Method and apparatus for allowing software access to navigational data in a decrypted media stream while protecting stream payloads
A method, apparatus and system enabling software access to navigational data in a decrypted media stream while protecting stream payloads. In one embodiment, a filter may route an encrypted content stream and associated information to a secure partition having a trusted computing component for decryption. Upon decryption, the trusted computing component may store the decrypted payload of the content in a secure storage location accessible to the trusted computing component. Thereafter, the decrypted navigational header information of the content may be used to navigate to the decrypted content via a trusted component such as a trusted rendering unit in the secure partition.
1. A method, comprising:
receiving a monolithically encrypted media stream with a header-match pattern and a header-match mask, by a trusted decryption module operating in a secure partition of a computing device, wherein the header-match pattern contains a description of an expected pattern of bits in a header of the media stream, and wherein the header-match mask contains a pattern of bits to be ignored if present in the header of the media stream;
decrypting the media stream, by the trusted decryption module, to derive decrypted header data and decrypted payload data; and
conditionally storing the decrypted payload data in a secure data storage accessible to a trusted component, if the decrypted header matches the header-match pattern and the header-match mask.
2. The method according to claim 1 further comprising:
the trusted decryption module enabling the trusted component to navigate to the decrypted payload data stored in the secure data storage.
3. The method according to claim 2 wherein the trusted component comprises a trusted graphics processing unit.
4. The method according to claim 2 , further comprising the trusted component navigating to the decrypted payload data stored in the secure data storage, including:
retrieving the decrypted payload data; and
processing the payload data according to a media type of the media stream.
5. The method according to claim 4 wherein the media type is graphics, the trusted component comprises a trusted graphics processing unit, and processing the payload data according to the media type includes the trusted graphics processing unit processing the decrypted payload to render and display graphics of the media stream.
6. The method according to claim 1 wherein the secure partition comprises one of a Trusted Platform Module (TPM), a Management Engine (ME) or an Active Management Technologies (“AMT”) partition.
7. The method according to claim 1 wherein the secure partition comprises a virtual partition running on a virtualized host.
8. An apparatus, comprising:
one or more computer processors;
a trusted decryption module operated in a secure partition by the one or more computer processors, the trusted decryption module configured to be operated to receive a monolithically encrypted media stream with a header-match pattern and a header-match mask from a source filter, and decrypt the monolithically encrypted media stream in the secure partition to derive decrypted header data and decrypted payload data, wherein the head-match pattern contains a description of an expected pattern of bits in a header of the media stream, and wherein the header-match mask contains a pattern of bits to be ignored if present in the header of the media stream; and
a secure data storage device coupled to the trusted decryption unit, and configured to enable the trusted decryption unit to conditionally store the decrypted payload data in the secure data storage module if the decrypted header matches the header-match pattern and the header-match mask.
9. The apparatus according to claim 8 wherein the trusted decryption module is further configured to:
enable a trusted component to navigate to the decrypted payload data stored in the secure data storage.
10. The apparatus according to claim 9 wherein the trusted component comprises a trusted graphics processing unit.
11. The apparatus according to claim 9 wherein the trusted component is configured to navigate to the decrypted payload data stored in the secure data storage device through:
retrieval of the decrypted payload data; and
processing of the payload data according to a media type of the payload data.
12. The apparatus according to claim 11 wherein the media type is graphics, the trusted component comprises a trusted graphics processing unit, and the trusted graphics processing unit is configured to process the decrypted payload according to the media type, and to render and display graphics in the media stream.
13. The apparatus according to claim 8 wherein the secure partition comprises one of a Trusted Platform Module (TPM), a Management Engine (ME) or an Active Management Technologies (“AMT”) partition.
14. The apparatus according to claim 8 wherein the secure partition comprises a virtual partition running on a virtualized host.
15. At least one non-transitory machine accessible medium having stored thereon instructions that, when executed by a machine, cause the machine to provide a trusted encryption module configured to:
receive an encrypted media stream with a header-match pattern and a header-match mask, with the trusted encryption module in a secure partition, wherein the head-match pattern contains a description of an expected pattern of bits in a header of the media stream, and wherein the header-match mask contains a pattern of bits to be ignored if present in the header of the media stream;
decrypt the media stream in the secure partition to derive decrypted header data and decrypted payload data; and
conditionally store the decrypted payload data in a secure data storage accessible to a trusted component, if the decrypted header matches the header-match pattern and the header-match mask.
16. The at least one non-transitory machine accessible medium according to claim 15 , wherein the trusted encryption module is further configured to enable the trusted component to navigate to the decrypted payload data stored in the secure data storage.
17. The at least one non-transitory machine accessible medium according to claim 16 wherein the trusted component comprises a trusted graphics processing unit.
18. The at least one non-transitory machine accessible medium according to claim 16 wherein the trusted component is configured to navigate to the decrypted payload data stored in the secure data storage by:
retrieval of the decrypted payload data; and
processing the decrypted payload data according to a media type of the payload data.
19. The at least one non-transitory machine accessible medium according to claim 18 wherein the media type is graphics, the trusted component comprises a trusted graphics processing unit, and the trusted graphics processing unit is configured to process the decrypted payload according to media type, and to render and display graphics of the media stream.
20. The at least one non-transitory machine accessible medium according to claim 15 wherein the secure partition comprises one of a Trusted Platform Module (TPM), a Management Engine (ME) or an Active Management Technologies (“AMT”) partition.
21. The at least one non-transitory machine accessible medium according to claim 16 wherein the secure partition comprises a virtual partition running on a virtualized host.
22. The method of claim 1 further comprising
receiving, by a source filter of the computing device, the monolithically encrypted media stream;
identifying, by the source filter, a media type of the monolithically encrypted media stream and header parameters associated with the media type of the monolithically encrypted media stream; and
providing, by the source filter, to the trusted decryption module, the monolithically encrypted media stream with the header-match pattern and the header-match mask.
23. The apparatus of claim 8 further comprising
a source filter module coupled to the trusted decryption module, and configured to receive the monolithically encrypted media stream, identify a media type of the monolithically encrypted media stream and header parameters associated with the media type of the monolithically encrypted media stream, and pass the encrypted media stream to the trusted decryption module with the header-match pattern and the header-match mask.
24. The apparatus of claim 23 , further comprising a media player module configured to play the media stream, with assistance from the trusted component in accessing the decrypted payload data stored in the secure storage.
25. The at least one non-transitory machine accessible medium according to claim 15 , wherein the instructions, when executed by the machine, further provides a source filter to the machine, configured to receive the monolithically encrypted media stream, identify a media type of the monolithically encrypted media stream and header parameters associated with the media type of the monolithically encrypted media stream, and pass the encrypted media stream to the trusted decryption module with the header-match pattern and the header-match mask.