LICENSABLE FUNCTION FOR SECURING STORED DATA

• US 20170032108A1
• Filed: 07/28/2015
• Published: 02/02/2017
• Est. Priority Date: 07/28/2015
• Status: Active Grant

• Current Assignee: JP Morgan Chase Bank, N.A. (JP Morgan Chase & Co)
• Original Assignee: Secure Content Storage Association, LLC (Western Digital Corporation)
• Inventors: Amaral Cid, Carlos Frederico, Dodd, Matthew Warren, Halpern, Joseph Edward III, Blankenbeckler, David L., Harvey, Ian E., Odgers, Christopher R.
• Granted Patent: US 10,642,962 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/1011 to devices
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 9/06 the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
• CPC Class Codes: H04L 9/0643 Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
• CPC Class Codes: H04L 9/0656 Pseudorandom key sequence combined element-for-element with data sequence, e.g. one-time-pad [OTP] or Vernam's cipher

Abstract

For securing content accessed from storage device, the storage device is associated with a licensee identifier. The licensee identifier is provided as input to an algorithm that generates, based on the identifier, a determinate set of instructions for a computer, for example, source code in a coding language, compiled binary code, or pseudo code that is capable of being translated into source code. The code, once compiled to machine-usable form, can be executed by a processor to perform a permutation operation that is unique to the licensee identifier. The output of the permutation operation can be used for protecting data provided by the storage device.

Claims

1. A computer-implemented method for enabling a secure electronic data using a licensable function, the method comprising:

defining a licensee identifier comprising binary data recorded in a computer memory;

generating a plurality of instructions for implementing a cryptographic permutation function, at least in part by providing the licensee identifier to an instruction-generating algorithm; and

providing at least one of the instructions or an executable function compiled from source code based on the instructions to a licensee identified by the licensee identifier for use in protecting electronic data for one or more devices associated with the licensee identifier.

2. The method of claim 1, wherein generating the plurality of instructions for implementing the cryptographic permutation function is based on a pseudorandom byte string, wherein operation of the cryptographic permutation function when compiled and executed by a processor is uniquely determined by the pseudorandom byte string.

3. The method of claim 2, wherein the cryptographic permutation function comprises “

Addition, cyclic Rotation and eXclusive or”

(ARX) components.

4. The method of claim 3, wherein values controlling the addition, rotation, and “

exclusive or”

ARX components are determined based on the pseudorandom byte string that is, in turn, a pseudorandom function of the licensee identifier.

5. The method of claim 2, further comprising generating, by a string-generating algorithm, the pseudorandom byte string based on the licensee identifier, the pseudorandom byte string being unique to the licensee identifier.

6. The method of claim 5, wherein the string-generating algorithm takes a system key and the licensee identifier as inputs.

7. The method of claim 2, further comprising recording at least one of the licensee identifier, the plurality of instructions, the executable function, or the pseudorandom byte string in an electronic database, in association with identifying information for the licensee.

8. The method of claim 1, wherein the one or more devices associated with the licensee identifier comprise at least one of a storage device or a player device.

9. The method of claim 1, further comprising configuring the licensable function for protecting a cryptographic key.

10. An apparatus for enabling a secure electronic data using a licensable function, comprising:

a processor and a memory coupled to the processor, wherein the memory holds instructions that when executed by the processor, cause the apparatus to perform;

defining a licensee identifier comprising binary data recorded in a computer memory, generating a plurality of instructions for implementing a cryptographic permutation function, at least in part by providing the licensee identifier to an instruction-generating algorithm, and providing at least one of the instructions or an executable function compiled from source code based on the instructions to a licensee identified by the licensee identifier for use in protecting electronic data for one or more devices associated with the licensee identifier.

11. The apparatus of claim 10, wherein the memory holds further instructions for generating the plurality of instructions for implementing the cryptographic permutation function based on a pseudorandom byte string, wherein operation of the cryptographic permutation function when compiled and executed by a processor is uniquely determined by the pseudorandom byte string.

12. The apparatus of claim 11, wherein the memory holds further instructions for implementing the cryptographic permutation function comprising “

Addition, cyclic Rotation and eXclusive or”

(ARX) components.

13. The apparatus of claim 12, wherein the memory holds further instructions for determining values controlling the addition, rotation, and “

exclusive or”

ARX components based on the pseudorandom byte string that is, in turn, a pseudorandom function of the licensee identifier.

14. The apparatus of claim 11, wherein the memory holds further instructions for generating, by a string-generating algorithm, the pseudorandom byte string based on the licensee identifier, the pseudorandom byte string being unique to the licensee identifier.

15. The apparatus of claim 14, wherein the memory holds further instructions for providing a system key and the licensee identifier as inputs to the string-generating algorithm.

16. The apparatus of claim 11, wherein the memory holds further instructions for recording at least one of the licensee identifier, the plurality of instructions, the executable function, or the pseudorandom byte string in an electronic database, in association with identifying information for the licensee.

17. The apparatus of claim 10, wherein the memory holds further instructions for configuring the licensable function for protecting a cryptographic key.

18. A computer-readable medium, encoded with instructions that, when executed by a processor, cause an apparatus to perform:

enabling a secure electronic data using a licensable function to perform defining a licensee identifier comprising binary data recorded in a computer memory, generating a plurality of instructions for implementing a cryptographic permutation function, at least in part by providing the licensee identifier to an instruction-generating algorithm, and providing at least one of the instructions or an executable function compiled from source code based on the instructions to a licensee identified by the licensee identifier for use in protecting electronic data for one or more devices associated with the licensee identifier.

19. An apparatus for enabling a secure electronic data using a licensable function, comprising:

means for defining a licensee identifier comprising binary data recorded in a computer memory;

means for generating a plurality of instructions for implementing a cryptographic permutation function, at least in part by providing the licensee identifier to an instruction-generating algorithm; and

means for providing at least one of the instructions or an executable function compiled from source code based on the instructions to a licensee identified by the licensee identifier for use in protecting electronic data for one or more devices associated with the licensee identifier.

20. A computer-implemented method for protecting content, the method comprising:

storing, by the first node, content that has been protected using a cryptographic key, wherein the cryptographic key is obtainable by a second node at least in part by transforming a first binary data string using a first cryptographic permutation algorithm comprising permutation operations that are defined at least in part by a unique licensee identifier of the second node; and

sending the content that is protected by the cryptographic key to the second node.

21. The method of claim 20, wherein the first cryptographic permutation algorithm comprises “

Addition, cyclic Rotation and eXclusive or”

(ARX) components.

22. The method of claim 21, wherein values controlling the addition, rotation, and “

exclusive or”

ARX components are determined based on a pseudorandom byte string that is a pseudorandom function of the unique licensee identifier.

23. The method of claim 20, further comprising providing an output by the first node to the second node, the output being (1) useable by the second node to obtain the cryptographic key and (2) based at least in part on transforming a second binary data string using a second cryptographic permutation algorithm comprising permutation operations that are defined at least in part by a unique licensee identifier of the first node.

24. The method of claim 23, further comprising storing the cryptographic permutation algorithm in a secure memory, during an initial configuration of the first node by a licensee to whom the unique licensee identifier of the first node is assigned.

25. An apparatus for protecting content, comprising:

a processor and a memory coupled to the processor, wherein the memory holds instructions that when executed by the processor, cause the apparatus to perform storing, by the first node, content that has been protected using a cryptographic key, wherein the cryptographic key is obtainable by a second node at least in part by transforming a first binary data string using a first cryptographic permutation algorithm comprising permutation operations that are defined at least in part by a unique licensee identifier of the second node, and sending the content that is protected by the cryptographic key to the second node.

26. The apparatus of claim 25, wherein the cryptographic permutation algorithm comprises “

Addition, cyclic Rotation and eXclusive or”

(ARX) components.

27. The apparatus of claim 26, wherein values controlling the addition, rotation, and “

exclusive or”

ARX components are determined based on a pseudorandom byte string that is a pseudorandom function of the unique licensee identifier of the first node.

28. The apparatus of claim 25, wherein the memory holds further instructions for providing an output by the first node to the second node, the output being (1) useable by the second node to obtain the cryptographic key and (2) based at least in part on transforming a second binary data string using a second cryptographic permutation algorithm comprising permutation operations that are defined at least in part by a unique licensee identifier of the first node.

29. The apparatus of claim 28, wherein the memory holds further instructions for storing the cryptographic permutation algorithm in a secure memory, during an initial configuration of the first node by a licensee to whom the unique licensee identifier of the first node is assigned.

30. A computer-readable medium, encoded with instructions that, when executed by a processor, cause an apparatus for protecting content to perform storing, by the first node, content that has been protected using a cryptographic key, wherein the cryptographic key is obtainable by a second node at least in part by transforming a first binary data string using a first cryptographic permutation algorithm comprising permutation operations that are defined at least in part by a unique licensee identifier of the second node, and sending the content that is protected by the cryptographic key to the second node.

31. An apparatus for protecting content, comprising:

means for storing, by the first node, content that has been protected using a cryptographic key, wherein the cryptographic key is obtainable by a second node at least in part by transforming a first binary data string using a first cryptographic permutation algorithm comprising permutation operations that are defined at least in part by a unique licensee identifier of the second node, and sending the content that is protected by the cryptographic key to the second node.