Data recording device, and method of processing data recording device

• US 9,319,389 B2
• Filed: 06/02/2014
• Issued: 04/19/2016
• Est. Priority Date: 04/28/2011
• Status: Active Grant

• Current Assignee: Kioxia Corporation
• Original Assignee: Kabushiki Kaisha Toshiba (Toshiba Corporation)
• Inventors: Kato, Taku, Nagai, Yuji, Matsushita, Tatsuyuki
• Primary Examiner(s): Mehedi, Morshed
• Application Number:
  US14/293,428
• Publication Number:
  US 20140281551A1
• Time in Patent Office: 687 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/73 by creating or determining hardware identification, e.g. serial numbers
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A controller is provided with a controller key and a first controller identification information unique to the controller. The controller generates a controller unique key unique to a respective controller based on the controller key and the first controller identification information, and a second controller identification information based on the first controller identification information. A decryptor decrypts the encrypted medium device key using the controller unique key to obtain a medium device key. An authentication/key exchange process unit performs authentication/key exchange process with the host device through an interface unit using the medium device key, the medium device key certificate and the second controller identification information to establish a secure channel.

Claims

1. A host storing host key information, the host comprising:

processing circuitry configured to perform a key exchange/authentication process with a medium by

generating a first random number, and sending, to a medium, the first random number and host certification information;

receiving, from the medium, a second random number, medium certification information, a first value, and unique ID information, the first value being calculated using a base point of an elliptic curve and a third random number, the unique ID information being generated by executing a one-way function calculation based on controller key information and controller identification information stored in the medium, the unique ID information being used in a signature process using medium key information;

generating a fourth random number, and calculating a second value using the fourth random number and the base point of the elliptic curve; and

generating shared key information based on the first value and the fourth random number to complete the key exchange/authentication process and establish a secure channel, the shared key information being shared between the host and the medium.

2. The host of claim 1, wherein the processing circuitry is further configured to receive, using the secure channel, data necessary for decryption of encrypted content data stored on the medium.