Abstract: A system for digital rights management including a processor in a platform and a memory device comprising instructions that when executed configure the processor to perform operations. The operations may include determining whether a digital media is locally installed in a platform before initiating an operating system, and launching a first UEFI application configured to generate attestation data and communicate attestation based data to a server through an encrypted medium in response to determining the digital media is not installed. The operations may also include receive a binary file of the digital media and a first decryption key and performing a sealing of the binary file using a sealing enclave of the first UEFI application and generating a local decryption second key based on the first key and local entropy. The operations may also include installing the sealed binary file on local storage.

Abstract: A system for secure processor virtualization including a secure initialization memory and one or more processors coupled to the secure initialization memory is disclosed. The secure initialization memory includes initialization instructions for launching a security runtime environment before operating systems and cryptographic keying for security handoffs. The processors are configured to retrieve the initialization instructions from the secure initialization memory at startup, execute the initialization instructions to launch the security runtime environment and retrieve at least a portion of the cryptographic keying, and generate specific keying for chip-level resources the processors by combining instruction sets of the chip-level resources and the cryptographic keying.