ACTIVATION AND MONETIZATION OF FEATURES BUILT INTO STORAGE SUBSYSTEMS USING A TRUSTED CONNECT SERVICE BACK END INFRASTRUCTURE

• US 20130291070A1
• Filed: 12/22/2011
• Published: 10/31/2013
• Est. Priority Date: 12/22/2011
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Triantafillou, Nicholas D., Bradfield, Terry Ryun, Saxena, Paritosh, Thadikaran, Paul J., Novick, David Owen
• Granted Patent: US 9,270,657 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/12 Protecting executable software
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management data processing systems or methods, specially adapted for commerce, e.g. marketing, shopping, billing, auctions or e-commerce G06Q30/00
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

Embodiments of systems, apparatuses, and methods to enable a value-added storage service of a storage system coupled to a client are described. In some embodiments, a system establishes a secure root of trust for the client. In addition, the system establishes a secure tunnel between an application of the client and a storage system of the client. Furthermore, the system securely downloads a license for the value-added storage service to the storage system and provides the license from the storage system to an application via the secure tunnel.

Claims

1. A method to enable a value-added storage service of a storage system coupled to a client, comprising:

establishing a secure root of trust for the client;

establishing a secure tunnel between an application of the client and a storage system of the client;

securely downloading a license for the value-added storage service to the storage system; and

securely providing the license from the storage system to an application via the secure tunnel.

2. The method of claim 1, wherein the storage system includes secure storage that is used to store the license.

3. The method of claim 2, wherein the secure storage is not accessible to an operating system of the client.

4. The method of claim 2, wherein the license stored in the secure storage is accessible via a private interface.

5. The method of claim 1, wherein establishing of the secure root of trust comprises:

provisioning a public key into the storage system.

6. The method of claim 1, wherein the securely downloading the digital rights managed content comprises:

authenticating with a service that manages the license.

7. The method of claim 1, wherein the securely downloading the digital rights managed content comprises:

receiving the license; and

storing the license in the storage system.

8. The method of claim 1, wherein the tunnel uses an action and results mailbox.

9. A device to enable a value-added storage service of a storage system coupled to a device, comprising:

a storage system, including,

an agent to establish a secure root of trust for the device;

a secure storage to establish a secure tunnel with a service provider, to securely download a license for the value-added storage service from the service provider, and to securely provide the license from the storage system to an application via the secure tunnel.

10. The device of claim 9, wherein the secure storage is not accessible to an operating system of the device.

11. The device of claim 9, wherein the license stored in the secure storage is accessible via a private interface.

12. The device of claim 9, wherein the agent is further configured to authenticate with service provider.

13. The device of claim 12, wherein the agent, to securely download the digital rights managed content, is configure to receive the license and to store the license in the storage system.

14. The device of claim 9, wherein the secure tunnel uses an action and results mailbox.

15. A system to enable a value-added storage service of a storage system coupled to a device, comprising:

a service provider that manages and stores a license for the value-added storage service; and

a storage system, including,

an agent that establishes a secure root of trust for the device with the service provider, and

a secure storage that establishes a secure tunnel with the service provider, securely downloads the license for the value-added storage service from the service provider, and securely provides the license from the storage system to an application via the secure tunnel.

16. The device of claim 15, wherein the secure storage is not accessible to an operating system of the device.

17. The device of claim 15, wherein the license stored in the secure storage is accessible via a private interface.

18. The system of claim 15, wherein the service provider provisions a public key for the agent.

19. The system of claim 15, wherein the agent further authenticates with service provider.

20. The system of claim 15, wherein the secure tunnel uses an action and results mailbox.

21. A non-transitory machine-readable medium having executable instructions to cause one or more processing units to perform a method to enable a value-added storage service of a storage system coupled to a client, the method comprising:

establishing a secure root of trust for the client;

establishing a secure tunnel between an application of the client and a storage system of the client;

securely downloading a license for the value-added storage service to the storage system; and

securely providing the license from the storage system to an application via the secure tunnel.