Portable authorization device for authorizing use of protected information and associated method

• US 7,032,240 B1
• Filed: 02/14/2000
• Issued: 04/18/2006
• Est. Priority Date: 12/07/1999
• Status: Expired due to Term

• Current Assignee: Pace Anti-Piracy, Inc.
• Original Assignee: Pace Anti-Piracy, Inc.
• Inventors: Fontana, Joseph M., Cronce, Paul Allen
• Primary Examiner(s): Morse, Gregory
• Assistant Examiner(s): Ho, Thomas
• Application Number:
  US09/503,778
• Time in Patent Office: 2,255 Days
• Field of Search: 713/200, 713/189, 713/193, 726/2, 726/27, 705/51
• US Class Current: 726/2
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 9/0838 Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these network architectures or network communication protocols for key exchange in a packet data network H04L63/061
• CPC Class Codes: H04L 9/16 the keys or algorithms being changed during operation
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

An authorization system and associated method for selectively authorizing a host system to use one or more items of protected information associated with the host system. The authorization system includes a portable authorization device that is removably couplable to the host system. The portable authorization device is capable of receiving and storing multiple items of authorization information associated with a plurality of respective items of protected information from one or more information authorities. Preferably, the portable authorization device is capable of communicating with multiple types of information authorities. The portable authorization device selectively authorizes the host system to use the one or more respective items of protected information based upon the respective authorization information stored therein.

Claims

1. A method for operating a portable authorization device for selectively authorizing a host system to use one or more items of protected information, including software, comprising:

coupling the portable authorization device to the host system;

receiving a first item of authorization information from a first type of information authority, the first item of authorization information being associated with a first one of the items of protected information and provided by a vendor of the first one of the items of protected information;

receiving a second item of authorization information from a second type of information authority, the second item of authorization information being associated with a second one of the items of protected information and provided by a vendor of the second one of the items of protected information; and

selectively authorizing the host system to use the one or more items of protected information based upon the first or second items of authorization information being stored therein.

2. A portable authorization device for selectively authorizing a host system to use one or more items of protected information, including software, comprising:

a processing unit;

a storage medium operatively coupled to the processing unit;

a first interface operative in conjunction with the processing unit and the storage medium for receiving a first item of authorization information from a first type of information authority the first item of authorization information being associated with a first one of the items of protected information and provided by a vendor of the first one of the items of protected information;

a second interface operative in conjunction with the processing unit and the storage medium for receiving a second item of authorization information from a second type of information authority the second item of authorization information being associated with a second one of the items of protected information and provided by a vendor of the second one of the items of protected information; and

a third interface operative in conjunction with the processing unit and the storage medium for communicating with the host system to selectively authorize the host system to use the one or more items of protected information based upon the first or second items of authorization information being stored therein;

wherein the portable authorization device is removably couplable to the host system through the third interface.

3. The portable authorization device of claim 2, wherein:

the first interface comprises a direct information authority interface program;

the first type of information authority comprises a direct information authority operatively coupled directly to the portable authorization device;

the second and third interfaces each comprise a same host system interface program; and

the second type of information authority comprises an indirect information authority operatively coupled to the portable authorization device through the host system.

4. The portable authorization device of claim 3, wherein the indirect information authority comprises a computer system coupled to the host system via a network.

5. The portable authorization device of claim 3, wherein the indirect information authority comprises data stored on a magnetic storage medium.

6. The portable authorization device of claim 2, further comprising:

a host authorizer operative in conjunction with the processing unit and the third interface for selectively authorizing the host system to use the one or more items of protected information based upon the first or second items of authorization information.

7. The portable authorization device of claim 6, wherein the host authorizer is a software program operatively stored in the storage unit.

8. The portable authorization device of claim 6, wherein:

the first and second items of authorization information comprise first and second key selectors, respectively; and

the host authorizer in conjunction with the processing unit and the third interface operatively generates a key based upon the first or second key selectors and selectively authorizes the host system to use the one or more items of protected information based upon the key.

9. The portable authorization device of claim 2, wherein the first interface is configured to conduct a challenge-response transaction with the first type of information authority.

10. The portable authorization device of claim 2, wherein the second interface is configured to conduct a challenge-response transaction with the second type of information authority.

11. The portable authorization device of claim 2, wherein the third interface is configured to conduct a challenge-response transaction with the host system.

12. An authorization system for selectively authorizing a host system to use one or more items of protected information, including software, comprising:

an access control mechanism associated with the host system for receiving a first item of authorization information from a first type of information authority operatively coupled to the host system and for forwarding the item of authorization information to the portable authorization device, the first item of authorization information being associated with a first one of the items of protected information and provided by a vendor of the first one of the items of protected information; and

a portable authorization device removably couplable to the host system for receiving the first item of authorization information from the access control mechanism and for selectively authorizing the host system to use the one or more items of protected information based upon the first item of authorization information being stored therein.

13. The authorization system of claim 12, wherein:

the portable authorization device is configured to also receive a second item of authorization information from a second type of information authority operatively coupled to the portable authorization device, the second item of authorization information being associated with a second one of the items of protected information and provided by a vendor of the second one of the items of protected information, and, furthermore, is configured to selectively authorize the host system to use the one or more items of protected information based upon the first or second items of authorization information being stored therein.

14. A portable authorization device for selectively authorizing a host system to use one or more items of protected information, comprising:

a processing unit;

a storage medium operatively coupled to the processing unit;

a first interface operative in conjunction with the processing unit and the storage medium for receiving a key selector from an information authority the key selector being associated with a first one of the items of protected information and provided by a vendor of the first one of the items of protected information;

a host authorizer operative in conjunction with the processing unit and the storage medium for generating a key based upon the key selector; and

a second interface operative in conjunction with the processing unit and the storage medium for communicating with the host system to selectively authorize the host system to use the one or more items of protected information based upon the key;

wherein the portable authorization device is removably couplable to the host system through the second interface.

15. The portable authorization device of claim 14, wherein:

the first interface comprises an information authority interface; and

the second interface comprises a host system interface.

16. A portable authorization device for selectively authorizing a host system to use a plurality of items of protected information, comprising:

a processing unit;

a storage medium operatively coupled to the processing unit for storing one or more items of blended authorization information, each item of blended authorization information being derived from a plurality of items of authorization information;

an unblending mechanism operative in conjunction with the processing unit and the storage medium for regenerating at least one of the plurality of items of authorization information from the one or more items of blended authorization information; and

a host system interface operative in conjunction with the processing unit and the storage medium for communicating with the host system to selectively authorize the host system to use an item of protected information based upon the at least one item of authorization information;

wherein the portable authorization device is removably couplable to the host system through the host system interface.

17. The portable authorization device of claim 16, wherein:

each item of blended authorization information is derived from the two or more items of authorization information by performing an arithmetic operation on the two or more items of authorization information.

18. A method for operating a portable authorization device for selectively authorizing a host system to use one or more items of protected information, comprising the steps of:

coupling the portable authorization device to the host system;

receiving a plurality of items of authorization information;

generating one or more items of blended authorization information from the plurality of items of authorization information;

storing the one or more items of blended authorization information in a storage medium;

retrieving one or more of the items of blended authorization information from the storage medium;

regenerating at least one of the plurality of items of authorization information from the one or more items of blended authorization information; and

selectively authorizing the host system to use an item of protected information based upon the at least one item of authorization information.

19. A portable authorization device for selectively authorizing a host system to use one or more items of protected information, comprising:

a processing unit;

a first storage medium operatively coupled to the processing unit for storing one or more encoded items of authorization information;

a second storage medium operatively coupled to the processing unit for storing decoding information used to decode the one or more encoded items of authorization information, wherein the second storage medium is accessible by the processing unit only if the processing unit receives proper authorization;

a decoding mechanism operative in conjunction with the processing unit and the first and second storage media for decoding at least one of the one or more encoded items of authorization information to produce at least one respective item of authorization information; and

an interface operative in conjunction with the processing unit for communicating with the host system to selectively authorize the host system to use an item of protected information based upon the at least one item of authorization information.

20. A portable security device removably coupled to a computer system for selectively authorizing the computer system to use multiple items of protected information, comprising:

a processing unit;

at least one storage medium coupled to the processing unit;

an interface capable of receiving multiple items of authorization information that are associated with respective ones of the multiple items of protected information, wherein the multiple items of authorization information are stored within the at least one memory; and

an interface program for selectively authorizing the computer system to use one of the items of protected information based upon the corresponding item of authorization information being stored in the memory.

21. The method of claim 20 wherein the multiple items of authorization information comprise key selectors.

22. The method of claim 21 a key is generated within the portable security device based upon the key selectors and selective authorization is given to the computer system to use the multiple items of protected information based upon the key.

23. The method of claim 20 wherein the multiple items of authorization information comprise one or more secret keys.

24. The method for selectively authorizing the use of multiple items of protected information on a computer system using a portable security device that is removably coupled to the computer system, the method comprising the steps of:

(a) providing the portable security device with the capability of receiving multiple items of authorization information that are associated with respective ones of the multiple items of protected information, wherein the multiple items of authorization information are stored within a single memory in the portable security device; and

(b) selectively authorizing the computer system to use one of the items of protected information based upon the corresponding item of authorization information being stored in the memory.

25. The method of claim 24 wherein the multiple items of authorization information comprise key selectors.

26. The method of claim 25 further including the step of:

generating a key within the portable security device based upon the key selectors and selectively authorizing the computer system to use the multiple items of protected information based upon the key.

27. The method of claim 24 wherein the multiple items of authorization information comprise one or more secret keys.

28. A method for selectively authorizing the use of multiple items of protected information on a computer system, the method comprising the steps of:

(a) providing a portable security device with at least one memory containing a shared secret and space for multiple key selectors, one key selector for each item of protected information, and at least one I/O port, whereby the key selectors can be downloaded into the security device, and communications can be established with the computer system;

(b) receiving by the portable security device an authorization request from the computer system to authorize use of a particular one of the items of protected information; and

(c) using the stored key selector corresponding to the particular one of the items and the shared secret to generate authorizing information, wherein the computer system validates the authorizing information and releases the particular one of the items of protected information for use.

29. The method of claim 28 further including the step of providing the key selectors to the portable security device memory using external information authorities within a secure transaction.

30. The method of claim 29 further including the step of receiving a random challenge from the information authority, using the shared secret to encrypt the response, and validating by the information authority the response by decrypting with the shared secret.

31. The method of claim 28 where the shared secret is an encryption key.

32. The method of claim 31 further including the step of transforming the received key selector into an authorizing key using the shared secret key.

33. The method of claim 32 where the authorization request is a randomly generated challenge number.

34. The method of claim 33 where the authorization information is generated by using the challenge and the authorizing key.

35. The method of claim 28 further including the step of encrypting the key selectors before storing in the portable security device memory.

36. The method of claim 35 further including the step of storing the key selectors in a merged pool in memory using a blending algorithm, whereby an individual key selector cannot be extracted from a specific location in memory.

37. The method of claim 28 further including the step of receiving the multiple items of information from multiple information authorities.