KR101450131B1 - Methods and apparatuses for accessing content based on a session ticket - Google Patents

Abstract

A method is provided for accessing content stored on a memory device. In this method, the request to access the content is sent and the session ticket is received. The session ticket contains the parameters used to decrypt the content and the session ticket is generated based on the variables configured to change the session. The content can be accessed based on the session ticket. An apparatus is provided that includes a memory and a processor in communication with the memory. The processor sending a request to the memory device to access content stored in the memory device; Receiving a session ticket; And access the content based on the session ticket. The session ticket contains the parameters used to decrypt the content and the session ticket is generated based on the number configured to change in the session.

Description

[0001] METHODS AND APPARATUS FOR ACCESSING CONTENT BASED ON A SESSION TICKET [0002]

Embodiments of the present invention relate generally to content access, and more specifically to associating content with a license and accessing content based on a session ticket.

Digital rights management (DRM) is a technology used to protect and control the distribution of content such as music files, video files, and other content. In DRM, the content is encrypted with an encryption key, and the encryption key can be used to decrypt the content. In order for the user to decrypt and access the content, the user must access the license associated with the content. In general, a license may authorize other access rights to access the content based on the permissions defined by the license provider. For example, a license may limit content (e.g., a music file) to play for a limited number of times.

In conventional DRM techniques, the encryption key used to decrypt the content is stored only in the license. The license can be hacked and the encryption key can be easily extracted from the license. If the encryption key is compromised, an unauthorized user can decrypt the content without a license and thus access the content without restriction. As a result, it is necessary to further improve the protection of the content.

Various embodiments of the present invention provide methods, systems and / or devices for connecting content and licenses and for accessing content based on session tickets. It should be appreciated that the embodiments may be practiced in a variety of ways including methods, circuits, systems, or devices. Some embodiments of the invention are described below.

In one embodiment, a method is provided for accessing content stored on a memory device. In this method, a request to access the content is sent and a session ticket is received. The session ticket contains the parameters used to decrypt the content and the session ticket is generated based on the variables configured to change in the session. The content can be accessed based on the session ticket.

In another embodiment, an apparatus is provided. The apparatus includes a memory and a processor in communication with the memory. The processor sends a request to the memory device to access the content stored in the memory device; Receiving a session ticket; And access the content based on the session ticket. A session ticket is a parameter used to decrypt content, and a session ticket is generated based on a variable configured to change in a session.
A method for accessing content in accordance with an embodiment of the present invention includes: storing content encrypted by an encryption key in a memory device; Receiving a session ticket and a request for accessing the content from a host computing device, the session ticket having a value that is already provided to the host computing device and has a value associated with the session, A step generated by the memory device by encrypting a parameter associated with the memory device; Attempting to extract the parameter associated with the encryption key from the session ticket by decrypting the session ticket with the variable; if the session has not changed, the value of the variable has not changed; and the parameter associated with the encryption key is Extracting from the session ticket; If the parameter associated with the encryption key is extracted from the session ticket: obtaining the encryption key based on the parameter; Decrypting the content using the encryption key; And sending the content to the host computing device.
A memory device according to another embodiment of the present invention includes: a memory operative to store content encrypted by an encryption key; Wherein the controller receives a session ticket and a request to access the content from a host computing device, the session ticket already provided to the host computing device and having a value associated with the session Generated by the memory device by encrypting a parameter associated with the encryption key with a variable that changes the value in other sessions; Attempting to extract the parameter associated with the encryption key from the session ticket by decrypting the session ticket with the variable; if the session has not changed, the value of the variable has not changed; and the parameter associated with the encryption key is Extracted from the session ticket; If the parameter associated with the encryption key is extracted from the session ticket: obtain the encryption key based on the parameter, decrypt the content using the encryption key, and send the content to the host computing device .
A memory device according to another embodiment of the present invention includes: a memory; The controller communicating with the memory, the controller generating a session ticket by encrypting a parameter associated with the encryption key having a value associated with the session and varying values in other sessions; Providing the session ticket to a host computing device; Receive a request for accessing the session ticket and content from a host computing device; Attempting to extract the parameter associated with the encryption key from the session ticket by decrypting the session ticket with the variable; if the session has not changed, the value of the variable has not changed; and the parameter associated with the encryption key is Extracted from the session ticket; If the parameter associated with the encryption key is extracted from the session ticket: obtain the encryption key based on the parameter, decrypt the content using the encryption key, and send the content to the host computing device .

Other embodiments and advantages of the present invention will become apparent from the following detailed description, taken in conjunction with the accompanying drawings, which illustrate, by way of example, the principles of the invention.

The present invention will be readily understood by the following detailed description in conjunction with the accompanying drawings, in which like reference numerals designate like structural elements.

1 is a simplified block diagram of a system of devices according to an embodiment of the present invention.

2 is a block diagram illustrating generation of parameters used to decrypt content according to an embodiment of the present invention.

3 is a simplified block diagram of a system for accessing a memory device in accordance with an embodiment of the present invention.

4 is a flow diagram illustrating accessing content from a memory device in accordance with an embodiment of the present invention.

5 is a block diagram illustrating generation of a session ticket according to an embodiment of the present invention.

6 is a simplified block diagram of a system for accessing a memory device using a session ticket in accordance with an embodiment of the present invention.

7 is a flow diagram illustrating accessing content from a memory device based on a session ticket in accordance with an embodiment of the present invention.

Figure 8 is a simplified block diagram of program applications that may be hosted on a host computing device for accessing content in accordance with an embodiment of the present invention.

9 is a simplified block diagram of program applications that may be included in a memory device according to an embodiment of the invention.

10 is a simplified block diagram of a general overview of a host computing device suitable for hosting a content protection platform and other program applications in accordance with an embodiment of the present invention.

11 is a simplified block diagram of a memory device in accordance with an embodiment of the present invention.

The detailed description of one or more embodiments is provided below in conjunction with the accompanying drawings. The detailed description is provided in connection with the above embodiments, but is not limited to any specific embodiment. The scope is limited only by the claims and many alternatives and modifications, and equivalents are included. Many specific items are set forth in the following description to provide a thorough understanding. These items are provided illustratively and the described embodiments may be practiced in accordance with the claims without some or all of these specific items. For simplicity, technical data known in the art relating to the embodiments are not described in detail in order to avoid unnecessarily obscuring the detailed description.

The embodiments described herein provide for connecting content and licenses and accessing content based on session tickets. The encryption key is used to decrypt and access the encrypted content. As will be described in more detail below, parameters associated with both licenses and content are used to derive the encryption key. In some embodiments, the parameters used to derive the encryption key are further encapsulated into a variable such that access to the content is restricted to the session.

1 is a simplified block diagram of a device system in accordance with an embodiment of the present invention. As shown in FIG. 1, system 102 includes host computing device 114 and memory device 116. The host computing device 114 may include various electronic devices capable of accessing the memory device 116 to store or retrieve the content 118 stored in the memory device. The memory device 116 may be removably coupled to the host computing device 114 by a mechanical interface 108, such as pins and / or socket connectors. The memory device 116 is a memory storage device. As will be described below, an example of the memory device 116 is a memory card that uses non-volatile memory.

Host computing device 114 hosts application 104. The application 104 includes a number of program applications. For example, the application 104 may be an operating system that manages hardware and software resources on the host computing device 114. In another embodiment, application 104 may be a multimedia player configured to play audio and video files. Additionally, for example, application 104 may be a video game. The application 104 may access the content 118 stored in the memory device 116. The content 118 may include a variety of data. Examples of content 118 include audio files encoded in audio file formats such as WAVE, MPEG-1 Audio Layer 3 (MP3), Advanced Audio Coding (AAC), and other audio file formats. Content 118 may include video files encoded in video file formats such as Audio Video Interleaved (AVI), Moving Picture Experts Group (MPEG), and other video file formats. Other examples of content 118 include document files, image files, application files, and other data.

Linking content and licenses

2 is a block diagram illustrating generation of parameters used to decrypt content according to an embodiment of the present invention. FIG. 2 shows content 118 and associated license 204. FIG. The content 118 is encrypted so that the content is difficult to understand. Generally, license 204 is data (e.g., strings, files, and other data) to which content 118 is to be accessed. The license 204 may include permissions or rules for accessing the content 118, such as the duration of the access, the access restrictions of the content to a particular computing device, the dates, times, the number of times the content can be accessed, Lt; / RTI > The license 204 may be configured to define permissions for accessing the content 118. The user therefore accesses the content 118 based on the permissions contained in the license 204. [ For example, the license 204 may cause the content 118 in the form of a music file to be played three times in a particular computing device. In another embodiment, the license 204 allows the content 118 to be accessed but not copied to another computing device.

The content 118 is encrypted and the third parameter 210 is configured for use when decrypting the content. The third parameter 210 includes a number of data that may be associated with a decryption of the content 118. For example, the third parameter 210 may be the encryption key used in the encryption and decryption of the content 118. Instead of the encryption key, the third parameter 210 may include a reference to the encryption key. For example, the reference may be a number or a string identifying the encryption key. The third parameter 210 may include an authentication key. The authentication key is an encryption key used to authenticate sessions between the host computing device and the memory device. In another example, the third parameter 210 may be an encryption nonce. The encryption key is a number that can be used to generate the encryption key.

The third parameter 210 is generated based on the first parameter 202 and the second parameter 206. In other words, the third parameter 210 can be expressed as:

Third parameter = F (first parameter, second parameter) 1.0

Where the third parameter is a function of the first and second parameters 202 and 206. The function may include various functions such as a hash function, and the third parameter 210 may be a hash value of the hash function. The first parameter 202 is associated with the license 204 and the second parameter 206 is associated with the content 118. The first and second parameters 202 and 206 may include various data. For example, the first parameter 202 may be a number. In an embodiment, the number may be randomly generated. In another embodiment, the number is predefined. The second parameter 206 may be in accordance with the first parameter 202 or vice versa. For example, the second parameter 206 may be a number or string derived from both the reference to the encryption key and the first parameter 202. The number or string can be expressed as:

Second parameter = F (key reference, first parameter) (1.2)

Where the second parameter 206 is a function of both the reference to the encryption key and the first parameter 202. It should be appreciated that the second parameter 206 may be derived from both the authentication key and the first parameter 202. In another embodiment, the second parameter 206 may be derived from the encryption nonce and the first parameter 202. Conversely, the first parameter 202 may be derived from a reference to an encryption key, an encryption nonce, or other parameters with a second parameter 206 and an authentication key.

The first and second parameters 202 and 206 are associated with the license 204 and the content 118, respectively. The first and second parameters 202 and 206 may be placed or included in the license and content, respectively, so as to be associated with the license 204 or the content 118. For example, the second parameter 206 may be placed in the header or footer of the content 118. Alternatively, the first parameter 202 and / or the second parameter 206 may be placed independently of the license 204 and / or the content 118. [ If placed irrelevant, the license 204 may be associated with a first parameter 202 that includes a pointer to the first parameter. The content 118 may include a pointer to a second parameter 206 if the second parameter is placed independent of the content.

3 is a simplified block diagram of a system for accessing a memory device in accordance with an embodiment of the present invention. As shown, the system 302 includes a host computing device 114 coupled to a memory device 116. The host computing device 114 may include an application 104 and a first content protection platform 304. The memory device 116 includes a second content protection platform 306, content 118, and a license 204. In an embodiment, the license 204 may be stored in a hidden partition of the memory device 116, where the license is not visible or accessible by many applications. In addition to being stored in the memory device 116, the license 204 may be stored in the host computing device 114. The first and second content protection platforms 304 and 306 are technical platforms for protecting the content 118 for the memory device 116. The first content protection platform 304 and / or the second content protection platform 306 allow the user to deliver the memory device 116 and the content 118 of the memory device without compromising content protection. There are several content protection platforms that can be used to protect data, examples of which are sold under the trade names TrustedFlash ^TM and Gruvi ^TM (manufactured by SanDisk, Inc.).

As shown in FIG. 3, application 104 by first content protection platform 304 sends a request for content 118 stored in memory device 116. Here, the content 118 is encrypted. To decrypt the content 118, the first parameter 202 associated with the license 204 and the second parameter 206 associated with the content 118 are retrieved. The first parameter 202 and the second parameter 206 may be included in the license 204 and the content 118, respectively, or may be files arranged independently of the license and the content. As defined by Equation 1.0, a third parameter is generated based on the first parameter 202 and the second parameter 206. [ In other words, the third parameter may be derived from the first and second parameters 202 and 206. The third parameter may be an encryption key used to decrypt the content 118, a reference to an encryption key, an authentication key, a nonce, or other parameters. With the third parameter, the application 104 can decrypt and access the content 118. To access the content 118, the first content protection platform 304 may send a request for the third parameter and the content 118 to the memory device 116. The second content protection platform 306 may decrypt the content 118 based on the third parameter and send the content to be decrypted to the application 104 by the first content protection platform 304. [

In the embodiment of FIG. 3, the first content protection platform 304 hosted on the host computing device 114 retrieves the first and second parameters 202 and 206 and, based on the first and second parameters, And generates a third parameter. In another embodiment, the second content protection platform 306 included in the memory device 116 retrieves the first and second parameters 202 and 206 and retrieves a third parameter based on the first and second parameters .

4 is a flow diagram illustrating accessing content from a memory device in accordance with an embodiment of the present invention. Beginning at 402, the content is analyzed to determine if the content is protected (i.e., encrypted). The various information associated with the content may indicate whether the content is encrypted. The header of the content may indicate, for example, that the content is encrypted. Optionally, the file name extension of the content indicates that the content is encrypted. If the content is not protected, the content can be directly accessed 410. If the content is not protected, the first parameter is retrieved from the license at 404. In this embodiment, the first parameter is a number. The number may be randomly generated or predefined. At 406, the second parameter is retrieved from the content. In an embodiment, as represented in equation 1.2, the second parameter may be derived from the reference to the encryption key and the first parameter. The encryption key is used to encrypt or decrypt the content. As a result, the second parameter is associated with both the content and the license, because the second parameter is derived or calculated from the number included with the reference and license for the encryption key used to decrypt the content. In another embodiment, the first parameter (e.g., number) may be associated with the content and the second parameter may be associated with the license.

Due to the first parameter and the second parameter, a reference to the encryption key may be generated or calculated at 408. As described above in Equation 1.0, a reference to the encryption key may be generated based on the first parameter and the second parameter. Then, at 410, the content can be decrypted and accessed based on the third parameter. For example, in one embodiment, a third parameter in the form of a reference to an encryption key may be sent to the memory device. The memory device may include a secure store for storing the encryption key. The memory device may retrieve the encryption key from the secure store using a reference to the encryption key. Due to the encryption key, the memory device can decrypt the content and send the decrypted content to the host computing device.

Access content based on session tickets

5 is a block diagram illustrating generation of a session key according to an embodiment of the present invention. The parameters 502 are initially provided and the parameters include various data that may be associated with the decryption of the content. The parameter 502 may be generated based on parameters associated with the license and content described above. Examples of the parameter 502 include a reference to the encryption key used for decrypting the content, encryption non-cues or other parameters.

The creation of a session ticket 506 involves the use of a variable 504. The variable 504 includes various data. For example, the data may be a number. The number may be predefined or optionally generated. In another embodiment, the data may be a character character. Unlike the above parameters, the variable 504 may not be associated with a license and content. In other words, the variable 504 may be independent of the license and the content. The variable 504 is configured to change in the session. The session may span for any period of time. For example, a session may last for hours, days, weeks, or other time units. In addition, the session may expire when the host computing device coupled to the memory device is started or restarted. The session may also expire when the memory device is disconnected from the host computing device. In addition, for example, a session may span a limited number of accesses to the content (e.g., a limited number of times the content can be accessed).

A session ticket 506 is generated based on the parameters 502 and 504 and the parameters are encrypted based on the variables to define the session ticket 506. [ The session ticket 506 is therefore expressed as:

Session ticket = F (parameter, variable) (2.0)

Where the session ticket is a function of the parameter 502 and the variable 504. Due to the session ticket 506, the content can be accessed based on the session ticket. For example, the host computing device may send a session ticket 506 to the memory device. The memory device may derive the parameters used to decrypt the content based on the session ticket (s) The parameter 502 is derived as follows:

Parameter = F ^-1 (session ticket, variable) (2.2)

Where the parameter is an inverse function of the session ticket 506 and the variable 504.

It should be appreciated that the session ticket 506 is associated with a particular content because the session ticket is used to decrypt the content. As a result, other content stored in the memory device can not be used or accessed in the session ticket 506 unless the session ticket contains parameters, such as parameters 502, to decrypt the other content. As an example, if two independent content stored in a memory device are encrypted with different encryption keys, the host computing device or memory device creates two different session tickets to access the two independent content. Here, one session ticket can not be used to access two independent content items encrypted with different encryption keys.

6 is a simplified block diagram of a system for accessing a memory device using a session ticket in accordance with an embodiment of the present invention. The system 602 includes a host computing device 114 coupled to the memory device 116. The host computing device 114 may include an application 104 and a first content protection platform 304. The memory device 116 includes a second content protection platform 306, content 118, and a license 204. As described above, the first and second content protection platforms 304 and 306 may be configured to manage the digital rights of the content 118 stored in the memory device 116.

As shown in FIG. 6, the application 104 sends a request for the content 118 stored in the memory device 116 by the first content protection platform 304. The content 118 is encrypted with an encryption key. Parameters associated with an encryption key (e.g., a reference to an encryption key, a nonce, or other parameters) are provided to the second content protection platform 306. In response to the request for the content 118, the second content protection platform 306 encrypts the parameter based on the variable 604 to define the session ticket represented by Equation 2.0. The second content protection platform 306 may generate a variable 604 (e.g., a number, string, or other parameter). Variable 604 is configured to change in the session. For example, the second content protection platform 306 may generate another variable 604 for every session. Variable 604 may optionally be created or predefined.

After the session ticket is generated, the second content protection platform 306 sends a session ticket to host the computing device 114. Due to the session ticket, the host computing device 114 can access the content 118 based on the session ticket. To access the content 118, the host computing device 114 sends back the session ticket back to the memory device 116. Upon receipt of the session ticket, the second content protection platform 306 decrypts the session ticket to extract the parameters used to decrypt the content 118 represented in equation 2.2. If the variable 604 is not changed, the parameter may be extracted because the decryption is based on the same variable used to encrypt the parameter. Variable 604 may change in other sessions. As a result, the variable 604 is the same as the variable used to encrypt the parameter if the variables are generated in the same session. However, if the variable 604 is changed, the parameter can not be extracted because the decryption is based on a variable other than the one used to encrypt the parameter. Variable 604 differs from the variable used to encrypt the parameters if they are generated in different sessions. By changing the variable 604 in the session, the session ticket lasts or is valid for one session. If the parameters are extracted, the second content protection platform 306 may decrypt the content 118 based on the parameters and send the decrypted content to the host computing device 114.

In another embodiment, the first content protection platform 304 may generate a session ticket by encrypting the parameters used to decrypt the content 118. Here, in response to a request by the application 104 to access the content 118, the first content protection platform 304 may generate a session ticket and may transmit the session ticket to the application 104. The application 104 may send the session ticket back to the first content protection platform 304 to access the content 118. [

7 is a flow diagram illustrating accessing content from a memory device based on a session ticket in accordance with an embodiment of the present invention. Beginning at 702, a reference to the encryption key is retrieved. The reference may be retrieved from a host computing device or a memory device. The content stored in the memory device may be encrypted and decrypted using the encryption key. Due to the reference to the encryption key, the reference to the encryption key is encrypted based on the number at 704 to define the session ticket. The number may be configured and optionally generated to vary in a session. The next session ticket may be sent, for example, at 706 to the host computing device.

When the host computing device accesses the content stored on the memory device, the host computing device may send the received session ticket to the memory device at 706. [ The memory device receives the session ticket at 708 and decrypts the session ticket based on the number at 710. If the number matches the number used to generate the session ticket, a reference to the encryption key may be extracted from the decryption operation. However, if the session is changed and another number is maintained by the memory device, the reference to the encryption key can not be extracted from the decryption operation because the numbers do not match. If a reference to the encryption key can be extracted from the session ticket, the encryption key is retrieved based on the reference at 712. The encryption key may be retrieved from, for example, a secure repository. The content is decrypted at 714 using the encryption key and sent to the host computing device at, for example, 716.

Figure 8 is a simplified block diagram of program applications that may be hosted on a host computing device for accessing content in accordance with an embodiment of the present invention. The host computing device 114 may host the application 104, the digital rights management (DRM) module 806, the content protection platform 304, the file system manager 808, and the device driver 810. As noted above, the application 104 may include various program applications, such as multimedia players, video games, and other applications. The application 104 communicates with the DRM module 806 and the content protection platform 304. The DRM module 806 allows the host computing device 114 to manage the digital rights of content stored in memory devices or other locations. For example, the DRM module 806 can protect the content and control the distribution of the content. As described above, the content protection platform 304 is a technical platform for protecting content on a memory device. The content protection platform 304 may include a security manager 802 and a host encryption engine 804. Generally, security manager 802 manages access of content stored in a memory device. Management may include, for example, checking that the content is protected, creating a reference to the encryption key based on the parameters associated with the license and content, generating a session ticket based on the parameters and variables, ≪ / RTI > The host encryption engine 804 includes cryptographic libraries for handling cryptographic operations. The content protection platform 304 and the DRM module 806 together provide secure storage and content management capabilities to the host computing device 114 (and memory device). For example, the content protection platform 304 and DRM module 806 may provide secure storage of content (e.g., music files, movie files, software, and other data) stored in the memory device and access to the content Allows the execution of predefined policies to control.

The content protection platform 304 communicates with the file system manager 808. In general, the file system manager 808 is configured to manage and process access (e.g., read, write, and other access operations) of content stored in a memory device. For example, the file system manager 808 may read the content from the memory device and send the content to the content protection platform 304 for processing. The host computing device 114 may interface with the memory device. The host computing device 114 may thus include a device driver 810 that communicates with the system manager 808 to interface with the memory device. The device driver 810 may include low level interface functions to communicate with, for example, a memory device. Examples of lower-level interface functions include memory device and input / output functions associated with input and output from the memory device.

9 is a simplified block diagram of program applications that may be included in a memory device in accordance with an embodiment of the invention. The memory device 116 may include a DRM module 902, a content protection platform 306, an encryption engine 904, and a secure repository 906. In the memory device 116, the DRM module 902 allows the memory device 116 to manage the digital rights of the content stored in the memory device. For example, the DRM module 902 may be configured to execute content rights. As described above, the content protection platform 306 is a technology platform for protecting content stored in the memory device 116. The content protection platform 306 may be configured to generate a reference to an encryption key based on parameters associated with the license and content to generate a session ticket based on parameters and variables, and may be configured for other operations. The encryption engine 904 processes the encryption operations and the secure store 906 stores the encryption keys.

It should be appreciated that in other embodiments, the host computing device 114 of FIG. 8 and the memory device 116 of FIG. 9 may include fewer or more program applications than those shown in FIGS. 8 and 9. For example, as shown in FIG. 8, the file system manager 808 and the device driver 810 may be integrated into the content protection platform 304. The host computing device 114 of FIG. 8 may therefore include a DRM module 806 and a content protection platform 304.

10 is a simplified block diagram of a general overview of a host computing device suitable for hosting a content protection platform and other program applications in accordance with an embodiment of the present invention. In some embodiments, the host computing device 114 may be used to execute computer programs (e.g., a content protection platform), logic, applications, methods, processes, or other software for accessing content . Examples of host computing devices 114 include desktop computers, servers, handheld computing devices, personal digital assistants, mobile telephones, computing engines within a machine, and other computer systems. 10, host computing device 114 may include a processor 1004, a system memory 1006 (e.g., random access memory (RAM)), a storage device 1008 (e.g., (E.g., a memory (ROM), magnetic disk drives, optical disk drives, and other storage devices), a communication interface 1012 (e.g., a modem or Ethernet card), a display 1014 (E.g., CRT) or liquid crystal display (LCD)), input / output device 1016 (e.g., keyboard), and cursor control 1018 (e.g., a mouse or trackball) Or other communication mechanism for communicating information to the user.

In some embodiments, the host computing device 114 performs certain operations by the processor 1004 when executing one or more sequences of one or more program instructions stored in the system memory 1006. The program instructions may be read into the system memory 1006 from another computer readable medium, such as the storage device 1008. In some embodiments, a wiring circuit may be used in combination with the software program instructions dash or the software program instructions to carry out embodiments of the present invention.

It should be appreciated that the term "computer readable medium" refers to any suitable medium that participates in providing program instructions to the processor 1004 for execution. The medium may take forms including but not limited to non-volatile media, volatile media, and transmission media. Non-volatile media may include, for example, optical or magnetic disks, such as storage device 1008. The volatile media may include dynamic memory, such as system memory 1006. The transmission medium includes coaxial cables, copper wires, and optical fibers with wires comprising a bus 1002. The transmission medium may take the form of acoustic or light waves as generated during radio wave and infrared data communications. Common forms of computer readable media include, for example, magnetic media (e.g., floppy disks, flexible disks, hard disks, magnetic tape, and other magnetic media), optical media (E.g., CD-ROMs and other optical media), physical media (e.g., punch cards, paper tape, any other physical media) with patterns, memory chips or cartridges, , Read only memory (EPROM), flash memory, and other memory chips or cartridges), and any other computer readable medium.

In some embodiments, the sequential execution of program instructions to perform embodiments may be performed by a single computing device 114. In other embodiments, a host computing device 114 (e.g., a local area network (LAN), a public switched telephone network (PSTN), a wireless network, and other communication links) coupled by a communication link 1020 ) May cooperate with one another to perform a sequence of program instructions for executing the embodiments. In addition, the computing device 114 may transmit and receive messages, data, and instructions, including applications, i.e., application code, via the communications link 1020 and the communications interface 1012. The received program instructions may be executed by the processor 1004 when the program instructions are received and / or stored in the storage device 1008, or other non-volatile storage for later execution.

11 is a simplified block diagram of a memory device in accordance with an embodiment of the present invention. As shown in FIG. 11, memory device 116 includes a controller 1102 in communication with memory 1104. In general, controller 1102 controls the operation of memory 1106. Examples of operations include data writing (or programming), data reading, data erasing, data verification, and other operations. Controller 1102 may also be configured to generate parameters based on parameters associated with licenses and content, and to generate session tickets based on parameters and numbers, and configured for other operations as described above.

The memory device 116 may include various non-volatile memory structures and techniques. Examples of memory technologies include flash memories (e.g., NAND, NOR, SLC / BIN, MLC, segmented bit-line NOR (DINOR) (HiCR), asymmetric contactless transistors (ACT), and other flash memories), erasable read only memory (EPROM), electrically erasable programmable read only memory (EEPROM) Memory (OTP), and other memory technologies. In one embodiment, the memory device 116 may be a flash memory card using flash memory. Examples of flash memory cards include Secure Digital ^TM (compliant with specifications maintained by the SD Card Association of San Ramon, California), specifications maintained by MultiMediaCard ^TM (Palo Alto, California, MultiMediaCard Association ("MMCA &Quot;), MiniSD ^TM (manufactured by SanDisk, Inc.), MicroSD ^TM (manufactured by SanDisk, Inc.), CompactFlash ^TM (Palo Alto, California, CompactFlash Association XD-Picture Card ^™ (xD-Picture Card Licensing, Tokyo, Japan), SmartMedia ^™ (conforming to the specifications maintained by Yokohama, Japan's Solid State Floppy Disk Card ("SSFDC" Conform to the specifications maintained by Office), Memory Stick ^™ (conforms to the specifications maintained by Yokohama, Japan's Solid State Floppy Disk Card ("SSFDC") Forum), TransFlash ^TM (SanDisk, Inc. , ≪ / RTI > and other flash memory cards. In another embodiment, the memory device 116 may be implemented as a non-removable memory device.

The following patent documents include embodiments that may be used in the embodiments described herein. Each of these patent documents is the same data field as the present application and is assigned to the assignee of the present invention and incorporated herein by reference: "Methods for Linking Content with License" of U.S. Patent Application 11 / 599,655; U.S. Patent Application 11 / 600,270 entitled " Apparatuses for Linking Content with License "; U.S. Patent Application 11 / 600,273 entitled " Apparatuses for Accessing Content Based on a Session Ticket "; U.S. Patent Application 11 / 600,262, entitled " Methods for Binding Content to a Separate Memory Device "; U.S. Patent Application 11 / 600,245 entitled " Apparatuses for Binding Content to a Separate Memory Device "; U.S. Patent Application 11 / 599,994, entitled " Method for Allowing Multiple Users to Access Preview Content "; U.S. Patent Application 11 / 599,995 entitled " System for Allowing Multiple Users to Access Preview Content "; "Method for Allowing content Protected by a First DRM System to Be Accessed by a Second DRM System" of U.S. Patent Application 11 / 600,005; U.S. Patent Application 11 / 599,991 entitled " System for Allowing Content Protected by a First DRM System to Be Accessed by a Second DRM System "; U.S. Patent Application 11 / 600,300 entitled " Method for Connecting to a Network Location Associated with Content "; And United States Patent Application 11 / 600,006 entitled " System for Connection to a Network Location Associated with Content ".

Although the above embodiments have been described in several items for clarity of understanding, the embodiments are not limited to the items provided. There are many different ways of implementing the embodiments. Accordingly, the disclosed embodiments are to be considered as illustrative and not restrictive, and the embodiments are not intended to be limited to the items provided herein, but may be modified within the scope and equivalents of the appended claims. In the claims, elements and / or actions are not meant to imply any particular order of operation unless explicitly stated in the claims.

As described above, the present invention is generally used to provide content access, and more particularly, to provide a method for connecting content with a license and accessing content based on a session ticket.

Claims (37)

A method for accessing content stored on a memory device, the method comprising: Storing the content encrypted by the encryption key in a memory device; Receiving a session ticket and a request for accessing the content from a host computing device, the session ticket having a value that is already provided to the host computing device and has a value associated with the session, A step generated by the memory device by encrypting a parameter associated with the memory device; Attempting to extract the parameter associated with the encryption key from the session ticket by decrypting the session ticket with the variable; if the session has not changed, the value of the variable has not changed; and the parameter associated with the encryption key is Extracting from the session ticket; If the parameter associated with the encryption key is extracted from the session ticket: Obtaining the encryption key based on the parameter; Decrypting the content using the encryption key; Sending the content to the host computing device; / RTI > of the content. delete 2. The method of claim 1, wherein the parameter is a reference to the encryption key. 2. The method of claim 1, wherein the parameter is a cryptographic nonce and the encryption policy is used to generate the encryption key. 2. The method of claim 1, wherein the variable is a number. 6. The method of claim 5, wherein the number is configured to change randomly in other sessions. 2. The method of claim 1, wherein the session spans any time. 2. The method of claim 1, wherein the session expires when the host computing device is restarted. 2. The method of claim 1, wherein the session expires when the memory device is disconnected from the host computing device. delete delete delete delete delete delete delete delete delete 13. A memory device comprising: A memory operative to store content encrypted by an encryption key; A controller in communication with the memory; Lt; / RTI > The controller comprising: Receiving a session ticket and a request for accessing the content from a host computing device, the session ticket having a value that is already provided to the host computing device and has a value associated with the session, By the memory device by encrypting a parameter associated with the memory device; Attempting to extract the parameter associated with the encryption key from the session ticket by decrypting the session ticket with the variable; if the session has not changed, the value of the variable has not changed; and the parameter associated with the encryption key is Extracted from the session ticket; If the parameter associated with the encryption key is extracted from the session ticket: Acquiring the encryption key based on the parameter, Decrypt the content using the encryption key, To transmit the content to the host computing device, Operating memory device. delete 20. The memory device of claim 19, wherein the parameter is a reference to the encryption key. 20. The memory device of claim 19, wherein the parameter is an encryption nonce and the encryption key is used to generate the encryption key. 20. The memory device of claim 19, wherein the session spans an arbitrary time period. 20. The memory device of claim 19, wherein the session expires when the host computing device is restarted. 20. The memory device of claim 19, wherein the session expires when the memory device is disconnected from the host computing device. 13. A memory device comprising: A memory; A controller in communication with the memory; Lt; / RTI > The controller comprising: Generating a session ticket by encrypting a parameter associated with the encryption key having a value associated with the session and changing a value in the other sessions; Providing the session ticket to a host computing device; Receive a request for accessing the session ticket and content from a host computing device; Attempting to extract the parameter associated with the encryption key from the session ticket by decrypting the session ticket with the variable; if the session has not changed, the value of the variable has not changed; and the parameter associated with the encryption key is Extracted from the session ticket; If the parameter associated with the encryption key is extracted from the session ticket: Acquiring the encryption key based on the parameter, Decrypt the content using the encryption key, To transmit the content to the host computing device, ≪ / RTI > delete 27. The memory device of claim 26, wherein the variable is a number configured to vary arbitrarily. 27. The memory device of claim 26, wherein the session spans an arbitrary time period. 27. The memory device of claim 26, wherein the session expires when the host computing device is restarted. 27. The memory device of claim 26, wherein the session expires when the memory device is disconnected from the host computing device. delete delete delete delete delete delete

Images