Content Control System Using Certificate Revocation Lists

• US 20080010452A1
• Filed: 11/06/2006
• Published: 01/10/2008
• Est. Priority Date: 07/07/2006
• Status: Abandoned Application

• Current Assignee: SanDisk Technologies LLC (Western Digital Corporation)
• Original Assignee: SanDisk Technologies LLC (Western Digital Corporation)
• Inventors: Sela, Rotem, Holtzman, Michael, Jogand-Coulomb, Fabrice, Barzilai, Ron
• Application Number:
  US11/557,026
• Publication Number:
  US 20080010452A1
• Time in Patent Office: Days
• US Class Current: 713/158
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3273 for mutual authentication network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869

Abstract

Host devices present both the host certificate and the pertinent certificate revocation lists to the memory device for authentication so that the memory device need not obtain the list on its own. Processing of the certificate revocation list and searching for the certificate identification may be performed concurrently by the memory device. The certificate revocation lists for authenticating host devices to memory devices may be stored in an unsecured area of the memory device for convenience of users.

Claims

1. A memory system configured to be removably connected to a host, comprising:

a non-volatile memory storing at least one certificate revocation list, said non-volatile memory capable of storing data; and

a controller controlling access by the host to said data through an authentication process, in which the host presents at least one certificate to the memory system, and said controller checks whether the at least one certificate presented by the host is on the at least one certificate revocation list, and fails the authentication process when the at least one certificate presented by the host is on the at least one certificate revocation list.

2. The memory system of claim 1, said non-volatile memory including an unprotected area available for access to the host without being authenticated through the authentication process, wherein said at least one certificate revocation list is stored in said unprotected area.

3. A non-volatile memory device removably connected to a host that sends sequentially portions of a certificate revocation list to the memory device for verification of a certificate, said memory device comprising a controller that verifies the certificate revocation list, processes said portions of the certificate revocation list sequentially, and searches for an identification of a certificate on said list, wherein said processing and searching are performed concurrently.

4. The device of claim 3, wherein said controller performs said processing on the fly as the portions of the list are received from the host.

5. The device of claim 3, wherein said controller discards portions of the certificate revocation list after the portions have been processed.

6. The device of claim 3, wherein said controller processes the portions of the list as they are received by hashing the portions to obtain a hashed certificate revocation list.

7. The device of claim 6, wherein portions of an encrypted hashed certificate revocation list are received at the device, and said controller processes portions of an encrypted hashed certificate revocation list by decrypting the encrypted hashed portions to obtain a decrypted and hashed certificate revocation list, and compares the hashed certificate revocation list with the decrypted and hashed certificate revocation list.

8. The device of claim 3, wherein said portions include serial numbers of revoked certificates on the list.