Source: http://www.google.com/patents/US7624276?dq=oakley+5,387,949&ei=4yI4T8nkLYa80QG0xqnWAg
Timestamp: 2014-11-28 16:08:36
Document Index: 92752042

Matched Legal Cases: ['Application No. 60', 'art 600', 'art 600', 'art 600', 'art 600', 'art 600', 'art 600', 'art 600', 'art 600', 'art 600', 'art 600', 'art 600', 'art 600', 'art 600', 'art 600', 'art 600', 'art 600', 'art 600', 'art 600', 'art 600']

Patent US7624276 - Secure device authentication system and method - Google PatentsSearch Images Maps Play YouTube News Gmail Drive More »Sign inAdvanced Patent SearchPatentsA technique for security and authentication on block-based media includes involves the use of protected keys, providing authentication and encryption primitives. A system according to the technique may include a secure device having a security kernel with protected keys. A disk drive security mechanism...http://www.google.com/patents/US7624276?utm_source=gb-gplus-sharePatent US7624276 - Secure device authentication system and methodAdvanced Patent SearchPublication numberUS7624276 B2Publication typeGrantApplication numberUS 11/586,446Publication dateNov 24, 2009Filing dateOct 24, 2006Priority dateOct 16, 2006Fee statusPaidAlso published asEP2080311A2, US7991999, US20080091945, US20100031035, WO2008048403A2, WO2008048403A3Publication number11586446, 586446, US 7624276 B2, US 7624276B2, US-B2-7624276, US7624276 B2, US7624276B2InventorsJohn Princen, Pramila Srinivasan, Craig Steven AndersonOriginal AssigneeBroadon Communications Corp.Export CitationBiBTeX, EndNote, RefManPatent Citations (102), Non-Patent Citations (46), Referenced by (6), Classifications (22), Legal Events (4) External Links: USPTO, USPTO Assignment, EspacenetSecure device authentication system and methodUS 7624276 B2Abstract A technique for security and authentication on block-based media includes involves the use of protected keys, providing authentication and encryption primitives. A system according to the technique may include a secure device having a security kernel with protected keys. A disk drive security mechanism may support authentication of data, secrecy, and ticket validation using the security kernel and, for example, a ticket services module (e.g., a shared service that may or may not be used by other storage devices like flash).
accessing a header including a data structure and a set of hash values;
obtaining from the data structure a first root hash of a hierarchical hash tree;
computing a second root hash from the set of hash values;
comparing the first root hash to the second root hash;
if the first root hash and the second root hash match,
obtaining an encrypted key from the data structure;
securely decrypting the encrypted key;
securely storing the key such that the key is not passed in the clear;
providing a reference to the key;
decrypting a data block with the reference to the key;
loading authentication data from a sub-block associated with the data block;
identifying, in the authentication data, a first set of hash values associated with a first level of the hierarchical hash tree;
computing a cryptographic hash of the data block to determine a first hash value;
comparing the first hash value to a corresponding value in the first set of hash values;
rejecting a block data request if the first hash value and the corresponding value in the first set of hash values do not match.
2. The method of claim 1, wherein the data structure is public key signed.
3. The method of claim 1, further comprising authenticating the data structure.
4. The method of claim 1, further comprising securely storing the set of hash values included in the header.
5. The method of claim 1, further comprising caching the hierarchical hash tree.
6. The method of claim 1, further comprising rejecting the header if the first root hash and the second root hash do not match.
7. The method of claim 1, further comprising validating a rights management ticket from a source other than the header.
8. The method of claim 1, wherein the reference to the key is provided in the clear.
9. The method of claim 1, wherein decrypting a data block with the reference to the key further comprises:
providing the reference to the key to a secure decryption engine;
decrypting the data block such that the key is not passed in the clear.
10. The method of claim 1, further comprising decrypting at least a portion of the sub-block.
11. The method of claim 1, further comprising, in each hash block:
inserting a calculated hash in an appropriate location;
computing the hash of the hash block.
12. The method of claim 1, if the first hash value matches the corresponding value in the first set of hash values, further comprising:
computing a second hash value corresponding to the first set of hash values;
identifying, in the authentication data, a second set of hash values associated with a second level of the hierarchical hash tree;
comparing the second hash value to a corresponding value in the second set of hash values;
rejecting the block data request if the second hash value and the corresponding value in the second set of hash values do not match.
13. The method of claim 12, if the second hash value matches the corresponding value in the second set of hash values, further comprising:
computing a third hash value corresponding to the second set of hash values;
identifying, in the authentication data, a third set of hash values associated with a third level of the hierarchical hash tree;
comparing the third hash value to a corresponding value in the third set of hash values;
rejecting the block data request if the third hash value and the corresponding value in the third set of hash values do not match.
14. The method of claim 13, if the third hash value matches the corresponding value in the third set of hash values, wherein the set of hash values of the header are a fourth set of hash values, and wherein the fourth set of hash values are associated with a fourth level of the hierarchical hash tree, further comprising:
computing a fourth hash value corresponding to the third set of hash values;
providing a fourth set of hash values associated with a fourth level of the hierarchical hash tree;
comparing the fourth hash value to a corresponding value in the fourth set of hash values;
rejecting the block data request if the fourth hash value and the corresponding value in the fourth set of hash values do not match;
returning the data block if the fourth hash value and the corresponding value in the fourth set of hash values match.
a block-based media driver coupled to a security API, wherein, in operation, the block-based media driver accesses a header associated with a block-based media device and extracts authentication data from the header;
ticket services coupled to the block-based media driver and the security API, wherein, in operation, the ticket services receive the authentication data from the block-based media driver and send a key decryption request to the security API;
a security kernel including the security API, an encryption/decryption engine, and a key store accessible to the security API, wherein, in operation, the encryption/decryption engine decrypts the key, the key is stored in the key store, and the security API returns a reference to the key to the ticket services;
wherein, in operation, the ticket services validates the authentication data and returns the reference to the key to the block-based media driver;
wherein, in operation, the block-based media driver accesses data blocks of the block-based media device, sends a block decryption request to the security API, and the security kernel decrypts the blocks and validates a hierarchical hash tree associated with the data blocks.
16. The system of claim 15, further comprising the block-based media device, wherein the header associated with the block-based media device includes a root hash value and a plurality of root-child hash values.
17. The system of claim 15, further comprising the block-based media device, wherein the data blocks each include a hash sub-block and a plurality of content data blocks.
18. A system having a means for secure content delivery with block-based media, comprising:
a secure key store means;
a means for accessing an encrypted key from a header of a block-based media device;
a means for securely decrypting the encrypted key;
a means for securely storing the key in the key store;
a means for referencing the key to securely decrypt data blocks of the block-based media device;
a means for providing hash values in association with the block-based media device and each data block of the block-based media device.
19. The system of claim 18, further comprising a means for aborting block-based media device access if hash values in the header are rejected.
20. The system of claim 18, further comprising a means for aborting data block access if hash values in the data block are rejected.
if the first root hash and the second root has match,
loading authentication data from a sub-block associated with an encrypted data block;
computing a cryptographic hash of the encrypted data block to determine a first hash value;
rejecting a block data request if the first hash value and the corresponding value in the first set of hash values do not match;
decrypting the encrypted data block with the reference to the key.
This application claims priority to U.S. Provisional Application No. 60/852,151, entitled SECURE DEVICE AUTHENTICATION SYSTEM AND METHOD, filed Oct. 16, 2006, which is hereby incorporated by reference in its entirety.
Some efforts to meet these requirements have been proposed, but, as is the case with many solutions in secrecy and authentication techniques, there is room for improvement. For example, one could attach a block signature based on public key cryptography (example, RSA signature), but this is relatively slow since every block of data that is read would require an RSA signature calculation. Besides, the size of an RSA signature for every block would impose a relatively high overhead. As another example, one could attach a SHA hash (or equivalent) for every block written in a custom protected area of disk, but this would require the manufacture of custom disks. As another example, one could attach a secret-key based message authentication code such as HMAC (or equivalent) for each block, but if the HMAC has to be the same for all disks, this becomes a common secret key mechanism, which may not provide a desired level of security. As another example, one could use a hierarchical signature approach that requires multiple seeks of the block device for every block access, to read the members of the hierarchy, but this may lead to increased latency.
A technique for security and authentication on block-based media includes involves the use of protected keys, providing authentication and encryption primitives. A system according to the technique may include a secure device having a security kernel with protected keys. A disk drive security mechanism may support authentication of data, secrecy, and ticket validation using the security kernel and, for example, a ticket services module (e.g., a shared service that may or may not be used by other storage devices like flash). Depending upon the implementation, the security kernel, disk drive security mechanism, and ticket services module may operate in three different execution spaces, and can be commonly used by various I/O and storage devices including, by way of example but not limitation, an optical disk.
In a non-limiting embodiment, the block-based media is read-only, but the technique may be applicable on write once, read many (WORM), writable, or other block-based media. The technique may also be applicable to other storage media, other licensing mechanisms leading to alternate methods to derive the encryption key, and/or other transport media (for example, Internet packet-based download.
where F(Yi) is a one-way function such as SHA-1. It follows that H(i, j, Y) is a one-way function of Yi, Yi+1, . . . Yj, and H(1, n, Y) is a one-way function of Y1 through Yn. Thus, the receiver can selectively authenticate Yk and a set of values of H.
Referring once again to FIG. 3, the hash block 302, which is subdivided, in this example, into 31 H0 hashes and padding 310, 8 H1 hashes and padding 312, and 8 H2 hashes and padding 314.
A header (not shown), such as a disk header, would typically be included with the 32 KB block 300. The header may be prepended, appended, or otherwise included with the block of data. In a non-limiting embodiment, the header includes the H4 hash and the relevant H3 hash (see, e.g., FIG. 2). In an alternative embodiment the relevant H3 could be derived from all 8 of the H2 hashes, and would not have to be provided, though this may require accessing data from the whole block-based device.
In a non-limiting embodiment, the header may include a signed data structure called a �ticket� which includes at least the final hash (e.g., H4), a content identification, and an optional key. The key may, for example, be signed by a content publishing server using a public key signature method such as, by way of example but not limitation, RSA. In a non-limiting embodiment, the ticket may include other rights management data granting rights to the content and a signature by another licensing server. The header may further include ancillary data structures to help validate the signatures, such as a chain of certificates, revocation lists, etc. Rights management licenses may be used in conjunction with other rights management licenses delivered by alternate means, to reduce or extend the rights applicable to the content.
In an embodiment, all data blocks are encrypted (e.g., using AES encryption) to ensure copy protection of the content. In an alternative embodiment, some of the data blocks may not be encrypted. In a non-limiting embodiment, data is decrypted starting from the hash block 302. Any known or convenient technique may be used to decrypt the hashes. For example, a constant known value may be chosen to decrypt the beginning of the hash block 302, and a portion of the H2 hashes may be used as a value for the data block decryption. The decryption key may be obtained as a byproduct of a ticket validation procedure (see, e.g., FIG. 5).
The computer system 400 may be controlled by an operating system (OS). An OS is a software program-used on most, but not all, computer systems�that manages the hardware and software resources of a computer. Typically, the OS performs basic tasks such as controlling and allocating memory, prioritizing system requests, controlling input and output devices, facilitating networking, and managing files. Examples of operating systems for personal computers include Microsoft Windows�, Linux, and Mac OS�. Delineating between the OS and application software is sometimes rather difficult. Fortunately, delineation is not necessary to understand the techniques described herein, since any reasonable delineation should suffice.
In the example of FIG. 5, the secure system 500 includes a secure processor 502, an OS 504, a block-based media driver 506, a block-based media device 508, protected memory 510, and ticket services 512. In the example of FIG. 5, the OS 504 includes a security kernel 514, which in turn includes a key store 516 and a security API 518. It should be noted that one or more of the described components, or portions thereof, may reside in the protected memory 510, or in unprotected memory (not shown). It should further be noted that the security kernel 514 is depicted as residing inside the OS 504 by convention only. It may or may not actually be part of the OS 504, and could exist outside of an OS or on a system that does not include an OS. For the purposes of illustrative simplicity, it is assumed that the OS 504 is capable of authentication.
The ticket services 512 may be thought of as �digital license validation services� and, in a non-limiting embodiment, may include known or convenient procedures associated with license validation. For example, the ticket services 512 may include procedures for validating digital licenses, PKI validation procedures, etc. In the example of FIG. 5, the ticket services 512 can validate a ticket on the block-based media device 508. In operation, the block-based media driver 506 obtains the ticket from the block-based media device 508. The block-based media driver 506 then provides the ticket to the ticket services 512, which proceeds to validate the ticket. If the ticket is valid, the block-based media driver 506 is permitted to decrypt blocks associated with the ticket.
In an embodiment, the security kernel 514 may be loaded at start-up. In another embodiment, a portion of the security kernel may be loaded at start-up, and the remainder loaded later. An example of this technique is described in application Ser. No. 10/360,827 entitled �Secure and Backward-Compatible Processor and Secure Software Execution Thereon� filed on Feb. 7, 2003 by Srinivasan et al., which is incorporated by reference. Any known or convenient technique may be used to load the security kernel 514 in a secure manner.
The key store 516 is a set of locations for keys. The key store 516 may be thought of as an array of keys, though the data structure used to store the keys is not critical. Any applicable known or convenient structure may be used to store the keys. In a non-limiting embodiment, the key store 516 is initialized with static keys, but variable keys are not initialized (or are initialized to a value that is not secure). For example, some of the key store locations are pre-filled with trusted values (e.g., a trusted root key), with the remaining extra index slots left unused.
The security API 518 is capable of performing operations using the keys in the key store 516 without bringing the keys out into the clear (i.e., the keys do not leave the security kernel 514). The security API 518 may include services to create, populate and use keys (and potentially other security material) in the key store 516. In an embodiment, the security API 518 also provides access to internal secrets and non-volatile data, including secret keys and device private key. Depending upon the implementation, the security API 518 may support AES and SHA operations using hardware acceleration.
In an embodiment, some operations performed by the security API 518 include encryption and decryption. For example, in operation, an application may request of the security API 518 a key handle that the application can use for encryption, then request that the API 518 encrypt data using the key handle. Advantageously, the API 518 provides the key handle in the clear, but the key itself never leaves the security kernel 514.
In the example of FIG. 5, to perform these security operations, the block-based media driver 506 may make use of other secure services in the system 500, such as the ticket services 512 and the security API 518. In an embodiment, each of these modules executes in a separate execution space for system security. In order to validate data blocks, the block-based media driver 506 reads a data block header, and uses the ticket services 512 to validate the ticket using data in the header. To support the decryption of the blocks, the ticket may include an encrypted key. The ticket services 512 decrypts the key using services in the security kernel 514.
In an embodiment, the security kernel 514 uses secret common keys from the key store 518 to perform this decryption. In another embodiment, the ticket services 512 could use a device personalized ticket obtained from flash or network (not shown), validate some rights to content, and then return the key. In any case, this process returns to the block-based media driver 506 a reference to a key for use in decrypting blocks. This key reference is used by the block-based media driver 506 to make subsequent calls to the security kernel 514 to decrypt blocks associated with the key.
After decryption, the block-based media driver 506 makes calls to the security API 516 (or some other interface to a hash computation engine) to validate a hierarchical hash tree associated with the ticket. (See, e.g., FIG. 3.) The security API 516 validates the root hash against the one in the ticket. Assuming validation is successful, the content associated with the ticket is made available for use.
An example of data flow in the system 500 is provided for illustrative purposes as arrows 520-536. Receiving the block header at the block-based media driver 506 is represented by a data block header arrow 520 from the block-based media device 508 to the block-based media driver 506. Sending data from the data block header, including a ticket, to the ticket services 512 is represented by an authentication data arrow 522. The ticket may include an encrypted key. Sending a request to the security API 516 to decrypt the key is represented as a key decryption request arrow 524. Returning a reference to the decrypted key, now stored in the key store 518, is represented by a reference to key arrow 526. After a successful validation of the ticket, the ticket services will send ticket validation data to the block-based media driver 506, including a reference to a key that the driver can use to decrypt blocks. The data sent from the ticket services 512 to the block-based media driver 506 is represented as a ticket validation arrow 528. A data block access arrow 530 represents reading blocks from the block-based media device 508 by the block-based media driver 506. The data access may or may not occur concurrently with the receipt of the header (520). The accessed blocks are decrypted using the ticket validation data (528) and a block decryption request arrow 532 represents the request. A hash tree validation arrow 534 represents a subsequent validation of the content of a block.
In an alternative embodiment, values of portions of a hierarchical hash tree could be hashed for future reference. This could save some hash computation time.
FIGS. 6A and 6B depict a flowchart 600 of an example of a method for secure block-based media access. In the example of FIG. 6A, the flowchart 600 begins at module 602 where a block-based media header is read. In the example of FIG. 6A, the flowchart 600 continues to module 604 where a ticket is validated and a reference to a decryption key is obtained.
In the example of FIG. 6B, the flowchart 600 continues to module 622 where the hash of the data sub-block is compared against a corresponding H0 hash value in the set of H0 hashes. (See, e.g., FIG. 3.) In the example of FIG. 6B, the flowchart 600 continues to decision point 624 where it is determined whether the comparison yields a valid result. If it is determined that the result is not valid (624-N), then the flowchart 600 aborts the read request from the block-based media device. If, on the other hand, it is determined that the result is valid (624-Y), then the flowchart 600 continues to module 626 where a hash of the set of H0 hashes, including the H0 hash value, is calculated.
In the example of FIG. 6B, the flowchart 600 continues to module 628 where the hash of the set of H0 hashes is compared against a corresponding H1 hash value in the set of H1 hashes. (See, e.g., FIG. 3.) In the example of FIG. 6B, the flowchart 600 continues to decision point 630 where it is determined whether the comparison yields a valid result. If it is determined that the result is not valid (630-N), then the flowchart 600 aborts the read request from the block-based media device. If, on the other hand, it is determined that the result is valid (630-Y), then the flowchart 600 continues to module 632 where a hash of the set of H1 hashes, including the H1 hash value, is calculated.
In the example of FIG. 6B, the flowchart 600 continues to module 634 where the hash of the set of H1 hashes is compared against a corresponding H2 hash value in the set of H2 hashes. (See, e.g., FIG. 3.) In the example of FIG. 6B, the flowchart 600 continues to decision point 636 where it is determined whether the comparison yields a valid result. If it is determined that the result is not valid (636-N), then the flowchart 600 aborts the read request from the block-based media device. If, on the other hand, it is determined that the result is valid (636-Y), then the flowchart 600 continues to module 638 where a hash of the set of H2 hashes, including the H2 hash value, is calculated.
In the example of FIG. 6B, the flowchart 600 continues to module 640 where the hash of the set of H2 hashes is compared against the corresponding stored H3 hash value (612). (See, e.g., FIG. 3.) In the example of FIG. 6B, the flowchart 600 continues to decision point 642 where it is determined whether the comparison yields a valid result. If it is determined that the result is not valid (642-N), then the flowchart 600 aborts the read request from the block-based media device. If, on the other hand, it is determined that the result is valid (642-Y), then the flowchart 600 continues to module 644 where the block read request is fulfilled.
Patent CitationsCited PatentFiling datePublication dateApplicantTitleUS5095798Jan 8, 1990Mar 17, 1992Nintendo Co. Ltd.Electronic gaming device with pseudo-stereophonic sound generating capabilitiesUS5184830Jun 15, 1992Feb 9, 1993Nintendo Company LimitedCompact hand-held video game systemUS5238250Dec 18, 1990Aug 24, 1993Bung Electronic Engineering CompanyComputer game control apparatusUS5261069Aug 13, 1990Nov 9, 1993Hewlett-Packard CompanyMethod of maintaining consistency of cached data in a database systemUS5367698Oct 31, 1991Nov 22, 1994Epoch Systems, Inc.Network file migration systemUS5400402Jun 7, 1993Mar 21, 1995Garfinkle; NortonSystem for limiting use of down-loaded video-on-demand dataUS5404505Nov 1, 1991Apr 4, 1995Finisar CorporationSystem for scheduling transmission of indexed and requested database tiers on demand at varying repetition ratesUS5426763May 20, 1993Jun 20, 1995Nintendo Co., Ltd.Memory cartridge including a key detector for inhibiting memory access and preventing undesirable write operationsUS5528513Nov 4, 1993Jun 18, 1996Digital Equipment Corp.Scheduling and admission control policy for a continuous media serverUS5586264Sep 8, 1994Dec 17, 1996Ibm CorporationVideo optimized media streamer with cache managementUS5590199 *Oct 12, 1993Dec 31, 1996The Mitre CorporationElectronic information network user authentication and authorization systemUS5610839Oct 7, 1994Mar 11, 1997Itt CorporationCommunications management system architectureUS5638443Nov 23, 1994Jun 10, 1997Xerox CorporationSystem for controlling the distribution and use of composite digital worksUS5715398Mar 13, 1996Feb 3, 1998R.R. Donnelley & Sons CompanySystem for distributing items from an origin to a plurality of destinationsUS5715403Nov 23, 1994Feb 3, 1998Xerox CorporationSystem for controlling the distribution and use of digital works having attached usage rights where the usage rights are defined by a usage rights grammarUS5765152Oct 13, 1995Jun 9, 1998Trustees Of Dartmouth CollegeSystem and method for managing copyrighted electronic mediaUS5781901Dec 21, 1995Jul 14, 1998Intel CorporationTransmitting electronic mail attachment over a network using a e-mail pageUS5790170Apr 14, 1997Aug 4, 1998Sony CorporationTwo-way information transmission system and two-way information transmission methodUS5809242Apr 19, 1996Sep 15, 1998Juno Online Services, L.P.Electronic mail system for displaying advertisement at local computer received from remote system while the local computer is off-line the remote systemUS5815662Aug 15, 1996Sep 29, 1998Ong; LancePredictive memory caching for media-on-demand systemsUS5818512Apr 4, 1997Oct 6, 1998Spectravision, Inc.Video distribution systemUS5829046Jun 10, 1996Oct 27, 1998Emc CorporationOn-line tape backup using an integrated cached disk arrayUS5867223Mar 27, 1996Feb 2, 1999Gateway 2000, Inc.System for assigning multichannel audio signals to independent wireless audio output devicesUS5892900Aug 30, 1996Apr 6, 1999Intertrust Technologies Corp.Systems and methods for secure transaction management and electronic rights protectionUS5903723Dec 21, 1995May 11, 1999Intel CorporationMethod and apparatus for transmitting electronic mail attachments with attachment referencesUS5905860Feb 24, 1997May 18, 1999Novell, Inc.Fault tolerant electronic licensing systemUS5913039Jan 17, 1997Jun 15, 1999Matsushita Electric Industrial Co., Ltd.Video on demand system with a transmission schedule table in the video server including entries for client identifiers, video titles, and reproduction start timesUS5933498Nov 5, 1997Aug 3, 1999Mrj, Inc.System for controlling access and distribution of digital propertyUS5983227Jun 12, 1997Nov 9, 1999Yahoo, Inc.Dynamic page generatorUS6016348Nov 27, 1996Jan 18, 2000Thomson Consumer Electronics, Inc.Decoding system and data format for processing and storing encrypted broadcast, cable or satellite video dataUS6032200Sep 30, 1996Feb 29, 2000Apple Computer, Inc.Process scheduling for streaming data through scheduling of disk jobs and network jobs and the relationship of the scheduling between these types of jobsUS6038601Jul 21, 1997Mar 14, 2000Tibco, Inc.Method and apparatus for storing and delivering documents on the internetUS6044157Mar 10, 1997Mar 28, 2000Matsushita Electric Industrial Co., Ltd.Microprocessor suitable for reproducing AV data while protecting the AV data from illegal copy and image information processing system using the microprocessorUS6049821Jan 24, 1997Apr 11, 2000Motorola, Inc.Proxy host computer and method for accessing and retrieving information between a browser and a proxyUS6052720May 14, 1998Apr 18, 2000Sun Microsystems, Inc.Generic schema for storing configuration information on a server computerUS6085193Sep 29, 1997Jul 4, 2000International Business Machines CorporationMethod and system for dynamically prefetching information via a server hierarchyUS6141756Apr 27, 1998Oct 31, 2000Motorola, Inc.Apparatus and method of reading a program into a processorUS6148340Apr 30, 1998Nov 14, 2000International Business Machines CorporationMethod and system for differencing container filesUS6157721Aug 12, 1996Dec 5, 2000Intertrust Technologies Corp.Systems and methods using cryptography to protect secure computing environmentsUS6167441Nov 21, 1997Dec 26, 2000International Business Machines CorporationCustomization of web pages based on requester typeUS6185625Dec 20, 1996Feb 6, 2001Intel CorporationScaling proxy server sending to the client a graphical user interface for establishing object encoding preferences after receiving the client's request for the objectUS6205475Aug 24, 1999Mar 20, 2001William Michael PittsRequest interceptor in network nodes for determining local storage of file image satisfying predetermined criteriaUS6212657May 25, 1999Apr 3, 2001Nstreams Technologies, Inc.System and process for delivering digital data on demandUS6219680Jun 19, 1998Apr 17, 2001International Business Machines CorporationSystem and method for building a web site for use in E-commerce with user specific pricingUS6219708May 30, 1996Apr 17, 2001Multi-Tech Systems, Inc.System for network resource managementUS6226618Aug 13, 1998May 1, 2001International Business Machines CorporationElectronic content delivery systemUS6243719Mar 17, 1998Jun 5, 2001Fujitsu LimitedData caching apparatus, data caching method and medium recorded with data caching program in client/server distributed systemUS6256637May 5, 1998Jul 3, 2001Gemstone Systems, Inc.Transactional virtual machine architectureUS6259471Mar 11, 1997Jul 10, 2001AlcatelApparatus and service for transmitting video dataUS6289452Nov 7, 1997Sep 11, 2001Cybersource CorporationMethod and system for delivering digital products electronicallyUS6292899Sep 23, 1998Sep 18, 2001Mcbride Randall C.Volatile key apparatus for safeguarding confidential data stored in a computer system memoryUS6321209Feb 18, 1999Nov 20, 2001Wired Solutions, LlcSystem and method for providing a dynamic advertising content window within a window based content manifestation environment provided in a browserUS6330566Jun 22, 1998Dec 11, 2001Microsoft CorporationApparatus and method for optimizing client-state data storageUS6338050Nov 16, 1998Jan 8, 2002Trade Access, Inc.System and method for providing and updating user supplied context for a negotiations systemUS6371854Aug 16, 2000Apr 16, 2002Ninetendo Co., Ltd.Combined game systemUS6377972Jan 19, 1999Apr 23, 2002Lucent Technologies Inc.High quality streaming multimediaUS6389460Aug 12, 1998May 14, 2002Compaq Computer CorporationMethod and apparatus for efficient storage and retrieval of objects in and from an object storage deviceUS6412008Jan 28, 1999Jun 25, 2002International Business Machines CorporationSystem and method for cooperative client/server customization of web pagesUS6412011Sep 14, 1998Jun 25, 2002At&T Corp.Method and apparatus to enhance a multicast information stream in a communication networkUS6427238May 29, 1998Jul 30, 2002Opentv, Inc.Module manager for interactive television systemUS6446113Jul 19, 1999Sep 3, 2002Groove Networks, Inc.Method and apparatus for activity-based collaboration by a computer system equipped with a dynamics managerUS6466048May 23, 2001Oct 15, 2002Mosaid Technologies, Inc.Method and apparatus for switchably selecting an integrated circuit operating modeUS6480883Jun 29, 1999Nov 12, 2002Kabushiki Kaisha ToshibaReal-time information transmission systemUS6500070May 18, 2000Dec 31, 2002Nintendo Co., Ltd.Combined game system of portable and video game machinesUS6510502Jul 17, 2000Jan 21, 2003Kabushiki Kaisha Sega EnterprisesInformation processing device and method for reading information recorded on an information recording mediumUS6526581Aug 3, 1999Feb 25, 2003Ucentric Holdings, LlcMulti-service in-home network with an open interfaceUS6544126Apr 25, 2001Apr 8, 2003Nintendo Co., Ltd.Portable game machine with download capabilityUS6557104May 2, 1997Apr 29, 2003Phoenix Technologies Ltd.Method and apparatus for secure processing of cryptographic keysUS6571279May 19, 1999May 27, 2003Pinpoint IncorporatedLocation enhanced information delivery systemUS6574605Nov 17, 1999Jun 3, 2003Citibank, N.A.Method and system for strategic services enterprise workload managementUS6594682Oct 28, 1997Jul 15, 2003Microsoft CorporationClient-side system for scheduling delivery of web content and locally managing the web contentUS6606644Feb 24, 2000Aug 12, 2003International Business Machines CorporationSystem and technique for dynamic information gathering and targeted advertising in a web based model using a live information selection and analysis toolUS6637029Jun 30, 1998Oct 21, 2003Nds LimitedIntelligent electronic program guideUS6654388May 26, 1999Nov 25, 2003Larscom IncorporatedMethod and apparatus for automatically determining allocation of voice and data channels on T1/E1 lineUS6669096Jul 27, 1998Dec 30, 2003GemplusSmart card reader with microcontroller and security componentUS6675350Nov 4, 1999Jan 6, 2004International Business Machines CorporationSystem for collecting and displaying summary information from disparate sourcesUS6691312Mar 17, 2000Feb 10, 2004University Of MassachusettsMulticasting videoUS6697948May 5, 1999Feb 24, 2004Michael O. RabinMethods and apparatus for protecting informationUS6704797Jun 10, 1999Mar 9, 2004International Business Machines CorporationMethod and system for distributing image-based content on the internetUS6785712Sep 21, 2000Aug 31, 2004Rockwell Collins, Inc.Airborne e-mail data transfer protocolUS6805629Sep 13, 2000Oct 19, 2004Casino Data SystemGaming device and methodUS6811486May 2, 2002Nov 2, 2004Sierra Design GroupMethod and apparatus for enhancing game play through savable game play stateUS6826593Jun 9, 1999Nov 30, 2004Lucent Technologies Inc.Computer implemented method and apparatus for fulfilling a request for information content with a user-selectable version of a file containing that information contentUS6832241Jul 25, 2002Dec 14, 2004Intel CorporationDynamic content customization in a client-server environmentUS6873975Mar 8, 2000Mar 29, 2005Fujitsu LimitedContent usage control system, content usage apparatus, computer readable recording medium with program recorded for computer to execute usage methodUS6901386Mar 31, 2000May 31, 2005Intel CorporationElectronic asset lending library method and apparatusUS6920567Apr 7, 2000Jul 19, 2005Viatech Technologies Inc.System and embedded license control mechanism for the creation and distribution of digital content files and enforcement of licensed use of the digital content filesUS6928551Oct 27, 2000Aug 9, 2005Lockheed Martin CorporationMethod and apparatus for selectively denying access to encoded dataUS6993557Oct 25, 2000Jan 31, 2006Broadon Communications Corp.Creation of customized web pages for use in a system of dynamic trading of knowledge, goods and servicesUS7092953Dec 28, 2001Aug 15, 2006Rightlsline, Inc.Apparatus and methods for intellectual property database navigationUS7099479Aug 25, 2000Aug 29, 2006Sony CorporationInformation transmission system, transmitter, and transmission method as well as information reception system, receiver and reception methodUS20010014882Feb 7, 2001Aug 16, 2001Stefik Mark J.System for controlling the distribution and use of digital works using digital ticketsUS20010026287Jan 25, 2001Oct 4, 2001Satoshi WatanabeApparatus and method for managing contents in a computerUS20020016818Jul 6, 2001Feb 7, 2002Shekhar KiraniSystem and methodology for optimizing delivery of email attachments for disparate devicesUS20020032784Aug 21, 2001Mar 14, 2002Community Learning And Information NetworkComputer architecture for managing courseware in a shared use operating environmentUS20020057799Oct 9, 2001May 16, 2002Fumio KohnoData delivery system, server apparatus, reproducing apparatus, data delivery method, data playback method, storage medium, control, signal, and transmission data signalUS20020059384Jul 5, 2001May 16, 2002Koninklijke Philips Electronics N.V.Substituting URL for attachment in forwarding electronic contentUS20020071557Dec 7, 2000Jun 13, 2002Nguyen Binh T.Secured virtual network in a gaming environmentUS20020085720Nov 30, 2001Jul 4, 2002Masahiro OkadaGame apparatus managing system, game apparatus, controlling method, computer program and recording mediumUS20020116615Apr 3, 2002Aug 22, 2002IgtSecured virtual network in a gaming environmentUS20020154779 *Jan 26, 2001Oct 24, 2002Tomoyuki AsanoData recording/reproducing device and saved data processing method, and program proving mediumUS20050071640 *Mar 9, 2004Mar 31, 2005General Instrument CorporationMethod and apparatus for authenticating data* Cited by examinerNon-Patent CitationsReference1Arbaugh, William A., et al., "A Secure and Reliable Bootstrap Architecture," University of Pennsylvania (1996).2Aziz, Ashar, et al., "Privacy and Authentication for Wireless Local Area Networks," Sun Microsystems, Inc., (1993).3Bharadvaj et al., Proceedings of the 17th IEEE Symposium on Reliable Distributed Systems, pp. 118-123 (1998).4David A Dodson, "Gain Some Perspective With Innovation's GBA to TV Converter" Jun. 6, 2002, http://www.viewonline.com/page/articles/innovationsGBATV.htm>, Accessed Mar. 29, 2008.5Davida, George I., et al., "Defending Systems Against Viruses through Cryptographic Authentication," IEEE pp. 312-318 (1989).6Diffie, Whitfield, "The First Ten Years of Public-Key Cryptography," Proceedings of the IEEE, vol. 96, No. 5, pp. 560-577 (May 1988).7Diffie, Whitfield, et al., "New Directions in Cryptography," (1976).8Dyer, Joan G., et al., "Building the IBM 4758 Secure Coprocessor," Computer, pp. 2-12 (Oct. 2001).9Frantzen, Mike, et al., "StackGhost: Hardware Facilitated Stack Protection," Proceedings of the 10th USENIX Security Symposium (2001).10Fujimura, Ko., et al., "Digital-Ticket-Controlled Digital Ticket Circulation," Proceedings of the 8th USENIX Security Symposium (1999).11Game Boy Advance,-Boy-Advanced> Accessed Mar. 30, 2008.12Game Boy, -Boy-Advanced> Accessed Mar. 30, 2008.13Game Cube,-Cube> Accessed Mar. 28, 2008.14Gligor, Virgil D., "20 Years of Operating Systems Security," University of Maryland.15Gutmann, Peter, "The Design of a Cryptographic Security Architecture," Proceedings of the 8th USENIX Security Symposium (1999).16Hori et al., Computer Networks, 33(1-6):197-211 (2000).17Itoi, Naomaru, "SC-CFS: Smartcard Secured Cryptographic File System," Proceedings of the 10th USENIX Security Symposium (2001).18Jaeger, Trent, et al., "Building Systems that Flexibly Control Downloaded Executable Context," Proceedings of the 6th USENIX UNIX Security Symposium (1996).19Karger, Paul A., "New Methods for Immediate Revocation," IEEE (1989).20Kent, Stephen Thomas, "Protecting Externally Supplied Software in Small Computers," Massachusetts Institute of Technology (1980).21Kogan, Noam, et al., "A Practical Revocation Scheme for Broadcast Encryption Using Smart Cards," Proceedings of the 2003 IEEE Symposium on Security and Privacy (2003).22Lampson, Butler, et al., "Authentication in Distributed Systems" Theory and Practice, Digital Equipment Corporation (1992).23Lotspiech, Jeffrey, et al., "Anonymous Trust: Digital Rights Management Using Broadcast Encryption," Proceedings of the IEEE, vol. 92, No. 6, pp. 898-909 (Jun. 2004).24Lotspiech, Jeffrey, et al., "Broadcast Encryption's Bright Future," Computer, pp. 57-63 (Aug. 2002).25Monrose, et al., "Toward Speech-Generated Cryptographic Keys on Resource Constrained Devices," Proceedings of the 11th USENIX Security Symposium (2002).26Neumann, P.G., et al., "A Provably Secure Operating System," Stanford Research Institute (1975).27Nonnenmacher, Jorg et al., "Asynchronous Multicast Push: AMP." 13th International Conference on Computer Commnication, Nov. 18-21, 1997, pp. 419-430,13, Proceedings of International Conference on Computer Communication, Cannes.28Palmer, Elaine R., "An Introduction to Citadel-A Secure Crypto Coprocessor for Workstations," IBM Research Division (1992).29Peterson, David S., et al., "A Flexible Containment Mechanism for Executing Untrusted Code," Proceedings of the 11th USENIX Security Symposium (2002).30Rodriguez, Pablo et al. Improving the WWW: Caching or Multicast? Computer Networks and ISDN Systems. Nov. 25, 1998, 30(22-23):2223-2243.31Rubin, Aviel D., "Trusted Distribution of Software Over the Internet," Internet Society 1995 Symposium on Network and Distributed System Security.32Smith, Sean W., "Secure Coprocessing Applications and Research Issues," Los Alamos Unclassified Release LA-UR-96-2805 (1996).33Smith, Sean W., et al., "Building a High-Performance, Programmable Secure Coprocessor," Secure Systems and Smart Cards, IBM T.J. Watson Research Center, NY (1998).34Smith, Sean W., et al., "Using a High-Performance, Programmable Secure Coprocessor," Proceedings of the Second International Conference on Financial Cryptography.35Smith, Sean, et al., "Validating a High-Performance, Programmable Secure Coprocessor," Secure Systems and Smart Cards, IBM T.J. Watson Research Center, NY.36Stefik, Mark, "Trusted Systems," Scientific American, pp. 78-81 (Mar. 1997).37Traylor, Scott, "Graphic Resolution and File Sizes", http://www.traylormm.com/harvard/53graphicresolution/.38Tygar, J.D. et al., "Dyad: A System for Using Physically Secure Coprocessors," School of Computer Science, Carnegie Mellon University (1991).39Tygar, J.D., et al., "Strongbox: A System for Self-Securing Programs," pp. 163-197.40Van Doom, Leendert, "A Secure Java(TM) Virtual Machine," Proceedings of the 9th USENIX Security Symposium (2000).41Wang, Zheng et al. "Prefetching in World Wide Web." Global TeleCommnications Conference, Nov. 18-22, 1996, pp. 28-32, London.42White, et al., "ABYSS: An Architecture for Software Protection," IEEE Transactions on Software Engineering, vol. 16, No. 6, pp. 619-629(1990).43White, Steve R., et al., "Introduction to the Citadel Architecture: Security in Physically Exposed Environments," IBM Research Division (1991).44Wobber, Edward, et al., "Authentication in the Taso Operating System," Digital Systems Research Center (1993).45Yee, B., "Using Secure Coprocessors," PhD Thesis, School of Computer Science, Carnegie Mellon University, Pittsburgh, PA (1994).46Yee, B., et al., "Secure Coprocessors in Electronic Commerce Applications," Proceedings of the First USENIX Workshop on Electronic Commerce (1995).Referenced byCiting PatentFiling datePublication dateApplicantTitleUS7757075 *Nov 15, 2002Jul 13, 2010Microsoft CorporationState referenceUS8019988 *Aug 22, 2006Sep 13, 2011The State Of Oregon Acting By And Through The State Board Of Higher Education On Behalf Of The University Of OregonSecurity protocols for hybrid peer-to-peer file sharing networksUS8028159 *Aug 19, 2008Sep 27, 2011The State Of Oregon Acting By And Through The State Board Of Higher Education On Behalf Of The University Of OregonSecurity protocols for hybrid peer-to-peer file sharing networksUS8356178 *Nov 13, 2006Jan 15, 2013Seagate Technology LlcMethod and apparatus for authenticated data storageUS8645691 *Jan 13, 2012Feb 4, 2014Combined Conditional Access Development And Support, LlcSystem and method for securing data while minimizing bandwidthUS20100229069 *Jun 23, 2009Sep 9, 2010Takahiro YamaguchiDrive device, content reproduction device, recording device, data readout method, program, recording medium, and integrated circuit* Cited by examinerClassifications U.S. Classification713/177, 713/193International ClassificationG06F21/00Cooperative ClassificationH04L9/3213, H04L2209/605, H04L9/3265, H04L9/3236, G11B20/0021, G11B20/00507, G06F21/10, G11B20/00086, G11B20/00333, H04L2209/38, H04L9/0897European ClassificationG11B20/00P5, G06F21/10, H04L9/32Q2, G11B20/00P5A6F, G11B20/00P5G1B, H04L9/32D2, H04L9/32L, G11B20/00PLegal EventsDateCodeEventDescriptionMay 23, 2013FPAYFee paymentYear of fee payment: 4May 11, 2012ASAssignmentFree format text: CHANGE OF NAME;ASSIGNOR:IGWARE, INC.;REEL/FRAME:028196/0632Effective date: 20120112Owner name: ACER CLOUD TECHNOLOGY, INC., CALIFORNIAJun 18, 2010ASAssignmentOwner name: IGWARE INC.,CALIFORNIAFree format text: CHANGE OF NAME;ASSIGNOR:BROADON;REEL/FRAME:24555/857Effective date: 20100609Free format text: CHANGE OF NAME;ASSIGNOR:BROADON;REEL/FRAME:024555/0857Owner name: IGWARE INC., CALIFORNIAOct 24, 2006ASAssignmentOwner name: BROADON COMMUNICATIONS, INC., CALIFORNIAFree format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:PRINCEN, JOHN;SRINIVASAN, PRAMILA;ANDERSON, CRAIG STEVEN;REEL/FRAME:018470/0471Effective date: 20061023RotateOriginal ImageGoogle Home - Sitemap - USPTO Bulk Downloads - Privacy Policy - Terms of Service - About Google Patents - Send FeedbackData provided by IFI CLAIMS Patent Services©2012 Google