JP2010509887A - Method and apparatus for accessing content based on a session ticket - Google Patents

Abstract

  A method is provided for accessing content stored on a storage device. In this method, a request to access content is sent and a session ticket is received. The session ticket includes parameters used to decrypt the content, and the session ticket is generated based on variables configured to change with the session. Content can be accessed based on the session ticket. An apparatus comprising a memory and a processor in communication with the memory is also provided. The processor is configured to send a request to the storage device to access content stored in the storage device, receive a session ticket, and access the content based on the session ticket. The session ticket includes parameters used to decrypt the content, and the session ticket is generated based on a number configured to change in the session.

Description

  Embodiments of the present invention relate generally to content access, and more particularly to linking content with a license and accessing content based on a session ticket.

  Digital Rights Management (DRM) is a technology used to protect and control the distribution of content such as music files, video files, and other content. In DRM, content is encrypted with an encryption key, which can also be used to decrypt the content. In order for a user to decrypt and access the content, the user must have access to the license associated with the content. In general, a license can give various access rights to content depending on the permissions defined by the license provider. For example, a license can limit content (eg, music files) so that it can be played a limited number of times.

  In the conventional DRM technology, the encryption key used for decrypting the content is stored only in the license. The license can be hacked and the encryption key can be easily extracted from the license. If the encryption key is compromised, an unauthorized user can decrypt the content without a license, thereby allowing unlimited access to the content. As a result, there is a need to further improve content protection.

US patent application Ser. No. 11 / 600,270 US Patent Application No. 11 / 600,263 US Patent Application No. 11 / 600,273 US Patent Application No. 11 / 600,262 US Patent Application No. 11 / 600,245 US patent application Ser. No. 11 / 599,994 US patent application Ser. No. 11 / 599,995 US Patent Application No. 11 / 600,005 US Patent Application No. 11 / 599,991 US Patent Application No. 11 / 600,300 US Patent Application No. 11 / 600,006

  Various embodiments of the present invention provide a method, system and / or apparatus for linking a license with content and accessing the content based on a session ticket. It is to be understood that this embodiment can be implemented in a number of ways including a method, circuit, system, or apparatus. Several embodiments of the invention are described below.

  In one embodiment, a method for accessing content stored on a storage device is provided. In this method, a request to access content is sent and a session ticket is received. The session ticket includes parameters used to decrypt the content, and the session ticket is generated based on variables configured to change with the session. Content can be accessed based on the session ticket.

  In another embodiment, an apparatus is provided. The apparatus includes a memory and a processor in communication with the memory. The processor is configured to send a request to the storage device to access content stored in the storage device, receive a session ticket, and access the content based on the session ticket. The session ticket includes parameters used to decrypt the content, and the session ticket is generated based on variables configured to change with the session.

  Other embodiments and advantages of the invention will be apparent from the following detailed description, taken in conjunction with the accompanying drawings, illustrating by way of example the principles of the invention.

  The present invention will be readily understood by the following detailed description in conjunction with the accompanying drawings, and like reference numerals designate like structural elements.

1 is a schematic block diagram of a system of devices according to one embodiment of the present invention. FIG. 3 is a block diagram depicting the generation of parameters used to decrypt content according to one embodiment of the invention. 1 is a schematic block diagram of a system for accessing a storage device according to one embodiment of the invention. FIG. FIG. 3 is a flow chart depicting content access from a storage device according to one embodiment of the invention. FIG. 3 is a block diagram depicting the generation of a session ticket according to one embodiment of the invention. 1 is a schematic block diagram of a system for accessing a storage device using a session ticket according to one embodiment of the invention. FIG. FIG. 4 is a flow chart depicting content access from a storage device based on a session ticket according to one embodiment of the invention. 2 is a schematic block diagram of a program application that may be hosted on a host computing device to access content according to one embodiment of the invention. FIG. FIG. 3 is a schematic block diagram of a program application that may be included in a storage device according to one embodiment of the present invention. 1 is a schematic block diagram of a general overview of a host computing device suitable for hosting content protection platforms and other program applications according to one embodiment of the present invention. 1 is a schematic block diagram of a storage device according to one embodiment of the present invention.

  A detailed description of one or more embodiments is provided below along with accompanying figures. Detailed descriptions are provided with respect to such embodiments, but are not limited to particular embodiments. The scope is limited only by the claims and includes numerous alternatives, modifications, and equivalents. Numerous specific details are set forth in the following description in order to provide a thorough understanding. These details are provided for the purpose of example, and the described embodiments may be realized according to the claims without some or all of these specific details. For the purpose of clarity, technical material that is known in the technical fields related to the embodiments has not been described in detail so as not to unnecessarily obscure the description.

  The embodiments described herein provide for linking licenses with content and accessing content based on session tickets. An encryption key is used to decrypt and access the encrypted content. As will be described in more detail below, parameters associated with both the license and the content are used to derive the encryption key. In some embodiments, the parameters used to derive the encryption key may be further encrypted with variables so that access to the content is limited to one session.

  FIG. 1 is a schematic block diagram of a system of devices according to one embodiment of the present invention. As shown in FIG. 1, the system 102 includes a host computing device 114 and a storage device 116. The host computing device 114 can include a variety of electronic devices that can access the storage device 116 to store the content 118 in the storage device or to retrieve the stored content 118. The storage device 116 may be removably coupled to the host computing device 114 via a mechanical interface 108 such as a pin and / or socket connector. The storage device 116 is a memory storage device. As will be described below, an example of the storage device 116 is a memory card that uses a nonvolatile memory.

  The host computing device 114 hosts the application 104. The application 104 can include various program applications. For example, the application 104 can be an operating system that manages hardware and software resources on the host computing device 114. In other examples, application 104 may be a multimedia player configured to play audio and video files. Further, for example, the application 104 can be a video game. Application 104 can access content 118 stored in storage device 116. The content 118 can include various data. Examples of content 118 include audio files encoded in audio file formats such as Wave (WAVE), MPEG-1 Audio Layer 3 (MP3), Advanced Audio Coding (AAC), and other audio file formats. Content 118 may also include video files encoded in video file formats such as Audio Video Interleave (AVI), Moving Picture Expert Group (MPEG), and other video file formats. Other examples of content 118 include document files, image files, application files, and other data.

Linking License with Content FIG. 2 is a block diagram depicting the generation of parameters used to decrypt content according to one embodiment of the invention. FIG. 2 shows the content 118 and associated license 204. The content 118 is encrypted so that the content is difficult to understand. In general, license 204 is data (eg, strings, files, and other data) that allows content 118 to be accessed. The license 204 can limit the access duration, content access to certain computing devices, permissions or rules for accessing the content 118, such as the date, time, number of times the content can be accessed, and other And permissions. Accordingly, the license 204 can be configured to determine permissions for accessing the content 118. Accordingly, the user is given access to the content 118 based on the permissions included in the license 204. For example, license 204 may allow content 118 in the form of a music file to be played three times on a particular computing device. In other examples, the license 204 can allow the content 118 to be accessed but not allowed to be copied to other computing devices.

  The content 118 is encrypted and a third parameter 210 is configured that is used to decrypt the content. The third parameter 210 includes various data that can be associated with the decryption of the content 118. For example, the third parameter 210 may be an encryption key that is used to encrypt and decrypt the content 118. The third parameter 210 can also include a reference to the encryption key instead of the encryption key. The reference can be, for example, a number or string that identifies the encryption key. The third parameter 210 can also include an authentication key. The authentication key is an encryption key used for an authentication session between the host computing device and the storage device. In another example, the third parameter 210 may be a cryptographic nonce. A cryptographic nonce is a number that can be used to generate a cryptographic key.

The third parameter 210 is generated based on the first parameter 202 and the second parameter 206. In other words, the third parameter 210 is
Third parameter = F (first parameter, second parameter) (1.0)
And the third parameter is a function of the first parameter 202 and the second parameter 206. This function may include various functions such as a hash function, in which case the third parameter 210 may be a hash value of the hash function. The first parameter 202 is associated with the license 204 and the second parameter 206 is associated with the content 118. The first parameter 202 and the second parameter 206 can include various data. For example, the first parameter 202 can be a number. In one embodiment, the number can be randomly generated. In another embodiment, the number is determined in advance. The second parameter 206 can be dependent on the first parameter 202 or vice versa. For example, the second parameter 206 can be a number or string derived from both a reference to the encryption key and the first parameter 202. Such a number or string,
Second parameter = F (key reference, first parameter) (1.2)
And the second parameter 206 is a function of both the reference to the encryption key and the first parameter 202. It should be understood that the second parameter 206 can also be derived from both the authentication key and the first parameter 202. In another example, the second parameter 206 may be derived from the cryptographic nonce and the first parameter 202. Conversely, the first parameter 202 may be derived from the second parameter 206 and the authentication key, reference to the encryption key, encryption nonce or other parameters.

  First parameter 202 and second parameter 206 are associated with license 204 and content 118, respectively. To be associated with license 204 or content 118, first parameter 202 and second parameter 206 can be placed or included in the license and content, respectively. For example, the second parameter 206 can be placed in the header or footer of the content 118. Alternatively, the first parameter 202 and / or the second parameter 206 can be placed separately from the license 204 and / or the content 118. If placed separately, the license 204 can be associated with a first parameter 202 that contains a pointer to the first parameter. If the second parameter is placed separately from the content, the content 118 can also include a pointer to the second parameter 206.

  FIG. 3 is a schematic block diagram of a system for accessing a storage device according to one embodiment of the present invention. As shown, system 302 includes a host computing device 114 coupled to storage device 116. The host computing device 114 can include an application 104 and a first content protection platform 304. The storage device 116 includes a second content protection platform 306, content 118, and a license 204. In one embodiment, license 204 may be stored in a secret partition of storage device 116 where the license is not visible to and accessible to many applications. In addition to being stored on storage device 116, license 204 may also be stored on host computing device 114. The first content protection platform 304 and the second content protection platform 306 are technology platforms for protecting the content 118 on the storage device 116. With the first content protection platform 304 and / or the second content protection platform 306, the user can pass the storage device 116 and its content 118 without compromising content protection. There are various content protection platforms that can be used to protect data, examples of which are manufactured under the trademarks TrustedFlash® and Grubi® (manufactured by SanDisk Corporation).

  As shown in FIG. 3, the application 104 sends a request for content 118 stored in the storage device 116 via the first content protection platform 304. Here, the content 118 is encrypted. In order to decrypt the content 118, a first parameter 202 associated with the license 204 and a second parameter 206 associated with the content 118 are retrieved. The first parameter 202 and the second parameter 206 can be included in the license 204 and the content 118, respectively, or can be a file located separately from the license and the content. A third parameter is generated based on the first parameter 202 and the second parameter 206 as defined by equation 1.0. In other words, the third parameter can be derived from the first parameter 202 and the second parameter 206. The third parameter can be an encryption key used to decrypt the content 118, a reference to the encryption key, an authentication key, a nonce, or other parameters. With the third parameter, the application 104 can decrypt and access the content 118. To access content 118, first content protection platform 304 can send a third parameter and a request for content 118 to storage device 116. The second content protection platform 306 can decrypt the content 118 based on the third parameter and can send the decrypted content to the application 104 via the first content protection platform 304.

  In the embodiment of FIG. 3, the first content protection platform 304 hosted on the host computing device 114 retrieves the first parameter 202 and the second parameter 206 and based on the first parameter and the second parameter. A third parameter is generated. In another embodiment, the second content protection platform 306 included in the storage device 116 also retrieves the first parameter 202 and the second parameter 206 and sets the first parameter based on the first parameter and the second parameter. Three parameters can be generated.

  FIG. 4 is a flow chart depicting content access from a storage device according to one embodiment of the invention. Beginning at 402, the content is analyzed to determine whether the content is protected (ie, encrypted). Various information associated with the content can indicate whether the content is encrypted. For example, the content header can indicate that the content is encrypted. Alternatively, the file name extension of the content can also indicate that the content is encrypted. If the content is not protected, the content can be accessed immediately at 410. If the content is protected, the first parameter is retrieved from the license at 404. In this embodiment, the first parameter is a number. The number can be generated randomly or determined in advance. At 406, the second parameter is retrieved from the content. In one embodiment, the second parameter can be derived from a reference to the encryption key and the first parameter, as represented by Equation 1.2. The encryption key is used to encrypt or decrypt the content. As a result, the second parameter is associated with both the content and the license. This is because the second parameter is derived or calculated from a reference to the encryption key used to decrypt the content and the number contained in the license. It should be noted that in another embodiment, a first parameter (eg, a number) can be associated with the content and a second parameter can be associated with the license.

  With the first parameter and the second parameter, a reference to the encryption key can be generated or calculated at 408. As previously indicated in equation 1.0, a reference to the encryption key can be generated based on the first parameter and the second parameter. Thereafter, at 410, the content can be decrypted and accessed based on the third parameter. For example, in one embodiment, a third parameter in the form of a reference to an encryption key can be sent to the storage device. The storage device can include a secure store that stores cryptographic keys. The storage device can retrieve the encryption key from its secure store using a reference to the encryption key. With the encryption key, the storage device can decrypt the content and send the decrypted content to the host computing device.

Accessing Content Based on Session Ticket FIG. 5 is a block diagram depicting the generation of a session ticket according to one embodiment of the present invention. The parameter 502 is initially provided and includes various data that can be associated with the decryption of the content. The parameter 502 may be generated based on parameters associated with the license and content, as previously discussed. Examples of parameters 502 include a reference to an encryption key used to decrypt the content, an encryption nonce, or other parameters.

  Generation of session ticket 506 includes the use of variable 504. Variable 504 includes various data. For example, the data can be a single number. The number can be determined in advance or randomly generated. In another embodiment, the data can be a character string. Unlike the parameters discussed previously, the variable 504 cannot be associated with a license and content. In other words, the variable 504 can be independent of the license and content. Variable 504 is configured to change from session to session. A session can span one period. For example, a session can last for 1 hour, 1 day, 1 week, or other unit of time. In addition, the session can be terminated when the host computing device coupled to the storage device is activated or restarted. A session can also be terminated when the storage device is disconnected from the host computing device. Further, for example, a session can span a limited number of accesses to the content (eg, a limited number of times that the content can be accessed).

Session ticket 506 is generated based on parameter 502 and variable 504 so that the parameter is encrypted based on the variable to define session ticket 506. Therefore, the session ticket 506 is
Session ticket = F (parameter, variable) (2.0)
And the session ticket is a function of parameters 502 and variables 504. With a session ticket 506, content can be accessed based on the session ticket. For example, the host computing device can send a session ticket 506 to the storage device. The storage device can derive parameters used to decrypt the content based on the session ticket 506. Parameter 502
Parameter = F ^-i (session ticket, variable) (2.2)
The parameter is the inverse function of the session ticket 506 and the variable 504.

  It should be understood that the session ticket 506 is associated with one particular content. This is because the session ticket is used to decrypt the content. As a result, other content stored in the storage device may be used or accessed in the session ticket 506 if the session ticket does not include a parameter (such as 502) for decrypting the other content. Can not. As an example, if two separate contents stored in a storage device are encrypted with different encryption keys, the host computing device or storage device will be two different to access the two separate contents. Generate a session ticket. Here, one session ticket cannot be used to access two separate contents that are encrypted with different encryption keys.

  FIG. 6 is a schematic block diagram of a system for accessing a storage device using a session ticket according to one embodiment of the present invention. System 602 includes a host computing device 114 that is coupled to a storage device 116. The host computing device 114 can include an application 104 and a first content protection platform 304. The storage device 116 includes a second content protection platform 306, content 118, and a license 204. As previously discussed, the first content protection platform 304 and the second content protection platform 306 may be configured to manage the digital rights of the content 118 stored on the storage device 116.

  As shown in FIG. 6, the application 104 sends a request for content 118 stored in the storage device 116 via the first content protection platform 304. The content 118 is encrypted with an encryption key. Parameters associated with the encryption key (eg, a reference to the encryption key, nonce, or other parameters) are provided to the second content protection platform 306. In response to the request to access content 118, second content protection platform 306 encrypts the parameters based on variable 604 to determine the session ticket displayed in Equation 2.0. The second content protection platform 306 can generate a variable 604 (eg, a number, string, or other parameter). Variable 604 is configured to change from session to session. For example, the second content protection platform 306 can generate a separate variable 604 for every session. Variable 604 can be generated randomly or determined in advance.

  After the session ticket is generated, the second content protection platform 306 sends the session ticket to the host computing device 114. If there is a session ticket, the host computing device 114 can access the content 118 based on the session ticket. To access content 118, host computing device 114 then sends a session ticket back to storage device 116. Upon receipt of the session ticket, the second content protection platform 306 decrypts the session ticket to extract the parameters used to decrypt the content 118 (shown in Equation 2.2). If the variable 604 has not changed, the parameter can be extracted because the decryption is based on the same variable that was used to encrypt the parameter. Variable 604 may change in different sessions. As a result, if they were created in the same session, the variable 604 is the same variable used to encrypt the parameters. However, if the variable 604 has changed, the parameter cannot be extracted because the decryption is based on a variable that is different from the variable used to encrypt the parameter. If they were created in a different session, the variable 604 is different from the variable used to encrypt the parameters. By changing the variable 604 in a session, the session ticket persists or is valid for one session. If the parameters can be extracted, the second content protection platform 306 can decrypt the content 118 based on the parameters and send the decrypted content to the host computing device 114.

  In another embodiment, the first content protection platform 304 may generate a session ticket by encrypting the parameters used to decrypt the content 118. Here, in response to a request by the application 104 to access the content 118, the first content protection platform 304 can generate a session ticket and send the session ticket to the application 104. Application 104 can then send the session ticket back to first content protection platform 304 to access content 118.

  FIG. 7 is a flow chart depicting content access from a storage device based on a session ticket according to one embodiment of the invention. Starting from 702, a reference to the encryption key is retrieved. The reference can be retrieved from the host computing device or storage device. The content stored in the storage device can be encrypted and decrypted using the encryption key. If there is a reference to the encryption key, the reference to the encryption key is encrypted 704 based on one number to determine the session ticket. The number can be configured to vary from session to session and can be randomly generated. The session ticket can then be sent at 706 to, for example, a host computing device.

  When the host computing device accesses content stored in the storage device, the host computing device can send 706 the received session ticket to the storage device. The storage device receives the session ticket at 708 and decrypts the session ticket based on one number at 710. If the number matches the number used to generate the session ticket, a reference to the encryption key can be extracted from the decryption operation. However, if the session changes and a different number is held by the storage device, the reference to the encryption key cannot be extracted from the decryption operation because the numbers do not match. If a reference to the encryption key can be extracted from the session ticket, the encryption key is retrieved 712 based on the reference. The encryption key can be retrieved from a secure store, for example. The content is then decrypted at 714 using the encryption key and then sent at 716 to, for example, a host computing device.

  FIG. 8 is a schematic block diagram of a program application that may be hosted on a host computing device to access content according to one embodiment of the present invention. Host computing device 114 can host application 104, digital rights management (DRM) module 806, content protection platform 304, file system manager 808, and device driver 810. As previously discussed, application 104 may include a variety of program applications such as multimedia players, video games, and other applications. DRM module 806 and content protection platform 304 communicate with application 104. The DRM module 806 allows the host computing device 114 to manage digital rights for content stored in a storage device or other storage location. For example, the DRM module 806 can protect content and control its distribution. As previously discussed, content protection platform 304 is a technology platform for protecting content on storage devices. The content protection platform 304 can include a security manager 802 and a host crypto engine 804. In general, the security manager 802 manages access to content stored in a storage device. Management can, for example, check whether the content is protected, generate a reference to the encryption key based on the parameters associated with the license and the content, generate a session ticket based on the parameters and variables , Generating variables, and other operations. The host cryptographic engine 804 includes a cryptographic library for processing cryptographic operations. The content protection platform 304 and the DRM module 806 jointly provide the host computing device 114 (and storage device) with secure storage and content management capabilities. For example, the content protection platform 304 and the DRM module 806 are for controlling the secure storage and access to content (eg, music files, movie files, software, and other data) stored on the storage device. Allows enforcement of a predetermined policy.

  File system manager 808 communicates with content protection platform 304. In general, the file system manager 808 is configured to manage and process access (eg, read, write, and other access operations) of content stored in the storage device. For example, the file system manager 808 can read the content from the storage device and send the content to the content protection platform 304 for processing. The host computing device 114 can interface with a storage device. Accordingly, the host computing device 114 can include a device driver 810 that communicates with the file system manager 808 to interface with the storage device. The device driver 810 can include, for example, a lower level interface function for communicating with a storage device. Examples of lower level interface functions include input / output functions associated with input of data to the storage device and output of data from the storage device.

  FIG. 9 is a schematic block diagram of a program application that may be included in a storage device according to one embodiment of the present invention. The storage device 116 can include a DRM module 902, a content protection platform 306, a cryptographic engine 904, and a secure store 906. In the storage device 116, the DRM module 902 enables the storage device 116 to manage the digital rights of the content stored in the storage device. For example, the DRM module 902 can be configured to enforce content rights. Content protection platform 306 is a technology platform for protecting content stored in storage device 116, as previously discussed. Content protection platform 306 can be configured to generate a reference to an encryption key based on parameters associated with the license and content to generate a session ticket based on the parameters and variables, and other operations Can be configured for. The cryptographic engine 904 handles cryptographic operations and the secure store 906 stores the cryptographic key.

  In other embodiments, the host computing device 114 of FIG. 8 and the storage device 116 of FIG. 9 may include fewer or more program applications apart from those shown in FIGS. It should be understood that it can. For example, as shown in FIG. 8, file system manager 808 and device driver 810 can be integrated into content protection platform 304. Accordingly, the host computing device 114 of FIG. 8 can include a DRM module 806 and a content protection platform 304.

  FIG. 10 is a schematic block diagram of a general overview of a host computing device suitable for hosting a content protection platform and other program applications according to one embodiment of the present invention. In certain embodiments, the host computing device 114 may be used to execute computer programs (eg, content protection platforms), logic, applications, methods, processes, or other software for accessing content. Examples of host computing device 114 include desktop computers, servers, portable computing devices, personal digital assistants (PDAs), cellular phones, computing engines within devices, and other computer systems. As shown in FIG. 10, the host computing device 114 includes a bus 1002 or other communication mechanism for communicating information, which includes a processor 1004, system memory 1006 (eg, random access memory (RAM)), storage Device 1008 (eg, read only memory (ROM), magnetic disk drive, optical disk drive, and other storage devices), communication interface 1012 (eg, modem or Ethernet card), display 1014 (eg, cathode ray tube (CRT) or liquid crystal display) Subsystems and devices such as (LCD)), input / output device 1016 (eg, keyboard), and cursor control device 1018 (eg, mouse or trackball).

  In some embodiments, the host computing device 114 performs certain operations by the processor 1004 when executing one or more sequences of one or more program instructions stored in the system memory 1006. Such program instructions may be loaded into system memory 1006 from other computer readable media such as storage device 1008. In some embodiments, hardwired circuitry may be used in place of or in combination with software program instructions to implement embodiments of the present invention.

  It should be understood that the term “computer-readable medium” refers to any suitable medium that participates in providing program instructions to processor 1004 for execution. Such a medium may take many forms, including but not limited to, non-volatile media, volatile media, and transmission media. Non-volatile media can include, for example, optical or magnetic disks such as storage device 1008. Volatile media can include dynamic memory, such as system memory 1006. Transmission media includes coaxial cables, copper wire, and fiber optics, including the wires that make up bus 1002. Transmission media can also take the form of acoustic or light waves, such as those generated during radio wave and infrared data communications. Common forms of computer readable media include, for example, magnetic media (eg, floppy disks, flexible disks, hard disks, magnetic tapes, and other magnetic media), optical media (eg, compact disk read-only memory (CD-ROM), and Other optical media), patterned physical media (eg punch cards, paper tape, and other physical media), memory chips or cartridges, carrier waves (eg RAM, programmable read-only memory (PROM), erasable Programmable read-only memory (EPROM), flash memory, and other memory chips or cartridges) and any other media that can be read by a computer.

  In certain embodiments, execution of a sequence of program instructions to implement an embodiment may be performed by a single computing device 114. In other embodiments, two or more such as host computing devices 114 coupled by a communication link 1020 (eg, a local area network (LAN), a public switched telephone network (PSTN), a wireless network, and other communication links). Computer systems can execute a sequence of program instructions to cooperate with one another to implement an embodiment. Further, the computing device 114 may send and receive instructions or application code including messages, data, and programs over the communication link 1020 and the communication interface 1012. The received program instructions may be executed by processor 1004 when the program instructions are received and / or stored in storage device 1008 or other non-volatile storage to be executed later.

  FIG. 11 is a schematic block diagram of a storage device according to one embodiment of the present invention. As shown in FIG. 11, the storage device 116 includes a memory controller 1102 that communicates with the memory 1104. In general, the memory controller 1102 controls the operation of the memory 1106. Examples of operations include writing (or programming) data, reading data, erasing data, verifying data, and other operations. Further, the memory controller 1102 can be configured to generate parameters based on parameters associated with the license and content, generate a session ticket based on the parameters and number, and other operations described above. Can be configured for.

  Storage device 116 may include a variety of non-volatile memory structures and technologies. Examples of memory technologies include flash memory (eg, NAND, NOR, single level cell (SLC / BIN), multilevel cell (MLC), split bit line NOR (DINOR), AND, high capacitive coupling ratio (HiCR), asymmetric Contactless transistors (ACT), and other flash memories), erasable programmable read only memory (EPROM), electrically erasable programmable read only memory (EEPROM), read only memory (ROM), Includes one-time programmable memory (OTP) and other memory technologies. In one embodiment, the storage device 116 may be a flash memory card that uses flash memory. Examples of flash memory cards include Secure Digital (registered trademark) (compliant with standards maintained by the SD Card Association of San Ramon, Calif.), Multimedia Card (registered trademark) (Multimedia Card Association of Palo Alto, California (“MMCA”)) )), Mini SD (registered trademark) (SanDisk Corporation) manufactured), Micro SD (registered trademark) (SanDisk Corporation) manufactured), CompactFlash (registered trademark), Palo Alto, California Conforms to the standards maintained by the Flash Association (“CFA”) standards, the SmartMedia® (solid state floppy disk card (“SSFDC)” forum in Yokohama, Japan) Forum ), XD Picture Card (registered trademark) (conforming to standards maintained by the xD Picture Card License Office in Tokyo, Japan), Memory Stick (registered trademark) (Solid State Floppy Disk Card (“SSFDC”) in Yokohama, Japan) According to the specifications maintained by the forum), branded products such as Transflash® (manufactured by SanDisk Corporation), and other flash memory cards. In another embodiment, the storage device 116 may be implemented as a non-removable storage device.

  The following patent documents include embodiments that may be used in the embodiments described herein. Each of these patent documents is filed on the same day as the present application, assigned to the assignee of the present invention, and incorporated herein by reference. These patent documents include US Patent Application No. 11 / 600,270 (Apparatus for Linking Content with License) and US Patent Application No. 11/600 (Methods for Accessing Content Based on a Session Ticket). No. 600,263 (Patent Literature 2), US Patent Application No. 11 / 600,273 (Patent Literature 3) “Apparatuses for Accessing Content Based on a Session Ticket”, “Methods for Binding Content to a Separate Memory Device” US Patent Application No. 11 / 600,262 (Patent Document 4), US Patent Application No. 11 / 600,245 (Patent Document 5) “Apparatuses for Binding Content to a Separate Memory Device”, “Method for Allowing Multiple Users” No. 11 / 599,994 (Patent Document 6) called “To Access Preview Content”, “System for Allowing Multiple Users to Access Preview Content” US Patent Application No. 11 / 599,995 (Patent Document 7), US Patent Application No. 11 / 600,005 (Method for Allowing Content Protected by a First DRM System to Be Accessed by a Second DRM System) 8), U.S. Patent Application No. 11 / 599,991, "System for Allowing Content Protected by a First DRM System to Be Accessed by a Second DRM System", "Method for Connecting to a Network Location Associated with" US Patent Application No. 11 / 600,300 entitled “Content” and US Patent Application No. 11 / 600,006 entitled “System for Connecting to a Network Location Associated with Content”. .

  Although the foregoing embodiment has been described in some detail for purposes of clarity of understanding, the embodiment is not limited to the details provided. There are many alternative ways of implementing the embodiments. Accordingly, the disclosed embodiments are to be construed as illustrative and not restrictive, and the embodiments should not be limited to the details provided herein, but may be It may be modified within the scope of the claims and the equivalents. In the claims, elements and / or operations do not imply any particular order of operation unless explicitly stated.

It should be understood that the term “computer-readable medium” refers to any suitable medium that participates in providing program instructions to processor 1004 for execution. Such a medium may take many forms, including but not limited to, non-volatile media, volatile media, and transmission media. Non-volatile media can include, for example, optical or magnetic disks such as storage device 1008. Volatile media can include dynamic memory, such as system memory 1006. Transmission media includes coaxial cables, copper wire, and fiber optics, including the wires that make up bus 1002. Transmission media can also take the form of acoustic or light waves, such as those generated during radio wave and infrared data communications. Common forms of computer readable media include, for example, magnetic media (eg, floppy disks, flexible disks, hard disks, magnetic tapes, and other magnetic media), optical media (eg, compact disk read-only memory (CD-ROM), and other optical media), physical medium with patterns (e.g., punch cards, paper tape, and other physical medium), a memory chip or cartridge (e.g., RAM, programmable read-only memory (PROM), erasable programmable Possible read-only memory (EPROM), flash memory, and other memory chips or cartridges) and any other media that can be read by a computer.

Claims (37)

A method for accessing content stored in a storage device, comprising:
Sending a request to access the content;
Receiving a session ticket generated based on a variable configured to change in a session and including parameters used to decrypt the content;
Accessing the content based on the session ticket;
Including methods. The method of claim 1, wherein
Accessing the content comprises:
Sending the session ticket to the storage device;
Receiving the content from the storage device;
Including methods. The method of claim 1, wherein
The parameter is a reference to an encryption key, and the content is encrypted with the encryption key. The method of claim 1, wherein
The parameter is a cryptographic nonce, and the cryptographic nonce is used to generate a cryptographic key. The method of claim 1, wherein
The method wherein the variable is a number. The method of claim 5, wherein
The method wherein the number is configured to vary randomly. The method of claim 1, wherein
The session is a method over a period of time. The method of claim 1, wherein
The method wherein the session is terminated when a computing device coupled to the storage device is restarted. The method of claim 1, wherein
The method wherein the session ends when the storage device is disconnected from the computing device. A computer program product embodied in a computer readable medium comprising:
Computer instructions for providing parameters used to decrypt the content;
Computer instructions for encrypting the parameters to determine a session ticket based on a first number configured to change in the session;
Computer instructions for accessing the content based on the session ticket;
Including computer program products. A computer program product according to claim 10, comprising:
A computer program product further comprising computer instructions for decrypting the session ticket based on a second number to extract the parameters. The computer program product of claim 11,
A computer program product wherein the first number is identical to the second number if the second number was generated in the session. The computer program product of claim 11,
The computer program product wherein the first number is different from the second number if the second number was generated in a different session. The computer program product according to claim 10.
The computer program product configured such that the first number varies randomly. A method for accessing content stored in a storage device, comprising:
Providing a reference to an encryption key, wherein the content is encrypted using the encryption key;
Encrypting the reference to the encryption key to determine a session ticket based on a number configured to vary randomly in the session;
Accessing the content based on the session ticket;
Including methods. The method of claim 15, wherein
The session is a method over a period of time. The method of claim 15, wherein
The method wherein the session is terminated when a computing device coupled to the storage device is restarted. The method of claim 15, wherein
The method wherein the session ends when the storage device is disconnected from the computing device. A storage device,
Memory,
A memory controller in communication with the memory,
Retrieve the parameters used to decrypt the content,
Generating a session ticket based on the parameters and a number configured to change in the session;
Sending the session ticket to a computing device configured to be coupled to the storage device;
A memory controller configured to receive the session ticket from the computing device and to access the content based on the session ticket;
A storage device. The storage device according to claim 19, wherein
The memory controller is
A storage device further configured to decrypt the session ticket based on the number to extract the parameter and to access the content based on the parameter. The storage device according to claim 19, wherein
The parameter is a reference to an encryption key, and the content is encrypted with the encryption key. The storage device according to claim 19, wherein
The parameter is an encryption nonce, and the encryption nonce is a storage device used for generating an encryption key. The storage device according to claim 19, wherein
The session is a storage device for one period. The storage device according to claim 19, wherein
The session is terminated when the computing device is restarted. The storage device according to claim 19, wherein
The storage device that terminates when the storage device is disconnected from the computing device. A storage device,
Non-volatile memory;
A memory controller that communicates with the non-volatile memory,
Retrieve a reference to the encryption key used to decrypt the content,
Encrypting the reference to the encryption key to determine a session ticket based on a number configured to change in the session;
Sending the session ticket to a computing device configured to be coupled to the storage device;
A memory controller configured to receive the session ticket from the computing device and to access the content based on the session ticket;
A storage device. 27. The storage device of claim 26.
The memory controller is
Decrypting the session ticket based on the number to extract the reference to the encryption key;
Retrieving the encryption key based on the reference to the encryption key;
A storage device further configured to decrypt the content using the encryption key and send the content to the computing device. 27. The storage device of claim 26.
The number is a randomly generated storage device. 27. The storage device of claim 26.
The session is a storage device for one period. 27. The storage device of claim 26.
The session is terminated when the computing device is restarted. 27. The storage device of claim 26.
The storage device that terminates when the storage device is disconnected from the computing device. A device,
Memory,
A processor in communication with the memory,
Sending a first request to the storage device to access the first content stored in the storage device;
Receiving a first session ticket including a first parameter used to decrypt the first content, generated based on a number configured to change in the session; and the first session A processor configured to access the first content based on a ticket;
A device comprising: The apparatus of claim 32.
The processor is
Sending a second request to the storage device to access second content stored in the storage device;
Further configured to receive a second session ticket that includes a second parameter used to decrypt the second content, and to access the second content based on the second session ticket. Equipment. The apparatus of claim 32.
The processor is
An apparatus further configured to send the session ticket to the storage device and receive the content from the storage device. The apparatus of claim 32.
The processor is
An apparatus further configured to decrypt the session ticket based on the number to extract the parameter and to access the content based on the parameter. The apparatus of claim 32.
The parameter is a reference to an encryption key, and the content is encrypted with the encryption key. The apparatus of claim 32.
The parameter is a cryptographic nonce, and the cryptographic nonce is used to generate a cryptographic key.

Images