PROTECTING REAL-TIME AUDIO/VISUAL COMMUNICATIONS END-TO-END
Methods, systems, and storage media for protecting real-time audio/visual (A/V) communications are disclosed. Exemplary implementations may: capture, at a sensor of a first A/V communication device, A/V data; transmit the captured data to a secure hardware module of a System-on-a-Chip (SoC) associated with the first A/V communication device, the secure hardware module having a first trusted execution environment (TEE) that is inaccessible by an Operating System (OS) of the SoC associated with the first A/V communication device; encrypt, in the first TEE, the captured data; transmit the encrypted data from the first A/V communication device to a second A/V communication device; receive, at a secure hardware module of a SoC associated with the second A/V communication device, the encrypted data, the secure hardware module of the SoC associated with the second A/V communication device having a second TEE that is inaccessible by an OS of the SoC associated with the second A/V communication device; decrypt, in the second TEE, the encrypted data; and cause presentation of the decrypted data at the second A/V communication device.
1 . A computer-implemented method for protecting real-time audio/visual (A/V) communications, the method comprising:
capturing, at a sensor of a first A/V communication device, A/V data;
transmitting the captured A/V data to a secure hardware module of a System on a Chip (SoC) associated with the first A/V communication device, the secure hardware module having a first trusted execution environment that is inaccessible by an Operating System of the SoC associated with the first A/V communication device;
encrypting, in the first trusted execution environment, the captured data;
transmitting the encrypted data from the first A/V communication device to a second A/V communication device;
receiving, at a secure hardware module of a SoC associated with the second A/V communication device, the encrypted data, the secure hardware module of the SoC associated with the second A/V communication device having a second trusted execution environment that is inaccessible by an Operating System of the SoC associated with the second A/V communication device;
decrypting, in the second trusted execution environment, the encrypted data; and
causing presentation of the decrypted data at the second A/V communication device.
2 . The method of claim 1 , wherein encrypting the captured data in the first trusted execution environment comprises encrypting the captured data with a session key.
3 . The method of claim 2 , further comprising periodically changing the session key in accordance with a pre-determined time interval.
4 . The method of claim 3 , wherein the pre-determined time interval is between one and ten seconds.
5 . The method of claim 1 , further comprising designating a privilege level of at least a portion of a plurality of hardware modules of the SoC associated with the first A/V device as one of secure or non-secure.
6 . The method of claim 1 , further comprising designating a privilege level of at least a portion of a plurality of hardware modules of the SoC associated with the second A/V device as one of secure or non-secure.
7 . The method of claim 1 , wherein the A/V data includes one or more of audio data, image data, and video data.
8 . A system configured for protecting real-time audio/visual (A/V) communications, the system comprising:
one or more hardware processors configured by machine-readable instructions to:
capture, at a sensor of a first A/V communication device, A/V data;
transmit the captured A/V data to a secure hardware module of a System-on-a-Chip (SoC) associated with the first A/V communication device, the secure hardware module having a first trusted execution environment that is inaccessible by an Operating System of the SoC associated with the first A/V communication device;
encrypt, in the first trusted execution environment, the captured data using a session key;
transmit the encrypted data from the first A/V communication device to a second A/V communication device;
receive, at a secure hardware module of a SoC associated with the second A/V communication device, the encrypted data, the secure hardware module of the SoC associated with the second A/V communication device having a second trusted execution environment that is inaccessible by an Operating System of the SoC associated with the second A/V communication device;
decrypt, in the second trusted execution environment, the encrypted data; and
cause presentation of the decrypted data at the second A/V communication device.
9 . The system of claim 8 , wherein the one or more hardware processors further are configured by the machine-readable instructions to periodically change the session key in accordance with a pre-determined time interval.
10 . The system of claim 9 , wherein the pre-determined time interval is between one and ten seconds.
11 . The system of claim 8 , wherein the one or more hardware processors further are configured by the machine-readable instructions to designate a privilege level of at least a portion of a plurality of hardware modules of the SoC associated with the first A/V device as one of secure or non-secure.
12 . The system of claim 8 , wherein the one or more hardware processors further are configured by the machine-readable instructions to designate a privilege level of at least a portion of a plurality of hardware modules of the SoC associated with the second A/V device as one of secure or non-secure.
13 . The system of claim 8 , wherein the A/V data includes one or more of audio data, image data, and video data.
14 . A non-transient computer-readable storage medium having instructions embodied thereon, the instructions being executable by one or more processors to perform a method for protecting audio/visual (A/V) communications, the method comprising:
capturing, at a sensor of a first A/V communication device, real-time A/V data;
transmitting the captured real-time A/V data to a secure hardware module of a System-on-a-Chip (SoC) associated with the first A/V communication device, the secure hardware module having a first trusted execution environment that is inaccessible by an Operating System of the SoC associated with the first A/V communication device;
encrypting, in the first trusted execution environment, the captured real-time A/V data;
transmitting the encrypted data from the first A/V communication device to a second A/V communication device;
receiving, at a secure hardware module of a SoC associated with the second A/V communication device, the encrypted data, the secure hardware module of the SoC associated with the second A/V communication device having a second trusted execution environment that is inaccessible by an Operating System of the SoC associated with the second A/V communication device;
decrypting, in the second trusted execution environment, the encrypted data; and
causing presentation of the decrypted data at the second A/V communication device.
15 . The computer-storage medium of claim 14 , wherein encrypting the captured data in the first trusted execution environment comprises encrypting the captured data with a session key.
16 . The computer-storage medium of claim 15 , further comprising periodically changing the session key in accordance with a pre-determined time interval.
17 . The computer-storage medium of claim 16 , wherein the pre-determined time interval is between one and ten seconds.
18 . The computer-storage medium of claim 14 , wherein the method further comprises designating a privilege level of at least a portion of a plurality of hardware modules of the SoC associated with the first A/V device as one of secure or non-secure.
19 . The computer-storage medium of claim 14 , further comprising designating a privilege level of at least a portion of a plurality of hardware modules of the SoC associated with the second A/V device as one of secure or non-secure.
20 . The computer-storage medium of claim 14 , wherein the real-time A/V data includes one or more of audio data, image data, and video data.