System and process for monitoring malicious access of protected content

A content reproducing device for detecting unauthorized access of data, the content reproducing device comprising:

• a communication interface configured to receive encrypted data;
• a memory storage device including an unprotected buffer;
• and
• a processor operatively coupled to the communication interface and the memory storage device, the processor configured to:
• store the encrypted data in a portion of the memory storage device,
• decrypt the encrypted data stored in the memory storage device into unencrypted data,
• store the unencrypted data as unprotected data in the unprotected buffer such that the unprotected data is vulnerable to unauthorized access,
• obtain an address range of said unprotected buffer,
• intercept a set of memory access calls related to memory access of said address range of said unprotected buffer,
• compare the set of memory access calls to an expected sequence of memory access calls, the expected sequence of memory access calls including at least one call to copy the unprotected data from the unprotected buffer while the unprotected data is stored in the unprotected buffer, and
• determine that a particular memory access call from the set of memory access calls is unauthorized when the particular memory access call accesses said address range of said unprotected buffer while not belonging to the expected sequence of memory access calls and while the unprotected data is stored in the unprotected buffer.

A non-transitory computer-readable recording medium encoded with instructions that, when executed on a processor of a content reproducing device, cause the content reproducing device to perform a method comprising:

• receiving encrypted data at the content reproducing device;
• storing the encrypted data in a portion of a memory storage device of the content reproducing device;
• decrypting the encrypted data stored in the memory storage device into unencrypted data by the processor of the content reproducing device;
• storing the unencrypted data as unprotected data in an unprotected buffer of the content reproducing device such that the unprotected data is vulnerable to unauthorized access;
• obtaining an address range of said unprotected buffer of the content reproducing device;
• intercepting a set of memory access calls related to memory access of said address range of said unprotected buffer;
• comparing the set of memory access calls to an expected sequence of memory access calls, the expected sequence of memory access calls including at least one call to copy the unprotected data from the unprotected buffer while the unprotected data is stored in the unprotected buffer;
• and
• determining that a particular memory access call from the set of memory access calls is unauthorized when the particular memory access call accesses said address range of said unprotected buffer while not belonging to the expected sequence of memory access calls and while the unprotected data is stored in the unprotected buffer.