Block-level storage device with content security

• US 8,010,790 B2
• Filed: 09/10/2008
• Issued: 08/30/2011
• Est. Priority Date: 10/28/2003
• Status: Active Grant

• Current Assignee: Hanger Solutions, LLC (IP Investments Group LLC)
• Original Assignee: DPHI Incorporated
• Inventors: Hines, Randal C., Blankenbeckler, David L., Lee, Lane W., Gurkowski, Mark J.
• Primary Examiner(s): Abrishamkar; Kaveh
• Application Number:
  US12/207,684
• Publication Number:
  US 20090003608A1
• Time in Patent Office: 1,084 Days
• Field of Search: None
• US Class Current: 713/167
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/80 in storage media based on magnetic or optical technology, e.g. disks with sectors preventing unauthorised reproduction or copying of disc-type recordable media G11B20/00
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: G11B 20/00086 Circuits for prevention of unauthorised reproduction or copying, e.g. piracy indicating unauthorised use of record carriers in general G11B23/28; scrambling for television signal recording H04N5/913; network architectures or network protocols for network security H04L63/00; cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
• CPC Class Codes: G11B 20/00195 using a device identifier associated with the player or recorder, e.g. serial numbers of playback apparatuses or MAC addresses
• CPC Class Codes: G11B 20/0021 involving encryption or decryption of contents recorded on or reproduced from a record carrier
• CPC Class Codes: G11B 20/00224 wherein the key is obtained from a remote server
• CPC Class Codes: G11B 20/00253 wherein the key is stored on the record carrier
• CPC Class Codes: G11B 20/00492 wherein content or user data is encrypted
• CPC Class Codes: G11B 20/00536 wherein encrypted content data is subjected to a further, iterated encryption, e.g. interwoven encryption
• CPC Class Codes: G11B 20/00855 involving a step of exchanging information with a remote server
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates

Abstract

A block-level storage device is provided that implements a digital rights management (DRM) system. In response to receiving a public key from an associated host system, the storage device challenges the host system to prove it has the corresponding private key to establish trust. This trust is established by encrypting a secure session key using the public key. The host system uses its private key to recover the secure session key. The storage device may store content that has been encrypted according to a content key. In addition, the storage device may encrypt the content key using the secure session key.

Claims

1. A block-level storage device, comprising:

a storage medium; and

a storage engine, the storage engine being configured to generate a secure session key and to receive a block of encrypted content and its corresponding encrypted content key from a host system, wherein the content key has been encrypted by the host system using the secure session key, the storage engine being further configured to decrypt the encrypted content key using the secure session key and to encrypt the decrypted content key with a first storage engine encryption key and to write the storage-engine-encrypted content key to the storage medium.

2. The block-level storage device of claim 1, wherein the storage engine is further configured to generate the secure session key in response to verifying the authenticity of a certifying authority'"'"'s digital signature provided by the host system.

3. The block-level storage device of claim 2, wherein the storage engine is further configured to encrypt the secure session key using a public key provided by the host system such that the host system can recover the secure session key only by decrypting the encrypted secure session key using the private key corresponding to the public key.

4. The block-level storage device of claim 3, wherein the storage engine is further configured to re-encrypt the block of encrypted content using at least a second storage engine encryption key.

5. The block-level storage device of claim 4, wherein the second storage engine encryption key comprises a Data Encryption Standard (DES) key.

6. The block-level storage device of claim 5, wherein the DES key comprises a triple DES key.

7. The block-level storage device of claim 1, wherein the storage engine is a hard disc storage engine and wherein the storage media is a hard disc.

8. The block-level storage device of claim 7, wherein the storage media is a removable hard disc.

9. The block-level storage device of claim 3, wherein the public key and the private key are elliptic curve cryptography keys.

10. The block-level storage device of claim 1, wherein the storage engine includes a random number generator for generating the secure session key.

11. A method of writing to a block-level storage device from a host system having a public key and a corresponding private key, comprising:

encrypting a secure session key using the public key;

recovering the secure session key from the encrypted secure session key using the corresponding private key;

encrypting content according to a content key and commanding the block-level storage device to write the encrypted content to host-system-determined block addresses;

encrypting the content key using the secure session key and transmitting the encrypted content key to the block-level storage device;

in the block-level storage device, decrypting the encrypted content key using the secure session key;

in the block-level storage device, encrypting the decrypted content key with a storage device key; and

writing the storage-device-encrypted content key to a host-system-determined block address.

12. The method of claim 11, wherein the content comprises a file system object, the method further comprising:

in the block-level storage device, encrypting the decrypted content key with a storage device key, and

writing the storage-device-encrypted content key to a storage-device-determined block address.

13. A block-level storage device, comprising:

a storage medium; and

a storage engine, the storage engine being configured to respond to block-level non-secure content requests, block-level secure content requests, and block-level security metadata requests from a host system, the storage engine being further configured to, in response to a security metadata request, generate a secure session key and to receive an encrypted content key from the host system, wherein the content key has been encrypted by the host system using the secure session key, the storage engine being further configured to decrypt the encrypted content key using the secure session key and to encrypt the decrypted content key with a first storage engine encryption key and to write the storage-engine-encrypted content key to the storage medium.

14. The block-level storage device of claim 13, wherein the storage engine includes a random number generator for generating the secure session key.

15. The block-level storage device of claim 13, wherein the storage engine is configured to receive a public key from the host system and to encrypt the secure session key with the public key and to send the encrypted secure session key to the host system, whereby the host system may recover the secure session key only through the use of the host system'"'"'s corresponding private key.