Content control method using certificate revocation lists

• US 8,245,031 B2
• Filed: 11/06/2006
• Issued: 08/14/2012
• Est. Priority Date: 07/07/2006
• Status: Expired due to Fees

• Current Assignee: SanDisk Technologies LLC (Western Digital Corporation)
• Original Assignee: Sandisk Technologies Incorporated (Western Digital Corporation)
• Inventors: Holtzman, Michael, Barzilai, Ron, Sela, Rotem, Jogand-Coulomb, Fabrice
• Primary Examiner(s): Davis, Zachary A
• Application Number:
  US11/557,006
• Publication Number:
  US 20080010451A1
• Time in Patent Office: 2,108 Days
• Field of Search: 713/158, 713/155, 713/156, 713/175, 713/168, 713/176, 726/10, 726/3, 726/5, 726 26- 29
• US Class Current: 713/158
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3273 for mutual authentication network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869

Abstract

Host devices present both the host certificate and the pertinent certificate revocation lists to the memory device for authentication so that the memory device need not obtain the list on its own. Processing of the certificate revocation list and searching for the certificate identification may be performed concurrently by the memory device. The certificate revocation lists for authenticating host devices to memory devices may be stored in an unsecured area of the memory device for convenience of users.

Claims

1. A method for determining if a certificate is revoked using a certificate revocation list, the method comprising:

performing by a storage device which is in communication with a host;

receiving a certificate from the host;

receiving a plurality of portions of a certificate revocation list from the host, wherein the plurality of portions of the certificate revocation list amount to the complete certificate revocation list;

processing the portions of the certificate revocation list in the order in which they are received and searching for a reference to the certificate in each of the portions as they are being processed, wherein the plurality of portions are received one after the other, and wherein the processing is performed on the fly as the plurality of portions are received; and

after the plurality of portions have been processed,

verifying the certification revocation list from the processed plurality of portions, and

determining that the certificate is revoked if the reference to it was found and the certificate revocation list was verified.

2. The method of claim 1, wherein the processing discards portions of the certificate revocation list after they have been processed.

3. The method of claim 1, wherein the processing includes hashing the portions of the certificate revocation list as they are received using a hashing algorithm to obtain a hashed certificate revocation list.

4. The method of claim 1, wherein the received plurality of portions of the certificate revocation list are associated with a first hash of all the portions of the certificate revocation list, the first hash being signed with a signature, wherein the processing includes calculating a second hash of all the portions of the certificate revocation list, and wherein the method further comprises, after the plurality of portions have been processed, verifying the signature of the first hash and comparing the first hash with the second hash.

5. The method of claim 1, wherein the plurality of portions include serial numbers of revoked certificates.

6. The method of claim 1, wherein the certificate and the plurality of portions of the certificate revocation list are received in response to a request to authenticate the host, and wherein the method further comprises:

determining that the certificate is revoked because the reference to it was found in the certification revocation list and then rejecting an attempt to authenticate the host.

7. The method of claim 1 further comprising:

receiving a second certificate from the host;

receiving a second plurality of portions of a second certificate revocation list from the host;

processing the portions of the second certificate revocation list in the order in which they are received and searching for a reference to the second certificate in each of the portions as they are being processed; and

after the plurality of portions of the second certificate revocation list have been processed,

verifying the second certification revocation list, and

determining that the second certificate is revoked if the reference to the second certificate was found and the second certificate revocation list was verified.

8. The method of claim 1, wherein the plurality of portions of the certificate revocation list received from the host were previously read by the host from a memory in the storage device.

9. A storage device comprising:

a memory; and

a controller in communication with the memory and operative to;

receive a certificate from an entity;

receive a plurality of portions of a certificate revocation list from the entity, wherein the plurality of portions of the certificate revocation list amount to the complete certificate revocation list;

process the portions of the certificate revocation list in the order in which they are received and search for a reference to the certificate in each of the portions as they are being processed, wherein the plurality of portions are received one after the other, and wherein the processing is performed on the fly as the plurality of portions are received; and

after the plurality of portions have been processed,

verify the certification revocation list from the processed plurality of portions, and

determine that the certificate is revoked if the reference to it was found and the certificate revocation list was verified.

10. The storage device of claim 9, wherein the processing discards portions of the certificate revocation list after they have been processed.

11. The storage device of claim 9, wherein the processing includes hashing the portions of the certificate revocation list as they are received using a hashing algorithm to obtain a hashed certificate revocation list.

12. The storage device of claim 9, wherein the received plurality of portions of the certificate revocation list are associated with a first hash of all the portions of the certificate revocation list, the first hash being signed with a signature, wherein the controller processes the portions by calculating a second hash of all the portions of the certificate revocation list, and wherein the controller is further operative to, after the plurality of portions have been processed, verify the signature of the first hash and comparing the first hash with the second hash.

13. The storage device of claim 9, wherein the plurality of portions include serial numbers of revoked certificates.

14. The storage device of claim 9, wherein the certificate and the plurality of portions of the certificate revocation list are received in response to a request to authenticate the entity, and wherein the controller is further operative to determine that the certificate is revoked because the reference to it was found in the certification revocation list and then rejecting an attempt to authenticate the entity.

15. The storage device of claim 9, wherein the controller is further operative to:

receive a second certificate from the entity;

receive a second plurality of portions of a second certificate revocation list from the entity;

process the portions of the second certificate revocation list in the order in which they are received and search for a reference to the second certificate in each of the portions as they are being processed; and

after the plurality of portions of the second certificate revocation list have been processed,

verify the second certification revocation list, and

determine that the second certificate is revoked if the reference to the second certificate was found and the second certificate revocation list was verified.

16. The storage device of claim 9, wherein the plurality of portions of the certificate revocation list received from the entity were previously read by the entity from the memory.