at least a portion of the untrusted software framework in the restricted operating system environment in accordance with the second access rights.

12. The method of claim 11, wherein the secure operating system kernel environment includes a symmetric multiprocessing Linux-based operating system kernel.

13. The method of claim 12, wherein the untrusted software framework comprises at least one version of an Android framework.

14. The method of claim 11,

providing the secure access server and the plurality of secure access clients operating in combination to regulate interactions between the privileged operating system environment and components of the untrusted software framework.

15. The method of claim 11, the media delivery device further having a set top box application, the secure media processing operations performed in the privileged operating system environment by the set top box application in accordance with the first access rights.

16. The method of claim 11, the media delivery device having a first processing unit and a second processing unit, wherein the privileged operating system environment is executed on the first processing unit and the restricted operating system environment is executed on the second processing unit.

17. A media processing device comprising:

processing circuitry;

a software framework to support software applications; and

an operating system executed by the processing circuitry in a secure operating system environment, the operating system configured to establish;

a privileged operating system environment to perform trusted media processing operations;

at least one restricted operating system environment that utilizes process isolation, the software framework executed in the at least one restricted operating system environment; and

a secure access interface configured to regulate interaction between the secure operating system environment, the privileged operating system environment and the software framework, the secure access interface comprising;

a secure access server executed in the secure operating system environment;

a first secure access client configured to interface with the secure access server, the secure access server configured to provide access to the secure operating system environment by the first secure access client in accordance with first access rights applicable to the trusted media processing operations; and

a second secure access client configured to interface with the secure access server, the secure access server configured to provide access to the secure operating system environment by the second secure access client in accordance with second access rights applicable to the software framework.

18. The media processing device of claim 17, further comprising:

a set top box application for performing the trusted media processing operations.

19. The media processing device of claim 18, the software framework and the set top box application implemented in accordance with at least one version of an Android framework.

20. The media processing device of claim 18, wherein the second access rights are limited as compared to the first access rights.