TWI441037B - Methods and apparatuses for accessing content based on a session ticket - Google Patents

Description

Method and device for accessing content based on session warrant

Particular embodiments of the present invention generally relate to content access, and more particularly to link content and authorization and access content based on a session ticket.

Digital Rights Management (DRM) is a technology used to protect and control the distribution of content such as music files, video files, and other content. In DRM, a cryptographic key is used to encrypt the content, so the cryptographic key can also be used to decrypt the content. In order for a user to decrypt and access the content, the user must have access to an authorization associated with the content. In general, an authorization grants different access rights to the content, depending on the permissions defined by an authorized provider. For example, the authorization may limit the duration of a limited number of times to play the content (eg, a music file).

In traditional DRM technology, the cryptographic key used to decrypt the content is stored in the authorization. Authorization may be cracked so that the cryptographic key can be easily extracted from the authorization. If the security of the cryptographic key is compromised, an unauthorized user can decrypt the content without authorization, thereby unrestricted access to the content. Therefore, it is necessary to further improve the content protection.

Various embodiments of the present invention provide methods, systems, and/or apparatus for linking an authorization and content and accessing content based on a session ticket. It should be understood that the specific embodiments can be implemented in many ways, including a method, a circuit, a system, or a device. The following describes several tools of the present invention. Body embodiment.

In a specific embodiment, a method for accessing content stored on a memory device is provided. In this method, a request to access the content is transmitted and a session ticket is received. The session ticket includes a parameter for decrypting the content and the session warrant is generated based on a variable configured to change during a session. The content can be accessed based on the session ticket.

In another embodiment, an apparatus is provided. The device includes a memory and a processor in communication with the memory. The processor is configured to: transmit a request to a memory device to access content stored in the memory device; receive a session ticket; and access the content based on the session ticket. The session ticket includes a parameter for decrypting the content and the session warrant is generated based on a variable configured to change during a session.

Other embodiments and advantages of the invention will be apparent from the accompanying drawings.

In conjunction with the drawings, a detailed description of one or more specific embodiments is provided below. The detailed description is provided in connection with such specific embodiments, but not limited to any particular embodiment. The scope is limited only by the scope of the patent application and encompasses many alternatives, modifications, and equivalents. Numerous specific details are set forth in the following description in order to provide a thorough understanding. The details are provided for the purpose of illustration and the specific embodiments may be practiced without departing from the scope of the application. For the sake of clarity, Technical material that is known in the art in connection with the specific embodiments is not described in detail to avoid unnecessarily obscuring the description.

The specific embodiments described herein provide a link to an authorization and content and access the content based on a session ticket. A cryptographic key is used to decrypt and access an encrypted content. As explained in more detail below, the cryptographic key is derived using parameters associated with both the authorization and the content. In some embodiments, a parameter for deriving the cryptographic key is further encrypted using a variable such that content access is limited to a session.

BRIEF DESCRIPTION OF THE DRAWINGS Figure 1 is a simplified block diagram of a device system in accordance with an embodiment of the present invention. As shown in FIG. 1, system 102 includes a host computing device 114 and a memory device 116. The host computing device 114 can include various electronic devices that can access the memory device 116 to store or retrieve content 118 stored on the memory device. The memory device 116 can be movably coupled to the host computing device 114 by a mechanical interface 108, such as a pin and/or socket connector. The memory device 116 is a memory storage device. As will be explained below, one example of a memory device 116 is a memory card that uses non-volatile memory.

The host computing device 114 hosts the application 104. Application 104 can include a variety of program applications. For example, application 104 may be an operating system that manages hardware and software resources on host computing device 114. In another example, application 104 may be a multimedia player configured to play audio and video files. Additionally, for example, the application 104 may be a video game. The application 104 can access the content 118 stored in the memory device 116. Content 118 can include a variety of materials. Examples of content 118 include audio file formats (eg, WAVE, MPEG-I audio layer) 3 (MP3), Advanced Audio Coding (AAC) and other audio files encoded in the audio file format. The content 118 may also include video files encoded in a video file format (eg, Audio Video Interleave (AVI), Moving Picture Experts Group (MPEG), and other video file formats. Other examples of content 118 include file files, video files, application files, and other materials.

Link authorization and content

2 is a block diagram depicting the generation of parameters for decrypting content in accordance with one embodiment of the present invention. FIG. 2 shows content 118 and associated authorization 204. The content 118 is encrypted, making the content difficult to understand. In general, the authorization 204 implements access to the content of the content 118 (e.g., a string, a file, and other materials). Authorization 204 may include permissions or rules to access content 118, such as access duration, content access limited to a particular computing device, date, time, number of accessible content, and other permissions. The authorization 204 can thus be configured to define a license to access the content 118. A user is thus allowed to access the content 118 based on the permissions included within the authorization 204. For example, the authorization 204 may allow content 118 in the form of a music file to be played three times on a particular computing device. In another example, authorization 204 may allow access to content 118, but does not allow copying to another computing device.

The content 118 is encrypted and the third parameter 210 is configured to decrypt the content. The third parameter 210 includes various materials that can be associated with the decryption of the content 118. For example, the third parameter 210 may be used to encrypt and decrypt the content 118. A password to compile the key. Instead of the cryptographic key, the third parameter 210 may also include a reference to the cryptographic key. For example, the reference may be a number or string identifying the cryptographic key. The third parameter 210 can also include a verification key. The verification key is a cryptographic key used to verify the session between the host computing device and the memory device. In another example, the third parameter 210 may be a cryptographically compiled temporary value. A cryptographic compilation temporary value is a number that can be used to generate the cryptographic compilation key.

The third parameter 210 is generated based on the first parameter 202 and the second parameter 206. In other words, the third parameter 210 can be expressed as The third parameter = F (first parameter, second parameter) (1.0) The third parameter is a function of the first parameter 202 and the second parameter 206. The function may include various functions, such as a hash function, so the third parameter 210 may be a hash value of the hash function. The first parameter 202 is associated with the authorization 204 and the second parameter 206 is associated with the content 118. The first parameter 202 and the second parameter 206 can include various materials. For example, the first parameter 202 may be a number. In a specific embodiment, the number may be randomly generated. In another embodiment, the number is predefined. The second parameter 206 may depend on the first parameter 202 or vice versa. For example, the second parameter 206 may be derived from one of a cryptographic key and one of the first parameters 202 to derive a number or string. Such numbers or strings can be expressed as The second parameter = F (key reference, first parameter) (1.2) The second parameter 206 is a function of the cryptographic compilation key reference and the first parameter 202. It should be appreciated that the second parameter 206 can also be derived from both a verification key and the first parameter 202. In another example, the second parameter 206 can be self-contained The code compilation temporary value is derived from the first parameter 202. Conversely, the first parameter 202 can be derived from the second parameter 206 and a verification key, a reference to a cryptographic key, a cryptographic temporary value, or other parameters.

The first parameter 202 and the second parameter 206 are associated with the authorization 204 and the content 118, respectively. For associated authorization 204 or content 118, first parameter 202 and second parameter 206 may be located or included in the authorization and the content, respectively. For example, the second parameter 206 can be located within the header or footer of the content 118. Alternatively, the first parameter 202 and/or the second parameter 206 can be separately located from the authorization 204 and/or the content 118. If the location is separated, the authorization 204 can include an indicator of the first parameter and be associated with the first parameter 202. In the event that the second parameter is separately located from the content, the content 118 may also include an indicator of the second parameter 206.

3 is a simplified block diagram of a system for accessing a memory device in accordance with one embodiment of the present invention. As shown, system 302 includes a host computing device 114 coupled to a memory device 116. The host computing device 114 can include an application 104 and a first content protection platform 304. The memory device 116 includes a second content protection platform 306, content 118, and an authorization 204. In one embodiment, the authorization 204 can be stored in a hidden partition of one of the memory devices 116, wherein the authorization is not visible or accessible to many applications. In addition to being stored within memory device 116, authorization 204 may also be stored within host computing device 114. The first content protection platform 304 and the second content protection platform 306 are used to protect the technology platform to the content 118 of the memory device 116. Using the first content protection platform 304 and/or the second content protection platform 306, a user can transfer the memory device 116 and its content 118 without compromising the security of the content protection. There are various content protection platform can be used for data protection, the Department of examples of sales under the trademark TrustedFlash ^TM and Cruvi ^TM (of SanDisk, Inc. manufacture).

As shown in FIG. 3, the application 104 transmits a pair of requests for content 118 stored in the memory device 116 by the first content protection platform 304. Here, the content 118 is encrypted. To decrypt the content 118, a first parameter 202 associated with the authorization 204 and a second parameter 206 associated with the content 118 are retrieved. The first parameter 202 and the second parameter 206 may be included in the authorization 204 and the content 118, respectively, or may be files that are separately located from the authorization and the content. As defined by Equation 1.0, a third parameter is generated based on the first parameter 202 and the second parameter 206. In other words, the third parameter can be derived from the first parameter 202 and the second parameter 20. The third parameter may be a cryptographic key used to decrypt the content 118, a reference to the key key, a verification key, a temporary value, or other parameters. Using this third parameter, the application 104 can decrypt and access the content 118. In order to access the content 118, the first content protection platform 304 can transmit the third parameter and the request for the content 118 to the memory device 116. The second content protection platform 306 can decrypt the content 118 based on the third parameter and can transmit the decrypted content to the application 104 by the first content protection platform 304.

In the specific embodiment of FIG. 3, the first content protection platform 304 hosted on the host computing device 114 retrieves the first parameter 202 and the second parameter 206, and generates the first parameter based on the first and second parameters. Three parameters. In another embodiment, the second content protection platform 306 included in the memory device 116 can also retrieve the first parameter 202 and the second parameter 206, and based on the first The second parameter is to generate the third parameter.

4 is a flow diagram depicting accessing content from a memory device in accordance with an embodiment of the present invention. Beginning at 402, the content is analyzed to determine whether to protect (ie, encrypt) the content. Various information associated with the content may indicate whether the content is encrypted. For example, the header of the content may indicate that the content is encrypted. Alternatively, the extension of the content may also indicate that the content is encrypted. If the content is not protected, then at 410, the content can be accessed directly. If the content is protected, the first parameter can be retrieved at 404. In this embodiment, the first parameter is a number. This number may be randomly generated or predefined. At 406, a second parameter is retrieved from the content. In a specific embodiment, as expressed by Equation 1.2, the second parameter can be derived from a reference to the cryptographic key and the first parameter. The cryptographic key is used to encrypt or decrypt the content. Thus, the second parameter is associated with both the content and the authorization, since the second parameter is derived from a reference to the cryptographic key used to decrypt the content and a number included in the authorization. Or calculation. It should be noted that in another embodiment, the first parameter (e.g., a number) may be associated with the content and the second parameter may be associated with the authorization.

Using the first parameter and the second parameter, a reference to the cryptographic key can be generated or calculated at 408. As expressed by Equation 1.0 above, the cryptographic compilation key reference can be generated based on the first parameter and the second parameter. Thereafter, at 410, the content can be decrypted and accessed based on the third parameter. For example, in one embodiment, the third parameter in the form of a cryptographically compiled key reference can be transmitted to the memory device. The memory device can A secure storage is included that stores the cryptographic key. The cryptographic key reference can be used by the memory device to retrieve the cryptographic key from the secure storage. Using the cryptographic key, the memory device can decrypt the content and transmit the decrypted content to a host computing device.

Access content based on a session ticket

Figure 5 is a block diagram depicting the generation of a session ticket in accordance with an embodiment of the present invention. Parameter 502 is initially provided and includes various materials that can be associated with content decryption. Parameter 502 can be generated based on parameters associated with the authorization and content described above. An example of parameter 502 includes a reference to a cryptographic compilation key used to decrypt the content, a cryptographic compilation temporary value, or other parameters.

The generation of the session ticket 506 involves the use of a variable 504. The variable 504 includes various materials. For example, the information may be a number. This number may be pre-defined or randomly generated. In another embodiment, the data may be a string. Unlike the above parameters, the variable 504 may not be associated with the authorization and content. In other words, the variable 504 may be independent of the authorization and content. The variable 504 is configured to vary during a session. A session can span a period of time. For example, the session may last for an hour, a day, a week, or other time unit. In addition, a session may be turned off when initializing or restarting a host computing device coupled to the memory device. A session may also be turned off when the memory device is decoupled from the host computing device. Moreover, for example, a session may span a limited number of content accesses (e.g., a limited number of times the content can be accessed).

Session ticket 506 is generated based on parameter 502 and variable 504, so the parameter can be encrypted based on the variable to define session ticket 506. The session ticket 506 can thus be expressed as a session ticket = F (parameter, variable) (2.0) where the session warrant is a function of the parameter 502 and the variable 504. Using session ticket 506, the content can be accessed based on the session ticket. For example, a host computing device can transmit session warrants 506 to the memory device. The memory device can derive parameters to decrypt the content based on the session ticket 506. Parameter 502 can derive a parameter =F ^-1 (session ticket, variable) (2.2) from which the parameter is an inverse of session warrant 506 and variable 504.

It should be appreciated that because the session warrant is used to decrypt the content, the session ticket 506 is associated with a particular content. Thus, the use of session ticket 506 cannot use or access another content stored in the memory device unless the session ticket includes a parameter (e.g., parameter 502) to decrypt other content. As an example, if different cryptographic keys are used to encrypt two separate content stored in a memory device, the host computing device or memory device generates two different session warrants to access the two Separate content. Here, a session ticket cannot be used to access the two separate contents encrypted using different cryptographic key encryption.

6 is a simplified block diagram of a system for accessing a memory device using a session ticket in accordance with one embodiment of the present invention. System 602 includes a host computing device 114 coupled to a memory device 116. The host computing device 114 can include an application 104 and a first content protection platform 304. The memory device 116 includes a second content protection platform 306, content 118, and an authorization 204. As described above, the first content protection platform 304 and the second content protection platform 306 can be configured to manage the digital rights of the content 118 stored in the memory device 116.

As shown in FIG. 6, application 104 transmits a request for content 118 stored in memory device 116 by first content protection platform 304. Content 118 is encrypted using a cryptographic key. A parameter associated with the cryptographic key (e.g., one of the cryptographic key references, a temporary value, or other parameter) is provided to the second content protection platform 306. Referring back to the request to access the content 118, the second content protection platform 306 encrypts the parameter based on the variable 604 to define a session ticket, which is expressed in Equation 2.0. The second content protection platform 306 can generate variables 604 (eg, a number, a string, or other parameters). The variable 604 is configured to vary during a session. For example, the second content protection platform 306 can generate a different variable 604 for each session. The variable 604 may be randomly generated or predefined.

After generating the session ticket, the second content protection platform 306 transmits the session ticket to the host computing device 114. Using the session ticket, host computing device 114 can access content 118 based on the session ticket. In order to access the content 118, the host computing device 114 then transmits the session ticket back to the memory device 116. After receiving the session ticket, the second content protection platform 306 decrypts the session ticket to extract parameters for decrypting the content 118, which is expressed in Equation 2.2. If the variable 604 has not changed, the parameter can be extracted because the decryption is based on a variable equivalent to the variable used to encrypt the parameter. The variable 604 can vary during different sessions. Thus, in the case where the variables are generated within the same session, the variable 604 is equivalent to encrypting the parameter. Variables. However, if the variable 604 has changed, the parameter cannot be extracted because the decryption is based on a variable different from the variable used to encrypt the parameter. In the event that such variables are generated within different sessions, the variable 604 is different from the variable used to encrypt the parameter. By changing the variable 604 at a session, the session ticket is used continuously or effectively for a session. If the parameter is extractable, the second content protection platform 306 can decrypt the content 118 based on the parameter and transmit the decrypted content to the host computing device 114.

In another embodiment, the first content protection platform 304 can also generate the session ticket by encrypting parameters used to decrypt the content 118. Here, in response to the application 104 requesting access to the content 118, the first content protection platform 304 can generate the session ticket and transmit the session ticket to the application 104. The application 104 can then transmit the session ticket back to the first content protection platform 304 to access the content 118.

7 is a flow diagram depicting accessing content from a memory device based on a session ticket in accordance with an embodiment of the present invention. Beginning at 702, a reference to one of the cryptographic keys is retrieved. The reference may be taken from a host computing device or a memory device. The content stored in the memory device is encrypted and can be decrypted using the cryptographic key. The key reference is compiled using the password, and at 704, the cryptographic key reference is encrypted based on a number to define a session ticket. This number is configured to change at one session and can be randomly generated. At 706, the session ticket can then be transmitted to, for example, a host computing device.

When the host computing device accesses content stored on a memory device, at 706, the host computing device can transmit the session received to the memory device Warrants. At 708, the memory device receives the session ticket and decrypts the session ticket based on a number at 710. If the number matches the number used to generate the session ticket, the cryptographic key reference can be extracted from the decryption operation. However, if the session has changed and the memory device holds a different number, the cryptographic compilation key reference cannot be extracted from the decryption operation because the numbers do not match. If the cryptographic compilation key reference is extractable from the session ticket, then at 712, the cryptographic key is retrieved based on the reference. The cryptographic key can be retrieved from, for example, a secure storage. The cryptographic key is then used at 714 to decrypt the content and then transmitted at 716 to, for example, the host computing device.

8 is a simplified block diagram of a program application for accessing content on a host computing device in accordance with an embodiment of the present invention. The host computing device 114 can host the application 104, the digital rights management (DRM) module 806, the content protection platform 304, the file system management program 808, and the device driver 810. As noted above, the application 104 can include a variety of program applications, such as multimedia players, video games, and other applications. The DRM module 806 and the content protection platform 304 are in communication with the application 104. The DRM module 806 allows the host computing device 114 to manage the digital rights of content stored in a memory device or other location. For example, DRM module 806 can protect content and control its distribution. As noted above, the content protection platform 304 is a technology platform for protecting content on a memory device. The content protection platform 304 can include a security management program 802 and a master password compilation engine 804. In general, the security management program 802 manages access to content stored in a memory device. Management includes, for example, checking whether content is protected, based on associations The one authorization and the content generate a reference to one of the cryptographic compile keys, generate a session ticket based on a parameter and a variable, generate the variable, and other operations. The master password compilation engine 804 includes such password compilation libraries for handling cryptographic compilation operations. Content protection platform 304 and DRM module 806 together provide secure storage and content management capabilities to host computing device 114 (and memory devices). For example, content protection platform 304 and DRM module 806 allow for the storage of content stored in the memory device (eg, music files, movie archives, software, and other materials) and enhances predefined policies for controlling content access.

A file system management program 808 that communicates with the content protection platform 304. In general, file system management program 808 is configured to manage and process access (e.g., read, write, and other access operations) of content stored in a memory device. For example, the file system management program 808 can read content from a memory device and transfer the content to the content protection platform 304 for processing. The host computing device 114 can interface with a memory device. Accordingly, host computing device 114 can include a device driver 810 that communicates with file system management program 808 to interface with the memory device. Device driver 810 can, for example, include a lower interface function to communicate with a memory device. An example of a lower layer interface function includes input/output functions associated with input data to and from the memory device.

9 is a simplified block diagram of a program application that can be included in a memory device in accordance with an embodiment of the present invention. The memory device 116 can include a DRM module 902, a content protection platform 306, a cryptographic compilation engine 904, and a secure storage 906. In the memory device 116, the DRM module 902 allows the memory device 116 to manage the digital rights of the content stored in the memory device. limit. For example, the DRM module 902 can be configured to enhance content rights. As described above, the content protection platform 306 is a technology platform for protecting content stored on the memory device 116. The content protection platform 306 can be configured to generate a reference to a cryptographic key based on a parameter associated with an authorization and the content, generate a session ticket based on a parameter and a variable, and can be configured For other operations. The cryptographic compilation engine 904 processes the cryptographic compilation operations and the secure storage 906 stores the cryptographic compilation keys.

It should be appreciated that in other embodiments, the main computing device 114 of FIG. 8 and the memory device 116 of FIG. 9 may include fewer or more program applications than those illustrated in FIGS. 8 and 9. For example, as shown in FIG. 8, file system management program 808 and device driver 810 can be integrated into content protection platform 304. The host computing device 114 of FIG. 8 may thus include a DRM module 806 and a content protection platform 304.

10 is a simplified block diagram of a general overview of a host computing device suitable for hosting a content protection platform and other programming applications in accordance with an embodiment of the present invention. In some embodiments, host computing device 114 can be used to implement computer programs (eg, content protection platforms), logic, applications, methods, programs, or other software for accessing content. Examples of host computing device 114 include a desktop computer, a server, a portable computing device, a number of assistants, a mobile phone, a computing engine within an appliance, and other computer systems. As shown in FIG. 10, the host computing device 114 includes a bus bar 1002 or other communication mechanism for communicating information, the communication mechanism interconnecting subsystems and devices, such as the processor 1004, the system memory 1006 (eg, random access memory) (RAM)), storage device 1008 (eg, read-only memory) (ROM), disk drive, CD player and other storage devices), communication interface 1012 (such as a data modem or Ethernet card), display 1014 (such as a cathode ray tube (CRT) or liquid crystal display (LCD)), input / Output device 1016 (eg, a keyboard) and cursor control 1018 (eg, a mouse or trackball).

In some embodiments, when executing one or more sequences of one or more program instructions stored in system memory 1006, host computing device 114 performs a particular operation by processor 1004. Such program instructions can be read into system memory 1006 from another computer readable medium (e.g., storage device 1008). In some embodiments, hard-wired circuitry may be used in place of or in combination with software program instructions to implement a particular embodiment of the invention.

It should be understood that the term "computer readable medium" refers to the appropriate medium that participates in providing program instructions to processor 1004 for execution. This medium can take many forms, including but not limited to, non-volatile media, volatile media, and transmission media. Non-volatile media may include, for example, a compact disc or a magnetic disk, such as storage device 1008. Volatile media can include dynamic memory, such as system memory 1006. The transmission medium includes a coaxial cable, a copper wire, and an optical fiber, and includes a wire including the bus bar 1002. The transmission medium may also take the form of sound waves or light waves, such as those generated during radio wave and infrared data communication. Common forms of computer readable media include, for example, magnetic media (such as floppy disks, floppy disks, hard disks, magnetic tapes, and other magnetic media), optical media (such as CD-ROMs and other optics). Media), patterned physical media (such as punch cards, tapes, any other physical media), memory chips or ports, carrier waves (such as RAM, programmable read-only memory (PROM), erasable programmable Read-only memory (EPROM), Flash memory and other memory chips or 匣) and any other media from which the computer can read.

In some embodiments, execution of the sequence of program instructions can be performed by a single computing device 114 to implement the specific embodiments. In other embodiments, two or more computer systems (eg, host computing) coupled by a communication link 1020 (eg, a local area network (LAN), a public switched telephone network (PSTN), a wireless network, and other communication links) The device 114) can execute a sequence of program instructions to implement the specific embodiments in coordination with one another. In addition, computing device 114 can transmit and receive messages, data, and instructions, including programs, ie, application code, over communication link 1020 and communication interface 1012. The received program instructions may be executed by processor 1004 and/or stored in storage device 1008 or other non-volatile storage for later execution upon receipt of the program instructions.

Figure 11 is a simplified block diagram of one of the memory devices in accordance with one embodiment of the present invention. As shown in FIG. 11, memory device 116 includes a memory controller 1102 in communication with memory 1104. In general, memory controller 1102 controls the operation of memory 1106. Examples of operations include writing (or stylizing) data, reading data, erasing data, verifying data, and other operations. Additionally, the memory control 1102 can be configured to generate a parameter based on the parameters associated with the authorization and the content, generate a session ticket based on a parameter and a number, and can be configured for the other operations described above .

Memory device 116 can include a variety of non-volatile memory structures and techniques. Examples of memory technologies include flash memory (eg, NAND, NOR, single-level cell (SLC/BIN), multi-level cell (MLC), divided bit line NOR (DINOR), AND, high capacitance coupling ratio (HiCR) , Asymmetric Contactless Transistor (ACT) and other flash memory), erasable programmable read only memory (EPROM), electrically erasable programmable read only memory (EEPROM), read-only memory Body (ROM), one-time programmable memory (OTP) and other memory technologies. In one embodiment, memory device 116 may be a flash memory card that uses flash memory. Examples include a variety of flash memory card of the following trademarks marked products, such as Secure Digital ^TM (San Ramon, Calif compatible with the SD Card Association advocated specifications), MultiMediaCard ^TM (compatible with MultiMediaCard Association of Palo Alto, California ( "MMCA") specifications, MiniSD ^TM (manufactured by SanDisk, Inc.), MicroSD ^TM (manufactured by SanDisk, Inc.), CompactFlash ^TM (compatible with CompactFlash Association of Palo Alto, California ("CFA") Proposed specifications), SmartMedia ^TM (compatible with the specifications of the Yokohama Solid State Disk Card ("SSFDC") Forum, xD-Picture Card ^TM (compatible with the xD-Picture Card Licensing Office in Tokyo, Japan) Specification), Memory Stick ^TM (compatible with Yokohama's solid state floppy disk card (the specification of the "SSFDC" forum), TransFlash ^TM (manufactured by SanDisk, Inc.) and other flash memory cards. In one example, the memory device 116 can be implemented as a non-removable memory device.

The following patent documents contain specific examples that can be used with the specific embodiments described herein. The patent documents of these patent documents are filed on the same day as the present application, assigned to the assignee of the present application, and hereby incorporated herein by reference: 11/599,655; "Device for Linking Content and Authorization", U.S. Patent Application Serial No. 11/600,270; "Using a Device for Accessing Content Based on Session Warrants", U.S. Patent Application Serial No. 11/600,273; "Method of combining content to a separate memory device", U.S. Patent Application Serial No. 11/600,262; "A device for combining content to a separate memory device", U.S. Patent Application Serial No. 11/600,245; Method for accessing pre-viewed content", U.S. Patent Application Serial No. 11/599,994; "System for Allowing Multiple Users to Access Pre-Viewed Content", U.S. Patent Application Serial No. 11/599,995; Method for accessing content protected by a first DRM system by a second DRM system", US Patent Application Serial No. 11/600,005; "System for Allowing a Second DRM System to Access Content Protected by a First DRM System", US Patent Application Serial No. 11/599,991; "Method for Connecting to a Network Location Associated with Content", U.S. Patent Application Serial No. 11/600,300; and "System for Connecting to a Network Location Associated with Content" , US patent application No. 11 / 600,006.

Although the foregoing specific embodiments have been described in some detail for the purposes of clarity, the particular embodiments are not limited to the details. There are many alternative ways of implementing such specific embodiments. Accordingly, the invention is to be construed as illustrative and not restrictive, and Things. Within the scope of the patent application, the components and/or operations do not imply any particular order of operation unless the scope of the patent application is otherwise expressly stated.

102‧‧‧System

104‧‧‧Application

108‧‧‧Mechanical interface

114‧‧‧Master computing device

116‧‧‧ memory devices

118‧‧‧Content

202‧‧‧ first parameter

204‧‧‧Authorization

206‧‧‧ second parameter

210‧‧‧ third parameter

302‧‧‧System

304‧‧‧First Content Protection Platform

306‧‧‧Second Content Protection Platform

502‧‧‧ parameters

504‧‧‧variables

506‧‧‧session warrants

602‧‧‧ system

604‧‧‧variables

802‧‧‧Security Management Program

804‧‧‧Master Password Compilation Engine

806‧‧‧Digital Rights Management (DRM) Module

808‧‧‧File System Management Program

810‧‧‧Device Driver

902‧‧‧DRM module

904‧‧‧ Password Compilation Engine

906‧‧‧Safe storage

1002‧‧‧ busbar

1004‧‧‧ processor

1006‧‧‧System Memory

1008‧‧‧Storage device

1012‧‧‧Communication interface

1014‧‧‧ display

1016‧‧‧Input/Output Devices

1018‧‧‧ cursor control

1020‧‧‧Communication link

1102‧‧‧ memory controller

1104‧‧‧ memory

The invention will be readily understood by the following detailed description, and the <

BRIEF DESCRIPTION OF THE DRAWINGS Figure 1 is a simplified block diagram of one of the device systems in accordance with one embodiment of the present invention.

2 is a block diagram depicting the generation of parameters for decrypting content in accordance with an embodiment of the present invention.

3 is a simplified block diagram of a system for accessing a memory device in accordance with one embodiment of the present invention.

4 is a flow diagram depicting accessing content from a memory device in accordance with an embodiment of the present invention.

Figure 5 is a block diagram depicting the generation of a session ticket in accordance with an embodiment of the present invention.

6 is a simplified block diagram of a system for accessing a memory device using a session ticket in accordance with one embodiment of the present invention.

7 is a flow diagram depicting accessing content from a memory device based on a session ticket in accordance with an embodiment of the present invention.

8 is a simplified block diagram of a program application for accessing content on a host computing device in accordance with an embodiment of the present invention.

9 is a simplified block diagram of a program application that can be included in a memory device in accordance with an embodiment of the present invention.

10 is a simplified block diagram of a general overview of a host computing device suitable for hosting a content protection platform and other programming applications in accordance with an embodiment of the present invention.

Figure 11 is a diagram of one of the memory devices in accordance with an embodiment of the present invention. Simplify the block diagram.

102‧‧‧System

104‧‧‧Application

108‧‧‧Mechanical interface

114‧‧‧Master computing device

116‧‧‧ memory devices

118‧‧‧Content

Claims (14)

A method for accessing content stored on a memory device, the method comprising: generating a session ticket by encrypting a parameter associated with a cryptographic key using a variable (session ticket), wherein the variable has a value associated with a session and varies at different sessions; providing the session ticket to a host computing device; receiving the session ticket from the host computing device and Requesting access to one of the content; attempting to extract the parameter associated with the cryptographic key from the session ticket by decrypting the session ticket with the variable, wherein the variable is unchanged if the session is unchanged The value does not change, and the parameter associated with the cryptographic key is extracted from the session ticket; and if the parameter associated with the cryptographic key is extracted from the session ticket: based on the The parameter obtains the cryptographic key, decrypts the content with the cryptographic key, and transmits the content to the host computing device. The method of claim 1, wherein the parameter is a cryptographically compiled temporary value, the cryptographically compiled temporary value being used to generate a cryptographic key. The method of claim 1, wherein the variable is a number. The method of claim 3, wherein the number is configured to vary randomly. The method of claim 1, wherein the session spans a period of time. The method of claim 1, wherein the session is terminated when the primary computing device is restarted. The method of claim 1, wherein the session is turned off when the memory device is decoupled from the host computing device. A memory device comprising: a memory; and a controller in communication with the memory, wherein the controller is configured to: by using a variable to encrypt a parameter associated with a cryptographic key Generating a session ticket, wherein the variable has a value associated with a session and varies at different sessions; providing the session ticket to a host computing device; receiving the session ticket from the host computing device and accessing the content One of the requests; attempting to extract the parameter associated with the cryptographic key from the session ticket by decrypting the session ticket with the variable, wherein if the session has not changed, the value of the variable does not change and is associated The parameter for the cryptographic key is extracted from the session ticket; and if the parameter associated with the cryptographic key is extracted from the session ticket: the cryptographic key is obtained based on the parameter, The cryptographically compiled key is used to decrypt the content and the content is transferred to the host computing device. A memory device as claimed in claim 8, wherein the parameter is a cryptographic nonce, the cryptographically compiled temporary value being used to generate a cryptographic key. A memory device as claimed in claim 8, wherein the variable is a number. The memory device of claim 10, wherein the number is configured to vary randomly. A memory device as claimed in item 8, wherein the session spans a period of time. The memory device of claim 8, wherein the session is turned off when the primary computing device is restarted. A memory device as claimed in claim 8, wherein the session is turned off when the memory device is decoupled from the host computing device.