A method in a client device for decrypting and decoding media assets through a secure data path, comprising: encrypting, by a secure core in a secure execution environment of the client device, a device certificate template and a private key using a key that is unique to the client device; storing the encrypted device certificate template and the private key in global memory in a common execution environment; receiving, by a host core in the common execution environment, a request to play a protected media asset; receiving, by the host core, the protected media asset and metadata for the protected media asset that includes a media asset key identifier of the protected media asset; reading, by the host core, the encrypted device certificate template and the private key and passing the encrypted device certificate template and the private key to the secure core; decrypting, by the secure core, the encrypted device certificate template and the private key using the key that is unique to the client device; generating, by the secure core using the device certificate template, a unique device certificate that is unique to the client device that includes a public key that corresponds to the private key; storing, by the secure core, the unique device certificate in a restricted memory of the secure execution environment; generating, by the secure core, a license challenge that includes the unique device certificate and the media asset key identifier; passing the generated license challenge from the secure core to the host core; transmitting, by the host core the generated license challenge to a license server; receiving, by the host core a response from the license server that includes an encrypted content key for decrypting the protected media asset, wherein at least the encrypted content key is encrypted with the public key of the unique device certificate; passing the encrypted content key to the secure core; decrypting, by the secure core using the private key, the encrypted content key to reveal a decrypted content key for decrypting the protected media asset; storing, by the secure core the decrypted content key in the restricted memory; passing the protected media asset from the host core to the secure core; decrypting, by the secure core, the protected media asset using the decrypted content key; and decoding, by a decoder in the secure execution environment, the decrypted media asset. encrypting, by a secure core in a secure execution environment of the client device, a device certificate template and a private key using a key that is unique to the client device; storing the encrypted device certificate template and the private key in global memory in a common execution environment; receiving, by a host core in the common execution environment, a request to play a protected media asset; receiving, by the host core, the protected media asset and metadata for the protected media asset that includes a media asset key identifier of the protected media asset; reading, by the host core, the encrypted device certificate template and the private key and passing the encrypted device certificate template and the private key to the secure core; decrypting, by the secure core, the encrypted device certificate template and the private key using the key that is unique to the client device; generating, by the secure core using the device certificate template, a unique device certificate that is unique to the client device that includes a public key that corresponds to the private key; storing, by the secure core, the unique device certificate in a restricted memory of the secure execution environment; generating, by the secure core, a license challenge that includes the unique device certificate and the media asset key identifier; passing the generated license challenge from the secure core to the host core; transmitting, by the host core the generated license challenge to a license server; receiving, by the host core a response from the license server that includes an encrypted content key for decrypting the protected media asset, wherein at least the encrypted content key is encrypted with the public key of the unique device certificate; passing the encrypted content key to the secure core; decrypting, by the secure core using the private key, the encrypted content key to reveal a decrypted content key for decrypting the protected media asset; storing, by the secure core the decrypted content key in the restricted memory; passing the protected media asset from the host core to the secure core; decrypting, by the secure core, the protected media asset using the decrypted content key; and decoding, by a decoder in the secure execution environment, the decrypted media asset.