A method for processing renderable digital media using an architecture for providing a protected media path along a chain of components from a content source to a rendering hardware, the chain comprising a content source component, a client component (304, 404, 604, 704), a demultiplexer, a decoder, an encryptor, an application for processing and mixing data streams and a renderer component (314, 414, 614, 714) as user mode components, the chain comprising further a rendering hardware as a kernel mode component, the method comprising: receiving, with the client component, encrypted content that is to be protected during a rendering process and digital rights management data associated with the content; determining by the client component whether any digital rights management data associated with the content needs to be translated to a form that can be understood by an authenticator's DRM system and, if so, effectuating translation of the digital rights management data, wherein translating is accomplished with a separate translator module; receiving by the client component a manifest associated with the content, the manifest specifying protected media path requirements for the rendering process; verifying by a secure server that the client component is a trusted component, by verifying a digital signature that is associated with the client; creating by the client component a primary authenticator (318, 418, 618, 718) that can be used to authenticate one or more components downstream from the client component, wherein the primary authenticator is a user mode authenticator for verifying user mode components; articulating by the client or one or more downstream components, to the primary authenticator, one or more downstream components that need to be authenticated; authenticating one or more downstream components using the primary authenticator; creating by the renderer component at least one secondary authenticator (320, 322, 420, 422, 620, 622, 720), which is verified by the primary authenticator, wherein the at least one secondary authenticator comprises a user mode authenticator for verifying the renderer component and a kernel mode authenticator for verifying kernel mode components; establishing by the authenticators a secure channel between the primary and the at least one secondary authenticator through which they can communicate in order to allow the components to communicate with one another using the secure channel, and allow the one or more components to set up session keys for use during the rendering process; articulating to the at least one secondary authenticator one or more downstream components that need to be authenticated; and authenticating one or more downstream components using the at least one secondary authenticator. receiving, with the client component, encrypted content that is to be protected during a rendering process and digital rights management data associated with the content; determining by the client component whether any digital rights management data associated with the content needs to be translated to a form that can be understood by an authenticator's DRM system and, if so, effectuating translation of the digital rights management data, wherein translating is accomplished with a separate translator module; receiving by the client component a manifest associated with the content, the manifest specifying protected media path requirements for the rendering process; verifying by a secure server that the client component is a trusted component, by verifying a digital signature that is associated with the client; creating by the client component a primary authenticator (318, 418, 618, 718) that can be used to authenticate one or more components downstream from the client component, wherein the primary authenticator is a user mode authenticator for verifying user mode components; articulating by the client or one or more downstream components, to the primary authenticator, one or more downstream components that need to be authenticated; authenticating one or more downstream components using the primary authenticator; creating by the renderer component at least one secondary authenticator (320, 322, 420, 422, 620, 622, 720), which is verified by the primary authenticator, wherein the at least one secondary authenticator comprises a user mode authenticator for verifying the renderer component and a kernel mode authenticator for verifying kernel mode components; establishing by the authenticators a secure channel between the primary and the at least one secondary authenticator through which they can communicate in order to allow the components to communicate with one another using the secure channel, and allow the one or more components to set up session keys for use during the rendering process; articulating to the at least one secondary authenticator one or more downstream components that need to be authenticated; and authenticating one or more downstream components using the at least one secondary authenticator.