Patent ID: 8209535

Claim:
A method for performing authentication between a device and a portable storage, which is performed by the device, comprising: transmitting a first key from the device to the portable storage; receiving a third key and a first encrypted random number, wherein the first encrypted random number is obtained by encrypting a first random number using the first key, from the portable storage and decrypting the first encrypted random number using a second key related with the first key; generating a second encrypted random number by encrypting a second random number using the third key after receiving the third key and the first encrypted random number, and transmitting the second encrypted random number from the device to the portable storage; generating a session key using the first random number and the second random number, the first random number being generated by the portable storage, and the second random number being generated by the device; receiving information regarding a time at which a certificate revocation list (CRL) of the portable storage is issued, from the portable storage, together with the first encrypted random number and the third key; and transmitting information regarding a time at which a CRL of the device is issued to the portable storage together with the second encrypted random number, receiving information indicating a session key generated by the portable storage; and verifying whether the session key generated by the device is identical with the session key generated by the portable storage.