Policy-based trusted inspection of rights managed content
An embodiment includes a method executed by at least one processor comprising: initializing first and second secure enclaves each comprising a trusted software execution environment that prevents software executing outside the first and second secure enclaves from having access to software and data inside the first and second secure enclaves; the first secure enclave (a)(i) inspecting a policy, (a)(ii) authenticating the second secure enclave in response to inspecting the policy; and (a)(iii) communicating encrypted content to the second secure enclave in response to authenticating the second secure enclave; and the second secure enclave (b)(i) decrypting the encrypted content to produce decrypted content, and (b)(ii) inspecting the decrypted content. Other embodiments are described herein.
1. At least one non-transitory storage medium having instructions stored thereon for causing a system to perform operations comprising:
initializing first and second secure enclaves each comprising a trusted software execution environment that prevents software executing outside the first and second secure enclaves from having access to additional software and data while the additional software and the data are inside the first and second secure enclaves;
the first secure enclave (a)(i) inspecting a policy, (a)(ii) authenticating the second secure enclave in response to inspecting the policy; and (a)(iii) communicating encrypted content to the second secure enclave in response to authenticating the second secure enclave; and
the second secure enclave, which includes a malware detection utility, (b)(i) decrypting the encrypted content to produce decrypted content, (b)(ii) inspecting the decrypted content with the malware detection utility, (b)(iii) authenticating the decrypted content in response to inspecting the decrypted content with the malware detection utility; and (b)(iv) communicating a message to the first secure enclave in response to authenticating the decrypted content.
2. The at least one medium of claim 1 , wherein the policy includes a whitelist listing the malware detection utility.
3. The at least one medium of claim 1 wherein authenticating the second secure enclave includes analyzing a measurement of contents included in the second secure enclave.
4. The at least one medium of claim 1 the operations comprising the first secure enclave decrypting the encrypted content to produce additional decrypted content and processing the additional decrypted content in response to receiving the message from the second secure enclave.
5. The at least one medium of claim 4 wherein the first secure enclave is not privileged, the operations further comprising processing the additional decrypted content while at least one of an operating system, virtual machine monitor, and binary input/output system (BIOS) includes malware more privileged than the first secure enclave.
6. The at least one medium of claim 1 wherein the first secure enclave is not privileged.
7. The at least one medium of claim 1 the operations comprising disallowing the first secure enclave from processing unencrypted content, derived from the encrypted content, in response to the second secure enclave inspecting the decrypted content.
8. The at least one medium of claim 1 wherein the first secure enclave includes an isolated memory region within an application's virtual address space and only code processing within the first secure enclave can access data located in the first secure enclave.
9. The at least one medium of claim 8 , wherein the encrypted content includes at least one of video and audio content.
10. The at least one medium of claim 1 , wherein authenticating the second secure enclave includes the second secure enclave communicating a report to the first secure enclave, the report being based on at least one of (a) an identifier that is specific to at least one of a computing platform including the second secure node, an independent software vendor (ISV), and a portion of the at least one processor, (b) a nonce generated by the computing platform, and (c) a measurement based on contents included in the second secure enclave.
11. At least one non-transitory storage medium having instructions stored thereon for causing a system to perform operations comprising:
initializing a first secure enclave comprising a trusted software execution environment that prevents software executing outside the first secure enclave from having access to additional software and data while the additional software and the data are inside the first secure enclave; and
the first secure enclave:
receiving content and inspecting a rights management policy;
determining whether a malware detection utility may inspect the content based on inspecting the policy;
authenticating the malware detection utility;
communicating an encrypted version of the content to the malware detection utility in response to authenticating the malware detection utility;
receiving a message from the malware detection utility indicating the content is authenticated; and
processing the content in response to receiving the message.
12. The at least one medium of claim 11 wherein authenticating the malware detection utility includes analyzing a measurement of at least a portion of the malware detection utility.
13. The at least one medium of claim 11 the operations comprising processing the content while at least one of an operating system, virtual machine monitor, and binary input/output system (BIOS) corresponding to the at least one processor includes malware more privileged than the first secure enclave.
14. The at least one medium of claim 13 wherein the first secure enclave is not privileged.
15. The at least one medium of claim 11 wherein the first secure enclave includes an isolated memory region within an application's virtual address space and only code executing within the first secure enclave can access the content located in the first secure enclave.
16. An apparatus comprising:
at least one memory;
at least one processor, coupled to the memory, to perform operations comprising:
initializing a first trusted software execution environment that prevents software executing outside the first trusted software execution environment from having access to additional software and data while the additional software and the data are inside the first trusted software execution environment; and
the first trusted software execution environment:
receiving content and inspecting a policy;
determining whether an inspection engine module may inspect the content based on inspecting the policy;
authenticating the inspection engine module;
communicating an encrypted version of the content to the inspection engine module in response to authenticating the inspection engine module;
receiving a message from the inspection engine module indicating the content is authenticated; and
processing the content in response to receiving the message.
17. The apparatus of claim 16 , wherein the operations comprise processing the content while at least one of an operating system, virtual machine monitor, and binary input/output system (BIOS) of the apparatus includes malware more privileged than the first trusted software execution environment.
18. The apparatus of claim 17 wherein the first trusted software execution environment includes a first secure enclave that is not privileged.
19. The apparatus of claim 18 wherein the first secure enclave includes an isolated memory region, of the at least one memory, within an application's virtual address space and only code executing within the first secure enclave can access data located in the first secure enclave.