DRM functionality in devices can be supported wholly via software, for example, by being built into a device’s operating system or a library module. Some devices have DRM clients that have been integrated in a way that uses security features of the underlying chipset to pipeline the video playback system. This provides a ‘hardware protection’ layer to the logic of the DRM client and protects any decryption keys or unencrypted video from being intercepted by malicious code running in parallel with the DRM client software. The hardware support is offered by devices that use ARM TrustZone or similar secure processor element in their architecture. The details of how security is implemented at this level are beyond the scope of this FAQ, but fundamentally tie the DRM logic to the hardware implemented identifier of the device chipset and the individualized secret keys programmed alongside this identifier at manufacture time. Sometimes the shorthand way to refer to this setup is a “hardware root of trust”.