Patent Application
20100125914
The present disclosure relates generally to information handling systems, and more particularly to a protected information stream allocation using a virtualized platform using an information handling system.
As the value and use of information continues to increase, individuals and businesses seek additional ways to process and store information. One option is an information handling system (IHS). An IHS generally processes, compiles, stores, and/or communicates information or data for business, personal, or other purposes. Because technology and information handling needs and requirements may vary between different applications, IHSs may also vary regarding what information is handled, how the information is handled, how much information is processed, stored, or communicated, and how quickly and efficiently the information may be processed, stored, or communicated. The variations in IHSs allow for IHSs to be general or configured for a specific user or specific use such as financial transaction processing, airline reservations, enterprise data storage, or global communications. In addition, IHSs may include a variety of hardware and software components that may be configured to process, store, and communicate information and may include one or more computer systems, data storage systems, and networking systems.
IHS architecture platforms have traditionally followed a well defined development evolution based on the Win Tel/x86 architecture.
Using virtualization systems in a CE device allows the ability for users to add features, applications or other capabilities to their IHS by adding virtual modules. In this way, the virtual modules enable the user to completely change the personality or functionality of the IHS. These virtual functionality modules generally share hardware resources. Security of data and content which flows into and out of these functional modules and guaranteed allocation of resources for resource heavy applications, are unique challenges to CE devices.
For example, challenges in offering a virtualization enabled CE device (e.g., one with Blu-ray or other video capabilities) include an issue of how to obfuscate the content stream coming from the video device. Another issue in offering a virtualization enabled CE device includes how to support multiple protected streams. In other words, if a user connects additional virtual machines that output a protected stream to the host, (e.g., gaming virtual machine), then there needs to be a way to protect the streams of content coming from the gaming virtual machine as well as the video device. Yet another issue in offering a virtualization enabled CE device includes how to allocate the appropriate graphics processor unit (GPU) resources to the video and the premium content virtual machines so they do not fight for resources of the IHS. A further issue in offering a virtualization enabled CE device includes how to message to the customer if resource re-prioritization is required. These issues illustrate problems with offering a virtualization enabled CE device.
Accordingly, it would be desirable to provide an improved protected information stream allocation using a virtualized platform absent the disadvantages discussed above.
According to one embodiment, a protected stream manager includes one or more subsystems to receive a content stream in a virtual environment, obfuscate the content stream, and prioritize use of a processor to process the content stream.
For purposes of this disclosure, an IHS 100 includes any instrumentality or aggregate of instrumentalities operable to compute, classify, process, transmit, receive, retrieve, originate, switch, store, display, manifest, detect, record, reproduce, handle, or utilize any form of information, intelligence, or data for business, scientific, control, or other purposes. For example, an IHS 100 may be a personal computer, a network storage device, or any other suitable device and may vary in size, shape, performance, functionality, and price. The IHS 100 may include random access memory (RAM), one or more processing resources such as a central processing unit (CPU) or hardware or software control logic, read only memory (ROM), and/or other types of nonvolatile memory. Additional components of the IHS 100 may include one or more disk drives, one or more network ports for communicating with external devices as well as various input and output (I/O) devices, such as a keyboard, a mouse, and a video display. The IHS 100 may also include one or more buses operable to transmit communications between the various hardware components.
Other resources can also be coupled to the system through the memory I/O hub 104 using a data bus, including an optical drive 114 or other removable-media drive, one or more hard disk drives 116, one or more network interfaces 118, one or more Universal Serial Bus (USB) ports 120, and a super I/O controller 122 to provide access to user input devices 124, etc. The IHS 100 may also include a solid state drive (SSDs) 126 in place of, or in addition to main memory 108, the optical drive 114, and/or a hard disk drive 116. It is understood that any or all of the drive devices 114, 116, and 126 may be located locally with the IHS 100, located remotely from the IHS 100, and/or they may be virtual with respect to the IHS 100.
Not all IHSs 100 include each of the components shown in
The IHS 100 shown in
Coupled with the IHS 100 are three virtual machine devices 140, 142 and 144. Any number of virtual machine devices may couple with the IHS 100. The virtual machines 140, 142 and 144 are designed to enable a “black box” device, such as the IHS 100, to change functions, including operating systems, hardware, and a variety of other features, when different virtual machines 140, 142 and 144 are coupled with the IHS 100. In an embodiment, the virtual machine 140 provides television signals, such as cable television 148, broadcast television 150, satellite television 152, or any other type of television to the IHS 100 via a secure content stream 156. In an embodiment, the virtual machine 142 provides Blu-ray or other high definition video signals to the IHS 100 via a secure content stream 158. In an embodiment, the virtual machine 144 provides gaming signals to the IHS 100 via a secure content stream 160. Each virtual machine 140, 142 and 144 may be an independent, isolated unit that may include its own version of an operating system running on the respective virtual machine 140, 142 and 144.
In an embodiment, the hypervisor 132 and the PSM 134 make resources available to the virtual machines 140, 142 and 144. Accordingly, the hypervisor 132 and the PSM 134 may prioritize the resources and time multiplex the resources so that each virtual machine 140, 142 and 144 thinks that it “owns” the GPU 110 or other processor. In other words, the PSM 134 allows each virtual machine 140, 142 and 144 to provide its content to the GPU 110 (110A, 110B and 110C, respectively) via the respective content stream 156, 158 and 160 so that each virtual machine 140, 142 and 144 appears to have ownership of the GPU 110.
In an embodiment, the PSM 134 is responsible for handling obfuscation of the content stream, supporting multiple protected streams, GPU 110 prioritization, messaging to the hypervisor 132 and processor 102 prioritization. Obfuscation is generally referred to as blocking an access path to information. Obfuscation may be performed by scrambling or encrypting the information, but does not have to be. Thus, any system or method may be used to obfuscate or block access paths to information in the secure content streams 156, 158 and 160. The PSM 134 handles obfuscation of the content stream coming from the Blu-ray virtual machine 142 as well as, potentially, multiple protected content stream sources (e.g., virtual machine 140 and virtual machine 144) using an allocation of secure resources by allocating secure memory, (e.g., a portion of memory 108), such that only designated functions have access to such memory, and sequestering data paths 156, 158 and 160, making them accessible only to authenticated subsystems defining the specific, secure, content path. Similarly, premium content via virtual machine 140 may be obfuscated by means of allocation and isolation.
The PSM 134 supports multiple protected streams (e.g., 156, 158 and 160) wherein if a user of the IHS 100 connects additional virtual machines that output a protected stream to the host, for example, the gaming virtual machine 144, then the PSM 134 will prevent what is known as man in middle attacks by preventing the streams 156, 158 and 160 from getting exposed through secure allocation of resources, as described above, and sequestering each stream from access by those outside of the authenticated secure path. As such this will also prevent the functions from getting access to each other's data content.
The PSM 134 provides GPU 110 prioritization by having the ability to allocate the appropriate GPU 110 resources (e.g., 110A, 110B and 110C) respectively to each function (e.g., virtual machine 140, virtual machine 142 and virtual machine 144) so they do not compete for resources, such as the GPU 110 or other processor, such as the processor 102. Therefore, each virtual machine 140, 142 and 144 each have appropriate resources (e.g., the GPU 110) to render the content stream 156, 158 and 160 in play. In an embodiment, the PSM 134 allows multiple applications to “time multiplex” the GPU 110. That is, each application has full access to all of the GPU resources for a unit of time (e.g., a time slice).
To provide GPU 110 prioritization, as described above, the PSM 134 may manage the graphics content between the times slices, such as by saving the state of the GPU 110 for the time slice that just completed, and restoring the state of the GPU 110 for the slice that is about to run. In an embodiment, graphics state information may include rendering state and surface data, such as texture data or render targets.
In addition, to provide GPU 110 prioritization, as described above, the PSM 134 may manage the allocation of video memory. To accomplish this, the PSM 134 may determine which resources need to be resident on the GPU 110 local memory and page out unused resources.
To provide GPU 110 prioritization, as described above, the PSM 134 may also ensure that the application's state is isolated from the state of the other applications. There may be special resources that are not capable of time multiplexing, for example, television turners or some video decoders. In this case, the PSM 134 will be responsible for prioritizing the assigning of these resources to the applications, such as by a “first in, first out” prioritization algorithm. Also where time multiplexing is not performed, the PSM 134 may be responsible for exception handling in the situation where an application requests one of these special resources, but all resources are allocated to other tasks. This may trigger a message to the customer that resources are low and may also be accompanied by guidance on how to reprioritize the resource allocation.
In an embodiment, the PSM 134 providing appropriate messaging to the hypervisor 132 and to the user of the IHS 100 if the GPU 110 runs low on capacity and needs guidance on prioritization of the virtual machines 140, 142 and 144. The messaging may be provided to the user by pop-up notifications on the display device 112. Other types of messaging may be used for the present disclosure.
The PSM 134 may provide processor 102 prioritization by including an ability to allocate the appropriate processor 102 resources to each function (e.g., a Blu-ray virtual machine 142 and/or other premium content virtual machines 140 and/or 144) so they do not compete for resources, and each virtual machine 140, 142 and/or 144 has appropriate resources to render the stream in play.
It should be readily understood by a person having ordinary skill in the art that embodiments of the present disclosure provide an application programming interface (API) for an application to access a resource manager in a firmware enabled hypervisor (e.g., hypervisor 132). Embodiments of the present disclosure also provide a system for securing protected content streams (e.g., protected content streams 156, 158 and 160) in a firmware enabled hypervisor (e.g., hypervisor 132) by isolating the compute (e.g., processor 102), memory (e.g., main memory 108) and GPU (e.g., GPU 110) resources used by a particular function. Embodiments of the present disclosure further provide an ability to offer Blu-ray and other premium content services in the form of virtual machines (e.g., virtual machines 140, 142 and 144), insuring proper resources are available for execution of their content stream (e.g., 156, 158 and 160). Other embodiments of the present disclosure provide systems obfuscating the protected content streams (e.g., protected content streams 156, 158 and 160) by isolating the compute environment. Still other embodiments of the present disclosure provide a secure system for allocating appropriate GPU resources (e.g., GPU 110, 110A, 110B and 110C) to protected streams (e.g., protected content streams 156, 158 and 160) without impacting the performance. Moreover, other embodiments of the present disclosure provide secure systems of allocating appropriate processor 102 resources to protected steams (e.g., protected content streams 156, 158 and 160) without impacting the performance.
Although illustrative embodiments have been shown and described, a wide range of modification, change and substitution is contemplated in the foregoing disclosure and in some instances, some features of the embodiments may be employed without a corresponding use of other features. Accordingly, it is appropriate that the appended claims be construed broadly and in a manner consistent with the scope of the embodiments disclosed herein.
