Patent ID: 7254836

Claim:
A common computing device having instantiated thereon a protected media path for delivering encrypted content from a sources to a plurality of sinks, the protected media path comprising: a media base providing a protected enviromnent in the common computing device and including a common infrastructure of core components effectuating processing of content from a first sources of the plurality content delivering source the processed content to a first sink of the plurality of sinks, and also including a policy engine enforcing policy on behalf of the first source, the policy corresponding to the content from the first source and including rules and requirements for accessing and rendering the content, whereby the media base allows content to flow through the common computing device in a protected fashion, and allows for arbitrary processing of the protected content in the common computing device; a source trust authority (SOTA) in the common computing device and associated with and corresponding to the first source of the content, the SOTA acting as a secure lockbox connecting the first source to the media base and representing the first source in the protected media path, decrypting the content from the first source, translating policy associated with the content from a native format of the first source into a format amenable to the policy engine, propagating the translated policy to the policy engine, and releasing the decrypted content to the media base; and a sink trust authority (SITA) in the common computing device and associated with and corresponding to the first sink of content, the SITA acting as a secure lockbox connecting the first sink to the media base and representing the first sink in the protected media path, re-encrypting the decrypted content released by the SOTA, receiving the translated policy from the policy engine, and re-translating the translated policy from the format of the policy engine into a format amenable to the first sink, whereby the re-encrypted content and the re-translated policy are delivered to the first sink, and whereby the first sink receives the re-encrypted content and the re-translated policy, decrypts the received content, and renders same based on the received policy.