Information storage device, memory access control method, and computer program

• US 20040243779A1
• Filed: 06/28/2004
• Published: 12/02/2004
• Est. Priority Date: 06/25/2002
• Status: Active Grant

• Current Assignee: Sony Corporation (Sony Group Corp.)
• Original Assignee: Sony Corporation (Sony Group Corp.)
• Inventors: Nakanishi, Kenichi, Okaue, Takumi, Okubo, Hideaki, Tashiro, Jun
• Granted Patent: US 7,962,713 B2
• Time in Patent Office: Days
• US Class Current: 711/166
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself

Abstract

A device and method is provided for maintaining, upon unlocking of a memory, the lock status of the memory prior to the memory being unlocked and recreating the lock status when power is turned on again. An information storage device, such as a memory card, performs unlocking of a memory in response to a command input from an information processing apparatus and stores lock status data prior to the memory being unlocked in a non-volatile memory (NVM). When the information storage device is turned off and then on, the information storage device recreates a lock status of the memory on the basis of the lock status data stored in the storage means and performs memory access control based on the recreated lock status.

Claims

1. An information storage device comprising a memory for storing data and a controller for performing access control on the memory, wherein

the controller performs unlocking of the memory in response to a command input from an information processing apparatus, and

the controller stores lock status data prior to the memory being unlocked in storage means and, when the information storage device is turned off and then on, the controller recreates a lock status of the memory on the basis of the lock status data stored in the storage means and performs memory access control based on the recreated lock status.

2. The information storage device according to claim 1, wherein the information storage device stores lock status information serving as the lock status data of the information storage device in the storage means, and

the controller stores the lock status information in a non-volatile memory (NVM) serving as first storage means for maintaining information stored therein even after the information storage device is turned off.

3. The information storage device according to claim 2, wherein the controller copies and stores the lock status information stored in the non-volatile memory (NVM) into a memory in the controller, the memory serving as second storage means, after the information storage device is turned on again, and performs access control based on the copied and stored information.

4. The information storage device according to claim 1, wherein the information storage device stores lock status information serving as the lock status data of the information storage device in the storage means,

the lock status information includes determination information based on which it is determined whether

the information storage device is export-locked (EL) in which output of a key set applicable to locking or unlocking is permitted, or

the information storage device is standard-locked (SL) in which output of a key set applicable to locking or unlocking is prohibited, and

the controller performs memory access control based on the determination information.

5. The information storage device according to claim 1, wherein the controller performs processing in response to an unlock request from the information processing apparatus on the basis of the lock status recreated when the information storage device is turned on again, and

the controller performs verification of a key set including an identifier (ID) of the information processing apparatus having output the unlock request and, provided that the verification succeeds, performs unlocking based on the unlock request.

6. The information storage device according to claim 5, wherein the key set is a key set [ID, LK] consisting of the ID held by the information processing apparatus and a lock key (LK) associated with the ID,

the information storage device has a lock master key (LMK) that is applicable to compute the lock key (LK), which is a hash value based on the relationship LK=H(LMK, ID), the hash value being computed for the ID by applying the lock master key (LMK), and

the controller verifies the key set held by the information processing apparatus, the key set being input from the information processing apparatus, on the basis of the lock key (LK) obtained by computing the hash value by applying the lock master key (LMK).

7. The information storage device according to claim 6, wherein the controller generates a random number and receives, from the information processing apparatus, encrypted data [E(Lk, Rms)] generated by encrypting the random number (Rms) on the basis of the lock key (LK) held by the information processing apparatus, and

the controller performs verification including checking of the received encrypted data against encrypted data [E(Lk, Rms)] computed on the basis of the lock key (LK) obtained by computing the hash value.

8. A memory access control method for an information storage device including a memory for storing data and a controller for performing access control on the memory, the method comprising:

an unlocking performing step of performing unlocking of the memory in response to a command input from an information processing apparatus;

a lock-status-data storing step of storing lock status data prior to the memory being unlocked in storage means; and

a memory access control step of recreating, when the information storage device is turned off and then on, a lock status of the memory on the basis of the lock status data stored in the storage means and performing memory access control based on the recreated lock status.

9. The memory access control method according to claim 8, wherein the lock-status-data storing step includes a step of storing lock status information serving as the lock status data of the information storage device in a non-volatile memory (NVM) serving as first storage means for maintaining information stored therein even after the information storage device is turned off.

10. The memory access control method according to claim 9, further comprising a step of copying and storing the lock status information stored in the non-volatile memory (NVM) into a memory in the controller, the memory serving as second storage means, after the information storage device is turned on again,

wherein the memory access control step is a step of performing access control based on the copied and stored information.

11. The memory access control method according to claim 8, wherein the lock-status-data storing step is a step of storing lock status information serving as the lock status data of the information storage device in the storage means,

the lock status information includes determination information based on which it is determined whether

the information storage device is export-locked (EL) in which output of a key set applicable to locking or unlocking is permitted, or

the information storage device is standard-locked (SL) in which output of a key set applicable to locking or unlocking is prohibited, and

the memory access control step is a step of recreating the lock status of the memory on the basis of the determination information and performing memory access control based on the recreated lock status.

12. The memory access control method according to claim 8, further comprising an unlock-request-associated processing step of performing processing in response to an unlock request from the information processing apparatus on the basis of the lock status recreated when the information storage device is turned on again,

wherein the unlock-request-associated processing step includes:

a verification step of performing verification of a key set including an identifier (ID) of the information processing apparatus having output the unlock request; and

an unlocking step of performing unlocking based on the unlock request provided that the verification succeeds.

13. The memory access control method according to claim 12, wherein the key set is a key set [ID, LK] consisting of the ID held by the information processing apparatus and a lock key (LK) associated with the ID,

the information storage device has a lock master key (LMK) that is applicable to compute the lock key (LK), which is a hash value based on the relationship LK=H(LMK, ID), the hash value being computed for the ID by applying the lock master key (LMK), and

the verification step includes a step of verifying the key set held by the information processing apparatus, the key set being input from the information processing apparatus, on the basis of the lock key (LK) obtained by computing the hash value by applying the lock master key (LMK).

14. The memory access control method according to claim 13, further comprising a step of generating a random number and receiving, from the information processing apparatus, encrypted data [E(Lk, Rms)] generated by encrypting the random number (Rms) on the basis of the lock key (LK) held by the information processing apparatus,

wherein the verification step includes a step of performing verification including checking of the received encrypted data against encrypted data [E(Lk, Rms)] computed on the basis of the lock key (LK) obtained by computing the hash value.

15. A computer program for performing memory access control on an information storage device including a memory for storing data and a controller for performing access control on the memory, the program comprising:

an unlocking performing step of performing unlocking of the memory in response to a command input from an information processing apparatus;

a lock-status-data storing step of storing lock status data prior to the memory being unlocked in storage means; and

a memory access control step of recreating, when the information storage device is turned off and then on, a lock status of the memory on the basis of the lock status data stored in the storage means and performing memory access control based on the recreated lock status.