Key-based secure storage

• US 7,194,092 B1
• Filed: 01/08/1999
• Issued: 03/20/2007
• Est. Priority Date: 10/26/1998
• Status: Expired due to Fees

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: England, Paul, Lampson, Butler W., DeTreville, John D.
• Primary Examiner(s): Moise; Emmanuel L.
• Assistant Examiner(s): CALLAHAN, PAUL E
• Application Number:
  US09/227,568
• Time in Patent Office: 2,993 Days
• Field of Search: 380/264, 380/282, 380/285, 380/28, 380/30, 380/262, 713/193, 713/171, 705/57, 705/56, 705/51, 726/28, 726/30, 726/32, 726/33
• US Class Current: 380/262
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 9/4406 Loading of operating system
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/166 at the transport layer

Abstract

Secure storage for downloaded content on a subscriber computer is keyed to a trusted digital rights management operating system, a trusted application, a trusted user or a combination thereof. A one-way hash function is applied to a seed supplied by an application to produce a hashed seed that is used to generate the application storage key. A one-way hash function is applied to a seed supplied by a user to produce a first hashed seed that is passed to a keyed hash function, which is keyed to an identity for the user, to produce a second hashed seed. The second hashed seed is used to generate the user storage key. An operating system storage key is generated from an unhashed seed. One of the storage keys is used to encrypt the downloaded content. An access predicate attached to the content when it is downloaded is associated with the storage key to enforce certain limitations on the access of the content.

Claims

1. A computerized method for key-based secure storage comprising:

downloading information and an access predicate that specifies requirements for an application to access the information;

generating a seed value;

producing a hash seed value based on the seed value using a one-way hash function;

generating an application storage key from the hash seed value;

encrypting the information using the application storage key; and

associating the access predicate with the encrypted information.

2. A computerized method for key-based secure storage comprising:

downloading information and an access predicate that specifies requirements for an application to access the information;

generating a seed value;

producing a first hash seed value based on the seed value using a one-way hash function;

producing a second hash seed value based on the seed value and a user identifier using a keyed hash function;

generating a user storage key from the second hash seed value;

encrypting the information using the user storage key; and

associating the access predicate with the encrypted information.

3. A computerized method for key-based secure storage comprising:

downloading information and an access predicate that specifies requirements for an application to access the information;

obtaining a storage key;

encrypting the information using the storage key;

associating the access predicate with the encrypted information;

obtaining an operating system storage key;

encrypting the access predicate with the operating system storage key; and

encrypting a plurality of other storage keys using the operating system storage key, wherein the other storage keys are selected from the group consisting of application storage keys and user storage keys.

4. A computerized method for key-based secure storage comprising:

downloading information and an access predicate that specifies requirements for an application to access the information;

obtaining a storage key;

encrypting the information using the storage key;

associating the access predicate with the encrypted information;

generating a seed value;

generating an operating system storage key based on the seed value; and

encrypting the access predicate with the operating system storage key.

5. A computerized method for key-based secure storage comprising:

downloading information and an access predicate that specifies requirements for an application to access the information;

generating a seed value for the application;

producing an application hash seed value based on the seed value for the application using an application-specific one-way hash function;

generating an application storage key from the application hash seed value;

generating a seed value for a user;

producing a first user hash seed value based on the seed value for the user using a one-way hash function;

producing a second user hash seed value based on the first user hash seed value and a user identifier using a keyed hash function;

generating a user storage key from the second user hash seed value, the application storage key and the user storage key to encrypt information containing a portion specific to an application and a portion specific to the user;

encrypting the information using the application storage key and the user storage key; and

associating the access predicate with the encrypted information.

6. A computer system comprising:

a processing unit;

a system memory coupled to the processing unit through a system bus;

a computer-readable medium coupled to the processing unit through a system bus;

a generate key function executed from the computer-readable medium by the processing unit, wherein the generate key function causes the processing unit to generate an operating system storage key based on an identity for the operating system and based on a seed.

7. A computer system comprising:

a processing unit;

a system memory coupled to the processing unit through a system bus;

a computer-readable medium coupled to the processing unit through a system bus;

a generate key function executed from the computer-readable medium by the processing unit, wherein the generate key function causes the processing unit to generate an operating system storage key based on an identity for the operating system;

an application specific one-way hash function executed from the computer-readable medium by the processing unit, wherein the application specific one-way hash function causes the processing unit to generate an application storage key from a hashed seed; and

a generate application key function executed from the computer-readable tedium by the processing unit, wherein the generate application key function causes the processing unit to generate the hashed seed from an application seed.

8. A computer system comprising:

a processing unit;

a system memory coupled to the processing unit through a system bus;

a computer-readable medium coupled to the processing unit through a system bus;

a generate key function executed from the computer-readable medium by the processing unit, wherein the generate key function causes the processing unit to generate an operating system storage key based on an identity for the operating system;

a key-hash function executed from the computer-readable medium by the processing unit, wherein the key-hash function causes the processing unit to generate a user storage key from a hashed seed and an identity for the user;

a one-way hash function executed from the computer-readable medium by the processing unit, wherein the one-way hash function causes the processing unit to generate the hashed seed from a previously hashed seed; and

a generate user key function executed from the computer-readable medium by the processing unit, wherein the generate user key function causes the processing unit to generate the previously hashed seed from a user seed.

9. A computer system comprising:

a processing unit;

a system memory coupled to the processing unit through a system bus;

a computer-readable medium coupled to the processing unit through a system bus; and

a trusted operating system executed from the computer-readable medium by the processing unit, wherein the trusted operating system causes the processing unit to;

encrypt downloaded information using a storage key based on a seed value,

encrypt an access predicate associated with the downloaded information using an operating system storage key,

encrypt the seed value for the storage key using the operating system storage key, and

associate the encrypted access predicate with the encrypted seed value.

10. The computer system of claim 9, wherein the trusted operating system further causes the processing unit to validate each application requesting access to the downloaded information using the access predicate, and decrypts the seed value for use by a validated application.

11. The computer system of claim 9, wherein the storage key used to encrypt the downloaded information is specific to an application.

12. A computer system comprising:

a processing unit;

a system memory coupled to the processing unit through a system bus;

a computer-readable medium coupled to the processing unit through a system bus; and

a trusted operating system executed from the computer-readable medium by the processing unit, wherein the trusted operating system causes the processing unit to encrypt downloaded information using a storage key based on a seed value, and wherein the storage key used to encrypt the downloaded information is specific to a user.

13. A computer system comprising:

a processing unit;

a system memory coupled to the processing unit through a system bus;

a computer-readable medium coupled to the processing unit through a system bus; and

an authencated operating system configured to execute on the processing unit from the computer-readable medium, the authenticated operating system causing the processing unit to encrypt downloaded information using a storage key based on a seed value;

wherein the authenticated operating system further causes the processing unit to encrypt an access predicate associated with the downloaded information using an operating system storage key, to encrypt the seed value for the storage key using the operating system storage key, and to associate the encrypted access predicate with the encrypted seed value.

14. The computer system of claim 13, wherein the authenticated operating system further causes the processing unit to validate each application requesting access to the downloaded information using the access predicate, and decrypts the seed value for use by a validated application.

15. The computer system of claim 13, wherein the storage key used to encrypt the downloaded information is specific to an application.

16. The computer system of claim 13, wherein the storage key used to encrypt the downloaded information is specific to a user.