System and method for digital content player with secure processing vault

• US 7,660,769 B2
• Filed: 09/12/2006
• Issued: 02/09/2010
• Est. Priority Date: 09/12/2006
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Shimizu, Kanna
• Primary Examiner(s): Elisca; Pierre E
• Application Number:
  US11/530,940
• Publication Number:
  US 20080065547A1
• Time in Patent Office: 1,246 Days
• Field of Search: 705/50, 705/51, 705/57
• US Class Current: 705/50
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/72 in cryptographic circuits

Abstract

A system and method for digital content player with secure processing vault is presented. A system uses an attached processing unit and a local storage area as a hardware-based secure processing vault. The secure processing vault calculates a title key based upon stored device keys, and decrypts encrypted/encoded digital content using the calculated title key. The decryption process results in encoded digital content, which remains within the secure processing vault until the secure processing vault decodes the encoded digital content. The decoded digital content is then passed to a main processing unit or a graphics card for further processing. In one embodiment, a secure processing vault may process multiple threads in parallel. In another embodiment, multiple secure processing vaults may be used to process a single, highly computational thread.

Claims

1. A computer-implemented method comprising:

receiving encrypted/encoded digital content within a secure processing vault;

retrieving an encrypted device key from an external storage area into an isolated local storage area located within the secure processing vault;

decrypting the encrypted device key within the secure processing vault, resulting in a decrypted device key;

calculating, by a processor, a title key within the secure processing vault using the decrypted device key;

decrypting the encrypted/encoded digital content within the secure processing vault using the title key, the decrypting resulting in encoded digital content that is isolated from any processes external to the secure processing vault;

decoding the encoded digital content within the secure processing vault, the decoding resulting in decoded digital content; and

providing the decoded digital content to one or more processes external the secure processing vault.

2. The method of claim 1 wherein the secure processing vault includes an attached processing unit and the isolated local storage area that are externally inaccessible when the secure processing vault is locked.

3. method of claim 2 further comprising:

receiving a thread request from a main processing unit at the attached processing unit;

in response to receiving the thread request, locking the secure processing vault prior to the decrypting and the decoding; and

authenticating the received thread request subsequent to the locking of the secure processing vault.

4. The method of claim 3 further comprising:

receiving a plurality of thread requests corresponding to a plurality of encrypted/encoded digital content from the main processing unit at the attached processing unit, the thread request included in the plurality of thread requests and the encrypted/encoded digital content included in the plurality of encrypted/encoded digital content; and

in response to receiving the plurality of thread requests, performing the decrypting, the decoding, and the providing for each of the plurality of thread requests simultaneously within the secure processing vault.

5. The method of claim 3 wherein the main processing unit and the attached processing unit are located on separate processor cores.

6. The method of claim 5 wherein the separate processor cores are heterogeneous.

7. The method of claim 2 wherein the attached processing unit accesses the local storage area using physical address locations without the use of an address translation mechanism.

8. The method of claim 1 wherein the method includes a plurality of secure processing vaults, the secure processing vault included in the plurality of secure processing vaults, and wherein each of the plurality of secure processing vaults includes an attached processing unit and a local storage area, the decoding further comprising:

partially decoding the encoded digital content at the secure processing vault, resulting in partially decoded digital content;

encrypting the partially decoded digital content within the secure processing vault, resulting in encrypted partially decoded digital content;

sending the encrypted partially decoded digital content to a different secure processing vault included in the plurality of secure processing vaults;

decrypting, at the different secure processing vault, the encrypted partially decoded digital data, resulting in the partially decoded digital content; and

further decoding the partially decoded digital content within the different secure processing vault, the further decoding resulting in the decoded digital content.

9. The method of claim 1 wherein the decoded digital content is selected from the group consisting of a digital video content stream and a digital audio content stream.

10. The method of claim 1 wherein the encrypted/encoded digital content is based upon a broadcast encryption technology.

11. The method of claim 1 wherein at least one of the processes is located on a device selected from the group consisting of a main processing unit and a graphics card.

12. An apparatus comprising:

one or more secure processing vaults that are each programmed to;

receive encrypted/encoded digital content;

retrieve an encrypted device key from an external storage area into an isolated local storage area located within the secure processing vault;

decrypt the encrypted device key within the secure processing vault, resulting in a decrypted device key;

calculate a title key within the secure processing vault using the decrypted device key;

decrypt the encrypted/encoded digital content using the title key, the decrypting resulting in encoded digital content that is isolated from any processes external to the secure processing vault;

decode the encoded digital content, the decoding resulting in decoded digital content; and

provide the decoded digital content to one or more processes external the secure processing vault.

13. The apparatus of claim 12 wherein the secure processing vault includes an attached processing unit and the isolated local storage area that are externally inaccessible when the secure processing vault is locked.

14. The apparatus of claim 13 wherein the secure processing vault is further programmed to:

receive a thread request from a main processing unit at the attached processing unit;

in response to receiving the thread request, lock the secure processing vault prior to the decrypting and the decoding; and

authenticate the received thread request subsequent to the locking of the secure processing vault.

15. The apparatus of claim 14 wherein the secure processing vault is further programmed to:

receive a plurality of thread requests corresponding to a plurality of encrypted/encoded digital content from the main processing unit at the attached processing unit, the thread request included in the plurality of thread requests and the encrypted/encoded digital content included in the plurality of encrypted/encoded digital content; and

in response to receiving the plurality of thread requests, perform the decrypting, the decoding, and the providing for each of the plurality of thread requests simultaneously within the secure processing vault.

16. The apparatus of claim 14 wherein the main processing unit and the attached processing unit are located on separate processor cores.

17. The apparatus of claim 16 wherein the separate processor cores are heterogeneous.

18. The apparatus of claim 13 wherein the attached processing unit accesses the local storage area using physical address locations without the use of an address translation mechanism.

19. The apparatus of claim 12 wherein the apparatus includes a plurality of secure processing vaults, the secure processing vault included in the plurality of secure processing vaults, and wherein each of the plurality of secure processing vaults includes an attached processing unit and a local storage area, the apparatus further programmed to:

partially decode the encoded digital content at the secure processing vault, resulting in partially decoded digital content;

encrypt the partially decoded digital content within the secure processing vault, resulting in encrypted partially decoded digital content;

send the encrypted partially decoded digital content to a different secure processing vault included in the plurality of secure processing vaults;

decrypt, at the different secure processing vault, the encrypted partially decoded digital data, resulting in the partially decoded digital content; and

further decode the partially decoded digital content within the different secure processing vault, the further decoding resulting in the decoded digital content.

20. The apparatus of claim 12 wherein the decoded digital content is selected from the group consisting of a digital video content stream and a digital audio content stream.

21. The apparatus of claim 12 wherein the encrypted/encoded digital content is based upon a broadcast encryption technology.

22. The apparatus of claim 12 wherein at least one of the processes is located on a device selected from the group consisting of a main processing unit and a graphics card.

23. An information handling system comprising:

a main processing device;

an attached processing device;

an isolated local storage area; and

a digital content processing tool for processing digital content, the digital content processing tool being programmed to;

receive encrypted/encoded digital content at a secure processing vault that includes the attached processing unit and the isolated local storage area;

retrieve an encrypted device key from an external storage area into the isolated local storage;

decrypt the encrypted device key within the secure processing vault, resulting in a decrypted device key;

calculate a title key within the secure processing vault using the decrypted device key;

decrypt the encrypted/encoded digital content using the title key within the secure processing vault, the decrypting resulting in encoded digital content that is isolated from any processes external to the secure processing vault;

decode the encoded digital content within the secure processing vault, the decoding resulting in decoded digital content; and

provide the decoded digital content to one or more processes external the secure processing vault.

24. The information handling system of claim 23 wherein the attached processing unit and the isolated local storage area are externally inaccessible when the secure processing vault is locked.

25. The information handling system of claim 24 wherein the digital content processing tool is further programmed to:

receive a thread request from the main processing unit at the attached processing unit;

in response to receiving the thread request, lock the secure processing vault prior to the decrypting and the decoding; and

authenticate the received thread request subsequent to the locking of the secure processing vault.

26. The information handling system of claim 25 wherein the digital content processing tool is further programmed to:

receive a plurality of thread requests corresponding to a plurality of encrypted/encoded digital content from the main processing unit at the attached processing unit, the thread request included in the plurality of thread requests and the encrypted/encoded digital content included in the plurality of encrypted/encoded digital content; and

in response to receiving the plurality of thread requests, perform the decrypting, the decoding, and the providing for each of the plurality of thread requests simultaneously within the secure processing vault.

27. The information handling system of claim 25 wherein the main processing unit and the attached processing unit are located on separate processor cores.

28. The information handling system of claim 27 wherein the separate processor cores are heterogeneous.

29. The information handling system of claim 24 wherein the attached processing unit accesses the local storage area using physical address locations without the use of an address translation mechanism.

30. The information handling system of claim 23 wherein the information handling system includes a plurality of secure processing vaults, the secure processing vault included in the plurality of secure processing vaults, the digital content processing tool further programmed to:

partially decode the encoded digital content at the secure processing vault, resulting in partially decoded digital content;

encrypt the partially decoded digital content within the secure processing vault, resulting in encrypted partially decoded digital content;

send the encrypted partially decoded digital content to a different secure processing vault included in the plurality of secure processing vaults;

decrypt, at the different secure processing vault, the encrypted partially decoded digital data, resulting in the partially decoded digital content; and

further decode the partially decoded digital content within the different secure processing vault, the further decoding resulting in the decoded digital content.

31. The information handling system of claim 23 wherein the decoded digital content is selected from the group consisting of a digital video content stream and a digital audio content stream.

32. The information handling system of claim 23 wherein the encrypted/encoded digital content is based upon a broadcast encryption technology.