# US 9,519,758 B2 · System and process for monitoring malicious access of protected content > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,519,758 B2 - Document ID: US9519758B2 - Status: Granted - Kind: B2 - Application number: 14/172,599 - Filed: 2014-02-04 - Published: 2015-08-06 - Granted: 2016-12-13 - Earliest claimed: 2014-02-04 - Assignees: Pegasus Media Security, LLC - Applicants: Pegasus Media Security, LLC - Inventors: Paul A. Kline; Allan M. Weinstein; David J. Weinstein; Changsheng Yang - Web page: https://patentgrep.com/patent/US9519758B2 ## CPC - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 21/84: output devices, e.g. displays or monitors - G06F 21/1063: {Personalisation} - G06F 2221/2101: Auditing as a secondary aspect - G06F 2221/2107: File encryption - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method detects unauthorized access of data, and includes receiving data from a content provider by a content reproducing device; storing the received data in a memory storage device of the content reproducing device; obtaining an address range of a buffer of the content reproducing device; intercepting system application programming interface calls related to memory access of the address range of the buffer; comparing the intercepted system application programming interface calls to an expected sequence of memory access calls; and determining that a particular memory access call is unauthorized when the particular memory access call accesses the address range of the buffer while not belonging to the expected sequence of memory access calls. ## Claims ### Claim 1 A method of detecting an unauthorized access of data, the method comprising: receiving encrypted data at a content reproducing device; storing the encrypted data in a portion of a memory storage device of the content reproducing device; decrypting the encrypted data stored in the memory storage device into unencrypted data; storing the unencrypted data as unprotected data in an unprotected buffer such that the unprotected data is vulnerable to unauthorized access; obtaining an address range of the unprotected buffer; intercepting a set of memory access calls related to memory access of said address range of said unprotected buffer; comparing the set of memory access calls to an expected sequence of memory access calls, the expected sequence of memory access calls including at least one call to copy the unprotected data from the unprotected buffer while the unprotected data is stored in the unprotected buffer; and determining that a particular memory access call from the set of memory access calls is unauthorized when the particular memory access call accesses said address range of said unprotected buffer while not belonging to the expected sequence of memory access calls and while the unprotected data is stored in the unprotected buffer. ### Claim 2 (depends on 1) The method according to claim 1, wherein the decrypting includes decrypting the encrypted data into unencrypted data by a media player executed on a processor of the content reproducing device. ### Claim 3 (depends on 1) The method according to claim 1, wherein said unprotected buffer is a picture buffer in a memory of the content reproducing device, the method further comprising: copying the unprotected data from the picture buffer to a frame buffer of the content reproducing device such that the frame buffer provides the unprotected data to a display device; obtaining an address range of the frame buffer; and intercepting a set of memory access calls related to memory access of said address range of the frame buffer. ### Claim 4 (depends on 1) The method according to claim 1, wherein the unprotected buffer is a frame buffer, the frame buffer is a memory space at least partially on a video card or a sound card of the content reproducing device. ### Claim 5 (depends on 1) The method according to claim 1, further comprising: detecting whether a media player is operating before said obtaining. ### Claim 6 (depends on 1) The method according to claim 1, further comprising: storing a count of memory access calls determined to be unauthorized access; and comparing said count to a threshold value to make a determination that unauthorized access of the unprotected data has occurred. ### Claim 7 (depends on 1) The method according to claim 1, further comprising: terminating a media player in response to a determination that unauthorized access of the unprotected data has occurred. ### Claim 8 (depends on 1) The method according to claim 1, further comprising: presenting a warning message on a display device in response to a determination that unauthorized access of the unprotected data has occurred. ### Claim 9 (depends on 1) The method according to claim 1, further comprising: transmitting a message to a media source device in response to a determination that unauthorized access of the unprotected data has occurred. ### Claim 10 (depends on 9) The method according to claim 9, wherein the message includes identification information of the content reproducing device. ### Claim 11 (depends on 9) The method according to claim 9, wherein the message includes identification information of a licensee of the unprotected data. ### Claim 12 (depends on 1) The method according to claim 1, wherein the intercepting utilizes a hooking technique. ### Claim 13 (depends on 1) The method according to claim 1, wherein the set of memory access calls includes at least one of: memcpy; or write. ### Claim 14 (depends on 1) The method according to claim 1, further comprising: providing by a media player the expected sequence of memory access calls. ### Claim 15 (depends on 14) The method according to claim 14, further comprising: receiving the media player from a media source device. ### Claim 16 (depends on 1) The method according to claim 1, further comprising: identifying a beginning address and a buffer size of the unprotected buffer, the obtaining the address range is based on said beginning address and said buffer size. ### Claim 17 A content reproducing device for detecting unauthorized access of data, the content reproducing device comprising: a communication interface configured to receive encrypted data; a memory storage device including an unprotected buffer; and a processor operatively coupled to the communication interface and the memory storage device, the processor configured to: store the encrypted data in a portion of the memory storage device, decrypt the encrypted data stored in the memory storage device into unencrypted data, store the unencrypted data as unprotected data in the unprotected buffer such that the unprotected data is vulnerable to unauthorized access, obtain an address range of said unprotected buffer, intercept a set of memory access calls related to memory access of said address range of said unprotected buffer, compare the set of memory access calls to an expected sequence of memory access calls, the expected sequence of memory access calls including at least one call to copy the unprotected data from the unprotected buffer while the unprotected data is stored in the unprotected buffer, and determine that a particular memory access call from the set of memory access calls is unauthorized when the particular memory access call accesses said address range of said unprotected buffer while not belonging to the expected sequence of memory access calls and while the unprotected data is stored in the unprotected buffer. ### Claim 18 (depends on 17) The content reproducing device according to claim 17, wherein the processor is configured to execute a media player to decrypt the received data into the unencrypted data. ### Claim 19 A non-transitory computer-readable recording medium encoded with instructions that, when executed on a processor of a content reproducing device, cause the content reproducing device to perform a method comprising: receiving encrypted data at the content reproducing device; storing the encrypted data in a portion of a memory storage device of the content reproducing device; decrypting the encrypted data stored in the memory storage device into unencrypted data by the processor of the content reproducing device; storing the unencrypted data as unprotected data in an unprotected buffer of the content reproducing device such that the unprotected data is vulnerable to unauthorized access; obtaining an address range of said unprotected buffer of the content reproducing device; intercepting a set of memory access calls related to memory access of said address range of said unprotected buffer; comparing the set of memory access calls to an expected sequence of memory access calls, the expected sequence of memory access calls including at least one call to copy the unprotected data from the unprotected buffer while the unprotected data is stored in the unprotected buffer; and determining that a particular memory access call from the set of memory access calls is unauthorized when the particular memory access call accesses said address range of said unprotected buffer while not belonging to the expected sequence of memory access calls and while the unprotected data is stored in the unprotected buffer. ### Claim 20 (depends on 19) The non-transitory computer readable recording medium according to claim 19, wherein the decrypting is performed by a media player executed on the processor of the content reproducing device. ### Claim 21 (depends on 1) The method according to claim 1, further comprising: executing a media player that loads graphic libraries; monitoring a loading sequence of graphic libraries that are used by the media player to access the unprotected data stored in said unprotected buffer; comparing the monitored loading sequence to an expected loading sequence of graphic libraries; and determining that a particular call is an unauthorized access of the unprotected data stored in the unprotected buffer when the particular call is to a library that is not within the expected loading sequence of graphic libraries. ### Claim 22 (depends on 1) The method according to claim 1, further comprising: obtaining a list of content-capture processes; detecting that a process included within the list of content-capture processes is being executed at the same time as a media player used to access the unprotected data within the unprotected buffer; and determining that unauthorized access of the unprotected data is occurring when the process included within the list of content-capture processes is detected. ### Claim 23 (depends on 1) The method according to claim 1, further comprising: sending, to a media source device and in response to the determining, an indicator associated with the content reproducing device such that the media source device ceases providing data to the content reproducing device. ### Claim 24 (depends on 1) The method according to claim 1, wherein the receiving includes receiving the encrypted data from a media source device. ### Claim 25 (depends on 1) The method according to claim 1, wherein the set of memory access calls includes at least one system application programming interface call. ### Claim 26 (depends on 17) The content reproducing device according to claim 17, wherein the communication interface is configured to send, to a media source device and in response to the determining, an indicator associated with the content reproducing device such that the media source device ceases providing data to the communication interface. ### Claim 27 (depends on 19) The non-transitory computer readable recording medium according to claim 19, wherein the method further comprises: sending, to a media source device and in response to the determining, an indicator associated with the content reproducing device such that the media source device ceases providing data to the content reproducing device. ### Claim 28 (depends on 21) The method according to claim 21, further comprising: sending, to a media source device and in response to the determining that the particular call is an unauthorized access of the unprotected data when the particular call is to the library that is not within the expected loading sequence of graphic libraries, an indicator associated with the content reproducing device such that the media source device ceases providing data to the content reproducing device. ### Claim 29 (depends on 22) The method according to claim 22, further comprising: sending, to a media source device and in response to the determining that unauthorized access of the unprotected data is occurring when the process included within the list of content-capture processes is detected, an indicator associated with the content reproducing device such that the media source device ceases providing data to the content reproducing device.