Enhanced security for hardware decoder accelerator
View Patent ↗A software security layer may be used to protect a system against exploitation of a hardware encoder accelerator by malicious data embedded in the one or more frames of encoded digital streaming data. It is emphasized that this abstract is provided to comply with the rules requiring an abstract that will allow a searcher or other reader to quickly ascertain the subject matter of the technical disclosure. It is submitted with the understanding that it will not be used to interpret or limit the scope or meaning of the claims.
1. A method, comprising:
receiving one or more frames of encoded digital streaming data in a system having a processor module, a memory and a hardware decoder accelerator;
decoding the one or more frames of encoded digital streaming data using the hardware decoder accelerator;
using a software security layer to protect the system against exploitation of the hardware decoder accelerator by malicious data embedded in the one or more frames of encoded digital streaming data, wherein the software security layer performs a data value check on data within the one or more frames when the data is used.
2. The method of claim 1 , wherein the software security layer is implemented in firmware of the system.
3. The method of claim 1 , wherein the software security layer is implemented in a kernel driver in system software of the system.
4. The method of claim 1 , wherein the software security layer is implemented in a software layer above a kernel driver in system software of the system.
5. The method of claim 1 , wherein the software security layer is configured to calculate a necessary size of one or more buffers used in decoding the one or more frames and verify if all memory within a range is valid.
6. The method of claim 1 , wherein the software security layer is configured to protect one or more buffers used in decoding the one or more frames from any user process access once a task is submitted.
7. The method of claim 6 , wherein the software security layer is configured to copy the one or more buffers from a user memory space to a secure memory space.
8. The method of claim 6 , wherein the software security layer is configured to locking one or more memory pages within a data range being written from by a user process.
9. The method of claim 1 , wherein when the hardware accelerator decodes coded streams at higher than a macroblock level, the software security layer rejects any input bitstreams for which buffer size related parameters coded in the stream mismatch with these parameters in a user's request.
10. The method of claim 1 , wherein software security layer checks if a slice position is within a current picture boundary and discards the slice when it is determined that a slice is not within the current picture boundary.
11. The method of claim 1 , wherein for each coded macroblock in the one or more frames the software security layer checks if a given macroblock in the one or more frames is within a current picture boundary and discarding the given macroblock if it is not within the current picture boundary.
12. The method of claim 1 , wherein for each macroblock in the one or more frames the software security layer checks if a header of a referred co-located reference macroblock is within a reference macroblock header buffer and discards the referred co-located macroblock when the header of the referred co-located reference macroblock is not within the reference macroblock header buffer.
13. The method of claim 1 , wherein the software security layer checks if a motion vector in a macroblock in the one or more frames is within a reference picture boundary and discards the macroblock when the motion vector is not within the reference picture boundary.
14. A system, comprising:
a processor module;
hardware decoder accelerator coupled to the processor; and
a memory coupled to the processor, wherein the memory contains executable instructions configured to implement a method, the method comprising:
receiving one or more frames of encoded digital streaming data at the system;
decoding the one or more frames of encoded digital streaming data using the hardware decoder accelerator;
using a software security layer to protect the system against exploitation of the hardware decoder accelerator by malicious data embedded in the one or more frames of encoded digital streaming data, wherein the software security layer performs a data value check on data within the one or more frames when the data is used.
15. The system of claim 14 , wherein the software security layer is implemented in firmware of the system.
16. The system of claim 14 , wherein the software security layer is implemented in a kernel driver in system software of the system.
17. The system of claim 14 , wherein the software security layer is implemented in a software layer above a kernel driver in system software of the system.
18. The system of claim 14 , wherein the software security layer is configured to calculate a necessary size of one or more buffers used in decoding the one or more frames and verify if all memory within a range is valid.
19. The system of claim 14 , wherein the software security layer is configured to protect one or more buffers used in decoding the one or more frames from any user process access once a task is submitted.
20. The system of claim 19 , wherein the software security layer is configured to copy the one or more buffers from a user memory space to a secure memory space.
21. The system of claim 19 , wherein the software security layer is configured to locking one or more memory pages within a data range being written from by a user process.
22. The system of claim 14 , wherein when the hardware accelerator decodes coded streams at higher than a macroblock level, the software security layer rejects any input bitstreams for which buffer size related parameters coded in the stream mismatch with these parameters in a user's request.
23. The system of claim 14 , wherein software security layer checks if a slice position is within a current picture boundary and discards the slice when it is determined that a slice is not within the current picture boundary.
24. The system of claim 14 , wherein for each coded macroblock in the one or more frames the software security layer checks if a given macroblock in the one or more frames is within a current picture boundary and discarding the given macroblock if it is not within the current picture boundary.
25. The system of claim 14 , wherein for each macroblock in the one or more frames the software security layer checks if a header of a referred co-located reference macroblock is within a reference macroblock header buffer and discards the referred co-located reference macroblock when the header of the referred co-located reference macroblock is not within the reference macroblock header buffer.
26. The system of claim 14 , wherein the software security layer checks if a motion vector in a macroblock in the one or more frames is within a reference picture boundary and discards the macroblock when the motion vector is not within the reference picture boundary.
27. A non-transitory computer readable medium having embodied therein computer readable instructions configured, to implement a method, the method comprising:
receiving one or more frames of encoded digital streaming data in a system having a processor module, a memory and a hardware decoder accelerator decoding the one or more frames of encoded digital streaming data using the hardware decoder accelerator;
using a software security layer to protect the system against exploitation of the hardware decoder accelerator by malicious data embedded in the one or more frames of encoded digital streaming data, wherein the software security layer performs a data value check on data within the one or more frames when the data is used.