System and method for access control for portable data storage media

• US 5,677,953 A
• Filed: 06/07/1995
• Issued: 10/14/1997
• Est. Priority Date: 09/14/1993
• Status: Expired due to Term

• Current Assignee: 3Com Corporation (HP Inc.), SPEX Technologies, Inc.
• Original Assignee: Spyrus, Inc.
• Inventors: Dolphin, Janet L.
• Primary Examiner(s): Cain, David C.
• Application Number:
  US08/485,817
• Time in Patent Office: 860 Days
• Field of Search: 380/4, 380/23, 380/25, 380/3
• US Class Current: 705/51
• CPC Class Codes: G06F 21/105 Arrangements for software license management or administration, e.g. for managing licenses at corporate level
• CPC Class Codes: G06F 21/109 by using specially-adapted hardware at the client
• CPC Class Codes: G06F 2211/007 Encryption, En-/decode, En-/decipher, En-/decypher, Scramble, (De-)compress
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 2221/2135 Metering
• CPC Class Codes: G06Q 30/04 Billing or invoicing
• CPC Class Codes: Y04S 40/20 Information technology specific aspects, e.g. CAD, simulation, modelling, system security

Abstract

The system and method of the present invention provides the support of high density removable media, such as CD-ROM or MO, to be used as a distributed media for storing data where access thereto is securely restricted. Through this system and method, the secure periodic distribution of several different sets of data information to the end user is achieved with access control selectively performed by at the user'"'"'s site through communication with the billing/access center. User billing is based on the purchase of the decryption access codes as indicated by the access code attributes encoded on the media. Access code availability is further controlled by selectively providing for updates of decryption access codes.

Claims

1. A system for accessing data by a user, comprising:

a processor for processing said data;

a data storage unit for storing said data in a manner requiring different access code for accessing correspondingly different data stored on said storage unit by the user;

a controller in communication with said processor for receiving a signal representative of one of said different access codes from a remote location and for sending a signal which enables access by said processor means to a selected portion of said data on said storage unit using one of said access codes;

a remote authorization unit located at a location remote from said processor and said controller, said remote authorization unit for transmitting an access code to said controller from said remote location in response to an authorization request signal sent by the user to said remote authorization unit; and

wherein said data storage unit stores update means cooperative with said transmitted access code for automatically generating updated access codes for access to previously unaccessible parts of said data storage unit when electronic update counter conditions are met.

2. A system as recited in claim 1 wherein said updated access codes are generated by said controller.

3. A system as recited in claim 1 wherein each of said access codes is correlated with an identifying code and wherein said authorization request includes said identifying code.

4. A system as recited in claim 3 wherein said identifying code is representative of an attribute.

5. A system as recited in claim 4 wherein said attribute is representative of a use of said data.

6. A system as recited in claim 1 wherein said controller is a hardware configuration.

7. A system as recited in claim 1 wherein said controller is a software configuration.

8. A system as recited in claim 1 wherein said data stored on said data storage unit includes identifying codes for identifying said data.

9. A system as recited in claim 8 wherein said identifying codes are codes are associated with attributes.

10. A system as recited in claim 9 wherein said attribute is representative of use of said data.

11. A system as recited in claim 8 wherein said authorization request includes one of said identifying codes.

12. A method for distributing data to a user comprising the steps of:

on a storage unit, providing encrypted data, such requiring an access code to decrypt said data to provide access thereto wherein a least a portion of said encrypted data is correlated with a corresponding access code identifier for identifying access codes;

at a remote location, storing a plurality of access codes together with corresponding access code identifiers;

at a remote location, generating an authorization signal when particular conditions are met, wherein said authorization signal causes one of said access codes to be transmitted to said user to enable said user to access a portion of said encrypted data by decrypting a portion of said encrypted data and wherein said access conditions include the receipt of one of said access code identifiers from said user;

applying said access code to said encrypted data to decrypt a portion of said encrypted data; and

processing said decrypted portion of said encrypted data.

13. A method as recited in claim 12 wherein on said data storage unit, update means are stored, such cooperative with said one transmitted access code for generating updated access codes for access to previously unaccessible parts of said data on said data storage unit.

14. A method as recited in claim 13 wherein said updated access codes are generated by a controller.

15. A method as recited in claim 12 wherein said authorization signal is generated in response to an authorization request by said user, such including said access code identifier.

16. A method as recited in claim 12 wherein said access code identifier is representative of an attribute.

17. A method as recited in claim 16 wherein said attribute is representative of use of said data.

18. A method as recited in claim 12 wherein said applying step is carried out by hardware configuration.

19. A method as recited in claim 12 wherein said applying step is carried out by software configuration.

20. A method as recited in claim 12 wherein said data stored on said data storage unit include identifying codes-associated with different portions of said data.

21. A method as recited in claim 20 wherein said identifying codes are correlated with attributes.

22. A method as recited in claim 21 wherein said attributes are representative of use of said data.

23. A method of distributing information in the form of data sets and providing access thereto, comprising the steps of.

encrypting said data sets so that different access codes are required to decrypt different portions of said data sets;

correlating said data sets with access code identifiers which identify particular access codes which will decrypt said data sets;

writing said data sets on a data storage unit;

providing a data storage controller which is capable of applying said access codes to said data storage means;

remotely providing a data access controller with one of said different access codes to decrypt a selected one of said encrypted data sets in response to the receipt of one of said access code identifiers;

said data access controller accessing said data sets written onto said data storage means; and

wherein said access codes are further stored with attributes defined in a manner which corresponds to particular properties of said data sets, both of which are transmitted to said data access controller in response to the receipt of one of said access code identifiers.

24. A method as recited in claim 23 wherein said data storage unit stores update means cooperative with said access codes for generating updated access codes for access to previously unaccessible parts of said data on said data storage unit.

25. A method as recited in claim 24 wherein said updated access codes are generated by said controller.

26. A method as recited in claim 23 wherein said attributes are representative of use of said data.

27. A system for encrypting data, comprising:

a memory medium including programming codes stored thereon for encrypting individual data sets and for assigning access code identifiers to said individual data sets, each of said access code identifiers associated with and used in identifying a particular access code for decrypting one of said individual data sets, said access code identifier for identifying said particular access code;

a processor in communication with said memory medium for writing said encrypted individual data sets to a data storage unit so that at least some of said individual data sets are stored in conjunction with access code identifiers on said data storage unit; and

a remote access code distribution controller for transferring a particular one of said access codes for use with a particular one of said portable data storage means on receipt of one of said access code identifiers from a second location.

28. A system as recited in claim 27 wherein said data storage unit stores update means which are cooperative with said access codes for generating updated access codes for access to previously unaccessible parts of said data on said data storage unit.

29. A system as recited in claim 27 wherein said access code is further associated with an attribute.

30. A system as recited in claim 29 wherein said attribute is representative of use of said data set.

31. A method for encrypting data sets to control access thereto, comprising the steps of:

defining attributes in a manner which corresponds to particular properties of said data sets;

binding said attributes to access codes and storing them in a first location;

encoding said data sets so they may be decrypted by said access codes when said access codes signal are applied to said data sets by a processor;

storing said encoded data sets on a data storage unit;

transmitting to a second location from said first location one of said access codes bound to one of said attributes.

32. A method as recited in claim 31 wherein said attributes are representative of a use of said data.

33. A method as recited in claim 31 wherein said access codes are correlated with identifying codes.

34. A method as recited in claim 31 wherein access to said encoded data sets of said data storage unit is provided by a remote authorization center and further comprises the step of:

providing a controller for communication with said data storage unit and wherein, upon transmitting one of said identifying codes to said remote authorization center, one of said access codes is downloaded to said controller wherein said controller provides access to said data sets stored on said data storage unit.

35. A method as recited in claim 34 wherein said controller is provided in a hardware configuration.

36. A method as recited in claim 34 wherein said controller is provided in a software configuration.

37. A method as recited in claim 34 wherein said data storage unit stores thereon means cooperative with access codes for generating updated access codes for access to previously unaccessible parts of said data stored on said data storage unit.

38. A data retrieval system-for use by a user comprising:

a data storage unit including data stored thereon including portions selected by said user, said selected portions on said data storage unit being accessible by a set of access codes, wherein one of said set of access codes is transmitted by a remote central processing unit to a user at a different location, such transmitted to said user to provide access to said selected portions of said data stored on said data storage unit; and

wherein said data storage unit includes update means cooperative with said transmitted access codes for automatically generating updated access codes for access to previously unaccessible parts of said selected portions of said data on said data storage unit when electronic update counter conditions are met.

39. A system as recited in claim 38 wherein each of said access codes is correlated with an identifying code and wherein said authorization request includes said identifying code.

40. A system as recited in claim 39 wherein said identifying code is representative of an attribute.

41. A system as recited in claim 40 wherein said attribute is representative of a use of said data.

42. A system as recited in claim 38 wherein said data stored on said data storage unit includes identifying codes for identifying said data.

43. A system as recited in claim 42 wherein said identifying codes are codes are associated with attributes.

44. A system as recited in claim 43 wherein said attribute is representative of use of said data.

45. A system for providing authentication of electronic transmissions, comprising:

an authorization center for transmitting access codes to different locations upon receipt of authenticated requests for said access codes, wherein one of said access codes is electronically transmitted to a different location when said authenticated request meets particular electronic signature conditions; and

a controller at said different location for receiving said access codes from said authorization Center, said controller capable of verifying that said access code was transmitted from said remote authorization center.

46. A system as recited in claim 45 wherein said access codes provide for the decryption of encrypted data stored on a data storage unit.

47. A system as recited in claim 46 wherein on said data storage unit, update means are stored, such being cooperative with said one transmitted access code for generating updated access codes for access to previously unaccessible parts of said data on said data storage unit.

48. A system as recited in claim 45 wherein said access codes are correlated with an identifying code and wherein said authenticated request includes said identifying code.

49. A system as recited in claim 48 wherein said identifying code is representative of an attribute.

50. A system as recited in claim 49 wherein said attribute is representative of a use of said data.

51. A system as recited in claim 45 wherein said controller is a hardware configuration.

52. A system as recited in claim 45 wherein said controller is a software configuration.

53. A system as recited in claim 46 wherein said data stored on said data storage unit includes identifying codes for identifying said data.

54. A system as recited in claim 53 wherein said identifying codes are codes are associated with attributes.

55. A system as recited in claim 54 wherein said attribute is representative of use of said data.

56. A method for providing authentication of electronic transmissions, comprising the steps of:

providing an authorization center for transmitting access codes to different locations upon receipt of authenticated requests for said access codes, wherein one of said access codes is electronically transmitted to a different location when said authenticated request meets particular electronic signature conditions; and

providing a controller at said different location for receiving said access codes from said authorization center, said controller capable of verifying that said access code was transmitted from said remote authorization center.

57. A method as recited in claim 56 wherein said access codes provide for the decryption of encrypted data stored on a data storage unit.

58. A method as recited in claim 57 wherein on said data storage unit, update means are stored, such being cooperative with said one transmitted access code for generating updated access codes for access to previously unaccessible parts of said data on said data storage unit.

59. A method as recited in claim 56 wherein said access codes are correlated with an identifying code and wherein said authenticated request includes said identifying code.

60. A method as recited in claim 59 wherein said identifying code is representative of an attribute.

61. A method as recited in claim 60 wherein said attribute is representative of a use of said data.

62. A method as recited in claim 56 wherein said controller is a hardware configuration.

63. A method as recited in claim 56 wherein said controller is a software configuration.

64. A method as recited in claim 56 wherein said data stored on said data storage unit includes identifying codes for identifying said data.

65. A method as recited in claim 64 wherein said identifying codes are codes are associated with attributes.

66. A method as recited in claim 66 wherein said attribute is representative of use of said data.