Tamper resistant method, apparatus and system for secure portability of digital rights management-protected content

A system, comprising:

• a media player configured to receive encrypted media, decrypt and play the media, wherein the encrypted media includes a plurality of blocks, each of the plurality of blocks encrypted with a block encryption key and the plurality of block encryption keys are made available encrypted;
• a device interface configured to removably accept and couple a portable secure device to the system, the device to contain a master key that enables decryption of the encrypted block encryption keys;
• and
• a virtual machine manager configured to manage memory space of the system, and instantiate the media player in the managed memory space;
• wherein the media player is further configured to:
• authenticate to the portable secure device to provide a secure channel between the media player and the portable secure device;
• for each of the plurality of blocks,
• send, over the provided secure channel, an encrypted block encryption key to the portable secure device;
• receive, over the provided secure channel, a decrypted block encryption key from the portable secure device, wherein the decrypted block encryption key is decrypted by the portable secure device;
• decrypt the block of encrypted media with the received decrypted block encryption key;
• and
• play the decrypted block;
• and
• stop playing the media when the portable secure device is removed from the machine.

A tangible, non-transitory computer-readable medium having stored thereon instructions that, when executed by a machine, cause the machine to be equipped with a media player;

• wherein the machine includes a virtual machine manager configured to manage memory space of the machine, including memory space where the media player resides and executes;
• and
• wherein the media player is configured to:
• access encrypted media, the encrypted media including a plurality of blocks, each of the plurality of blocks encrypted with a block encryption key, and the block encryption keys are made available encrypted;
• authenticate the media player to a portable secure device removably coupled to the machine, and containing a master key capable of decrypting each of the encrypted block encryption keys to enable the master key to be available to decrypt the encrypted block encryption keys;
• communicate with the portable secure device over a secure channel between the media player and the portable secure device, the secure channel provided by the authenticating the media player to the portable secure device, wherein the communication with the portable secure device ceases when the portable secure device is removed from the machine;
• and
• for each of the plurality of blocks,
• send over the provided secure channel an encrypted block encryption key to the portable secure device;
• receive over the provided secure channel a decrypted block encryption key from the portable secure device, wherein the decrypted block encryption key is decrypted by the portable secure device,
• decrypt the block of encrypted media with the received decrypted block encryption key;
• and
• play the decrypted block.

A media player having a processor and a memory having executable instructions stored thereon that, when executed on the processor, cause the media player to:

• access encrypted media, the encrypted media including a plurality of blocks, each of the plurality of blocks encrypted with a block encryption key, and the block encryption keys are made available encrypted;
• authenticate the media player to a portable secure device removably coupled to a machine associated with the media player, the device containing a master key capable of decrypting each of the encrypted block encryption keys to enable the master key to be available to decrypt the encrypted block encryption keys;
• communicate with the portable secure device over a secure channel between the media player and the portable secure device, the secure channel provided by the authenticating the media player to the portable secure device, wherein the communicating with the portable secure device ceases when the portable secure device is removed from the machine;
• and
• for each of the plurality of blocks,
• send over the provided secure channel an encrypted block encryption key to the portable secure device;
• receive over the provided secure channel a decrypted block encryption key from the portable secure device, wherein the decrypted block encryption key is decrypted by the portable secure device,
• decrypt the block of encrypted media with the received decrypted block encryption key;
• and
• play the decrypted block.