KR20090108690A - Methods and apparatuses for linking content with license - Google Patents

Abstract

A method for accessing content is provided. In this method, a first parameter associated with a license is retrieved. The license is associated with the content. A second parameter associated with the content also is retrieved. With the first and second parameters, a third parameter based on the first and second parameters is generated. The third parameter is configured for use in decrypting the content and the content can be accessed based on the third parameter. An apparatus is also provided comprising a memory and a processor in communication with the memory. The processor is configured to retrieve a first parameter associated with a license; retrieve a second parameter associated with the encrypted content; generate a third parameter based on the first and second parameters; and access the encrypted content based on the third parameter.

Description

METHODS AND APPARATUSES FOR LINKING CONTENT WITH LICENSE}

Embodiments of the present invention generally relate to content access and, more particularly, to associating content with a license and accessing content based on session tickets.

Digital rights management (DRM) is a technique used to protect and control the distribution of content such as music files, video files, and other content. In DRM, content is encrypted with an encryption key so that the encryption key can be used to decrypt the content. In order for a user to decrypt and access the content, the user must access a license associated with the content. In general, the license may grant other access rights to access the content based on the permissions defined by the licensor. For example, a license may restrict the content (eg, music files) to be played for a limited number of times.

In conventional DRM techniques, the encryption key used to decrypt the content is stored only in the license. The license can be hacked and the encryption key can be easily extracted from the license. If the encryption key is compromised, unauthorized users can decrypt the content without a license and thus access the content without restriction. As a result, there is a need to further improve the protection of the content.

Various embodiments of the present invention provide methods, systems and / or devices for linking content and licenses and for accessing content based on session tickets. It should be appreciated that the above embodiments may be implemented in a variety of ways, including methods, circuits, systems, or devices. Some embodiments of the invention are described below.

In one embodiment, a method for accessing content is provided. In this method, the first parameter associated with the license is retrieved. Licenses are associated with content. The second parameter associated with the content is retrieved. Due to the first and second parameters, a third parameter is generated based on the first and second parameters. The third parameter is configured for use in decrypting the content and the content can be accessed based on the third parameter.

In another embodiment, an apparatus is provided. The apparatus includes a memory and a processor in communication with the memory. The processor retrieves a first parameter associated with the license; Retrieve a second parameter associated with the content; Generate a third parameter based on the first and second parameters; And access content based on the third parameter.

Other embodiments and advantages of the invention will be apparent from the following detailed description, taken in conjunction with the accompanying drawings, which illustrate by way of example the principles of the invention.

BRIEF DESCRIPTION OF THE DRAWINGS The present invention will be readily understood by the following detailed description in conjunction with the accompanying drawings, wherein like reference numerals indicate similar structural elements.

1 is a simplified block diagram of a system of devices in accordance with an embodiment of the present invention.

2 is a block diagram illustrating generation of a parameter used to decrypt content in accordance with an embodiment of the present invention.

3 is a simplified block diagram of a system for accessing a memory device according to an embodiment of the present invention.

4 is a flow chart illustrating access of content from a memory device in accordance with an embodiment of the invention.

5 is a block diagram illustrating the creation of a session ticket according to an embodiment of the invention.

6 is a simplified block diagram of a system for accessing a memory device using a session ticket in accordance with an embodiment of the present invention.

7 is a flow diagram illustrating access of content from a memory device based on a session ticket in accordance with an embodiment of the present invention.

8 is a simplified block diagram of program applications that may be hosted on a host computing device for accessing content in accordance with an embodiment of the present invention.

9 is a simplified block diagram of program applications that may be included in a memory device according to an embodiment of the present invention.

10 is a simplified block diagram of a general overview of a host computing device suitable for hosting a content protection platform and other program applications in accordance with an embodiment of the present invention.

11 is a simplified block diagram of a memory device according to an embodiment of the present invention.

A detailed description of one or more embodiments is provided below in conjunction with the accompanying drawings. Detailed descriptions are provided in connection with the above embodiments, but are not limited to any particular embodiment. The scope is limited only by the claims and the numerous alternatives, modifications and equivalents included. Many specific items appear in the following detailed description to provide a thorough understanding. These items are provided by way of example and the described embodiments may be practiced according to the claims without some or all of these specific items. For the sake of simplicity, technical material known in the technical fields related to the embodiments is not described in detail in order to avoid unnecessarily obscuring the detailed description.

Embodiments described herein provide for linking content and licenses and accessing content based on session tickets. The encryption key is used to decrypt and access the encrypted content. As will be described in more detail below, parameters associated with both licenses and content are used to derive the encryption key. In some embodiments, the parameter used to derive the encryption key is further encrypted with a variable so that access to the content is restricted to the session.

1 is a simplified block diagram of an apparatus system according to an embodiment of the present invention. As shown in FIG. 1, system 102 includes a host computing device 114 and a memory device 116. The host computing device 114 may include various electronic devices capable of accessing the memory device 116 to store or retrieve content 118 stored in the memory device. Memory device 116 may be removably coupled to host computing device 114 by a mechanical interface 108, such as pin and / or socket connectors. Memory device 116 is a memory storage device. As will be described below, an example of the memory device 116 is a memory card that uses nonvolatile memory.

Host computing device 114 hosts application 104. Application 104 includes various program applications. For example, the application 104 may be an operating system that manages hardware and software resources on the host computing device 114. In another embodiment, the application 104 may be a multimedia player configured to play audio and video files. Additionally, for example, application 104 may be a video game. The application 104 can access the content 118 stored in the memory device 116. The content 118 may include various data. Examples of content 118 include audio files encoded in audio file formats, such as WAVE, MPEG-1 Audio Layer 3 (MP3), Advanced Audio Coding (AAC), and other audio file formats. The content 118 may include video files encoded in video file formats such as Audio Video Interleave (AVI), Moving Picture Experts Group (MPEG), and other video file formats. Other examples of content 118 include document files, image files, application files, and other data.

Content and license Linking

2 is a block diagram illustrating generation of a parameter used to decrypt content in accordance with an embodiment of the present invention. 2 shows content 118 and associated license 204. Content 118 is encrypted so that the content is difficult. Generally, license 204 is data (eg, strings, files, and other data) to which content 118 is accessed. The license 204 may be licenses or rules for accessing the content 118, such as the duration of the access, the access restriction of the content to a particular computing device, dates, times, the number of times the content can be accessed, and other permissions. Can include them. License 204 may be configured to define permissions for accessing content 118. Thus, the user has access to the content 118 based on the permissions contained in the license 204. For example, license 204 can cause content 118 in the form of a music file to be played three times on a particular computing device. In another embodiment, license 204 allows content 118 to be accessed but not to be copied to another computing device.

The content 118 is encrypted and the third parameter 210 is configured for use when decrypting the content. The third parameter 210 includes various data that may be associated with the decryption of the content 118. For example, the third parameter 210 may be an encryption key used for encryption and decryption of the content 118. Instead of the encryption key, the third parameter 210 can include a reference to the encryption key. For example, the reference can be a number or a string identifying the encryption key. The third parameter 210 can include an authentication key. The authentication key is an encryption key used to authenticate sessions between the host computing device and the memory device. In another example, the third parameter 210 can be an encryption nonnce. Encryption nonce is a number that can be used to generate an encryption key.

The third parameter 210 is generated based on the first parameter 202 and the second parameter 206. In other words, the third parameter 210 can be expressed as follows:

Third parameter = F (first parameter, second parameter) (1.0)

The third parameter here is a function of the first and second parameters 202 and 206. The function may include various functions, such as a hash function, such that the third parameter 210 may be a hash value of a hash function. The first parameter 202 is associated with the license 204 and the second parameter 206 is associated with the content 118. The first and second parameters 202 and 206 may include various data. For example, the first parameter 202 may be a number. In an embodiment, the number can be generated arbitrarily. In another embodiment, the number is predefined. The second parameter 206 may be in accordance with the first parameter 202 or vice versa. For example, the second parameter 206 can be a number or string derived from both the reference to the encryption key and the first parameter 202. The number or string may be expressed as follows:

2nd parameter = F (key reference, 1st parameter) (1.2)

The second parameter 206 is here a function of both the reference to the encryption key and the first parameter 202. It should be appreciated that the second parameter 206 can be derived from both the authentication key and the first parameter 202. In another embodiment, the second parameter 206 may be derived from the cryptographic nonce and the first parameter 202. Conversely, the first parameter 202 can be derived from a reference to the encryption key, encryption nonce, or other parameters with the second parameter 206 and the authentication key.

The first and second parameters 202 and 206 are associated with the license 204 and the content 118, respectively. To be associated with the license 204 or the content 118, the first and second parameters 202 and 206 may be disposed or included in the license and the content, respectively. For example, the second parameter 206 can be placed in the header or footer of the content 118. Optionally, the first parameter 202 and / or the second parameter 206 can be placed independent of the license 204 and / or the content 118. If deployed irrespective, license 204 may be associated with a first parameter 202 that includes a pointer to the first parameter. The content 118 may include a pointer to the second parameter 206 if the second parameter is placed independent of the content.

3 is a simplified block diagram of a system for accessing a memory device according to an embodiment of the present invention. As shown, the system 302 includes a host computing device 114 coupled to a memory device 116. Host computing device 114 may include an application 104 and a first content protection platform 304. Memory device 116 includes a second content protection platform 306, content 118, and a license 204. In an embodiment, license 204 may be stored in a hidden compartment of memory device 116 where the license is not visible or accessible by many applications. In addition to being stored in the memory device 116, the license 204 may be stored in the host computing device 114. The first and second content protection platforms 304 and 306 are technical platforms for protecting content 118 for the memory device 116. The first content protection platform 304 and / or the second content protection platform 306 allows the user to deliver the memory device 116 and the content 118 of the memory device without compromising content protection. There are various content protection platforms that can be used to protect data, examples of which are sold under the trade names TrustedFlash ^™ and Gruvi ^™ (manufactured by SanDisk, Inc.).

As shown in FIG. 3, the application 104 by the first content protection platform 304 sends a request for content 118 stored in the memory device 116. Here, the content 118 is encrypted. To decrypt the content 118, the first parameter 202 associated with the license 204 and the second parameter 206 associated with the content 118 are retrieved. The first parameter 202 and the second parameter 206 may be included in the license 204 and the content 118, respectively, or may be files placed independently of the license and the content. As defined by equation 1.0, the third parameter is generated based on the first parameter 202 and the second parameter 206. In other words, the third parameter can be derived from the first and second parameters 202 and 206. The third parameter can be the encryption key used to decrypt the content 118, a reference to the encryption key, an authentication key, a nonce, or other parameters. Due to the third parameter, the application 104 can decrypt and access the content 118. To access the content 118, the first content protection platform 304 can send a request for the third parameter and the content 118 to the memory device 116. The second content protection platform 306 can decrypt the content 118 based on the third parameter and send the content to be decrypted to the application 104 by the first content protection platform 304.

In the embodiment of FIG. 3, the first content protection platform 304 hosted on the host computing device 114 retrieves the first and second parameters 202 and 206 and based on the first and second parameters. Create a third parameter. In another embodiment, the second content protection platform 306 included in the memory device 116 retrieves the first and second parameters 202 and 206 and sets the third parameter based on the first and second parameters. Create

4 is a flow chart illustrating access of content from a memory device in accordance with an embodiment of the invention. Starting at 402, the content is analyzed to determine if the content is protected (ie, encrypted). Various information associated with the content may indicate whether the content is encrypted. The header of the content may, for example, indicate that the content is encrypted. Optionally, the filename extension of the content indicates that the content is encrypted. If the content is not protected, the content can be accessed directly at 410. If the content is not protected, the first parameter is retrieved from the license at 404. In this embodiment, the first parameter is a number. The number can be arbitrarily generated or predefined. At 406, the second parameter is retrieved from the content. In an embodiment, as represented in equation 1.2, the second parameter may be derived from a reference to the encryption key and the first parameter. The encryption key is used to encrypt or decrypt the content. As a result, the second parameter is associated with both content and license since the second parameter is derived or calculated from the number included with the license and the reference to the encryption key used to decrypt the content. In another embodiment, the first parameter (eg, number) may be associated with the content and the second parameter may be associated with the license.

Due to the first parameter and the second parameter, a reference to the encryption key can be generated or calculated at 408. As described above in Equation 1.0, a reference to the encryption key may be generated based on the first parameter and the second parameter. The content can then be decrypted and accessed based on the third parameter, at 410. For example, in one embodiment, the third parameter in the form of a reference to an encryption key can be sent to the memory device. The memory device may include a secure storage that stores the encryption key. The memory device can retrieve the encryption key from the secure store using the reference to the encryption key. The encryption key allows the memory device to decrypt the content and send the decrypted content to the host computing device.

Based on session ticket On content  access

5 is a block diagram illustrating generation of a session key in accordance with an embodiment of the present invention. The parameter 502 is initially provided and includes the various data that can be associated with the decryption of the content. The parameter 502 may be generated based on parameters associated with the license and content described above. Examples of parameter 502 include a reference, encryption nonce, or other parameters to the encryption key used for decryption of the content.

Creation of session ticket 506 involves the use of variable 504. Variable 504 contains various data. For example, the data may be a number. The number can be predefined or arbitrarily generated. In other embodiments, the data may be character characters. Unlike the parameters described above, the variable 504 may not be associated with a license and content. In other words, variable 504 may be independent of license and content. Variable 504 is configured to change in the session. The session can span any time period. For example, a session can last for hours, days, weeks, or other time units. In addition, the session may expire when the host computing device coupled to the memory device is started or restarted. The session can also expire when the memory device is detached from the host computing device. In addition, for example, a session can span a limited number of times of access to the content (eg, a limited number of times the content can be accessed).

The session ticket 506 is generated based on the parameter 502 and the variable 504 so that the parameter is encrypted based on the variable to define the session ticket 506. The session ticket 506 is therefore represented as follows:

Session Ticket = F (Parameters, Variable) (2.0)

The session ticket here is a function of parameter 502 and variable 504. The session ticket 506 allows the content to be accessed based on the session ticket. For example, the host computing device can send a session ticket 506 to the memory device. The memory device may derive the parameters used to decrypt the content based on the session ticket 506. The parameter 502 is derived as follows:

Parameter = F ^-1 (session ticket, variable) (2.2)

The parameter here is the inverse function of the session ticket 506 and the variable 504.

It should be appreciated that session ticket 506 is associated with specific content because the session ticket uses to decrypt the content. As a result, other content stored in the memory device cannot be used or accessed in the session ticket 506 if the session ticket does not include a parameter such as parameter 502 to decrypt the other content. By way of example, if two separate contents stored in a memory device are encrypted with different encryption keys, the host computing device or memory device generates two different session tickets to access the two separate contents. Here, one session ticket cannot be used to access two separate contents encrypted with different encryption keys.

6 is a simplified block diagram of a system for accessing a memory device using a session ticket in accordance with an embodiment of the present invention. System 602 includes a host computing device 114 coupled to a memory device 116. Host computing device 114 may include an application 104 and a first content protection platform 304. Memory device 116 includes a second content protection platform 306, content 118, and a license 204. As described above, the first and second content protection platforms 304 and 306 may be configured to manage the digital rights of the content 118 stored in the memory device 116.

As shown in FIG. 6, the application 104 sends a request for content 118 stored in the memory device 116 by the first content protection platform 304. Content 118 is encrypted with an encryption key. Parameters associated with an encryption key (eg, a reference to the encryption key; nonce, or other parameters) are provided to the second content protection platform 306. In response to the request for content 118, the second content protection platform 306 encrypts the parameter based on the variable 604 to define a session ticket represented by equation 2.0. The second content protection platform 306 can generate a variable 604 (eg, a number, string, or other parameter). The variable 604 is configured to change in the session. For example, the second content protection platform 306 can generate another variable 604 for every session. Variable 604 can be arbitrarily created or predefined.

After the session ticket is generated, the second content protection platform 306 sends a session ticket to host the computing device 114. The session ticket allows the host computing device 114 to access the content 118 based on the session ticket. To access the content 118, the host computing device 114 later sends a session ticket back to the memory device 116. Upon receipt of the session ticket, the second content protection platform 306 decrypts the session ticket to extract the parameters used to decrypt the content 118 represented in equation 2.2. If the variable 604 is not changed, the parameter can be extracted because decryption is based on the same variable as the variable used to encrypt the parameter. The variable 604 may change in other sessions. As a result, the variable 604 is the same variable used to encrypt the parameter if the variables are created within the same session. However, if variable 604 is changed, the parameter cannot be extracted because decryption is based on a variable different from the variable used to encrypt the parameter. Variable 604 is different from the variable used to encrypt the parameter if the variables were created in other sessions. By changing the variable 604 in the session, the session ticket lasts or is valid for one session. If the parameter is extracted, the second content protection platform 306 can decrypt the content 118 based on the parameter and send the decrypted content to the host computing device 114.

In another embodiment, first content protection platform 304 may generate a session ticket by encrypting a parameter used to decrypt content 118. Here, in response to a request by the application 104 to access the content 118, the first content protection platform 304 can generate a session ticket and send the session ticket to the application 104. . The application 104 may send a session ticket back to the first content protection platform 304 to access the content 118.

7 is a flow diagram illustrating access of content from a memory device based on a session ticket in accordance with an embodiment of the present invention. Starting at 702, a reference to the encryption key is retrieved. The reference can be retrieved from a host computing device or a memory device. Content stored on the memory device can be encrypted and decrypted using the encryption key. Due to the reference to the encryption key, the reference to the encryption key is encrypted based on the number at 704 to define the session ticket. The number can be configured to vary in the session and can be arbitrarily generated. The session ticket can then be sent to the host computing device, for example, at 706.

When the host computing device accesses content stored on the memory device, the host computing device may transmit the received session ticket to the memory device at 706. The memory device receives the session ticket at 708 and decrypts the session ticket based on the number at 710. If the number matches the number used to generate the session ticket, a reference to the encryption key can be extracted from the decryption operation. However, if the session is changed and another number is maintained by the memory device, then the reference to the encryption key cannot be extracted from the decryption operation because the numbers do not match. If a reference to the encryption key can be extracted from the session ticket, then the encryption key is retrieved based on the reference at 712. The encryption key can be retrieved from a secure storage, for example. The content is decrypted at 714 using the encryption key and sent to the host computing device at 716, for example.

8 is a simplified block diagram of program applications that may be hosted on a host computing device for accessing content in accordance with an embodiment of the present invention. The host computing device 114 can host the application 104, the digital rights management (DRM) module 806, the content protection platform 304, the file system manager 808, and the device driver 810. As noted above, the application 104 may include various program applications such as multimedia players, video games, and other applications. The application 104 communicates with the DRM module 806 and the content protection platform 304. DRM module 806 allows host computing device 114 to manage digital rights of content stored in a memory device or other locations. For example, the DRM module 806 may protect content and control the distribution of the content. As noted above, content protection platform 304 is a technical platform for protecting content on a memory device. The content protection platform 304 can include a security manager 802 and a host encryption engine 804. In general, security manager 802 manages access to content stored in a memory device. Management checks, for example, whether content is protected, creates a reference to an encryption key based on parameters associated with the license and content, creates a session ticket based on parameters and variables, creates a variable, and other Includes actions. Host cryptographic engine 804 includes cryptographic libraries to process cryptographic operations. The content protection platform 304 and the DRM module 806 together provide secure storage and content management capabilities to the host computing device 114 (and memory device). For example, the content protection platform 304 and the DRM module 806 provide for secure storage and access to content of content stored on a memory device (eg, music files, movie files, software, and other data). Allows the execution of predefined policies to control.

The content protection platform 304 communicates with the file system manager 808. In general, file system manager 808 is configured to manage and process access (eg, read, write, and other access operations) of content stored on a memory device. For example, file system manager 808 may read content from the memory device and send the content to content protection platform 304 for processing. The host computing device 114 may interface with a memory device. The host computing device 114 may therefore include a device driver 810 in communication with the system manager 808 to interface with the memory device. The device driver 810 may include low level interface functions, for example, to communicate with a memory device. Examples of lower level interface functions include input / output functions associated with inputs and outputs to and from a memory device.

9 is a simplified block diagram of program applications that may be included in a memory device in accordance with an embodiment of the invention. Memory device 116 may include DRM module 902, content protection platform 306, encryption engine 904, and secure storage 906. In the memory device 116, the DRM module 902 allows the memory device 116 to manage the digital rights of the content stored in the memory device. For example, the DRM module 902 can be configured to execute content rights. As described above, the content protection platform 306 is a technology platform for protecting content stored in the memory device 116. The content protection platform 306 may be configured to generate a reference to the encryption key based on the parameters associated with the license and the content to generate a session ticket based on the parameters and variables, and may be configured for other operations. Encryption engine 904 processes the encryption operations and secure storage 906 stores the encryption keys.

In other embodiments, it should be appreciated that the host computing device 114 of FIG. 8 and the memory device 116 of FIG. 9 may include fewer or more program applications than those shown in FIGS. 8 and 9. For example, as shown in FIG. 8, file system manager 808 and device driver 810 may be integrated into content protection platform 304. The host computing device 114 of FIG. 8 may therefore include a DRM module 806 and a content protection platform 304.

10 is a simplified block diagram of a general overview of a host computing device suitable for hosting a content protection platform and other program applications in accordance with an embodiment of the invention. In some embodiments, host computing device 114 may be used to execute computer programs (eg, a content protection platform), logic, applications, methods, processes, or other software for accessing content. Can be. Examples of host computing device 114 include desktop computers, servers, portable computing devices, personal digital assistants, mobile phones, computing engines within appliances, and other computer systems. As shown in FIG. 10, host computing device 114 may include processor 1004, system memory 1006 (eg, random access memory (RAM)), and storage device 1008 (eg, read-only). Memory (ROM), magnetic disk drives, optical disk drives, and other storage devices), communication interface 1012 (eg, modem or Ethernet card), display 1014 (eg, cathode ray tube ( Interact with devices and subsystems such as a CRT or liquid crystal display (LCD), an input / output device 1016 (eg, a keyboard), and a cursor control 1010 (eg, a mouse or trackball) A bus 1002 or other communication mechanism for communicating information.

In some embodiments, host computing device 114 performs certain operations by processor 1004 when executing one or more sequences of one or more program instructions stored in system memory 1006. The program instructions may be read into system memory 1006 from another computer readable medium, such as storage device 1008. In some embodiments, wiring circuitry may be used in combination with software program instructions dash or the software program instruction to implement embodiments of the present invention.

It should be appreciated that the term "computer readable medium" refers to a suitable medium that participates in providing program instructions to processor 1004 for execution. The medium may take forms, including but not limited to, nonvolatile media, volatile media, and transmission media. Non-volatile media may include, for example, optical or magnetic disks, such as storage device 1008. Volatile media can include dynamic memory, such as system memory 1006. The transmission medium includes coaxial cables, copper wire, and optical fibers with wires that include bus 1002. The transmission medium may take the form of acoustic or light waves as generated during radio wave and infrared data communications. Common forms of computer readable media include, for example, magnetic media (eg, floppy disks, flexible disks, hard disks, magnetic tape, and other magnetic media), optical media (eg, compact disk read only). Memory (CD-ROM) and other optical media), physical media with patterns (eg punch cards, paper tape, any other physical media), memory chips or cartridges, carriers (eg , RAM, program read only memory (PROM), erasable programmable read only memory (EPROM), flash memory, and other memory chips or cartridges), and any other medium that a computer can read.

In some embodiments, the execution of a sequence of program instructions to execute the embodiments may be performed by a single computing device 114. In other embodiments, the host computing device 114 coupled by the communication link 1020 (eg, local area network (LAN), public switching telephone networks (PSTN), wireless network, and other communication links). The same two or more computer systems may cooperate with one another to perform a sequence of program instructions for executing embodiments. In addition, computing device 114 may send and receive messages, data, and instructions that include a program, that is, application code, through communication link 1020 and communication interface 1012. Received program instructions may be executed by processor 1004 when the program instructions are received and / or stored in storage device 1008, or other non-volatile storage for later execution.

11 is a simplified block diagram of a memory device in accordance with an embodiment of the present invention. As shown in FIG. 11, memory device 116 includes a memory controller 1102 in communication with memory 1104. In general, memory controller 1102 controls the operation of memory 1106. Operational examples include data writing (or programming), data reading, data erasing, data verification, and other operations. The memory controller 1102 may also be configured to generate parameters based on parameters associated with licenses and content, generate session tickets based on parameters and numbers, and may be configured for other operations described above.

Memory device 116 may include various nonvolatile memory structures and technologies. Examples of memory technologies include flash memories (eg, NAND, NOR, single-level cell (SLC / BIN), multi-level cell (MLC), partitioned bit-line NOR (DINOR), AND, high capacity coupling ratio). (HiCR), asymmetric contactless transistor (ACT), and other flash memories), erasable read only memory (EPROM), electrically-erasable programmable read only memory (EEPROM), read only memory (ROM), one time programmable Memory (OTP), and other memory technologies. In one embodiment, the memory device 116 may be a flash memory card that uses flash memory. Examples of flash memory cards are Secure Digital ^TM (compliant with specifications maintained by the SD Card Association of San Ramon, California), MultiMediaCard ^TM (specifications maintained by the MultiMediaCard Association ("MMCA") of Palo Alto, California). Compliant), MiniSD ^TM (manufactured by SanDisk, Inc.), MicroSD ^TM (manufactured by SanDisk, Inc.), CompactFlash ^TM (manufactured by the CompactFlash Association ("CFA") of Palo Alto, California) Compliant with specifications), SmartMedia ^TM (complies with specifications maintained by Solid State Floppy Disk Card ("SSFDC") in Yokohama, Japan), xD-Picture Card ^TM (xD-Picture Card Licensing from Tokyo, Japan) Compliant with specifications maintained by the Office), Memory Stick ^TM (compliant with specifications maintained by the Solid State Floppy Disk Card ("SSFDC") Forum in Yokohama, Japan), TransFlash ^TM (with SanDisk, Inc.) Manufactured by USC), and other flash memory cards. In other embodiments, memory device 116 may be implemented as a non-removable memory device.

The following patent documents contain embodiments that may be used in the embodiments described herein. Each of these patent documents is in the same data field as the present application and is assigned to the assignee of the present invention and incorporated herein by reference: "Apparatuses for Linking Content with License" of US Patent Application 11 / 600,270; "Methods for Accessing Content Based on a Session Ticket" in US patent application Ser. No. 11 / 600,263; Apparatuses for Accessing Content Based on a Session Ticket in US Patent 11 / 600,273; "Methods for Binding Content to a Separate Memory Device" in US Patent Application 11 / 600,262; "Apparatuses for Binding Content to a in US Patent Application 11 / 600,245. Separate Memory Device ";" Method for Allowing Multiple Users to Access Preview Content "of U.S. Patent Application 11 / 599,994;" System for Allowing Multiple Users to Access Preview Content "of U.S. Patent Application 11 / 599,995; U.S. Patent Application 11 / 600,005 "Method for Allowing content Protected by a First DRM System to Be Accessed by a Second DRM System"; "System for Allowing Content Protected by a First DRM System to Be Accessed by a Second DRM System" of US Patent Application 11 / 599,991; United States "Method for Connecting to a Network Location Associated with Content" in patent application 11 / 600,300; and "System for Connectiong to a Network Location Associated with Content" in US patent application 11 / 600,006.

Although the above embodiments have been described in some items for clarity of understanding, the embodiments are not limited to the items provided. There are many other ways of implementing the embodiments. Accordingly, the disclosed embodiments are to be considered as illustrative and not restrictive, and the embodiments are not to be limited to the items provided herein, but may be modified within the scope and equivalents of the appended claims. In the claims, the elements and / or actions do not imply any particular order of action unless explicitly stated in the claims.

As mentioned above, the present invention is generally used to provide a method of content access, more specifically associating content with a license and accessing content based on session tickets.

Claims (47)

As a method for accessing content, Retrieving a first parameter associated with a license, wherein the license is associated with content; Retrieving a second parameter associated with the content; Generating a third parameter based on the first and second parameters, Accessing content based on a third parameter, wherein the third parameter is configured to use to decrypt the content. And a method for accessing content. The method of claim 1 wherein accessing the content comprises: Sending a request for the third parameter and the content, and receiving the content. The method of claim 1, Encrypting the third parameter based on the variable to define a session ticket, the variable configured to change in the session; To access content based on session tickets Further comprising: a method for accessing content. 4. The method of claim 3, wherein the variable is configured to change randomly in a session. The method of claim 1, wherein the license and content are stored on a memory device. The method of claim 1, wherein the first parameter is a number. 7. The method of claim 6, wherein the number is randomly generated. The method of claim 1, wherein the second parameter is derived from a reference to the encryption key and the first parameter. The method of claim 1, wherein the second parameter is derived from an authentication key and the first parameter. The method of claim 1, wherein the second parameter is derived from cryptographic nonce and the first parameter. The method of claim 1, wherein the third parameter is a reference to an encryption key. The method of claim 1, wherein the third parameter is an authentication key. The method of claim 1, wherein the third parameter is a cryptographic nonce and the cryptographic nonce is used to generate an encryption key. A computer program product embodied in a computer readable medium, Retrieve the first parameter from the license (the license is associated with the content), Retrieve a second parameter from the content, Generate a reference to the encryption key based on the first and second parameters, To access content based on a reference to an encryption key. A computer program product comprising computer instructions. 15. The computer program product of claim 14, wherein the computer instructions for accessing the content are: Send a reference to the encryption key and a request for content to the memory device, Receiving content from a memory device (the content is decrypted using an encryption key) Included, computer program products. 15. The computer program product of claim 14, wherein the license and content are stored on a memory device. The computer program product of claim 14, wherein the first parameter is derived from a reference to a cryptographic key and a second parameter. 15. The computer program product of claim 14, wherein the second parameter is a randomly generated number. A method for accessing content stored on a memory device, the method comprising: Retrieving a first number from a license, wherein the license is associated with the content and the first number is randomly generated; Retrieving a parameter from the content, wherein the parameter is derived from a reference to the encryption key and a first number; Generating a reference to the encryption key based on the first number and the parameter; Accessing the content based on the reference to the encryption key And a method for accessing content. The method of claim 19, Generating a session ticket based on a reference and a second number, the second number configured to change in a session; To access content based on session tickets Further comprising: a method for accessing content. 20. The method of claim 19, wherein the content is encrypted using an encryption key. 20. The method of claim 19, wherein the parameter is placed in a header of the content. 20. The method of claim 19, wherein the license is stored on a memory device. The method of claim 23, wherein the license is located in a hidden compartment of a memory device. As a device, With memory, A processor in communication with the memory Including, The processor, Retrieve a first parameter associated with the license (the license is associated with the encrypted content), Retrieve a second parameter associated with the encrypted content, Generate a third parameter based on the first and second parameters, To access the encrypted content based on the third parameter (the third parameter is configured for use in decrypting the encrypted content). Configured, device. The method of claim 25, wherein the processor, Encrypt the third parameter based on the number for defining the session ticket (the number is configured to change in the session), To access encrypted content based on session tickets. Further configured, the device. 27. The apparatus of claim 26, wherein the number is configured to vary randomly in a session. 27. The apparatus of claim 25, wherein the licensed and encrypted content is stored in a memory device, the memory device configured to be coupled with the apparatus. The apparatus of claim 25, wherein the first parameter is a number. 30. The apparatus of claim 29, wherein the number is randomly generated. 27. The apparatus of claim 25, wherein the second parameter is derived from a reference to the encryption key and the first parameter. 27. The apparatus of claim 25, wherein the second parameter is derived from an authentication key and a first parameter. 27. The apparatus of claim 25, wherein the second parameter is derived from cryptographic nonce and the first parameter. 27. The apparatus of claim 25, wherein the third parameter is a reference to an encryption key. The apparatus of claim 25, wherein the third parameter is an authentication key. 27. The apparatus of claim 25, wherein the second parameter is a cryptographic nonce and the cryptographic nonce is used to generate an encryption key. As a computing device, With memory, A processor in communication with the memory Including, The processor, Retrieve the first parameter from the license (the license is configured to define a permission to access the content), Retrieve a second parameter from the content, Generate a reference to an encryption key based on the first and second parameters, To access content based on a reference to the encryption key. Configured, computing device. The method of claim 37, wherein the processor, Send a reference to an encryption key and a request for content to a memory device (the memory device is configured to be coupled with a computing device), Receive content from a memory device (the content is decrypted using an encryption key), Configured, computing device. 38. The computing device of claim 37, wherein the license and content are stored in a memory device, the memory device configured to be coupled with a computing device. 38. The computing device of claim 37, wherein the first parameter is derived from a reference to a cryptographic key and a second parameter. 38. The computing device of claim 37, wherein the second parameter is a randomly generated number. As a computing device, With memory, A processor in communication with the memory Including, The processor, Retrieve a first number from a license associated with the content (the first number is randomly generated), Retrieve from the content a parameter derived from a reference to the encryption key and a first number, Generate a reference to the encryption key based on the first number and the parameter, To access content based on references to encryption keys. Configured, computing device. The method of claim 42, wherein the processor, Generate a session ticket based on the reference and the second number, To access content based on the session ticket. Further configured, computing device. 43. The computing device of claim 42, wherein the content is encrypted using an encryption key. 43. The computing device of claim 42, wherein the parameter is disposed in a footer for content. 43. The computing device of claim 42, wherein the content and license are stored in a memory device, the memory device configured to be coupled to a computing device. 47. The computing device of claim 46, wherein the license is located in a hidden compartment of a memory device.

Images