System and method for detecting a security compromise on a device

摘要

Embodiments of a system and method for detecting a security compromise on a device are described. Embodiments may be implemented by a content consumption application configured to protect content decryption keys on a device, such as a computer system (e.g., a desktop or notebook computer) or a mobile device (e.g., a smartphone or tablet). For instance, the content consumption application may be configured to provide decryption keys for respective content to a media component (or another component of the operating system) if multiple conditions have been met. For instance, in various embodiments, the content consumption application may pass the key to the media component after ensuring that i) one or more security mechanisms of the device operating system have not been compromised and ii) one or more executable instructions of the content consumption application have not been tampered (e.g., instructions corresponding to a function that handles the decryption key(s)).

主权项

1. A computer-implemented method performed on a computer, the method comprising:
receiving, via an application on the computer, one or more decryption keys configured to enable a media component on the computer to decrypt encrypted content; attempting, via the application, to access a memory space assigned by an operating system of the computer to another application to test whether one or more security mechanisms of the operating system are compromised; determining that the one or more security mechanisms of the operating system are not compromised in response to the operating system not permitting the application to access the memory space assigned to the other application; initiating, via the application, execution of an anti-debugging function of the operating system, the anti-debugging function configured to prevent debugging applications from intercepting the decryption keys; determining that one or more executable instructions of the application are not altered in response to the anti-debugging function executing and preventing the debugging applications from intercepting the decryption keys; providing, via the application, the one or more decryption keys to the media component on the computer in response to determining that:
the one or more security mechanisms of the operating system of the computer are not compromised; andthe one or more executable instructions of the application are not altered.