A DRM solution using TZMP

on YouTube ↗25m

" summary

A DRM prototype uses Arm TZMP1 protected mode to keep keys, decryption and decoder state inside protected memory regions while Rich OS runs the regular media stack; implementation ties ExoPlayer and an Android fork to a TrustZone TA and a GPU surface protected by a 8-region firewall (TZMP controller) that enforces read/write permissions. The build duplicates buffers (secure and nonsecure) so playback uses double-buffered secure/non-secure memory, is upstream-patched partially, and runs end-to-end on the reference hardware.

AI-written summary · about

" chapters (7)

1. 0:00Introduction to DRM with TZMP
2. 2:14Secure window pass concept
3. 5:33TZMP solution overview
4. 8:10Protected memory and hardware access
5. 11:29Reference implementation details
6. 17:28Media framework integration
7. 19:23Q&A on memory regions

" related talks

• 49mThe ARMs race for kernel protectionJonathanLevin · CODE BLUE 2016
• 27mvTZ: Virtualizing ARM TrustZoneHaibo Chen, Haibing Guan, Yubin Xia, Binyu Zang, Jinyu Gu, Zhichao Hua · 26th USENIX Security Symposium (USENIX Security '17)
• 19mStreamBox-TZ: Secure Stream Analytics at the Edge with TrustZoneFelix Xiaozhu Lin, Shuang Zhai, Heejin Park, Long Lu · USENIX ATC '19
• 41mOP-TEE - Using TrustZone to Protect Our Own SecretsMarc Kleine-Budde · Open Source Summit Europe + Embedded Linux Conference Europe 2017
• 43mBreaking Samsung's ARM TrustZoneMaxime Peterlin, Alexandre Adamski, Joffrey Guilbon · Black Hat USA 2019
• 16mUsing PMP, ePMP and Rust to Protect Embedded Kernels, Even from ThemselvesAlistair Francis · RISC-V Forum: Security 2021
• 48mOP-TEE: Using the ARM Trust-Zone to Control Tamper Resistant ProcessorsJorge Ramirez-Ortiz · Linux Security Summit Europe 2023
• 19mSupporting Trusted Virtual Machines with Hardware-based Secure Remote MemoryJaehyuk Huh, Taekyung Heo, Seunghyo Kang, Sanghyeon Lee, Soojin Hwang, Joongun Park · ISMM 2024