diff --git a/libwvdrmengine/mediadrm/src_hidl/WVDrmPlugin.cpp b/libwvdrmengine/mediadrm/src_hidl/WVDrmPlugin.cpp
index 528b0f2e..2c9abf0a 100644
--- a/libwvdrmengine/mediadrm/src_hidl/WVDrmPlugin.cpp
+++ b/libwvdrmengine/mediadrm/src_hidl/WVDrmPlugin.cpp
@@ -6,8 +6,10 @@
 
 //#define LOG_NDEBUG 0
 #define LOG_TAG "WVCdm"
+#include <hwbinder/IPCThreadState.h>
 #include <utils/Log.h>
 
+#include <cstring>
 #include <list>
 #include <stdlib.h>
 #include <string>
@@ -1721,6 +1723,14 @@ Return<void> WVDrmPlugin::signRSA(
     const hidl_vec<uint8_t>& wrappedKey,
     signRSA_cb _hidl_cb) {
 
+  const auto& self = android::hardware::IPCThreadState::self();
+  const char* sid = self->getCallingSid();
+  if (!sid || (!strstr(sid, "mediashell_app") && !strstr(sid, "mediadrmserver"))) {
+    ALOGE("Only mediashell/mediadrmserver can call signRSA");
+    _hidl_cb(Status::ERROR_DRM_UNKNOWN, hidl_vec<uint8_t>());
+    return Void();
+  }
+
   if (sessionId.size() == 0 || algorithm.size() == 0 ||
       message.size() == 0 || wrappedKey.size() == 0) {
     _hidl_cb(Status::BAD_VALUE, hidl_vec<uint8_t>());