JP2009543211A5 - - Google Patents

Claims (75)

A storage system,
A non-volatile memory that functions to store data;
A controller functionally coupled to the non-volatile memory and configured to communicate with an entity;
One or more software applications that function to process data upon startup by the entity;
Information for authenticating the entity and as soon as the entity is authenticated by the controller, the entity accesses the data and activates and communicates with a particular software application of the software applications. An access management structure that contains additional information to determine authority;
A storage system comprising: The storage system according to claim 1,
The access management structure is a storage system that contains further information for determining authority of the one or more software applications. The storage system according to claim 1,
The access management structure further information for determining which data of the data stored in the storage system is permitted to access both the entity and the one or more software applications. Accommodating storage system. The storage system according to claim 1,
The access management structure is a storage system that contains further information for managing a right of a particular software application among the software applications to access the data stored in the nonvolatile memory. The storage system according to claim 1,
The storage system, wherein the controller functions to further utilize the access management structure in delegating authority between separate entities and software applications for the purpose of sharing the data. The storage system according to claim 1,
The access management structure includes first and second sub-management structures, wherein the first sub-management structure is associated with the one or more software applications, the second sub-management structure is associated with an entity, A storage system capable of delegating authority between a first sub-management structure and the second sub-management structure. The storage system according to claim 1,
The one or more software applications include a DRM software application that can be selected and activated by the entity in processing the data. The storage system according to claim 1,
The one or more software applications include two or more software applications, the entity activates the two or more software applications in response to a data processing request, and the storage system includes the two or more software applications. Further comprising a communication channel corresponding to each one and passing the data processing request from the entity to the two or more software applications, wherein the access management structure includes the two or more software applications from the entity. A storage system that manages the communication channel to pass any one of the data processing requests over any one of them, each of the communication channels corresponding to only one application. The storage system according to claim 8.
A storage system further comprising a secure storage application, wherein data processing request information passing through the communication channel is transparent to the secure storage application. The storage system according to claim 1,
A storage system further comprising a secure storage application associated with the access management structure, the business entity, and the one or more software applications. The storage system of claim 10, wherein
The one or more software applications send a request to the secure storage application, and the secure storage application does not distinguish between requests from the entity and requests from the one or more software applications. The storage system according to claim 1,
And further comprising at least one data object accessed by the business entity and stored in the non-volatile memory, the at least one data object comprising the data and the at least one data object and the one or more software applications. At least one association between the at least one association and thereby causing the one or more software applications to be launched by the at least one association when a request for information is sent by the entity to the access management structure. Accumulation system. The storage system of claim 12,
Further comprising encrypted content stored in the non-volatile memory, wherein the data includes a decryption key value, and the information is obtained from the encrypted content and the decryption key value by the one or more software applications. Storage system containing decrypted content to be generated. The storage system of claim 12,
The data includes a seed value for generating a disposable password by the one or more software applications, and the information includes a storage system including the disposable password. The storage system according to claim 1,
An object including a key pair consisting of a private key and a public key, and at least one certificate that accommodates the public key, wherein the one or more software applications provide the public key to the business entity. A storage system that uses the at least one certificate to prove authenticity and to obtain data encrypted with the public key. The storage system according to claim 1,
Further comprising encrypted data stored in the non-volatile memory, the encrypted data can be decrypted with a decryption key stored in the storage system, and the access management structure is used for managing access to the decryption key. Storage system used. The storage system of claim 16, wherein
A storage system in which only the controller can access the decryption key. The storage system according to claim 1,
And further comprising a set of protocols stored in the non-volatile memory for communication between the business entity and the storage system, wherein at least one of the protocols is modified by activation of the one or more software applications. Storage system that can. The storage system of claim 18, wherein
The activation of the one or more software applications is a storage system that replaces the at least one protocol with another protocol. The storage system of claim 19,
The other protocol is a storage system related to a credential revocation system. The storage system according to claim 1,
The access management structure manages access to data by enforcing an access policy, and activation of the one or more software applications is at least one different from the access policy for accessing the data by the entity. Storage system that imposes two additional conditions. The storage system of claim 21, wherein
The at least one additional condition is a storage system related to a license. The storage system of claim 21, wherein
A storage system in which the entity is required to comply with both the first and second access policies before access to data is granted. The storage system according to claim 1,
At least one data object stored in the non-volatile memory, the at least one data object between at least a portion of the data and between the at least one data object and the one or more software applications; Accommodates at least one association so that when the at least one data object is accessed by the entity, the at least some data in the at least one data object is processed to obtain information Therefore, a storage system in which the one or more software applications are activated by the at least one connection. 25. The storage system of claim 24.
The access management structure manages access by the at least one entity to the data stored in the non-volatile memory through an authentication process, and after the entity is authenticated by the access management structure through the authentication process. A storage system capable of disclosing the information to the business entity without further activation of the one or more software applications. The storage system of claim 25.
A storage system wherein the business entity cannot access the at least some data in the at least one data object. The storage system according to claim 1,
The access management structure includes: a first sub-management structure for managing access by the entity to information available from data stored or to be stored in the non-volatile memory; and the one or more software applications. And a second sub-management structure for managing activation, wherein the first and second sub-management structures use substantially the same management mechanism. The storage system according to claim 1,
To be able to provide and store at least one data object with data from the entity or derived data derived from the data under the management of the access management structure, stored in the non-volatile memory, A plurality of first protocol sets consisting of different protocols, selected one by one by the entity;
A second set of protocols that is stored in the non-volatile memory and that allows the data or derived data to be derived from the at least one data object under the control of the access management structure;
A storage system that can enable the second protocol set to retrieve and retrieve the data or derived data whatever the first protocol set has been made possible to provide and store. The storage system of claim 28.
The difference between the first protocol set is a storage system related to authentication of the non-volatile memory or encryption of the data. The storage system of claim 28.
A plurality of different software applications stored in the non-volatile memory, each of the at least some different software applications corresponding to any one of the first protocol set, whereby the data Or when any one of the first protocol sets is selected to enable providing and storing derived data, to process the data or derived data. A storage system in which the software application corresponding to one set is activated. The storage system of claim 30, wherein
A storage system wherein each of the at least some different software applications yields different results from processing the data or derived data. The storage system of claim 30, wherein
The data or derived data includes any one of a plurality of seed values, and each of the at least some different software applications processes a corresponding one of the plurality of seed values. A storage system that generates a corresponding disposable password. The storage system of claim 30, wherein
The non-volatile memory stores encrypted data, and the data or derived data includes any one of a plurality of decryption keys for decrypting the encrypted content, and the at least some different software applications Are storage systems that use any one of the plurality of decryption keys for decrypting the encrypted content. The storage system according to claim 1,
A storage system in which data is accessed by the entity after being processed by the one or more software applications. The storage system according to claim 1,
The data stored in the storage system includes at least one license for accessing encrypted content stored in the non-volatile memory, and the data provided to the entity is valid for the at least one license A storage system that includes instructions on whether or not. 36. The storage system of claim 35.
The non-volatile memory stores encrypted data, and the access management structure manages a decryption of the encrypted content according to the instruction. The storage system according to claim 1,
The storage system wherein the one or more software applications are implicitly activated by the controller. The storage system according to claim 1,
A storage system in which the entity cannot access data stored in the storage system, but is allowed to communicate with the one or more software applications. A method of providing data processing services to an entity,
A controller, a non-volatile memory for storing data, one or more software applications, information for authenticating an entity, and the entity accesses the data as soon as the entity is authenticated, and the software application Authenticating the entity with a storage system comprising: an access management structure containing additional information for activating and communicating with a particular software application of
An authority to receive a request from an authenticated entity to communicate with a particular software application of the one or more software applications and to communicate with a particular software application of the one or more software applications is the authentication. Granting the request only if it is in a completed entity and executing a particular software application of the one or more software applications if it is not currently running;
Receiving a request to write or read data in the memory and granting the write or read request if the entity is authorized to access the memory; and
Including methods. 40. The method of claim 39, wherein
The access management structure contains additional information for determining authority of the one or more software applications. 40. The method of claim 39, wherein
The access management structure further information for determining which data of the data stored in the storage system is permitted to access both the entity and the one or more software applications. How to house. 40. The method of claim 39, wherein
The access management structure contains further information for managing the right of a particular software application of the software applications to access the data stored in the non-volatile memory. 40. The method of claim 39, wherein
A method wherein the controller functions to further utilize the access management structure in delegating authority between separate entities and software applications for the purpose of sharing the data. 40. The method of claim 39, wherein
The access management structure includes first and second sub-management structures, wherein the first sub-management structure is associated with the one or more software applications, the second sub-management structure is associated with an entity, A method by which authority can be delegated between the first sub-management structure and the second sub-management structure. 40. The method of claim 39, wherein
The method wherein the one or more software applications include a DRM software application that can be selected and launched by the entity in processing the data. 40. The method of claim 39, wherein
The one or more software applications include two or more software applications, the entity activates the two or more software applications in response to a data processing request, and the storage system includes the two or more software applications. Further comprising a communication channel corresponding to each one and passing the data processing request from the entity to the two or more software applications, wherein the access management structure includes the two or more software applications from the entity. Managing the communication channels to pass any one of the data processing requests over any one of them, each of the communication channels corresponding to only one application. The method of claim 46.
A method in which data processing request information passing through the communication channel is transparent to a secure storage application in the storage system. 40. The method of claim 39, wherein
Further comprising sending a request from the one or more software applications to a secure storage application in the storage system, wherein the secure storage application includes a request from the entity and from the one or more software applications. A method that does not distinguish between requests. 40. The method of claim 39, wherein
When a request for information is sent by the entity to the access management structure, due to at least one association between at least one data object accessed by the entity and the one or more software applications, the A method by which one or more software applications are launched. 50. The method of claim 49, wherein
The method wherein the data includes a decryption key value and the information includes decrypted content obtained from the encrypted content and the decryption key value by the one or more software applications. 50. The method of claim 49, wherein
The data includes a seed value for generating a disposable password by the one or more software applications, and the information includes the disposable password. 40. The method of claim 39, wherein
The one or more software applications prove to the entity that the public key is authentic by using at least one certificate containing a public key of a public / private key pair; And the method of obtaining the data encrypted with the said public key. 40. The method of claim 39, wherein
The encrypted data stored in the non-volatile memory can be decrypted with a decryption key stored in the storage system, and the access management structure is used for managing access to the decryption key. 54. The method of claim 53, wherein
Only the controller can access the decryption key. 40. The method of claim 39, wherein
A method wherein a set of protocols stored in the non-volatile memory for communication between the business entity and the storage system can be modified by launching the one or more software applications. 56. The method of claim 55, wherein
The launching of the one or more software applications replaces the at least one protocol with another protocol. 57. The method of claim 56, wherein
The other protocol is a method related to a credential revocation scheme. 40. The method of claim 39, wherein
The access management structure manages access to data by enforcing an access policy, and activation of the one or more software applications is at least one different from the access policy for accessing the data by the entity. To impose two additional conditions. 59. The method of claim 58, wherein
The method wherein the at least one additional condition relates to a license. 59. The method of claim 58, wherein
The method in which the entity needs to comply with both the first and second access policies before being granted access to data. 40. The method of claim 39, wherein
When the entity accesses the at least one data object, the at least one data object and the 1 are used to process the at least some data in the at least one data object to obtain information. A method in which the one or more software applications are activated by at least one association with the one or more software applications. 62. The method of claim 61, wherein
The access management structure manages access by the at least one entity to data stored in the non-volatile memory through an authentication process, and after the entity is authenticated by the access management structure through the authentication process, A method by which the information can be disclosed to the entity without further activation of the one or more software applications. 64. The method of claim 62, wherein
The method wherein the entity cannot access the at least some data in the at least one data object. 40. The method of claim 39, wherein
The access management structure includes a first sub-management structure for managing access by the entity to information available from data stored or to be stored in the non-volatile memory, and the one or more software applications. A second sub-management structure for managing activation, wherein the first and second sub-management structures use substantially the same management mechanism. 40. The method of claim 39, wherein
The storage system is
To be able to provide and store at least one data object with data from the entity or derived data derived from the data under the management of the access management structure, stored in the non-volatile memory, A plurality of first protocol sets consisting of different protocols, selected one by one by the entity;
A second set of protocols that is stored in the non-volatile memory and that allows the data or derived data to be derived from the at least one data object under the control of the access management structure;
A method wherein the second protocol set can allow the data or derived data to be retrieved whatever the first protocol set has been made possible to provide and store. 66. The method of claim 65, wherein
The difference between the first protocol sets is a method related to authentication of the non-volatile memory or encryption of the data. 66. The method of claim 65, wherein
A plurality of different software applications are stored in the non-volatile memory, each of the at least some different software applications corresponding to any one of the first protocol set, whereby the data or derivative When any one of the first set of protocols is selected to allow data to be provided and stored, any one of the first set is processed to process the data or derived data. A method in which the software application corresponding to a set is activated. 68. The method of claim 67, wherein
The method wherein each of the at least some different software applications yields different results from processing the data or derived data. 68. The method of claim 67, wherein
The data or derived data includes any one of a plurality of seed values, and each of the at least some different software applications processes a corresponding one of the plurality of seed values. A method for generating a corresponding disposable password. 68. The method of claim 67, wherein
The non-volatile memory stores encrypted data, and the data or derived data includes any one of a plurality of decryption keys for decrypting the encrypted content, and the at least some different software applications Each of which uses any one of the plurality of decryption keys for decrypting the encrypted content. 40. The method of claim 39, wherein
A method in which data is accessed by the entity after being processed by the one or more software applications. 40. The method of claim 39, wherein
The data stored in the storage system includes at least one license for accessing encrypted content stored in the non-volatile memory, and the data provided to the entity is valid for the at least one license A method that includes an indication of whether or not. 73. The method of claim 72, wherein
The non-volatile memory stores encrypted data, and the access management structure manages the decryption of the encrypted content according to the instruction. 40. The method of claim 39, wherein
The method wherein the one or more software applications are implicitly launched by the controller. 40. The method of claim 39, wherein
A method in which the entity cannot access data stored in the storage system but is allowed to communicate with the one or more software applications.