Method and apparatus to using storage devices to implement digital rights management protection
Embodiments of systems, apparatuses, and methods to securely download digital rights managed content with a client are described. In some embodiments, a system establishes a secure root of trust for the client. In addition, the system establishes a secure tunnel between an agent of the client and a storage system of the client. Furthermore, the system securely downloads the digital rights managed content to the storage system via the secure tunnel and securely provides the digital rights managed content from the storage system to a display.
1. A method to securely download digital rights managed content with a client, comprising:
establishing a secure root of trust for the client;
establishing a secure tunnel between an agent of the client and a storage system of the client;
securely downloading the digital rights managed content from a remote service provider to a secure storage of the storage system via the secure tunnel, wherein the secure storage is not accessible to an operating system of the client, wherein the securely downloading the digital rights managed content comprises: authenticating with a service that manages the digital rights managed content, negotiating a content specific key for the digital rights managed content, and storing the content specific key in the storage system;
receiving a request for the digital rights managed content from another entity, decrypting the digital rights managed content, re-encrypting the digital rights managed content as per a root of trust protocol, and providing the re-encrypted digital rights managed content to the another entity; and
securely providing the digital rights managed content from the storage system to a display;
wherein the agent further provides the re-encrypted digital rights managed content to a display.
2. The method of claim 1 , wherein the digital rights managed content stored in the secure storage is accessible via a private interface.
3. The method of claim 2 , wherein the securely downloading the digital rights managed content comprises: receiving the digital rights managed content, the digital rights managed content encrypted using the content specific key; and storing the digital rights managed content and metadata associated with the digital rights managed content in the storage system.
4. The method of claim 1 , wherein establishing of the secure root of trust comprises provisioning a public key into the storage system.
5. The method of claim 1 , wherein the secure tunnel uses an action and results mailbox.
6. A device to securely download and display digital rights managed content, comprising:
a storage system, including,
an agent to establish a secure root of trust for the device;
a secure storage to establish a secure tunnel with a remote service provider, to securely download the digital rights managed content from the remote service provider to the secure storage via the secure tunnel, and to securely provide the digital rights managed content from the storage system, wherein the secure storage is not accessible to an operating system of the device and the secure storage includes physical storage,
wherein the agent to
securely download the digital rights managed content,
authenticate with the remote service provider that manages the digital rights managed content,
negotiate a content specific key for the digital rights managed content,
store the content specific key in the secure storage,
receive a request for the digital rights managed content from another entity,
decrypt the digital rights managed content,
re-encrypt the digital rights managed content as per root of trust protocol, and
provide the re-encrypted digital rights managed content to the another entity.
7. The device of claim 6 , wherein the digital rights managed content stored in the secure storage is accessible via a private interface.
8. The device of claim 6 , wherein the agent, to securely download the digital rights managed content, is further configured to receive the digital rights managed content, the digital rights managed content encrypted using the content specific key, and store the digital rights managed content and metadata associated with the digital rights managed content in the storage system.
9. A system to securely download digital rights managed content, comprising:
a service provider that manages and stores the digital rights managed content; and
a storage system, including,
an agent that establishes a secure root of trust for the device coupled to the storage system with the service provider, and
a secure storage that establishes a secure tunnel with the service provider, securely downloads the digital rights managed content to the secure storage via a tunnel with the service provider, and securely provides the digital rights managed content to a display, wherein the secure storage is not accessible to an operating system of the device and the secure storage includes physical storage,
wherein the agent to
securely download the digital rights managed content,
authenticate with the remote service provider that manages the digital rights managed content,
negotiate a content specific key for the digital rights managed content,
store the content specific key in the secure storage,
receive a request for the digital rights managed content from another entity,
decrypt the digital rights managed content,
re-encrypt the digital rights managed content as per root of trust protocol, and
provide the re-encrypted digital rights managed content to the another entity.
10. The system of claim 9 , wherein digital rights managed content stored in the secure storage is accessible via a private interface.
11. The system of claim 9 , wherein the service provider provisions a public key for the agent.
12. A non-transitory machine-readable medium having executable instructions to cause one or more processing units to perform a method to securely download digital rights managed content with a client, the method comprising:
establishing a secure root of trust for the client;
establishing a secure tunnel between an agent of the client and a storage system of the client;
securely downloading the digital rights managed content from a remote service provider to a secure storage of the storage system via the secure tunnel, wherein the secure storage is not accessible to an operating system of the client, wherein the securely downloading the digital rights managed content comprises: authenticating with a service that manages the digital rights managed content, negotiating a content specific key for the digital rights managed content, and storing the content specific key in the storage system;
receiving a request for the digital rights managed content from another entity, decrypting the digital rights managed content, re-encrypting the digital rights managed content as per a root of trust protocol, and providing the re-encrypted digital rights managed content to the another entity; and
securely providing the digital rights managed content from the storage system to a display;
wherein the agent further provides the re-encrypted digital rights managed content to a display.