METHOD AND APPARATUS OF STORAGE ANTI-PIRACY KEY ENCRYPTION (SAKE) DEVICE TO CONTROL DATA ACCESS FOR NETWORKS

• US 20090319798A1
• Filed: 07/28/2009
• Published: 12/24/2009
• Est. Priority Date: 07/31/2002
• Status: Active Grant

• Current Assignee: Trek 2000 International Limited (Trek Technology Singapore PTE Limited)
• Original Assignee: Trek 2000 International Limited (Trek Technology Singapore PTE Limited)
• Inventors: Tan, Henry, Poo, Teng Pin, Lim, Lay Chuan, Ooi, Chin Shyan Raymond
• Granted Patent: US 8,429,416 B2
• Time in Patent Office: Days
• US Class Current: 713/186
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 21/79 in semiconductor storage media, e.g. directly-addressable memories
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231

Abstract

A method comprises performing an authentication of a user of a portable device, performing an authentication handshake between the portable device and a content server, wherein the portable device includes a USB plug that plugs directly into a USB port of a host computer and the host computer is communicatively coupled to the content server, and sending a first key sent from the portable device to the content server, wherein access to restricted content on the content server by the user is enabled if the user authentication, the authentication handshake, and an authentication using the first key are all successful. The process may also include encrypting restricted content received from the content server using a private key before storing the restricted content in a non-volatile memory of the portable device.

Claims

1. A method comprising:

establishing communication via a Universal Serial Bus (USB) plug of a portable device with a host computer when the USB plug is directly connected to a USB port of the host computer;

performing a user authentication of a user of the portable device, the user authentication being performed by the portable device;

if the user authentication is successful, sending information from the portable device to a content server via the host computer for performance of an authentication handshake between the portable device and the content server;

if the authentication handshake is successful, sending an encrypted first key from the portable device to the content server via the host computer for performance of a second user authentication by the content server; and

if the second user authentication is successful, receiving restricted content from the content server via the host computer.

2. The method of claim 1, wherein the user authentication is a biometrics-based user authentication.

3. The method of claim 2, wherein the biometrics-based user authentication compares a user'"'"'s detected fingerprint to a fingerprint template stored in the portable device.

4. The method of claim 2, wherein the biometrics-based user authentication compares a user'"'"'s detected iris pattern to an iris pattern stored in the portable device.

5. The method of claim 1, wherein the encrypted first key is an encrypted public key.

6. The method of claim 1, further comprising encrypting a first key.

7. The method of claim 1, further comprising storing the restricted content in a non-volatile memory of the portable device.

8. The method of claim 1, further comprising encrypting the restricted content using a second key and storing the encrypted restricted content in a non-volatile memory of the portable device.

9. A method comprising:

establishing communication via a Universal Serial Bus (USB) plug of a portable device with a host computer when the USB plug is directly connected to a USB port of the host computer;

performing a user authentication of a user of a portable device, the user authentication being performed by the portable device;

if the user authentication is successful, sending information from the portable device to a content server via a host computer for performance of an authentication handshake between the portable device and the content server;

if the authentication handshake is successful, sending a hashed first key from the portable device to the content server for performance of a second user authentication by the content server; and

if the second user authentication is successful, receiving restricted content from the content server via the host computer.

10. The method of claim 9, wherein the user authentication is a biometrics-based user authentication.

11. The method of claim 10, wherein the biometrics-based user authentication compares a user'"'"'s detected fingerprint to a fingerprint template stored in the portable device.

12. The method of claim 10, wherein the biometrics-based user authentication compares a user'"'"'s detected iris pattern to an iris pattern stored in the portable device.

13. The method of claim 9, wherein the hashed first key is a hashed public key.

14. The method of claim 9, further comprising hashing a first key.

15. The method of claim 9, further comprising storing the restricted content in a non-volatile memory of the portable device.

16. The method of claim 9, further comprising encrypting the restricted content using a second key and storing the encrypted restricted content in a non-volatile memory of the portable device.

17. A method comprising:

establishing communication via a Universal Serial Bus (USB) plug of a portable device with a host computer when the USB plug is directly connected to a USB port of the host computer;

executing a user authentication process of a user of the portable device;

sending a security code from the portable device to a content server via a host computer in response to a request from the content server;

sending a hashed first key from the portable device to the content server via the host computer; and

receiving restricted content from the content server via the host computer.

18. The method of claim 17, wherein the user authentication process is a biometrics-based user authentication process.

19. The method of claim 18, wherein the biometrics-based user authentication process compares a user'"'"'s detected fingerprint to a fingerprint template stored in the portable device.

20. The method of claim 18, wherein the biometrics-based user authentication process compares a user'"'"'s detected iris pattern to an iris pattern stored in the portable device.

21. The method of claim 17, wherein the hashed first key is a hashed public key.

22. The method of claim 17, further comprising hashing a first key.

23. The method of claim 17, further comprising storing the restricted content in a non-volatile memory of the portable device.

24. The method of claim 17, further comprising encrypting the restricted content using a second key and storing the encrypted restricted content in a non-volatile memory of the portable device.

25. A portable device comprising:

a processor;

a non-volatile memory coupled to the processor;

a Universal Serial Bus (USB) plug coupled to a USB controller that is coupled to the processor, the USB plug configured to directly connect the portable device to a USB port of a host computer;

a user authentication algorithm configured to authenticate a user of the portable device;

the processor configured to perform an authentication handshake with a content server via the host computer if the user authentication algorithm indicates a successful user authentication; and

a hashing algorithm configured to hash a public key before the processor sends the public key to a content server via the host computer.

26. The portable device of claim 25, wherein the processor is further configured to store content received from the content server via the host computer in the non-volatile memory.

27. The portable device of claim 25, further comprising an encryption unit configured to encrypt content received from the content server via the host computer, and wherein the processor is further configured to store the encrypted content in the non-volatile memory.

28. The portable device of claim 27, wherein the encryption unit is configured to encrypt the content using a private key.

29. The portable device of claim 25, further comprising a tamper-proof unit configured to erase at least a portion of data stored in the non-volatile memory upon detecting at least one operation parameter falling beyond a predetermined normal operating range.

30. The portable device of claim 25, wherein the public key is stored in the non-volatile memory.

31. A portable device comprising:

a processor;

a non-volatile memory coupled to the processor;

a Universal Serial Bus (USB) plug coupled to a USB controller that is coupled to the processor, the USB plug configured to directly connect the portable device to a USB port of a host computer;

a user authentication algorithm configured to authenticate a user of the portable device;

the processor configured to send a security code to a content server via the host computer if the user authentication algorithm indicates a successful user authentication; and

a hashing algorithm configured to hash a public key before the processor sends the public key to a content server via the host computer.

32. The portable device of claim 31, wherein the processor is further configured to store content received from the content server via the host computer in the non-volatile memory.

33. The portable device of claim 31, further comprising an encryption unit configured to encrypt content received from the content server via the host computer, and wherein the processor is further configured to store the encrypted content in the non-volatile memory.

34. The portable device of claim 33, wherein the encryption unit is configured to encrypt the content using a private key.

35. The portable device of claim 31, further comprising a tamper-proof unit configured to erase at least a portion of data stored in the non-volatile memory upon detecting at least one operation parameter falling beyond a predetermined normal operating range.

36. The portable device of claim 31, wherein the public key is stored in the non-volatile memory.