Apparatus, system, method, and computer program product for executing a program utilizing a processor to generate keys for decrypting content
An apparatus, system, method, and computer program product are provided for executing a program provided a second party utilizing a processor to generate keys for decrypting content of a third party. In operation, content and a program to confidentially generate keys for decrypting the content of the third party are received at a processor. Additionally, the second party's program is executed utilizing the processor-derived keys to decrypts the third party's content.
1. A method, comprising:
receiving, at a processor, content of a third party and a program of a second party to generate confidential keys for decrypting the content of the third party; and
executing the program of the second party utilizing the processor for decrypting the content of the third party;
wherein the confidential keys include at least one content key associated with the content of the third party and at least one application key associated with an application of the second party via which the content of the third party and the program of the second party are received at the processor.
2. The method of claim 1 , wherein decrypting the content of the third party requires use of confidential algorithms and keying information provided to the second party.
3. The method of claim 1 , wherein the confidential keys and algorithms used to decrypt the content of the third party are re-encrypted by the second party.
4. The method of claim 3 , and further comprising decrypting the confidential keys utilizing the processor.
5. The method of claim 1 wherein confidential run-time values, intermediate crypto values, and the confidential keys generated from the program of the second party are stored in confidential write-only processor registers and in indexed buffers that are configured to only be indirectly dereferenced by processor operations and are configured to be unreadable.
6. The method of claim 5 , wherein the write-only processor registers and the indexed buffers are erased after the program of the second party terminates, ensuring subsequent virtual machine sessions do not have access to residual secrets.
7. The method of claim 1 , wherein application of the second party includes a content player.
8. The method of claim 1 , wherein the processor processes at least one content key of the third party and at least one application key of the second party to generate at least one title key.
9. The method of claim 8 , wherein the title key is utilized for decrypting the content of the third party.
10. The method of claim 1 , wherein the program of the second party is used by the application of the second party via which the content of the third party and the program of the second party are received.
11. The method of claim 10 , wherein the program of the second party is applicable for decrypting the content of the third party and is retrieved by the application of the second party based on the content of the third party.
12. The method of claim 11 , wherein the program of the second party and content keys have been encrypted before being retrieved by the application of the second party.
13. The method of claim 11 , wherein the program of the second party and content keys are encrypted utilizing a public key before being retrieved by the application of the second party.
14. The method of claim 13 , wherein one or more keys for encrypting the program of the second party and the content keys are provided by a manufacturer of the processor.
15. The method of claim 11 , wherein the program of the second party is encrypted before being combined in a package within a distribution binary associated with the application of the second party.
16. The method of claim 1 , wherein the application of the second party further re-encrypts a package including the program of the second party and the confidential keys, before being passed to the processor.
17. The method of claim 1 , wherein exposure of confidential algorithms and the confidential keys to a central processing unit is prevented by containing the confidential algorithms and the confidential keys within an encrypted program package which is not decrypted until run within a virtual machine inside the processor.
18. The method of claim 17 , wherein potential exposure of the confidential algorithms and the confidential key secrets is further prevented by encrypting the package using ephemeral values created by a public key exchange between the application of the second party, and in the processor where the program of the second party will be decrypted.
19. The method of claim 17 , wherein exposure of the confidential algorithms and the confidential keys is further prevented through use of a second party license secret or a third party licensee secret placed in the processor and used without exposure to a processor vendor by encryption of the program of the second party.
20. The method of claim 19 , wherein programming of the second party license secret and the third party licensee secret is protected from alteration once programmed into the processor through use of a one-time programming mechanism.
21. A computer program product embodied on a non-transitory computer readable medium, comprising:
computer code for receiving, at a processor, content of a third party and a program of a second party to generate confidential keys for decrypting the content of the third party; and
computer code for executing the program of the second party utilizing the processor for decrypting the content of the third party;
wherein the confidential keys include at least one content key associated with the content of the third party and at least one application key associated with an application of the second party via which the content of the third party and the program of the second party are received at the processor.
22. An apparatus, comprising:
a processor for receiving content of a third party and a program of a second party to generate confidential keys for decrypting the content of the third party, and for executing the program of the second party utilizing the processor for decrypting the content of the third party;
wherein the confidential keys include at least one content key associated with the content of the third party and at least one application key associated with an application of the second party via which the content of the third party and the pro ram of the second party are received at the processor.
23. The method of claim 1 , wherein the processor includes a graphics processor.
24. The method of claim 1 , wherein the processor includes at least one secure virtual machine implemented on the processor.
25. The method of claim 1 , wherein a plurality of secure virtual machines are implemented on the processor, and sharing of information between the virtual machines is restricted.