RU2308077C2 - Methods and systems for cryptographic protection of protected content - Google Patents

Abstract

FIELD: methods and systems for cryptographic protection of data in graphical subsystems of a computing device.

SUBSTANCE: in accordance to the invention, methods for encoding of video memory content are realized, so that unsanctioned software may not obtain substantial access to it, resulting in supported confidentiality. Also, a mechanism is suggested for detecting unsanctioned access, providing a warning, when data is changed in a certain way, resulting in maintained integrity. In different variants of realization, content of overlay surfaces and/or command buffers are encoded, and/or graphic processing block is capable of working with encoded content, limiting access to content for unauthorized sides, devices or software.

EFFECT: ensured confidentiality and protection of data sent through graphic channel.

3 cl, 15 dwg, 3 tbl, 1 ann

Description

Cross references to related applications

This application claims the provisional application numbers 60/337617 dated December 4, 2001 and 60/339143 dated December 10, 2001 and is related to the commonly reassigned co-filed US Patent Application No. 10/125170 filed April 18, 2002.

Copyright Notice and Permission

Part of the disclosure in this patent document may contain material that is protected by copyright. The copyright holder has no objection to the facsimile reproduction by anyone of this patent document or patent disclosure, as it is presented in the files and records of the Patent and Trademark Office, but in all other cases reserves all copyrights. The following notice must be attached to this document: Copyright © 2001, Microsoft Corp.

Field of Invention

The present invention relates to methods and systems for cryptographic protection of protected content. In particular, the present invention relates to methods for cryptographic protection of content sent through a graphic channel, while ensuring that the content is both confidential and anti-counterfeit.

The current level of technology

The Internet and many other sources and applications provide a huge array of changing or fixed information or other content for listening, viewing, processing, storage and other visualization. However, at present, there is no practical way to collect, record or visualize changing or fixed information or other content in a copy-protected manner so that pirates cannot connect to the stream at any point along the channel - during the content processing or during visualization content - to obtain ownership of a copy or change of this content. This problem existed in the past and in connection with other devices for visualizing and recording information, for example, video recorders for television content or tape recorders for audio signals, but with at least one key difference. Since the content of digital information can be recorded virtually without signal loss, this creates a “risk” for copyright owners that their work will be freely distributed (pirated) without compensation. Using video recorders and tape recorders, the device (a) and the transmission medium introduce noise or data distortion into the recording process. With a changing (streaming) or fixed digital transmission medium, it does not matter why transformations and retransmissions that are practically free of loss, even at least within the limits of human hearing and vision, cannot be performed, and it does not matter why natural digital data cannot be stored and freely distributed. Thus, it would be desirable to prevent the unlimited redistribution of digital data, because there is not the slightest difference between what copyright owners can provide for a fee and what pirates can freely provide. In addition, in relation to transmissions that are desired to be kept confidential, such as e-commerce transactions, for the user participating in the dialogue, it is important that no one third becomes involved in these transactions. Thus, with respect to content from a reliable source, there is currently no practical way to “securely” process or visualize data on a user computer without preventing piracy or distortion.

In particular, when the content is transmitted through the channel between the main computing system, one or more graphic processing units (BGO) and a visualizing device, such as a monitor, there are several possibilities for a pirate or other unauthorized third party to connect to a line or signal and or to illegally receive a signal, either distort it. In addition, as user dialogue is becoming more complicated due to messaging and video teleconferencing services, providing a reliable transmission channel for protected content, wherever it comes from, is becoming an increasingly important advance.

Further, it is clear that future generations of operating systems, computing devices, or software applications will use more computationally powerful BGOs for commercial applications, compared with the use of more computationally powerful central processors (CPUs), as in modern personal computers. Thus, guaranteeing that content is sent to the BGO through “reliable software applications” will become a fundamental property for future computing devices, but is not adequately provided by current computing systems.

We can assume that this problem of providing a secure transmission channel for reliable content consists of two parts: (1) it is necessary to ensure that the reliable content cannot be copied or viewed at some weak point in the transmission channel (confidentiality), and (2) it must be guaranteed that The transmission channel prevents unauthorized data distortion in the channel (security). In the context of system protection, complexity is an obstacle because it complicates the security of the system. As in the case of an airport or other security scenario, the more entrances and exits the system has, the more difficult it is to ensure its security. In this regard, at present, there are no means by which the scope of the BGO functions and the display driver (s) can be made reliable in terms of both confidentiality and security. Thus, it would be desirable to implement a reliable graphical environment in connection with a computing device that receives content from a reliable source, so that the user of this device can be sure that this content cannot be copied without permission and cannot be falsified or altered by a third party .

SUMMARY OF THE INVENTION

In view of the foregoing, the present invention provides methods and systems for cryptographic protection of protected content in connection with a graphics subsystem of a computing device. Such methods are used to encrypt the contents of the video memory that unauthorized software cannot gain access to it, thereby satisfying the purpose of confidentiality. In addition, a fraud detection mechanism has been proposed that provides awareness of when the data has been changed in any way, thereby satisfying the purpose of security. In various embodiments, the invention discloses how to encrypt the contents of overlay surfaces and / or command buffers, and / or discloses how to allow BGO to work with encrypted content while preventing it from being accessible to untrusted parties, devices, or software.

The methods of the invention in various ways include cryptographic protection methods for protected content in connection with reliable graphic systems having video data memory, a graphic processing unit (s) and a cryptographic processing device connected to communicate with the BGO, the methods comprising requesting a graphic system software application or device to perform processing or visualization of protected content, while the request includes the transfer of session key by a software application or device into the graphics system and transferring the protected content to the encrypted part (s) of the video data memory, decrypting the contents of the encrypted part (s) of the video data memory by the graphic processing unit (s) while communicating with the cryptographic processing device, processing or visualizing the decrypted content block (s) of graphic processing and the removal of this content from the BGO.

Similar methods of the invention in various ways include requesting a graphic system by a software application or device to process or visualize protected content, the request including transmitting a session key by a software application or device to a graphics system to authenticate the cryptographic processing device and transferring the protected content to encrypted part (s) of video memory, decrypting the contents of the encrypted part (s) of video memory OF DATA input mechanism decryption unit BGO, wherein the decryption mechanism is in communication with the cryptographic processing device, performing the processing or rendering the decrypted content unit (s) of image-crypting mechanism content encryption / decryption block output BGO encrypted content and excretion of BGO.

Other features and embodiments of the present invention are described below.

Brief Description of the Drawings

Methods and systems for cryptographic protection of protected content in accordance with the present invention are described below with reference to the accompanying drawings, in which the following is presented:

FIG. 1A is a block diagram representing an example network environment with various computing devices in which the present invention may be implemented;

FIG. 1B is a block diagram showing a non-limiting example of a computing device in which the present invention may be implemented;

FIG. 2 is a flowchart illustrating unprotected portions of a graphic channel that are protected in accordance with the invention;

FIG. 3A and 3B are block diagrams illustrating exemplary aspects of a first level of security in accordance with the invention;

FIG. 4A-4C are block diagrams illustrating exemplary aspects of a second level of security in accordance with the invention;

FIG. 5A-5B show an example mix of AYUV / ARGB formats in accordance with the invention;

FIG. 6A-6B are an example of mixing YUY2 formats in accordance with the invention;

FIG. 7A-7B show an exemplary mixing of a packaged flat format in accordance with the invention;

FIG. 8A and 8B are block diagrams illustrating exemplary aspects of a third level of security in accordance with the invention;

FIG. 9A and 9B are flowcharts illustrating exemplary encryption methods that can be used for the output of a graphics processing unit in accordance with the invention.

DETAILED DESCRIPTION OF THE INVENTION

Overview

The present invention provides systems and methods for expanding an operating system or other intermediary between content from a trusted source and a graphics system for processing and / or visualizing this content to enable the operation of "reliable graphics" applications, such as tamper-proof confidential dialogs, and reproduction of the primary content protected against unauthorized duplication. One of the aspects of the invention is that it provides three "levels" of security: (1) encryption of the contents of the overlay surfaces, (2) allowing the graphic processing unit or other collaborative device (coprocessor) to operate with encrypted content, without making it accessible to unreliable parties, and (3) permission to encrypt command buffers.

As mentioned, in the context of system security, complexity is an obstacle because it complicates the security of the system. As a result, the invention proceeds from the fact that the entire scope of the BGO functions and the display driver (s) should be considered unreliable (vulnerable). The invention then applies methods that increase the chances of a correct implementation in terms of confidentiality and security by limiting the amount of hardware that can be implemented to meet the security criteria.

The terminology in accordance with the invention has already been discussed above. However, for clarity, some terms will be defined below. The term "confidential" refers to preventing access to information of reliable (protected) content by a non-trusted (inaccurate) third party, such as a third-party device or software. An example of such confidentiality includes preventing non-trusted third parties from accessing the encrypted primary video content anywhere along the graphics channel. The term "secure" refers to preventing access to information of reliable content or its modification by a non-trusted third party, such as a third-party device or software, without detecting this fact. An example of such security includes preventing access to the display of a protected dialogue or changing it by a non-trusted third party that may occur during an e-commerce transaction.

In this regard, the invention contemplates overlapping windows, for example a user interface on top of primary content video streams, as well as dimming windows that may appear during e-commerce dialogs.

Sample network environment

One skilled in the art may understand that a computer or other client or server device may be used as part of a computer network, or in a distributed computing environment. In this regard, the present invention is applicable to any computer system having any number of memory or storage units and any number of software applications and processes implemented in any number of storage units, or volumes that can use the reliable graphics mode of the invention. The present invention can be applied to an environment with server computers and client computers located in a network environment or in a distributed computing environment having remote or local memory. The present invention can also be applied in stand-alone computing devices having a programming language function, interpretation and execution capabilities for generating, receiving and transmitting information in connection with remote or local services.

Distributed computing facilitates the sharing of computer resources and services through direct exchange between computing devices and systems. These resources and services include information exchange, cache and disk storage for files. Distributed computing benefits from network connectivity, enabling customers to align their collective performance to provide benefits to the entire enterprise. In this regard, various devices may have software applications, objects, and resources that can interact using reliable graphics channels of the present invention.

FIG. 1A is a schematic diagram of an example network or distributed computing environment. This distributed computing environment comprises computing objects 10a, 10b, etc. and computing objects or devices 110a, 110b, 110c, etc. These objects may contain programs, methods, data banks, programmable logic, etc. Objects may contain parts of the same or different devices, such as personal digital assistants (PDAs), televisions, MP3 players, personal computers, etc. Each object can communicate with another object via the communication network 14. This network itself may contain other computing entities and computing devices that provide services to the system of FIG. 1A. In accordance with one aspect of the invention, each object 10 or 110 may comprise a software application that may request reliable graphic resources.

It should also be borne in mind that an object, such as 110c, can act as the host device in another computing device 10 or 110. Thus, although the displayed physical environment can represent connected devices as computers, this illustration is just an example, and the physical environment can alternatively displayed and described containing various digital devices, such as PDA, televisions, MP3 players, etc., software objects, such as interfaces, communication objects and the like.

There are many component systems and network configurations that support distributed computing environments. For example, computing systems can be connected together by wired or wireless line systems, local area networks, or wide area networks. Currently, many networks are connected to the Internet, which provides the infrastructure for globally distributed computing and encompasses many different networks.

In home networking environments, there are at least four completely different network transfer channels, each of which can support a single protocol, such as a power line, a data channel (both wireless and wired), a voice channel (such as a telephone), and entertainment channels. Most home control devices, such as light switches and home appliances, can use a power line to connect. Data services can be entered into the house as broadband (for example, either a digital subscriber line (DSL) or as a cable modem) and be accessible at home using either wireless (for example, HomeRF or 802.11b) or wired (for example , Home PNA, Cat 5, even the power line) connection. Voice traffic can be entered into the house either as wired (for example, Cat 3), or wirelessly (for example, cell phones) and can be distributed in the house using Cat 3 wiring. Entertaining channels can be entered into the house either via satellite or cable and usually distributed in a home using coaxial cable. The IEEE 1394 and DVI standards also represent digital interconnects for a group of media devices. All of these network environments and anything else that may be protocol standards can connect to each other to form an internal corporate network (intranet) that can connect to the outside world via the Internet. In short, there are many different sources for storing and transmitting data, and therefore computing devices will require ways to protect content in all parts of the data processing channel.

The term Internet usually refers to a collection of networks and gateways using the TCP / IP protocol suite, which is well known in the field of computer networks. "TCP / IP" is an acronym for "Transport Control Protocol / Interface Program". The Internet can be described as a system of geographically distributed remote computer networks interconnected by computers that execute network protocols that allow users to interact and share information over networks. Due to such wide sharing of information, remote networks, such as the Internet, are generally largely included, with little or no restriction, in an open system for which developers can design software applications to perform specialized operations or services.

Thus, the network infrastructure provides the bulk of network topologies such as client-server, peer-to-peer or hybrid architectures. A “Client” is a member of a class or group using the services of another class or group to which it does not belong. Thus, in computing, the client is a process, i.e., roughly speaking, a set of commands or tasks that requires a service provided by another program. The client process uses the required service without “knowing” any working details about this other program or service itself. In a client / server architecture, in particular in a network system, the client is usually a computer that has access to shared network resources provided by another computer, such as a server. In the example of FIG. 1A, computers 110a, 110b, etc. can be considered as clients, and computers 10a, 10b, etc. can be considered as a server, where the server 10a, 10b, etc. serves data that is then copied to client computers 110a, 110b, etc.

A server is typically a remote computer system that can be accessed over a remote network, such as the Internet. The client process can be active in the first computer system, and the server process can be active in the second computer system, communicating with each other through a data transmission medium, thereby providing distributed functions and allowing multiple clients to take advantage of the server’s functionality to collect information.

The client and server communicate with each other using the functions provided by the protocol layer. For example, the Hypertext Transfer Protocol (CTP) (HTTP) is a common protocol that is used in conjunction with the World Wide Web (WWW). Typically, server or client computers identify each other using a computer network address, such as a Unified Resource Locator (URL) or Internet Protocol (IP) address. The network address may be referred to as the address of a unified resource locator. For example, communication may be provided over a data medium. In particular, the client and server can be connected to each other via TCP / IP connections for high bandwidth communications.

Thus, FIG. 1A illustrates an example network or distributed environment with a server communicating with client computers over a network / bus where the present invention can be used. More details, several servers 10a, 10b, etc. interconnected via a communication network / bus 14, which may be a local area network (LAN), wide area network (WAN), corporate network, Internet, and the like. with client or remote computing devices 110a, 110b, 110c, 110d, 110e, etc., such as a laptop computer, a hand computer, a thin client (or client terminal), network equipment, or another device, such as a VCR, a television, oven, lamp, heater and the like in accordance with the present invention. Thus, it is expected that the present invention can be applied to any computing device using which it is desirable to process, store or visualize protected content from a reliable source.

In a network environment in which the communication network / bus 14 is, for example, the Internet, the servers 10 may be Web servers with which clients 110a, 110b, 110c, 110d, 110e, etc. communicate through any known protocols, such as HTTP. Servers 10 may also serve as clients 110, which may be a property of a distributed computing environment. Communication can be wired or wireless, as convenient. Client devices 110 may or may not communicate over the communication network / bus 14 and may have independent communications means associated with them. For example, in the case of a television or VCR, the network aspect may or may not be used to control it. Each client computer 110 and server computer 10 can be equipped with various application program modules or objects 135 and have connections or access to various types of storage elements or objects in which files can be stored or in which part (s) of files can be loaded or moved. Thus, the present invention can be used in a computer network environment having client computers 110a, 110b, etc. that can access and interact with computer network / bus 14, and server computers 10a, 10b, etc., which can interact with client computers 110a, 110b, etc. and other devices 111 and databases 20.

Example computing device

FIG. 1B and the following discussion provide a brief, general description of a suitable computing environment in which the invention may be implemented. However, it should be borne in mind that portable, portable and other computing devices and computing objects of all kinds are suitable for use in connection with the present invention. Although a universal computer is described below, this is just an example, and the present invention can be implemented in connection with a thin client that has the ability to work together (over a network / bus) and interact. Thus, the present invention can be implemented under the control of the main program in a network services environment in which very small or minimal client resources are involved, for example, in a network environment in which a client device serves simply as an interface for a network / bus, as an object placed into equipment. Essentially, everything where data can be stored and from where this data can be retrieved or visualized is a desirable or suitable environment for the cryptographic protection of the protected content of the invention to operate.

Although not required, the invention can be implemented through an operating system, application programming interface (API) and / or included in application software that interacts with valid content. In various embodiments, the invention is also applicable to hardware that is interoperable, and to the encryption methods described below. Software may be described in the general context of computer-executable instructions, such as program modules, being executed by one or more computers, such as client workstations, servers, or other devices. In general, program modules include routines, programs, objects, components, data structures, and other means that perform particular tasks or implement particular abstract data types. Typically, the functions of program modules in various embodiments may be combined or distributed as desired. In addition, it will be apparent to those skilled in the art that the invention may be practiced with other computer system configurations. Other well-known computing systems, environments and / or configurations that may be suitable for use with the invention include, but are not limited to, personal computers (PCs), automated banking machines, server computers, portable or compact devices, and multiprocessors systems, programmable user electronics, networked PCs, equipment, lights, environmental controls, minicomputers, mainframes and the like. The invention may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are connected through a communication network / bus or other data transmission medium. In a distributed computing environment, program modules can be located in both local and remote computer storage environments, including storage devices, and client nodes, in turn, can behave like server nodes.

FIG. 1B also illustrates an example of a suitable computing system environment 100 in which the invention may be implemented, although, as explained above, this computing system environment 100 is only an example of a suitable computing environment and does not impose any restrictions on the scope of use or the functions of the invention . This computing environment 100 should not be interpreted as having any dependency or requirement associated with any of the components or their combination illustrated in the example operating environment 100.

In FIG. 1B, an exemplary system for practicing the invention includes a general-purpose computing device in the form of a computer 110. The components of this computer may include, but are not limited to, a processing unit 120, a system memory 130, and a system bus 121 that couples various system components, including and system memory, with processing unit 120. The system bus 121 may be any of various types of bus structures, including a memory bus or memory controller, a peripheral bus, and a local bus using any of a variety of bus architectures. By way of example, but not limitation, such architectures include an ISA standard (industry standard architecture) bus, an MCA standard (microchannel architecture), an EISA standard (extended industry standard architecture), a local VESA (Video Electronics Standards Association) standard bus ) and a PCI bus (interconnecting peripheral components) (also known as an expansion bus).

Computer 110 typically includes various computer readable media. Machine-readable media can be any available media that can be accessed by computer 110, and includes both volatile and non-volatile media, both removable and non-removable media. By way of example, but not limitation, computer-readable media may include computer storage media and data transmission media. Computer storage media includes both volatile and non-volatile, removable and non-removable media implemented in any way or using any technology for storing information, such as machine-readable instructions, data structures, program modules and other data. Computer-readable media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, ROM-CD (CDROM), digital multi-purpose disk (DVD) or other optical disk memory, magnetic tapes, magnetic tape , memory on magnetic disks or other magnetic storage devices, or any other medium that can be used to store the desired information and which can be accessed by computer 110. Communication media typically implement machine-readable instructions, data structures, software modules or other data in a modulated data signal such as a carrier wave or other transport mechanism and include any information delivery media. The expression "modulated data signal" means a signal that has one or more of the characteristics set or changed to encode information in the signal. By way of example, but not limitation, communication media includes wired media such as a wired network and direct wired connection, and wireless media such as audio, radio frequency, infrared, and other wireless media. Combinations of any of the above are also included in the scope of computer-readable media.

System memory 130 includes a computer storage medium in the form of volatile and / or non-volatile memory, such as read-only memory (ROM) 131 and random access memory (RAM) 132. Basic input-output system (BSVV) (BIOS) 133, containing basic routines that help transfer information between items inside computer 110, as during startup, is usually stored in ROM 131. RAM 132 typically contains data and / or program modules that are immediately available to processing unit 121 and / or process are being given to them at the moment. By way of example, but not limitation, FIG. 1B illustrates an operating system 134, application programs 135, other program modules 136, and program data 137.

Computer 110 may also include other removable, non-removable, volatile, non-volatile computer storage media. By way of example only, FIG. 1B illustrates a hard disk drive 141 that reads from or writes to a non-removable non-volatile magnetic medium, a magnetic disk drive 151 that reads from or writes to a removable non-volatile disk 152, an optical disk drive 155 that reads from a removable non-volatile optical disk, such as a CD ROM or other optical media, or writes to it. Other removable, non-removable, volatile, non-volatile computer storage media that can be used in an exemplary operating environment include, but are not limited to, magnetic tape cartridges, miniature flash memory cards, multi-purpose digital disks, digital video tapes, solid state RAM, solid state ROMs, and things like that. The hard disk drive 141 is typically connected to the system bus 121 via a non-removable memory interface such as interface 140, and the magnetic disk drive 151 and the optical disk drive 155 are usually connected to the system bus 121 by a removable memory interface such as interface 150.

The drives and related computer storage media mentioned above and illustrated in FIG. 1B, readable instructions, data structures, program modules, and other data for computer 110 are inserted into computer memory. FIG. 1B, for example, the hard disk drive 141 is illustrated as storing the operating system 144, application programs 145, other program modules 146, and program data 147. Note that these components may either be the same as the operating system 134, application programs 135 , other program modules 136 and program data 137, or different from them. The operating system 144, application programs 145, other program modules 146, and program data 147 are indicated here by different reference numbers to illustrate that they are, at a minimum, different copies. The user can enter commands and information into the computer 110 through input devices such as a keyboard 162 and a coordinate device 161, commonly referred to as a mouse, trackball, or touchpad. Other input devices (not shown) may include a microphone, joystick, game pad, satellite dish, scanner, or the like. These and other input devices are often connected to the processing unit 120 via an input user interface that connects to the system bus 121, but can also connect to other interface and bus structures, such as a parallel port, a game port, or a universal serial bus (USB) (USB) ) A graphical interface 182, such as Northbridge, may also be connected to system bus 121. Northbridge is a chipset that communicates with a CPU or main processing unit 120 and provides information exchange for an accelerated graphic port (GPU). One or more graphics processing units (BGOs) 184 may communicate with a graphical interface 182. In this regard, BGOs 184 generally include internal memory, such as register memory, and BGOs 184 communicate with video memory 186. BGOs 184, however are not the only coprocessor examples, and therefore many coprocessor devices can be included in the computer 110. A monitor 191 or other type of device is also connected to the system bus 121 via an interface, such as the video interface 190, which, in turn, can can communicate with video memory 186. In general, it is this part of the computing device that is vulnerable, and, accordingly, the present invention provides protection and confidentiality of the data processed or visualized therein. In addition to the monitor 191, computers may include other peripheral output devices, such as speakers 197 and a printer 196, which can be connected via an output peripheral interface 195.

Computer 110 may operate in a networked or distributed environment by connecting to one or more remote computers, such as remote computer 180. This remote computer 180 may be a personal computer, server, router, network PC, peer device, or other common network node, and typically includes many or all of the elements described above with respect to computer 110, although in FIG. 1B, only the storage device 181 is illustrated. The logical connections shown in FIG. 1B include a local area network (LAN) 171 and a wide area network (WAN) 173, but may also include other networks / buses. Such networking environments are commonplace in homes, offices, enterprise-wide computer networks, corporate networks, and the Internet.

When used in a LAN network environment, computer 110 connects to the LAN 171 via a network interface or adapter 170. When used in a LAN network environment, computer 110 typically includes a modem 172 or other means for establishing communication over the HS 173, such as the Internet. The modem 172, which may be internal or external, may be connected to the system bus 121 via a user input interface 160 or other suitable mechanism. In a networked environment, program modules shown with respect to computer 110, or parts thereof, may be stored in a remote storage device. By way of example, but not limitation, FIG. 1B illustrates remote application programs 185 as residing in memory device 181. It will be appreciated that the network connections shown are exemplary, and other means can be used to establish a communication link between computers.

Sample distributed computing shells or architectures

Various distributed computing shells are or are being developed in the light of the convergence of personal computing and the Internet. Individual and business users are equally equipped with an interface that effectively interacts and provides connectivity to the worldwide network for software applications and computing devices, dramatically expanding the ability of computers with respect to search tools and networks.

For example, the .Net platform MICROSOFT® campaign shell includes servers, unified module services, such as network-based data storage and device downloadable software. Generally speaking, the .Net platform shell provides: (1) the ability to work the entire range of computing devices together, and automatically update and synchronize user information on all of them, (2) increased interactive features for Web sites, provided by the wider use of XML, and non-HTML, (3) real-time services that differ in customer-friendly access and delivery of products and services to a user from a central source point for managing various software applications, such as email, for example, or software such as Office.Net, (4) centralized memory, which will increase the efficiency and ease of access to information, as well as synchronization of information between users and devices, (5) the ability to integrate various transmission media data, such as e-mail, faxes and telephones, (6) for developers the ability to create reusable modules, thereby increasing productivity and reducing the number of programming errors, and (7) as well as many other features and tegratsii between platforms.

Although exemplary embodiments are described herein in connection with methods implemented by software residing in a computing device, one or more parts of the invention may also be implemented by an operating system, an application programming interface, or an intermediary between the coprocessor and the unchanged content, so that the services are valid content can be executed, maintained, or accessed through all .NET languages and services, as well as in other distributions computing shells. In addition, it is understood that one or more of the methods described in accordance with the invention may entail changes in hardware, such as BGO, to support these methods.

Cryptographically Protected Protected Content

The present invention thus provides methods and systems for expanding operating systems or any platform to provide “reliable graphics” software applications, such as tamper-proof confidential dialogs, and to ensure that content is reproduced in a manner that resists unauthorized copying. The problem solved by the present invention is illustrated in FIG. 2, in which the encrypted primary content 200 is shown passing to or generated by a valid TS software application. Content 200 may use the functions of the BGO 265 before rendering (or otherwise using) the content 200 through the visualization device 295, as is typical for using reliable TS software. Such content 200 will pass from the system or main memory 230 to the video data memory 260 for processing by the graphic processing unit 265. The dashed line in FIG. 2 illustrates where there is a security problem. As indicated in the section characterizing the current level of technology, none of the existing systems properly protect and deliver confidentially the contents through the elements shown as surrounded by a dotted line. From the point of view of reliable TS software, the first problem is whether it is possible to trust the contents to the components inside the dotted line before transferring this content to the BGO. Assuming that reliable TS software can properly certify components within the dashed line, a second problem from the point of view of reliable TS software is that reliable TS software must be more or less confident that when data is transferred to the environment outlined by a dashed line, this data will not be changed. The present invention, in the various embodiments described below, addresses both of these types of problems. In different ways, these methods and systems are implemented: (1) by encrypting the contents of overlapping surfaces, (2) allowing BGOs to work with encrypted content without making it available to unreliable software applications or parties, and (3) encrypting the contents of command buffers.

The first aspect of the problem of processing and visualizing reliable graphics, the solution of which this invention is directed, relates to obtaining a cryptographic (sometimes referred to as “crypto”) processor and indexed key management. The commonly reassigned jointly filed US patent application, conventionally labeled No. AA / IIISSS (hereinafter referred to as “CCC Application”), entitled “Methods and Systems for Authenticating Components in a Graphic System”, disclose methods for authenticating a component (s) in connection with a graphic system, as described below. It should be understood, however, that the invention assumes that authentication has occurred, and thus any authentication methods can be used to provide a reliable graphic platform, as described below in various embodiments of the invention.

Sample Authentication

In this regard, secure graphics cards must be able to authenticate themselves as such. In particular, reliable software should be able to distinguish between secure graphics adapters or workarounds, such as spoofing. In addition, reliable software must be able to detect cryptographic keys for graphics adapters and should be able to verify that the receiver of these keys is a truly secure graphics adapter. For this purpose, the secure graphics adapters in accordance with the invention are equipped with crypto processors that perform cryptographic authentication and key transfer tasks.

With respect to the hardware in accordance with the invention, cryptoprocessors are provided that are individualized and certified during production. Each crypto processor contains a unique private key to the _private decryption. Although many encryption and decryption algorithms are assumed and known in the field of cryptography according to this invention, the algorithm described here is RSA and the key length is 1024 bits, but this is not a limitation and the choice should be made according to well-known compromises depending on the desired software application and security level (s).

In this regard, the crypto processor is constantly connected to the graphics adapter either by adding it to an existing chip or by adding it as a separate chip on the adapter. The cryptoprocessor implements a public key cryptographic algorithm, as described in more detail below, and hides a unique secret key. In this regard, such a crypto processor can quickly perform public key decryption using modern semiconductor technologies. However, the crypto processor can also be included in the public key accelerator and can implement a symmetric cipher and some control logic.

In one exemplary non-limiting embodiment, the crypto processor includes the following volatile registers: (1) a 256-bit S register for the session key. The life of this key is usually the runtime of reliable software, and (2) a matrix of many index keys. Each key can be 128 bits long, although other choices may be suitable. Each key is associated with a specific window and is used by the graphics adapter to decrypt its contents. The life of each key is controlled by commands from reliable software.

As mentioned, the crypto processor of the invention is constantly connected to the graphics adapter. Thus, a tool is required for secure interaction with the cryptoprocessor in order to use its functions. In terms of interaction with a crypto processor, the present invention considers at least two methods: (a) an external interface to reliable TS software and (b) an interface to BGO 265. The first of these interfaces is at least its cryptographic aspects - must be standardized. The last of these interfaces can be implemented in a specialized form, but must adhere to all the principles set forth below.

As for the implementation of the external interface, this external interface uses the secret key encryption protocol (SC) for authentication and key transfer. According to this protocol, reliable software encrypts the session key with the public key of the crypto processor. The crypto processor accepts the resulting cryptographic binary encoded array and decrypts it with its private key, thereby obtaining a session key. Reliable software and a crypto processor now share security. Trusted software can use this session key to send commands to the crypto processor.

In one non-limiting embodiment, the crypto processor acts on the external interface with the following functions:

The Set Session Key () function performs the initial authentication step and key transfer. This is the only function that refers to the cryptoprocessor public key function. Thus, in one embodiment, the present invention contemplates calling this function once per load. The following example pseudo-code represents the following non-limiting implementation of the Session Key () function:

Setting the Session Key (crypto-binary array) {

ChC Decryption (private Key, crypto binary array, session Key);

}

Upon successful completion of this operation, the session-key register contains a key, such as a 256-bit key, from a cryptographic binary-encoded array. The public key algorithm may be, for example, an RSA algorithm with a length of 1024 bits.

When a symmetric session key K is installed between the trusted software and the crypto processor, this key can be used to secure all further data transfer to and from the crypto processor. Reliable software and a crypto processor can communicate using the simple Get and Install methods, the parameters of which are cryptographically protected for confidentiality and integrity. In particular, the parameter block B of each call can be processed in the following non-limiting way:

AES (M | HMAC (M, K1), K2),

Where:

K1 is the first half of K (bits 0 - 127),

K2 is the second half of K (bits 128 - 255),

AES (M, K) is the result of encrypting the message M with the key K in the AES standard in the CBC mode,

NMAC (M, K) is the result of calculating NMAC through a suitable hash function on an array M with key K,

A | B is the result of concatenation of A and B.

This format can be used to enter parameters and to output parameters of the following functions:

Set ([IN] BOOL needsAck, [IN] BITS128 nonce, [IN] ENUM propertyID, [IN] BYTESEQUENCE propertyParamters, [OUT] BYTESEQUENCE ack)

Where:

needsAck is a boolean value that allows reliable software to indicate whether acknowledgment is required.

nonce is a 128-bit value selected by trusted software. nonce can be used in acknowledgment if acknowledgment is requested.

propertyID identifies the property that is being set. An approximate list of supported properties is given below in Table 1.

propertyParamters is a sequence of parameters that is specific to each propertyID.

Finally, ack is an acknowledgment of an operation. The crypto processor produces ack if and only if needsAck was installed. Ack is made up of nonce, followed by a message that is specific to each propertyID.

Table 1 - List of propertyID for the Set function

PropertyID Needsawck Options Acknowledgment Pointing key Yes Pointer, Key, Purpose Ok refusal Output lock Yes {lock, permission} Status after locking operation L2KEYMGMT Yes Update frequency Ok refusal

In relation to the propertyID (property identifier) "index key", this method writes the new key and destination label to the key register identified by the pointer.

In relation to the propertyID “output blocking”, this method sets the flag for blocking the output. When this flag is set, the screen geometry (width, height, color depth, refresh rate), as well as the output of the graphics adapter (VGA, DVI) cannot be changed. In particular, the graphics adapter will not execute commands to change these settings while the output lock flag is set.

With respect to propertyID L2KEYMGMT, this method sets (key management at level 2) the key update frequency under the second security level, as described in accordance with the invention, i.e. encryption of inputs and outputs, described in more detail below.

Similarly, the Get function is proposed as follows:

Get ([IN] BITS128 nonce, [IN] ENUM propertyID, [IN] BYTESEQUENCE propertyParamters, [OUT] BYTESEQUENCE response)

Where:

nonce is a 128-bit value selected by trusted software for use in response.

propertyID identifies the property to set. The list of supported properties is given below in Table 2.

propertyParamters is a sequence of parameters that is specific to each propertyID.

Response contains the results of the operation. Response consists of nonce followed by a message that is specific to each propertyID.

Table 2 - List of propertyID for the Get function Get

PropertyID Options Response Output ports Key pointer VGA, AGP, etc. Authentication code Key pointer X bit number DX-SEC Version No Version number Counting protection surfaces No The number of supported protection surfaces Counting overlapping surfaces No Number of supported overlapping surfaces Primary type No one Geometry No Width, height, refresh rate, color depth of the primary surface

In relation to the Output ports, this method responds by setting the outputs of the graphics adapter, for example VGA, DVI, etc.

With respect to the Authentication Code, this method responds with a hash function of the contents of the window according to the first level of protection described in accordance with the invention, for example, encryption of overlays.

In relation to the DX-SEC version, this method responds with the DX-SEC version supported by the graphics adapter.

In relation to the calculation of protection surfaces, this method returns the number of protection surfaces supported by the graphics adapter.

With respect to Counting overlapping surfaces, this method responds with the number of overlapping surfaces supported by the graphics adapter.

In relation to the Primary type, this method returns 1 and provides flexibility for the future.

In relation to Geometry, this method responds with the width, height, refresh rate, and color depth of the primary surface.

The Set function may further include a method that sets the location or size of the protected area overlap, or the location and size of the portion of the primary (primary) surface to be decrypted.

Thus, the above functions SetSessionKey (SetSession Key), Get (Set) and Set (Install) are non-limiting options for the execution of the external interface. The expression "internal interface" refers to the interface between the crypto processor and the rest of the graphics adapter. The details of this type of interface according to the invention, up to the implementation of each individual graphic adapter, must be subject to the following restrictions: (1) the crypto processor must be constantly connected to the graphic adapter and (2) the connection between the crypto processor and the rest of the graphic adapter must not be opened.

In this regard, removing the crypto processor from the graphics adapter should not be trivial. If the cryptoprocessor is run as a separate chip, this is mainly a limitation on the mechanical interface that will secure the cryptoprocessor to the graphics adapter. In a typical case, the crypto processor should be soldered to the graphics adapter. Alternatively, the crypto processor may reside in the same chip as the main CPU. The use of standardized mechanical interfaces that allow the cryptoprocessor to be removed, such as smart card readers, socket cartridges, and the like, is unacceptable.

In addition, the physical connection between the crypto processor and the rest of the graphics adapter should not be accessible and should not be opened through standard interfaces. For example, the USB connector on this bus is not acceptable in accordance with the invention.

With respect to key management rules, each index key can only be used in accordance with its associated assignment parameter. In one embodiment, the values of the destination parameter mean the following:

L1STREAM: This key can only be used with the DX-SEC stream cipher described below in connection with the first level of protection provided by the invention, for example, encryption of overlays.

L2BLOCK: This key can only be used with a block cipher in the ECB mode of the second level of protection provided by the invention, for example, encryption of inputs and outputs, described below. Block cipher in the ECB mode is used to decrypt texture blocks, which are recorded by reliable software.

In this regard, no copies of keys should be supported when the pointer is populated with a new value.

First level of protection - encrypted overlays

Since video memory can be displayed and read by unreliable software running on the CPU, video memory cannot contain plaintext information. Video memory that obeys this requirement includes the video memory used to update the display. The original implementation of a system that satisfies this criterion in accordance with the invention encrypts the contents of the overlay surface. The overlay will then be decrypted during operation of the DAC equipment or immediately before reaching the DAC equipment when the image is sent to the display.

FIG. 3A illustrates an exemplary implementation of such a method. The encrypted primary content 200, wherever it is taken or generated, inherent in a trusted software application 210, is accepted by that trusted software application 210. An authentication exchange with crypto processor 220, such as the authentication exchange procedure (s) described above in the exemplary embodiments, or another method for reliable delivery of keys, either cryptographic, or along a path protected by other means. Content 200 passes from system memory 230 to the encrypted overlay surface 240, which overlaps the primary surface 270 of the video memory 260. In combination with the crypto processor 220, the decryption section 250 in the CPU decrypts the encryption level provided by the encrypted overlap (overlay) 240 and passes the contents to the selection section 280 pixels for output to a digital video interface (CVI) / digital-to-analog converter (DAC) 290 for output to a visualizing device, such as a monitor. However, the system shown in FIG. 3A does not meet all the criteria described above since there is only one overlay. In order to meet the minimum functionality limit necessary for a trusted environment, such as trusted windows, the invention allows two overlays in an alternative embodiment. The first “confidential” overlay is basically an overlay that exists on platforms today, primarily for video playback, expanded so that its contents can be encrypted. The second overlay is specifically designed to provide a responsive user interface, such as e-commerce dialogs. This “protected overlay” is always at the top and does not close, i.e. It has no color coding and has preference over the first overlay. The second overlay may be subject to some restrictions to minimize cost. For example, the second overlay can be obtained so that the data is in the same pixel format as the primary surfaces, and is not able to stretch or enter into many buffers. In addition, the contents of the secure overlay can be checked by hardware. Table 3 summarizes exemplary differences between a confidential layer and a protected layer.

Table 3.

Match confidential and secure overlays

Thing Confidential Overlay Protected Overlay Same pixel format as primary Yes No Can stretch No Yes Can be encoded with target color Yes No Can be written to many buffers Yes No Always upstairs No Yes Content can be checked No Yes

FIG. 3B shows a system that includes both confidential layers, for example layers 310a, 310b and 310c of a chain 310 reflecting confidential overlays, and secure overlays 320. Whenever possible, stream ciphers are used to encrypt protected surfaces because they are faster and easier to implement than block ciphers (more information is given in Appendix A). Stream ciphers encrypt data according to the principle of “byte position in the stream”. Thus, the first level of protection according to the invention initializes the stream cipher with a pixel encryption key in the upper left corner of the surface. The stream cipher advances for each pixel contained in the overlay surface, regardless of whether that pixel is displayed. The proposed system comprises two stream cipher decryption components 300a and 300b, one for a confidential overlay and one for a secure overlay, respectively. When the decrypted pixel values are available, hardware 280 selects the pixel values of the secure overlay 320, confidential overlay 310 (if the primary surface 270 is the same as the color code and / or if color coding is enabled), or the primary surface 270 and sends this pixel value to the display equipment through the CVI / DAC 290.

Note that the adversary can access the overlays by any number of means and at the same time either make the displayed image invisible or replace the protected content with noise content, since the data recorded by the adversary will also be decrypted. Although the invention does not directly protect against such attacks, the invention nevertheless provides an integrity check to ensure that the expected content has been presented to the end user. Thus, if the output result differs in any way from the input, a user of reliable software 210 may be warned that content has been tampered with.

In relation to the program interface with overlays, in addition to the usual overlay information, such as a frame restricting the source or destination, the target color code, etc., the confidential overlay 310 supports the fact that the encryption key pointer is defined, and the secure overlay 320 additionally supports that a memory cell is defined where the cyclic redundancy code (CRC) of the decrypted overlay content is to be written.

The confidential overlay interface is similar to existing overlays except that the mirror method defines an encryption key pointer for the contents of the overlay reverse buffer 310a, i.e. a buffer to which data is mirrored.

The secure overlay interface is simpler and creates a reserve for the CEC of the surface to be sent to the memory cell after it is displayed for the first time. A standardized hardware interface manages the location of the overlay and makes the CEC available to interested survey-based software. For example, one register may indicate whether the CEC is available, and the other may allow the CEC to read. For example, the following example pseudo-code can be used in connection with the secure overlay interface:

HRESULT UpdateOverlay (LPPOINT ppntUL);

Where:

ppntUL defines the upper left corner of the secure overlay.

In this regard, the software 210 calculates the CRC value, which is expected if it relates to integrity.

Second level of protection - encrypted inputs and outputs

In accordance with the invention, in order to expand BGO 265 for processing encrypted content as input (input data) and outputting encrypted content as output data, encryption and decryption equipment is added to the texture display unit (on the input side) and the alpha mixing unit channel (on the output side), and the hardware developers interact to follow some rules when implementing these functions. Since stream ciphers do not provide random access to encrypted data, the system uses block ciphers to encrypt data, for example, 128 bits at a time. The texture mapper decrypts to fill the cache line, and the alpha mix block decrypts when it reads the cache line from the color buffer and encrypts before writing. The encryption keys used in these operations may vary.

Computational tasks other than three-dimensional visualization, such as video decoding, are immediate extensions of the paradigm just described. Instead of textures, the encrypted input is video macroblocks; and the encrypted output instead of the color buffer is the decoded output frame. If the content is to be protected when it is delivered over the network in a command stream to BGO 265, then the method by which the command buffer can also be encrypted is described below.

FIG. 4A shows the above-described system performing the pre-processing operation, taking the encrypted surface 420 as an input and issuing the encrypted surface as an output, i.e. preprocessing methods for the encrypted texture and color buffer, through the encryption and decryption component 440. The invention further provides an encrypted texture 400b, and texture 400b may be a regular texture of video memory 260. The encrypted texture 400a is provided to the decryption component 450 in the BGO 265, which works with the crypto processor 220 to decrypt this texture and apply graphics algorithms, such as shading, to the 430a component. and the like, to decrypted data from component 440.

In anticipation of the deployment of a complex reflective desktop page, the system described with reference to FIG. 4A can protect an entire desktop PC, provided that the DAC equipment can decrypt the primary surface 270 as well as the overlay surfaces 310 and 320 described above. Note that in this case, the DAC equipment will decrypt using a block cipher, not a stream cipher. Such a system allows the use of an arbitrary number of confidential surfaces in the work of a desktop PC with arbitrary ordering by the Z coordinate, smooth articulation, or even applying three-dimensional or other effects to them, without compromising protection. Protected overlay surfaces 320, which should always be at the top and the contents of which should be checked, are in separate surfaces. The confidential overlay 310 described above is retained until it can be emulated in desktop software or a secure page reflection platform.

In one embodiment, in addition to being able to decrypt the primary surface 270, the system requires that BGO 265 also provide plaintext encryption from conventional desktop PC applications, such as reliable word processors, so they can also be used on a desktop PC. FIG. 4B illustrates such a scenario in which a chain 510 encrypting primary surfaces, including front 510b and rear 510a, is encrypted. Thus, the desktop typesetter 430 can perform operations on primary surfaces protected by the encryption-decryption component 440a, respectively, for issuing from or introducing into it. Then, together with the crypto processor 220, the decryption component 500 decrypts the front surface 510b for output to the CVI / DAC 290. This exposes the system to some types of attacks, which are described in detail below in connection with the protection, where some strategies for combating these attacks are disclosed.

An alternative to the embodiment of FIG. 4B is shown in FIG. 4C, where copying to chain 310 reflecting confidential overlays is performed. So, as an alternative to encrypting the primary surface 270 in accordance with the invention, the hardware can provide encryption with a stream cipher for consumption by confidential overlay equipment 300a, which can decrypt stream cipher data with crypto processor 220. This presentation mechanism may be less expensive than encryption the primary surface with a block cipher, but it may turn out to be less scalable or flexible, as a trade-off. Since confidential overlay 310 uses a stream cipher for encryption, a reasonable operation to support in this context is a “copy” operation in which the input is decrypted by the decryption component 440b using the block cipher of the input surface 510a and re-encrypted by the 440b component using the overlay stream cipher.

These embodiments and their various combinations are useful, for example, when one encrypted input at a time is sufficient, provided that any number of open text inputs can be combined with the encrypted input to generate an encrypted output.

With respect to long-term protection, there are a number of measures that can be implemented in accordance with the invention. First of all, the above second level of protection is based on the idea that plaintext cannot be disclosed from BGO 265 when it is decrypted. For example, there are no debugging registers or other means that allow reading plaintext from a microcircuit by a central processor (CPU) of the host computer. In addition to carefully developing the hardware to avoid such leaks, the BGO 265 instruction set is designed so that it is not possible to allow decryption of the input without permission to encrypt and exit. In addition, the hardware prevents the leakage of plaintext data by a foreign driver, extraneous code or accidental.

In addition, the hardware cannot allow key leaks. When keys are delivered to BGO 265 through the cryptographic protocol described according to the authentication exchange, they are available only for encryption and decryption components.

As discussed above, if BGO 265 is capable of encrypting plaintext for display in the primary surface 270, this is considered a vulnerability in the system, as this encryption tool is the only described mechanism in which the adversary could have plaintext and the corresponding ciphertext available at the same time. By transforming the primary surface so that it is visible to the central processor and creating a window to be encrypted, the adversary can construct a subset of blocks of ciphertext that corresponds to known plaintext blocks. These so-called dictionary attacks work better when the number of blocks of interest is small. For example, to display black and white dialog boxes in 32bpp display mode, since there are 4 pixels per block, only 16 blocks are needed to display such a dialog. One possible way for an adversary to open 16 ciphertext blocks would be to falsify the dialog for the end user by creating content that makes sense even after decryption in BGO 265. For this reason, a secure overlay is best suited for being protected against unauthorized access dialogs because it enables software applications to detect when the end user does not see what he expects.

There are two good strategies to negate the efforts of an adversary who wants to create dictionaries. First of all, since dictionaries are only good for a given key, changing the key and re-encrypting the contents force the adversary to start with a new dictionary. Further, to encrypt the primary surface, it is not necessary to make the key available for software, it can be scrolled in the hardware, and the software only needs to be notified that the key has been changed. Since the previous key is still available, the software can use this previous key to decrypt and re-encrypt parts of the primary surface that have not changed. Therefore, the crypto processor 220 periodically scrolls the encryption key for the primary surface 270 so that the previous key is still available, i.e. performs double buffering of the key encryption pointers, and so that notifies the software that the key is scrolled.

Another strategy involves encoding the location in the image before encryption. For example, the pixel location (x, y) in an image (or some derived value, such as an image shift) can be converted, before being encrypted by an EXCLUSIVE OR (XOR) operation, into pixel data; this operation can then be canceled after decryption. As a result, blocks of pixels in different areas of the surface are encrypted in different ways, and converting plain text to encrypted text makes sense only for a given location in the surface that is not accessible to the adversary.

The present invention also provides predetermined mixed formats. Because textures and surfaces off the screen require random access, they must be encoded in block ciphers. There is good synergy between the usual block size for a block cipher and the usual cache line size for modern three-dimensional accelerators, for example, if the cache line and block size both have 128 bits, then effective encryption and decryption can be implemented in hardware. Even if there are slight differences (for example, a block size of 128 bits and a cache line size of 256 bits), the hardware implementation should still be efficient.

One problem with encrypted texture data is that the block cipher scheme requires adjacent byte blocks to be available before they can be encrypted or decrypted; and filling the cache line requires that the pixel data be “mixed”, i.e. so that the translation from the position (X, Y) in the image to the address is formed in such a way that filling the cache line produces a two-dimensional region of pixels. Nowadays, hardware vendors offer visually linear surface formats when mixing image data without knowledge of a software application. However, since reliable software will provide encrypted texture data, this software must have a priori knowledge of the mixing scheme so that it can encrypt adjacent blocks of data and maintain a two-dimensional location. In response to this invention, it defines a dictionary of mixed image formats, including YUV 4: 4: 4b 4: 2: 2 and 4: 2: 0, as well as RGB formats for use by the software application. The quality of these formats can be as high as if the images were mixed in a format specific to the equipment, but encryption is achieved due to some deterioration in quality, i.e. security in exchange for speed.

For AYUV / ARGB (32bpp, packed), this 32bpp surface format contains an alpha channel in addition to 8-bit color channels for luminance (Y) and color (U and V) samples. Alternatively, it may contain the standard 32GBpp ARGB format, since both formats are 32bpp and are packaged. The following discussion assumes AYUV format. The linear circuit is the same as in FIG. 5A.

The pixel shift (X, Y) in the image is as follows:

Offset = Y * Pitch + X * 4

Assuming a 128-bit encryption block size and cache line size, 4 pixels can fall into one block. The interleaving of the lower X and Y bits before generating the address will result in improved two-dimensional localization in filling the cache line. These blocks are arranged linearly according to the format.

The resulting image layer is illustrated in FIG. 5B. Each numbered rectangle is a pixel, and bold rectangles are encrypted blocks. An exemplary pseudo-code for the mixing function of the invention for this format, which converts the location (x, y) in the image into a shift, has the following form:

DWORD

SwizzleAYUV (DWORD x, DWORD y, DWORD Pitch)

{

// pitch is the number of bytes per macroblock scan string

DWORD BlockOffset = (y≫1) * Pitch + (x≫1) * (128/8);

DWORD IntraBlockOffset = ((y & 2) ≪2) | ((x & 2) ≪1) | (

(y & 1) ≪1) | (x &1);

return BlockOffset + IntraBlockOffset * 4;

}

As for YUV2 (16bpp, packed), this surface format additionally discretizes the U and V “color” samples with a coefficient of 2. The result is a packed image format that averages 16 bits per pixel. A line diagram is shown in FIG. 6A. The mixing format of the invention distributes encrypted blocks of 4 × 2 pixels, as shown in FIG. 6B. As for FIG. 5A and 5B, 128-bit blocks are also mixed. Note that for FIG. 6B and for the following exemplary mixing pseudo-code that translates coordinate pairs (x, y) into image shifts, it is assumed that U and V even have X coordinates:

DWORD

SwizzleYUY2Y (DWORD x, DWORD y, const SURFACEDESC & sd)

{

assert (x <sd.Width);

assert (y <sd.Height);

DWORD BlockOffset = (y≫1) * sd.Pitch + (x≫2) * (128/8);

DWORD IntraBlockOffset = ((x & 2) ≪1) |

((y & 1) ≪1) |

((x & 1) ≪0);

DWORD dwRet = BlockOffset + (IntraBlockOffset≪1);

Return dwRet;

}

DWORD

SwizzleYUY2U (DWORD x, DWORD y, const SURFACEDESC & sd)

{

assert (x <sd.Width);

assert (0 == (x &1));

assert (y <sd.Height);

DWORD BlockOffset = (y≫1) * sd.Pitch + (x≫2) * (128/8);

DWORD IntraBlockOffset = ((x & 2) ≪1) |

((y & 1) ≪1) |

((x & 1) ≪0);

return BlockOffset + (IntraBlockOffset≪1) +1;

}

DWORD

SwizzleYUY2V (DWORD x, DWORD y, const SURFACEDESC & sd)

{

assert (x <sd.Width);

assert (0 == (x &1));

assert (y <sd.Height);

DWORD BlockOffset = (y≫2) * sd.Pitch + (x≫3) * (512/8);

DWORD IntraBlockOffset = ((x & 2) ≪1) |

((y & 1) ≪1) |

((x & 1) ≪0);

return BlockOffset + (IntraBlockOffset≪1) +3;

}

In this regard, for the pseudo-code accompanying the mixing of FIG. 5A, 5B, 6A, and 6B, the pitch of a surface is defined as the number of bytes per scan line of 128 bit blocks.

As for the packed planar format (12bpp), this surface format additionally discretizes the samples U and V with a factor of 2 both horizontally and vertically. Luminance and color readings are composed of two separate parts of the surface. A linear diagram of a packed planar format (12bpp) is shown in FIG. 7A.

The surface step is determined by the number of bytes per scan line of 512-bit blocks in the Y plane. The step of the UV plane is half the step of the Y plane, because there are only a quarter of the samples, but twice as many color elements per sample. The resulting mixed image format in accordance with the invention is shown in FIG. 7B.

An example pseudo-code for the mixing function according to the invention for this format, which translates the coordinates (x, y) into offsets for the elements Y, U and V, has the following form:

DWORD

SwizzlePP12Y (DWORD x, DWORD y, const SURFACEDESC & sd)

{

assert (x <sd.Width);

assert (y <sd.Height);

DWORD BlockOffset = (y≫2) * sd.Pitch + (x≫2) * (128/8);

DWORD IntraBlockOffset = ((x & 2) ≪2) |

((x & 2) ≪1) |

((y & 1) ≪1) |

((x &1);

return BlockOffset + IntraBlockOffset;

}

DWORD

SwizzlePP12U (DWORD x, DWORD y, const SURFACEDESC & sd)

{

DWORD PlaneOffset = (sd.Height≫3) * sd.Pich;

if ((0! = (x & 1)) || (0! = (y & 1)))

_asm int 3

x≫ = 1;

y≫ = 1;

DWORD BlockOffset = (y≫1) * sd.Pitch / 2 + (x≫2) * (128/8);

DWORD IntraBlockOffset = ((x & 2) ≪1) |

((y & 1) ≪1) |

(x &1);

return PlaneOffset + BlockOffset + (IntraBlockOffset≪1);

}

DWORD

SwizzlePP12V (DWORD x, DWORD y, const SURFACEDESC & sd)

{

DWORD PlaneOffset = (sd.Height≫3) * sd.Pich;

if ((0! = (x & 1)) || (0! = (y & 1)))

_asm int 3

x≫ = 1;

y≫ = 1;

DWORD BlockOffset = (y≫1) * sd.Pitch / 2 + (x≫2) * (128/8);

DWORD IntraBlockOffset = ((x & 2) ≪1) |

((y & 1) ≪1) |

(x &1);

return PlaneOffset + BlockOffset + (IntraBlockOffset≪1) +1;

}

Third level of protection - encrypted command buffers

The functions of the embodiments described above with respect to the first and second security levels can be enhanced in accordance with the invention for encrypting the command buffers proposed in the BGO 265 in addition to the image data that the BGO 265 operates with. These functions are desirable if the software application 210 wants to protect content that is sent to the hardware over the network in a command buffer. FIG. 9A shows video decoding using an encrypted command buffer 900, whereby the content is delivered to the encrypted texture 400a and is decrypted by the decryption component 450 and decoded by the video decoder 430b. Although only the command buffer can be encrypted, the contents are encrypted in video memory, as is the command buffer, as shown by the encrypted decoded frame 420a. Encryption of the command buffer is therefore appropriate in a situation like this, when the macroblocks are in video memory, and with motion vectors and other commands sent in the command stream.

The elementary restriction for encrypted texture data also applies to encrypted command buffer data with a warning that encryption of the color buffer may not be sufficient to protect the content in question. Intermediate buffers, such as the Z buffer, can also be encrypted to protect the system from attacks on plain text. FIG. 9B shows an exemplary three-dimensional visualization using an encrypted command buffer in accordance with the invention. As illustrated, 3D rendering instructions 810 are encrypted along the path to video decoder 430c. The texture data 400a is decrypted by the decryption component 450 and processed in accordance with instructions 810 by the video decoder 430c. The inherent data in the color buffer 820 is encrypted using the encryption-decryption component 830.

Unauthorized access can be detected before using the command buffer with two passes or after the command buffer is used. In one embodiment, unauthorized access detection is permitted after the content is displayed or visualized.

Further alternative embodiments are encryption of outputs from the graphics adapter

In each of the above embodiments, although confidentiality and integrity are described and demonstrated with respect to the dotted line portion of FIG. 2, confidentiality and integrity are not demonstrated with respect to the video output, i.e. in theory, the interface between a graphics adapter and a visualizing device, such as a monitor, and / or the visualizing device itself is susceptible to attack.

Thus, in the above embodiments, as shown in FIG. 9A, at some point during the process, even though the contents are protected in the video memory and during processing in the graphics adapter, the data is sent to the CVI / DAC 290 in clear text. As a result, the data can be intercepted or modified along the way to the imaging device and in the imaging device.

Thus, in accordance with an alternative embodiment of the invention, which may be further combined with the other embodiments described herein, the same type of crypto processor 220b is provided in the imaging device to complement the functions performed by the crypto processor 220a. In this regard, the encryption component 910a connected to communicate with the crypto processor 220a encrypts the data before it is delivered to the CVI / DAC component 290, and the decryption component 910b connected to communicate with the crypto processor 220b decrypts the data as part of a display or visualization that has place, preventing data interception. The encryption component 910 may alternatively be included in the CVI / DAC component 290. In short, using the same encryption and decryption, content can be protected throughout the graphic channel for cryptographically secure reliable delivery and processing of content.

As mentioned above, although exemplary embodiments of the present invention are described in connection with various computing devices, hardware, software, and network architectures, the fundamental principles can be applied to any computing device or system in which it is desirable to protect content from a trusted source. Thus, the methods of cryptographically secure protected content in accordance with the present invention can be applied to a variety of software applications and devices. For example, the cryptographic protection methods of protected content according to the invention can be applied to the operating system of a computing device provided as a separate object in the device, as part of another object, as a downloadable object from a server, as a distributed object, etc. Although exemplary programming languages, pseudo-codes, names and examples are chosen as representatives of various possibilities, these languages, pseudo-codes, names and examples are not aimed at limiting.

The diverse methods described herein can be implemented in hardware as well as in software, or, when appropriate, in a combination thereof. Thus, the methods and devices of the present invention, or some aspects or parts thereof, can take the form of program code (i.e., instructions) implemented on real media, such as floppy disks, CD-ROMs, hard drives, or any other computer-readable storage medium moreover, when the program code is downloaded by a machine, such as a computer, this machine becomes a device for implementing the invention. If the program code is executed on programmable computers, the computing device will generally include a processor, a data carrier read by this processor (including volatile and non-volatile memory and / or storage elements), at least one input device and at least one output device. One or more programs that can apply the methods of the present invention, for example, through the use of a data processing API, an operating system, a reliable software application, and the like, are preferably implemented in a high-level procedural or object-oriented programming language for communication with a computer system. However, the program (s) may be implemented in assembler or machine language, if desired. In any case, the language may be a compiled or interpreted language, and in various embodiments of the invention imposes conditions on embodiments of BGO 265 equipment.

The methods and devices of the present invention can also be implemented through data communications, implemented in the form of program code that is transmitted over some transmission medium, such as electric wires or cable, through fiber optics or through any other type of transmission, moreover, when the program code is received, loaded and executed in a machine, such as EPROM, gate array, programmable logic device (PLD), a client computer, VCR, or the like, or in a receiving machine with graphical m adapter encryption capabilities and functionalities as described above in exemplary embodiments, the machine becomes an apparatus for practicing the invention. When implemented on a universal computer, program code is combined with a processor to provide a single device that works to invoke the functions of the present invention. Additionally, any storage method used in connection with the present invention may invariably be a combination of hardware and software.

Although the present invention has been described in connection with the preferred embodiments shown in the drawings, it should be borne in mind that other similar embodiments may be used or that changes or additions may be made to the described embodiments to realize the same function of the present invention without changing its essence. For example, although exemplary network environments of the invention, such as a peer-to-peer network environment, are described in the context of a network environment, one skilled in the art will understand that the present invention is not limited thereto and that the methods as described herein can be applied to any computing device or environment, such as a game console, a handheld computer, a laptop computer, etc., wired or wireless, and can be applied to any number of such computing devices connected through a communication network and interacting on it th network. Further, it should be emphasized that many computer platforms are implied, including operating systems of hand-held devices and other operating systems specific to software applications, especially as the number of wireless network devices constantly increases. Further, the present invention can be implemented on a variety of coprocessor chips or devices, such as a device with multiple BGOs, and memory can likewise be executed on multiple devices. Therefore, the present invention should not be limited to any single embodiment, but should be interpreted in its breadth and scope in accordance with the appended claims.

Appendix A. Stream ciphers versus block ciphers

This application details the differences between stream ciphers and block ciphers to the extent that they are related to the contents of this document.

Characteristic Stream cipher Block cipher Grain Byte 16 bytes (128 bits) Random access Difficult / impossible Directly Key Changes Often (per frame) Seldom Complexity 1 × 4 × stream cipher IP status Specialized Freely copyable

As a rule, stream ciphers are faster and easier to implement than block ciphers.

As the name implies, stream ciphers encrypt and decrypt a stream of bytes. To decrypt the Nth byte in the stream, the cipher starts at the beginning and passes one byte at a time until the desired shift in the stream.

In contrast, block ciphers, which are executed in the electronic codebook mode, can encrypt or decrypt arbitrary blocks in the data, but must encrypt-decrypt the complete block at a time. The usual block size is 16 bytes.

Stream ciphers are used in such a way that the same data is never encrypted twice, i.e. The key used for encryption and decryption should change frequently. When used, for example, to reproduce the primary surface, changing the keys once per frame is sufficient.

As a final note, it should be noted that there are good quality block ciphers available for free copying.

Claims (54)

1. A method of cryptographic protection of protected content using a reliable graphic system of a computing device, wherein this reliable graphic system has video memory, at least one graphic processing unit (BGO) and a cryptographic processing device connected to communicate with at least one BGO containing requesting a graphic system by a software application or device to process or visualize protected content, wherein said request includes transferring a session key by said software application or device to a graphic system and transferring said protected content to encrypted overlay surfaces that overlap at least one the primary surface of said video memory, including the first encrypted confidential overlay for the base video visualization of the protected content and a second encrypted secure overlay specially designed for existing sensitive user interfaces, the second encrypted secure overlay being always at the top and not closing, and the contents of the second encrypted secure overlay are checked by the said at least one BGO; decrypting the contents of said at least one encrypted part of the video memory by said at least one BGO while communicating with a cryptographic processing device, said decryption including decrypting the contents of the first encrypted confidential overlay by the first decryption component of the stream cipher and decrypting the contents of the second encrypted secure overlay by the second stream decryption decryption component; performing at least processing or visualization of said decrypted content with at least one BGO and deducing said content from at least one BGO. 2. The method according to claim 1, wherein if the output at said output differs from the protected content at said request configured for any processing performed with respect to said protected content by said at least one BGO, said software application or device warned of this difference. 3. The method according to claim 1, in which said decryption of the contents of said at least one encrypted part of the video memory includes decryption of the geometric part of the primary surface, while pixels other than the geometric part are not decrypted. 4. The method according to claim 1, in which the cryptographic processor is constantly connected to the graphics adapter by either (A) adding this cryptographic processor to an existing chip, or (B) adding this cryptographic processor as a separate chip to the graphics adapter, while the physical the connection between the cryptographic processor and the rest of the graphics adapter is not available and is not shown. 5. The method according to claim 1, wherein said decryption includes decrypting said at least one encrypted overlapping surface by a decryption mechanism of said BGO connected to communicate with said cryptographic processing device. 6. The method according to claim 1, wherein said decryption includes either (A) decrypting said at least one encrypted overlapping surface while the apparatus is performing digital-to-analog conversion (DAC) in the graphics system as the contents are output according to said derivation, or (B) decrypting said at least one encrypted overlapping surface at runtime, just before the contents reach the DAC equipment in the graphics system me 7. The method according to claim 1, wherein said decryption includes decrypting said at least one encrypted overlapping surface before the contents reach the DAC equipment in the graphics system, a component that does not have a return channel to the main computer system. 8. The method according to claim 1, additionally containing re-encrypting said content with said at least one BGO when communicating with a cryptographic processing device before said output; and decrypting said re-encrypted content with at least a second cryptographic processing device in an external computing device. 9. The method according to claim 1, in which the content is transmitted digitally to an external device having a second cryptographic processing device, and said decryption takes place in said external device. 10. The method of claim 8, wherein said external computing device is either (A) a monitor, or (B) a set top box, or (C) a digital signal processing (DSP) visualization device. 11. The method according to claim 1, wherein said decryption includes calculating the cryptographic content of the decrypted data, and said method further comprises transmitting said cryptographic content to a software application or device to ensure that the displayed pixels are pixels transmitted in connection with said request from a software application or device. 12. The method according to claim 1, in which at least one bit of each pixel in the primary surface is used to determine membership in a virtual protected surface for that pixel, wherein the graphics adapter selects a suitable decryption key for the pixel based on said at least , one bit. 13. The method of claim 12, wherein if said at least one bit contains a null value, then the virtual protected surface associated with said at least one bit is interpreted as being non-decryptable. 14. The method according to claim 1, further comprising, when the decoded pixel values are available, selecting a pixel selection component in said at least one BGO pixel value either (A) a second encrypted secure overlay or (B) a first encrypted confidential overlay, or (3) the primary surface. 15. The method according to claim 1, wherein said request includes at least (A) a bounding source or destination frame of said at least one encrypted overlapping surface, (B) a target color code of said at least at least one encrypted overlapping surface, (C) in the case of the first encrypted confidential overlay, a description of the key pointer to encrypt the contents of the overlay reverse buffer to which the data should be reflected, (D) in the case of the second encrypted protection of the overlay, a description of the memory cell where at least one of the cyclic redundancy code (CEC) is written, integrity measures and values of the contents of the decrypted overlay content, (E) the border of the source or destination frame of at least one encrypted primary surface , and (F) the target color code of said at least one encrypted primary surface. 16. The method of claim 15, wherein the software application or device calculates at least one of a cyclic redundancy code (CEC), integrity measures, and content values, if said software application or device relates to content integrity. 17. The method according to claim 1, in which at least one command buffer sent to the video decoder block of at least one BGO inherent in said request is encrypted by said software application or device and decrypted by said video decoder block when implemented communication with said cryptographic processing unit. 18. The method according to 17, further comprising detecting unauthorized access to the at least one command buffer, either (A) using two passes before using at least one command buffer, or (B) after command buffer used. 19. At least one computer-readable storage medium containing computer-executable modules, including computer-executable instructions for cryptographic protection of protected content, used in a reliable graphics system of a computing device, wherein this reliable graphics system has video memory of at least one block graphic processing (BGO) and a cryptographic processing device connected to communicate with said at least one BGO, while executable computers rum modules contain means for requesting a graphic system with a software application or device to process or visualize the protected content, wherein said requesting means includes means for transmitting the session key by said software application or device to the graphics system, and means for transmitting said protected content to encrypted overlapping surfaces which overlap at least one primary surface of said video memory, including the first an encrypted confidential overlay for basic visualization of the protected content and a second encrypted secured overlay specially designed for existing sensitive user interfaces, said second encrypted secured overlay being always at the top and not closing, and the contents of the second encrypted secured overlay are checked by said at least one BGO , means for decrypting the contents of said at least one encrypted part of the video memory by said at least one BGO while communicating with said cryptographic processing device, said decryption comprising decrypting the contents of the first encrypted secure overlay by the second decryption component of the stream cipher; means for performing at least processing or visualization of said decrypted content with at least one BGO; and means for removing said content from at least one BGO. 20. The storage medium according to claim 19, in which, if the output of the said means for removing is different from the protected content in the said means for requesting, configured for any processing performed on the said protected content by the said at least one BGO, then said software an application or device is warned about this difference. 21. The storage medium according to claim 19, wherein said means for decrypting the contents of said at least one encrypted part of the video memory includes means for decrypting the geometric part of the primary surface, while pixels other than the geometric part are not decrypted. 22. The storage medium according to claim 19, in which the cryptographic processor is constantly connected to the graphics adapter, either (A) adding this cryptographic processor to an existing chip, or (B) adding this cryptographic processor as a separate chip to the graphics adapter, while the physical connection between the cryptographic processor and the rest of the graphics adapter is inaccessible and not shown. 23. The storage medium according to claim 19, wherein said decryption means includes means for decrypting said at least one encrypted overlapping surface by a decryption mechanism of said BGO connected to communicate with said cryptographic processing device. 24. The storage medium according to claim 19, in which said means for decryption includes either (A) means for decrypting said at least one encrypted overlapping surface during the execution of digital-to-analog conversion (DAC) equipment in a graphics system, as after the contents are output according to said derivation, or (B) means for decrypting said at least one encrypted overlapping surface at run time immediately before the contents mine will reach the DAC hardware in the graphics system. 25. The storage medium according to claim 19, wherein said decryption means includes means for decrypting said at least one encrypted overlapping surface before the contents reach the DAC equipment in the graphics system, a component that does not have a return channel to main computer system. 26. The storage medium according to claim 19, further comprising means for re-encrypting said content with said at least one BGO when communicating with a cryptographic processing device before said output by said output means; and means for decrypting said re-encrypted content with at least a second cryptographic processing device in an external computing device. 27. The storage medium according to claim 19, in which the content is transmitted digitally to an external device having a second cryptographic processing device, and said decryption of said decryption means is carried out in said external device. 28. The storage medium according to claim 26, wherein said external computing device is either (A) a monitor, or (B) a set top box, or (C) a digital signal processing (DSP) visualization device. 29. The storage medium of claim 19, wherein said decryption means includes means for calculating the cryptographic content of the decrypted data, and said computer-executable modules further comprise means for transmitting said cryptographic content to a software application or device to ensure that the displayed pixels are pixels transmitted in connection with said request from a software application or device through said means for interrogation. 30. The storage medium according to claim 19, in which at least one bit of each pixel in the primary surface is used to determine membership in a virtual protected surface for that pixel, and the graphics adapter selects a suitable decryption key for the pixel based on said at least at least one bit. 31. The storage medium according to claim 30, wherein if said at least one bit contains a null value, then the virtual protected surface associated with said at least one bit is interpreted as an area not to be decrypted. 32. The storage medium according to claim 19, further comprising a means for selecting, when the decoded pixel values are available, the pixel selection component in said at least one BGO pixel value of either (A) a second encrypted secure overlay or (B) a first encrypted confidential overlay, or (3) primary surface. 33. The storage medium according to claim 19, wherein said requesting of said means for requesting includes at least (A) a source or destination bounding box of said at least one encrypted overlapping surface, (B) a target color code of said at least one encrypted overlapping surface, (C) in the case of a first encrypted confidential overlay, a description of a key encryption indicator of the contents of the overlay inverse buffer, to which should be reflected data, (D) in the case of the second encrypted secure overlay, a description of the memory cell where at least one of the cyclic redundancy code (CEC) is written, integrity measures and values of the contents of the decrypted overlay content, (E) the frame that limits the source or destination at least one encrypted primary surface, and (F) a target color code of said at least one encrypted primary surface. 34. The storage medium according to claim 33, wherein the software application or device calculates at least one of a cyclic redundancy code (CEC), integrity measures, and content values, if said software application or device relates to the integrity of the content. 35. The storage medium according to claim 19, in which at least one command buffer transmitted to the video decoder block of the at least one BGO according to said request is encrypted by said software application or device and decrypted by said video decoder block communication with said cryptographic processing unit. 36. The storage medium of claim 35, further comprising means for detecting unauthorized access to said at least one command buffer, either (A) using two passes before using at least one command buffer, or (B) after of how the command buffer is used. 37. A computing device containing means for cryptographic protection of protected content in connection with the use of a reliable graphic system of a computing device, this reliable graphic system having video memory, at least one graphic processing unit (BGO) and a cryptographic processing device connected for communication with said at least one BGO containing means for requesting a graphic system with a software application or device to process or visualize the protected content, wherein said requesting means includes means for transmitting a session key by said software application or device to a graphics system and means for transmitting said protected content to encrypted overlapping surfaces, which overlap at least one primary surface of said video memory, including the first a second encrypted confidential overlay for basic visualization of the protected content and a second encrypted secured overlay specially designed for existing sensitive user interfaces, said second encrypted secured overlay being always at the top and not closing, and the contents of the second encrypted secured overlay are checked by said at least one BGO means for decrypting the contents of said at least one encrypted portion of the video memory by said at least one BGO in communication with said cryptographic processing device, said decryption comprising decrypting the contents of the first encrypted confidential overlay by the first decryption component of the stream cipher and decrypting the contents of the second encrypted secure overlay by the second stream decryption decryption component; means for performing at least processing or visualization of said decrypted content with at least one BGO; and means for removing said content from at least one BGO. 38. The computing device according to clause 37, wherein if the output of said output means differs from the protected content in said requesting means configured for any processing performed on said protected content by said at least one BGO, said software an application or device is warned about this difference. 39. The computing device according to clause 37, wherein said means for decrypting the contents of said at least one encrypted part of the video memory includes means for decrypting the geometric part of the primary surface, so that pixels other than the geometric part are not decrypted. 40. The computing device according to clause 37, in which the cryptographic processor is constantly connected to the graphics adapter either (A) adding this cryptographic processor to an existing chip, or (B) adding this cryptographic processor as a separate chip to the graphics adapter, while the physical connection between the cryptographic processor and the rest of the graphics adapter is inaccessible and not shown. 41. The computing device according to clause 37, in which the said means for decryption includes means for decrypting the at least one encrypted overlapping surface by the decryption mechanism of the mentioned BGO, connected to communicate with the said cryptographic processing device. 42. The computing device according to clause 37, in which the said means for decryption includes either (A) means for decrypting the at least one encrypted overlapping surface during the execution of the digital-to-analog conversion (DAC) in the graphics system, as after the content is output according to said derivation, or (B) means for decrypting said at least one encrypted overlapping surface at run time immediately before ak content reaches the DAC hardware in the graphics system. 43. The computing device according to clause 37, in which the said means for decryption includes means for decrypting said at least one encrypted overlapping surface before the contents reach the DAC equipment in the graphics system, a component that does not have a return channel to main computer system. 44. The computing device according to clause 37, further comprising means for re-encrypting said content with said at least one BGO when communicating with a cryptographic processing device before said output by said output means; and means for decrypting said re-encrypted content with at least a second cryptographic processing device in an external computing device. 45. The computing device according to clause 37, in which the content is transmitted digitally to an external device having a second cryptographic processing device, and said decryption of said decryption means is carried out in said external device. 46. The computing device of claim 44, wherein said external computing device is either (A) a monitor, or (B) a set-top box, or (C) a digital signal processing (DSP) visualization device. 47. The computing device according to clause 37, wherein said decryption tool includes means for calculating the cryptographic content of the decrypted data, and said computer-executable modules further comprise means for transmitting said cryptographic content to a software application or device to ensure that the displayed pixels are pixels transmitted in connection with said request from a software application or device through said medium Property to request. 48. The computing device according to clause 37, in which at least one bit of each pixel in the primary surface is used to determine membership in a virtual protected surface for that pixel, and the graphics adapter selects a suitable decryption key for the pixel based on said at least at least one bit. 49. The computing device of claim 48, wherein if said at least one bit contains a null value, then the virtual protected surface associated with said at least one bit is interpreted as being non-decryptable. 50. The computing device according to clause 37, further comprising a means for selecting, when the decoded pixel values are available, the pixel selection component in said at least one BGO pixel value, either (A) a second encrypted secure overlay or (B) a first encrypted confidential overlay, or (3) primary surface. 51. The computing device according to clause 37, wherein said requesting said means for requesting includes at least (A) a bounding source or destination frame of said at least one encrypted overlapping surface, (B) a target color the code of the at least one encrypted overlapping surface, (C) in the case of the first encrypted confidential overlay, a description of the key pointer to encrypt the contents of the overlay reverse buffer to which data to be traded, (D) in the case of a second encrypted secure overlay, a description of the memory cell where at least one of the cyclic redundancy code (CEC) is written, integrity measures and values of the contents of the decrypted overlay content, (E) restricting the source or destination a frame of at least one encrypted primary surface, and (F) a target color code of said at least one encrypted primary surface. 52. The computing device of claim 51, wherein the software application or device calculates at least one of a cyclic redundancy code (CEC), integrity measures, and content values if said software application or device is related to the integrity of the content. 53. The computing device according to clause 37, in which at least one command buffer transmitted to the video decoder unit of at least one BGO according to the aforementioned request is encrypted by said software application or device and decrypted by said video decoder unit communication with said cryptographic processing unit. 54. The computing device of claim 53, further comprising means for detecting unauthorized access to said at least one command buffer, either (A) using two passes before using at least one command buffer, or (B) after of how the command buffer is used.

Images