Abstract: Method for establishing a trust chain, comprising: requesting a third CA for a third key pair and a third certificate, writing a private key of the third key pair and the third certificate into a security storage area, the third certificate comprising model information of the smart television (SMTV) terminal and information of a public key of the third key pair. The SMTV terminal check its possession of a fourth certificate on every start, generate a unique fourth key pair in absence of a fourth certificate, submit online a public key of the fourth key pair and a unique identification of each SMTV terminal to a fourth CA to request for a fourth certificate, and send along the third certificate and a signature signed on the request with the private key of the third key pair; write the fourth certificate into the security storage area upon receiving the fourth certificate.

Abstract: Method for establishing a trust chain, comprising: requesting a third CA for a third key pair and a third certificate, writing a private key of the third key pair and the third certificate into a security storage area, the third certificate comprising model information of the smart television (SMTV) terminal and information of a public key of the third key pair. The SMTV terminal check its possession of a fourth certificate on every start, generate a unique fourth key pair in absence of a fourth certificate, submit online a public key of the fourth key pair and a unique identification of each SMTV terminal to a fourth CA to request for a fourth certificate, send along the third certificate and a signature signed on the request with the private key of the third key pair; write the fourth certificate into the security storage area upon receiving the fourth certificate.

Abstract: A digital rights management (DRM) method for an intelligent operating system comprises: acquiring a play list of media data to be played and encrypted media data; inquiring and acquiring one or more DRM application modules, wherein the DRM application module contains an identifier of a trusted application module; requesting DRM authorization by the DRM application module from a DRM server, judging a content permission and acquiring an encrypted content encryption key (ECEK) and transmitting the ECEK to a TEE; after judging that the content permission is legitimate; decrypting the ECEK acquired by the trusted application module which is in the TEE and corresponds to the trusted application module identifier to acquire a content encryption key (CEK), and decrypting the encrypted media data by using the CEK; and storing the decrypted media data in a security cache region for decoding and outputting.

Abstract: Disclosed is a method for implementing a digital rights management-enabled media gateway. The media gateway comprises a trusted execution environment and a trusted application configured therein. The method comprises: acquiring a videoPid, an audioPid, a casId, an ecmPid, and an emmPid of a program; parsing the ecmPid and the emmPid using a parsing mechanism that matches the casId, obtaining encryption level keys EK1 and EK2 and an encryption control word ECW; descrambling the scrambled program data stream using the EK1, EK2, ECW, videoPid and audioPid of the program; generating a content encryption key CEK by the trusted application, encrypting the descrambled program data using the CEK and transmitting the same to the terminal; acquiring a public key from the terminal, encrypting the CEK with the public key by the trusted application to obtain an encrypted content encryption key ECEK and transmitting the ECEK to the terminal.

Abstract: A digital rights management (DRM) method for an intelligent operating system comprises: acquiring a play list of media data to be played and encrypted media data; inquiring and acquiring one or more DRM application modules, wherein the DRM application module contains an identifier of a trusted application module; requesting DRM authorization by the DRM application module from a DRM server, judging a content permission and acquiring an encrypted content encryption key (ECEK) and transmitting the ECEK to a TEE; after judging that the content permission is legitimate; decrypting the ECEK acquired by the trusted application module which is in the TEE and corresponds to the trusted application module identifier to acquire a content encryption key (CEK), and decrypting the encrypted media data by using the CEK; and storing the decrypted media data in a security cache region for decoding and outputting.