LAS16-406: Android Widevine on OP-TEE
6 likes•2,041 views
The document discusses the integration of Widevine DRM with OP-TEE for secure media playback on Android devices. It highlights the challenges of managing plaintext video data and key security within user and kernel spaces, and introduces OP-TEE as a solution to secure content. The presentation outlines the current status of implementing this technology, including necessary improvements and ongoing efforts to enhance security features.
LAS16-406: Android Widevine on OP-TEE
- 1. Android Widevine on OP-TEE David Brown
- 2. ENGINEERS AND DEVICES WORKING TOGETHER Agenda ● Motivations ● How not to do it ● OP-TEE ● General solutions ● Overview of Widevine
- 3. ENGINEERS AND DEVICES WORKING TOGETHER Motivation
- 4. ENGINEERS AND DEVICES WORKING TOGETHER Motivation ● Software playback ● Red arrow, bad! ● Creators sad, no HD
- 5. ENGINEERS AND DEVICES WORKING TOGETHER Agenda ● Motivations ● How not to do it ● OP-TEE ● General solutions ● Overview of Widevine
- 6. ENGINEERS AND DEVICES WORKING TOGETHER How not to do it? ● Plaintext video passes through userspace ● Find exploit in player, or many other things ● Root makes it trivial to get ● Notice the key is also in userspace ● This is bad
- 7. ENGINEERS AND DEVICES WORKING TOGETHER Can we do better?
- 8. ENGINEERS AND DEVICES WORKING TOGETHER ● Less is accessible ● Plaintext still in userspace ● Creators still sad Can we do better?
- 9. ENGINEERS AND DEVICES WORKING TOGETHER All plaintext in kernel?
- 10. ENGINEERS AND DEVICES WORKING TOGETHER All plaintext in kernel? ● Better, no plaintext in userspace ● Key still there ● Kernel is vulnerable
- 11. ENGINEERS AND DEVICES WORKING TOGETHER Key in kernel
- 12. ENGINEERS AND DEVICES WORKING TOGETHER Key in kernel ● All key/plaintext now in kernel ● Content protected from userspace ● Kernel exploits possible ● Creators still sad
- 13. ENGINEERS AND DEVICES WORKING TOGETHER OP-TEE ● ARM® TrustZone® ○ Trustable through boot into secure OS ○ Runs alongside Kernel ● GlobalPlatform TEE Specification ○ OP-TEE is our implementation ○ Allows trusted apps, and clients
- 14. ENGINEERS AND DEVICES WORKING TOGETHER OP-TEE
- 15. ENGINEERS AND DEVICES WORKING TOGETHER DRM in TEE
- 16. ENGINEERS AND DEVICES WORKING TOGETHER DRM in TEE ● Almost there, key is in TEE ● Plaintext video still available at end ● Providers still sad
- 17. ENGINEERS AND DEVICES WORKING TOGETHER One more thing ● We need a weird buffer ○ Accessible to secure side ○ Not readable by unsecure (even kernel) ○ Accessible by HW decoder ● SMAF ○ Secure memory allocator ○ TEE can decode into this memory ○ HW can play it back ● It’s tricky to get right, only certain HW should have access
- 18. ENGINEERS AND DEVICES WORKING TOGETHER Agenda ● Motivations ● How not to do it ● OP-TEE ● General solution ● Overview of Widevine
- 19. ENGINEERS AND DEVICES WORKING TOGETHER Keybox
- 20. ENGINEERS AND DEVICES WORKING TOGETHER Keybox
- 21. ENGINEERS AND DEVICES WORKING TOGETHER Content Key
- 22. ENGINEERS AND DEVICES WORKING TOGETHER Content Key
- 23. ENGINEERS AND DEVICES WORKING TOGETHER Content Key
- 24. ENGINEERS AND DEVICES WORKING TOGETHER Content Key
- 25. ENGINEERS AND DEVICES WORKING TOGETHER Agenda ● Motivations ● How not to do it ● OP-TEE ● General solution ● Overview of Widevine
- 26. ENGINEERS AND DEVICES WORKING TOGETHER Widevine ● CDM (content decryption module) for Android ● Specifics are for partners only ● Plugin based, we implement oemcrypto.so using our client lib and TA
- 27. ENGINEERS AND DEVICES WORKING TOGETHER Status ● Working on HiKey board ● OP-TEE available for Android AOSP ● We have a liboemcrypto.so and TA for Widevine CDM ● Several security things missing ○ No trusted boot chain, TEE could be modified (HiKey issue) ○ SMAF not yet supported (patches in progress) https://lkml.org/lkml/2016/9/7/133 ○ No HW video playback, buffers still need to be visible to software (HiKey work in progress)
- 28. Thank You #LAS16 For further information: www.linaro.org LAS16 keynotes and videos on: connect.linaro.org