According to one embodiment, a method is disclosed. The method includes receiving video data at an application program, receiving the video data to one or more memory buffers, decrypting the video data, and monitoring page table entries corresponding to the memory buffers to determine whether a second application program has accessed the memory buffers.