Secure media path methods, systems, and architectures
View Patent ↗Methods, systems and architectures for processing renderable digital content are described. The various embodiments can protect against unauthorized access or duplication of unprotected content (i.e. decrypted content) once the content has reached a rendering device such as a user's computer. A flexible framework includes an architecture that allows for general media sources to provide virtually any type of multimedia content to any suitably configured rendering device. Content can be protected and rendered locally and/or across networks such as the Internet. The various embodiments can provide a standard platform that can that can be leveraged to protect content across a wide variety of rendering environments, content types, and DRM techniques.
1. A method comprising:
establishing one or more paths of components that are to process and render digital content, the components each having an associated address and a signature, at least one component to pass data to another component;
receiving encrypted content that is to be processed by the one or more paths, the encrypted content being subject to a license that defines, at least in part, how the encrypted data is to be processed;
creating an authenticator to authenticate components along the one or more paths;
determining whether any digital rights management data associated with the content needs to be translated to a form that can be understood by an authenticator's DRM system and, if so, effectuating translation of the digital rights management data by using a separate translator module that is configured to translate the digital rights management data;
querying, with the authenticator, individual components of the one or more paths to ascertain the addresses of the components the queried components pass data to;
creating additional authenticators to authenticate components along the one or more paths, the additional authenticators including a user mode authenticator to authenticate user mode components and a kernel mode authenticator to authenticate kernel mode components;
providing a secure communication channel between the authenticators;
authenticating, with the authenticators, the signatures of the queried components and the components at the addresses of the components that the queried components pass data to;
establishing encryption/decryption keys with multiple components of the one or more paths for the components to use to encrypt and decrypt data.
2. The method of claim 1 , wherein the license specifies one or more revocation lists that can be utilized to ascertain whether individual components have been compromised.
3. The method of claim 1 , wherein the license specifies a level of security that is to be used to protect the encrypted content.
4. The method of claim 1 , wherein the act of establishing the encryption/decryption keys comprises using the secure communication channel between the authenticators to establish the encryption/decryption keys.
5. The method of claim 1 , wherein the act of establishing the encryption/decryption keys comprises establishing session-based keys.
6. The method of claim 1 further comprising periodically re-authenticating the components using the authenticators.
7. A computing device programmed to implement the method of claim 1 .
8. One or more computer-readable media having computer-readable instructions thereon which, when executed by one or more processors, cause the one or more processors to:
establish one or more paths of components that are to process and render digital content, the components each having an associated address and a signature, at least one component to pass data to another component;
receive encrypted content that is to be processed by the one or more paths, the encrypted content being subject to a license that defines, at least in part, how the encrypted data is to be processed;
create multiple authenticators to authenticate components along the one or more paths;
provide a secure communication channel between the authenticators;
query, with the authenticators, individual components of the one or more paths to ascertain the addresses of the components the queried components pass data to;
authenticate, with the authenticators, the signatures of the queried components and the signatures of the components that the queried components pass data to, the authenticators corresponding to the queried components and the components that the gueried components pass data to; and
establish encryption/decryption keys with multiple components of the one or more paths for the components to use to encrypt and decrypt data.
9. The one or more computer-readable media of claim 8 , wherein the instructions cause the one or more processors to establish the encryption/decryption keys using the secure communication channel between the authenticators.
10. The one or more computer-readable media of claim 8 , wherein the instructions cause the one or more processors to establish the session-based encryption/decryption keys using the secure communication channel between the authenticators.
11. A computing device embodying the computer-readable media of claim 8 .
12. A computing device comprising: memory;
one or more processors;
instructions in the memory which, when executed by the one or more processors, cause the one or more processors to:
establish one or more paths of components that are to process and render digital content, the components each having an associated address and a signature, at least one component to pass data to another component;
receive encrypted content that is to be processed by the one or more paths, the encrypted content being subject to a license that defines, at least in part, how the encrypted content is to be processed;
create multiple authenticators to authenticate components along the one or more paths, at least one of the authenticators comprising a user mode authenticator for authenticating user mode components, and at least one other of the authenticators comprising a kernel mode authenticator for authenticating kernel mode components;
provide a secure communication channel between the authenticators;
query, with the authenticators, individual components of the one or more paths to ascertain the addresses of the components the queried components pass data to;
authenticate, with the authenticators, queried components and, if possible, the signatures of the components that the queried components pass data to; and
establish encryption/decryption keys with multiple components of the one or more paths for the components to use to encrypt and decrypt data.
13. The computing device of claim 12 , wherein the license specifies one or more revocation lists that can be utilized to ascertain whether individual components have been compromised.
14. The computing device of claim 12 , wherein identification information is passed up a chain of encrypted channels associated with the authenticators to allow for component verification, without requiring revocation lists to be propagated down the chain.
15. The computing device of claim 12 , wherein the license specifies a level of security that is to be used to protect the encrypted data.
16. The computing device of claim 12 , wherein the instructions cause the one or more processors to establish session-based keys.