Content playback APIS using encrypted streams

One embodiment of the present invention sets forth a technique for decrypting digital content in a secure environment. The technique includes the steps of receiving a digital rights management (DRM) license associated with a first frame of encrypted data from a DRM server, where the DRM license includes a decryption key for decrypting the first frame of encrypted data, transmitting the DRM license to a secure content playback pipeline for storage, and transmitting the first frame of encrypted data to the secure content playback pipeline for decryption, where, in response to receiving the first frame of encrypted data, a trusted processing entity within the secure content playback pipeline decrypts the first frame of encrypted data based on the decryption key included in the DRM license to generate a first set of decrypted data and store the first set of decrypted data in a secure memory space.

BACKGROUND OF THE INVENTION

1. Field of the Invention

Embodiments of the present invention relate generally to digital media and, more specifically, to content playback APIs using encrypted streams.

2. Description of the Related Art

Digital content distribution systems conventionally include a content server, a content player, and a communications network connecting the content server to the content player. The content server is configured to store digital content files, which can be downloaded from the content server to the content player. Each digital content file corresponds to a specific identifying title, such as “Gone with the Wind,” which is familiar to a user. The digital content file typically includes sequential content data, organized according to playback chronology, and may comprise audio data, video data, or a combination thereof.

The content player is configured to download and play a digital content file, in response to a user request selecting the title for playback. The process of playing the digital content file includes decoding and rendering audio and video data into an audio signal and a video signal, which may drive a display system having a speaker subsystem and a video subsystem. Playback typically involves a technique known in the art as “streaming,” whereby the content server sequentially transmits the digital content file to the content player, and the content player plays the digital content file while content data is received that comprises the digital content file.

Content data is typically encrypted and needs to be decrypted before the data can be played. The playback process, therefore, includes four steps, (i) retrieve content, (ii) decrypt content, (iii) decode content and (iv) output content. For the purposes of content protection, the content is most vulnerable and step (ii). At this step, the decrypted (and, therefore, unprotected) but still compressed content data is available. Since it is not always desirable or possible to prevent execution of un-trusted code, the decrypted content at step (ii) is vulnerable to attacks from third-party applications.

As the foregoing illustrates, what is needed in the art is an approach for decrypting digital data in a secure environment.

SUMMARY OF THE INVENTION

One embodiment of the present invention sets forth a method for decrypting digital data within a secure execution environment. The method comprises the steps of receiving a digital rights management (DRM) license associated with a first frame of encrypted data from a DRM server, where the DRM license includes a decryption key for decrypting the first frame of encrypted data, transmitting the DRM license to a secure content playback pipeline for storage, and transmitting the first frame of encrypted data to the secure content playback pipeline for decryption, where, in response to receiving the first frame of encrypted data, a trusted processing entity within the secure content playback pipeline decrypts the first frame of encrypted data based on the decryption key included in the DRM license to generate a first set of decrypted data and store the first set of decrypted data in a secure memory space.

One advantage of the disclosed technique is that the encrypted digital content is decrypted in a secure environment of the trusted execution environment and, therefore, is less vulnerable to attacks from a malicious third-party application executing on the CPU.

DETAILED DESCRIPTION

FIG. 1illustrates a content distribution system100configured to implement one or more aspects of the invention. As shown, the content distribution system100includes a content distribution network (CDN)102, a communications network104, a digital rights management (DRM) server106and an endpoint device108.

The communications network104includes a plurality of network communications systems, such as routers and switches, configured to facilitate data communication between the CDN102, the DRM server and the endpoint device108. Persons skilled in the art will recognize that many technically feasible techniques exist for building the communications network104, including technologies practiced in deploying the well-known internet communications network.

The endpoint device108may comprise a computer system, a set top box, a mobile device such as a mobile phone, or any other technically feasible computing platform that has network connectivity and is coupled to or includes a display device and speaker device for presenting video frames, and generating acoustic output, respectively.

The CDN102comprises one or more computer systems configured to serve download requests for digital content files received from the endpoint device108. The digital content files may reside on a mass storage system accessible to the computer system. The mass storage system may include, without limitation, direct attached storage, network attached file storage, or network attached block-level storage. The digital content files may be formatted and stored on the mass storage system using any technically feasible technique. A data transfer protocol, such as the well-known hyper-text transfer protocol (HTTP), may be used to download digital content files from the CDN102to the endpoint device108.

The DRM server106serves requests for licenses associated with encrypted digital content files received from the endpoint device108. In operation, an encrypted digital content file downloaded from the CDN102by the endpoint device108must be decrypted before the digital content file can be played. The license associated with the encrypted digital content file is stored in the DRM server106and is transmitted to the endpoint device108, which in turn uses the license to decrypt the digital content file.FIGS. 2 and 3describe in detail a technique for securely decrypting encrypted digital content files.

Although, in the above description, the content distribution system100is shown with one endpoint device108and one CDN102, persons skilled in the art will recognize that the architecture ofFIG. 1contemplates only an exemplary embodiment of the invention. Other embodiments may include any number of endpoint devices108and/or CDNs102. Thus,FIG. 1is in no way intended to limit the scope of the present invention in any way.

FIG. 2is a more detailed view of the endpoint device108ofFIG. 1, according to one embodiment of the invention. As shown, the endpoint device108includes, without limitation, a central processing unit (CPU)210, a graphics subsystem212, an input/output (I/O) device interface214, a network interface218, a secure memory space220, an interconnect222, a memory subsystem230, a trusted execution environment (TEE)242and an audio/video decoder244. The endpoint device108may also include a mass storage unit216.

The CPU210is configured to retrieve and execute programming instructions stored in the memory subsystem230. Similarly, the CPU210is configured to store and retrieve application data residing in the memory subsystem230. The interconnect222is configured to facilitate transmission of data, such as programming instructions and application data, between the CPU210, graphics subsystem212, I/O devices interface214, mass storage216, network interface218, secure memory space220and memory subsystem230.

The graphics subsystem212is configured to generate frames of video data and transmit the frames of video data to display device250. In one embodiment, the graphics subsystem212may be integrated into an integrated circuit, along with the CPU210. The display device250may comprise any technically feasible means for generating an image for display. For example, the display device250may be fabricated using liquid crystal display (LCD) technology, cathode-ray technology, and light-emitting diode (LED) display technology (either organic or inorganic). An input/output (I/O) device interface214is configured to receive input data from user I/O devices252and transmit the input data to the CPU210via the interconnect222. For example, user I/O devices252may comprise one of more buttons, a keyboard, and a mouse or other pointing device. The I/O device interface214also includes an audio output unit configured to generate an electrical audio output signal. User I/O devices252includes a speaker configured to generate an acoustic output in response to the electrical audio output signal. In alternative embodiments, the display device250may include the speaker. A television is an example of a device known in the art that can display video frames and generate an acoustic output. A mass storage unit216, such as a hard disk drive or flash memory storage drive, is configured to store non-volatile data. A network interface218is configured to transmit and receive packets of data via the communications network120. In one embodiment, the network interface218is configured to communicate using the well-known Ethernet standard. The network interface218is coupled to the CPU210via the interconnect222.

The memory subsystem230includes programming instructions and data that comprise an operating system232, a user interface234, a playback application236, a digital rights management (DRM) agent238and a playback application programming interface (API)240. The operating system232performs system management functions such as managing hardware devices including the network interface218, mass storage unit216, I/O device interface214, and graphics subsystem212. The operating system232also provides process and memory management models for the user interface234and the playback application236. The user interface234provides a specific structure, such as a window and object metaphor, for user interaction with endpoint device108. Persons skilled in the art will recognize the various operating systems and user interfaces that are well-known in the art and suitable for incorporation into the endpoint device108.

The playback application236is configured to retrieve encrypted digital content from the CDN102via the network interface218. In addition, the playback application236is configured to interact with the DRM agent238via the playback API240so that the retrieved digital content is decrypted and rendered. In operation, the playback application236first retrieves the header information associated with a digital content file to be played from the CDN102. The playback application236then transmits a request for a DRM challenge that includes the header information to the DRM agent238via the playback API240. In response to the request, the DRM agent238generates a DRM challenge that is encrypted by an encryption/decryption module executing in the TEE242. The DRM agent238then transmits the DRM challenge to the playback application236.

Once the playback application236receives the DRM challenge, a request for a DRM license that includes the DRM challenge is transmitted to the DRM server106. As previously described herein, the DRM server106, upon receiving the DRM challenge, transmits a DRM license associated with the digital content file to be played to the playback application236. The DRM license includes the decryption key needed to decrypt the encrypted digital content file. Upon receipt, the playback application236transmits the DRM license to the DRM agent238via the playback API240for storage in the TEE242. In another embodiment, the TEE242only stores the decryption key included in the DRM license. In addition, the playback application236transmits a request for a decryption context generated based on the DRM license to the DRM agent238via the playback API240. Any subsequent decryption and rendering operations are performed using the decryption context generated by the DRM agent238.

Again, the playback application236is configured to retrieve encrypted digital content from the CDN102via the network interface218. Once the encrypted digital content is retrieved from the CDN102and the decryption context is received from the DRM agent238, the playback application236transmits the encrypted digital content along with the decryption context to the DRM agent238for decryption and rendering. The DRM agent238, in turn, transmits the encrypted digital content and the decryption context to the TEE242. The TEE242decrypts the encrypted digital content using decryption algorithms within the TEE242. Importantly, the TEE242is a secure processing environment, and a third-party application executing outside the TEE242cannot access the decrypted digital content. The decrypted digital content is then stored in the secure memory space220. In an alternate embodiment, the decrypted digital content is stored in a memory space that is not secure, i.e., a standard random access memory (RAM). In such an embodiment, the same decryption and rendering processes described herein still apply. In addition, a pointer to the storage location that stores the decrypted digital content is transmitted to the DRM agent238.

The DRM agent238, in response to receiving the pointer to the storage location that stores the decrypted digital content, transmits a request to the audio/video decoder244to render the decrypted digital content. In an alternate embodiment, the TEE242transmits the pointer to the storage location that stores the decrypted digital content directly to the audio/video decoder244to render the decrypted digital content.

In the case of video data, the audio/video decoder244reads units of video data from the secure memory space220, and renders the units of video data into a sequence of video frames corresponding in duration to the fixed span of playback time. The sequence of video frames is processed by graphics subsystem212and transmitted to the display device250. In the case of audio data, the audio/video decoder244reads units of audio data from the secure memory space220, and renders the units of audio data into a sequence of audio samples, generally synchronized in time with the sequence of video frames. In one embodiment, the sequence of audio samples is transmitted to the I/O device interface214, which converts the sequence of audio samples into the electrical audio signal. The electrical audio signal is transmitted to the speaker within the user I/O devices252, which, in response, generates an acoustic output.

It should be noted that any combination of encrypted/unencrypted audio/video data can be processed by the system described herein. In some cases, both audio and video data are encrypted, while in other cases only one of the audio or video data is encrypted.

In such a manner, the encrypted digital content is decrypted in a secure environment of the TEE242and, therefore, is less vulnerable to attacks from a malicious third-party application executing on the CPU210.

FIG. 3is a flow diagram of method steps for decrypting and rendering encrypted audio/video content, according to one embodiment of the invention. Although the method steps are described in conjunction with the systems forFIGS. 1-2, persons skilled in the art will understand that any system configured to perform the method steps, in any order, is within the scope of the invention.

The method300begins at step302, where the playback application236retrieves header information associated with a digital content file (audio/video data) to be played from the CDN102. The playback application236then transmits a request for a DRM challenge that includes the header information to the DRM agent238via the playback API240. At step304, the DRM agent238generates a DRM challenge based on the header information that is then encrypted by an encryption/decryption module executing in the TEE242. The DRM agent238then transmits the DRM challenge to the playback application236.

At step306, the playback application236transmits a request for a DRM license that includes the DRM challenge to the DRM server106. As previously described herein, the DRM server106, upon receiving the DRM challenge, transmits a DRM license associated with the digital content file to be played to the playback application236. The DRM license includes the decryption key needed to decrypt the encrypted digital content file. At step308, the playback application236transmits the DRM license to the DRM agent238via the playback API240for storage in the TEE242.

At step310, the playback application236retrieves the encrypted digital content from the CDN102via the network interface218. At step312, the playback application236transmits the encrypted digital content to the DRM agent238for decryption and rendering. The DRM agent238, in turn, transmits the encrypted digital content to the TEE242, and the TEE242decrypts the encrypted digital content. The decrypted digital content is then stored in the secure memory space220. In addition, a pointer to the storage location that stores the decrypted digital content is transmitted to the DRM agent238.

At step314, the DRM agent238, in response to receiving the pointer to the storage location that stores the decrypted digital content, transmits a request to the audio/video decoder244to render the decrypted digital content.

One advantage of the disclosed technique is that the encrypted digital content is decrypted in a secure environment of the TEE242and, therefore, is less vulnerable to attacks from a malicious third-party application executing on the CPU210.

One embodiment of the invention may be implemented as a program product stored on computer-readable storage media within the endpoint device108. In this embodiment, the endpoint device108comprising an embedded computer platform such as a set top box. An alternative embodiment of the invention may be implemented as a program product that is downloaded to a memory within a computer system, for example as executable instructions embedded within an internet web site. In this embodiment, the endpoint device108comprises the computer system.

In view of the foregoing, the scope of the present invention is determined by the claims that follow.