Abstract: Enhanced configuration of security and access control for data in a storage device is disclosed. A request is received to access an addressable memory location in a storage media within the storage device. A set of addressable memory locations with contiguous addresses identified by an address range is associated with first and second characteristics. The first characteristic is applied if the addressable memory location is within the set of addressable memory locations, and an entity is currently authenticated to and authorized to access the set of addressable memory locations. The second characteristic is applied if the addressable memory location is within the set of addressable memory locations, and no entity is currently authenticated to and authorized to access the set of addressable memory locations. The set of addressable memory locations can also be a logical partition, where the first and second characteristics are stored in a logical partition table.

Abstract: A storage device and method for providing a scalable content protection system are disclosed. In one embodiment, a storage device is provided comprising a memory operative to store a plurality of versions of content, wherein each version of the content is of a different quality and is associated with a different level of content protection. The storage device receives information from the host identifying a level of content protection supported by the host. The storage device sends, to the host, a version of the content that is associated with the level of content protection supported by the host, wherein the version of the content is sent to the host using the level of content protection that is supported by the host. In another embodiment, different levels of content protection are applied to different types of content.

Abstract: Techniques are presented for sending an application instruction from a hosting digital appliance to a portable medium, where the instruction is structured as one or more units whose size is a first size, or number of bytes. After flushing the contents of a cache, the instruction is written to the cache, where the cache is structured as logical blocks having a size that is a second size that is larger (in terms of number of bytes) than the first size. In writing the instruction (having a command part and, possibly, a data part), the start of the instruction is aligned with one of the logical block boundaries in the cache and the instruction is padded out with dummy data so that it fills an integral number of the cache blocks. When a response from a portable device to an instruction is received at a hosting digital appliance, the cache is similarly flushed prior to receiving the response. The response is then stored to align with a logical block boundary of the cache.

Abstract: A memory system comprises an encryption engine implemented in the hardware of a controller. In starting up the memory system, a boot strapping mechanism is implemented wherein a first portion of firmware when executed pulls in another portion of firmware to be executed. The hardware of the encryption engine is used to verify the integrity of at least the first portion of the firmware. Therefore, only the firmware that is intended to run the system will be executed.

Abstract: A method for using time from a trusted host device is disclosed. In one embodiment, an application on a memory device receives a request to perform a time-based operation from an entity authenticated by the memory device, wherein the entity is running on a host device. The application selects time from the host device instead of time from a time module on the memory device to perform the time-based operation and uses the time from the host device to perform the time-based operation. Other embodiments are disclosed, and each of the embodiments can be used alone or together in combination.

Abstract: A mechanism or structure may be provided to divide a memory into partitions and so that at least some data in the partitions can be encrypted with a key, so that in addition to authentication that is required for accessing some of the partitions, access to one or more keys may be required to decrypt the encrypted data in such partitions. All of the content that the user wishes to access may be associated with a first account, so that all such content can be accessed via different applications (e.g. music player, email, cellular communication etc.) without having to log in multiple times. Then a different set of authentication information may then be used for logging in to access protected content that is in an account different from the first account, even where the different accounts are for the same user or entity.

Abstract: The embodiments described herein generally use a challenge to protect a removable mobile flash memory storage device, where the challenge may be in the form of a “Completely Automated Public Turing Test to Tell Computers and Humans Apart” (“CAPTCHA”). In one embodiment, a method is provided in which a removable mobile flash memory storage device receives a command from a host device, generates a CAPTCHA challenge, provides the CAPTCHA challenge to the host device, receives a response to the CAPTCHA challenge from the host device, determines if the response satisfies the CAPTCHA challenge, and performs the command only if the response satisfies the CAPTCHA challenge. In another embodiment, a removable mobile flash memory storage device is provided for performing these acts.

Abstract: A method for improving accuracy of a time estimate used in digital rights management (DRM) license validation is disclosed. In one embodiment, a memory device receives a request to validate a DRM license stored on the memory device, wherein the DRM license is associated with a time stamp update policy (TUP) that specifies when a new time stamp is needed. Before attempting to validate the DRM license, the memory device determines if a new time stamp is needed based on the TUP associated with the DRM license. If a new time stamp is needed, the memory device receives the new time stamp and then attempts to validate the DRM license using a time estimate based on the new time stamp. Other embodiments are disclosed, and each of the embodiments can be used alone or together in combination.

Abstract: A method for improving accuracy of a time estimate from a memory device is disclosed. In one embodiment, a memory device receives a time stamp and measures active time with respect to the received time stamp. The memory device determines accuracy of previously-measured active time and generates a time estimate using the measured active time, the accuracy of previously-measured active time, and the received time stamp. In another embodiment, measured active time is adjusted, with or without generating a time estimate. Other embodiments are disclosed, and each of the embodiments can be used alone or together in combination.

Abstract: An object known as an identity object comprises a public key and a private key pair and at least one certificate issued by a certificate authority that certifies that the public key of the pair is genuine. In one embodiment, this object may be used as proof of identification by using the private key to sign data provided to it or signals derived from the data. An identity object may be stored in a non-volatile memory as proof of identity, where the memory is controlled by a controller. Preferably, a housing encloses the memory and the controller.

Abstract: A data object storing data in the memory device is associated with at least one software application. Accessing the object will invoke the at least one software application which processes the data in the object. Individual ones of a plurality of first sets of protocols are selectable for enabling data to be provided and stored in a data object. A second set of protocols can be used to retrieve data from the data object, or data derived from such data, irrespective of which of the first set of protocols was used to enable the provision and storing of data in the object.

Abstract: In some applications, it may be more convenient to the user to be able to log in the memory system using one application, and then be able to use different applications to access protected content without having to log in again. In such event, all of the content that the user wishes to access in this manner may be associated with a first account, so that all such content can be accessed via different applications (e.g. music player, email, cellular communication etc.) without having to log in multiple times. Then a different set of authentication information may then be used for logging in to access protected content that is in an account different from the first account, even where the different accounts are for the same user or entity.

Abstract: These embodiments relate to authentication and securing of write-once, read-many (WORM) memory devices. In one embodiment, a memory device comprises a controller operable in first and second modes of operation after stored security information is validated, wherein in the first mode of operation, the memory device operates in a read-only mode, and wherein in the second mode of operation, the memory device operates in a write-once, read-many (WORM) mode. In another embodiment, the controller is operative to perform security methods.

Abstract: A method and memory device for implementing long operations and supporting multiple streams are provided. In one embodiment, a memory device receives data and a command from a host to perform an operation on the data, wherein a time required for the memory device to complete the operation exceeds a maximum response time for the memory device to respond to the command. The memory device begins performing the operation on the data and, before exceeding the maximum response time and before completing the operation, sends the context of the operation to the host. At a later time, the memory device receives from the host: (i) a command to resume performing the operation and (ii) the context. The memory device then resumes performing the operation on the data based on the context received from the host.

Abstract: Many storage devices are not aware of file systems while many computer host devices read and write data in the form of files. The host device provides a key reference or ID, while the memory system generates a key value in response which is associated with the key ID, which is used as the handle through which the memory retains complete and exclusive control over the generation and use of the key value for cryptographic processes, while the host retains control of files.

Abstract: A secure memory card with encryption capabilities comprises various life cycle states that allow for testing of the hardware and software of the card in certain of the states. The testing mechanisms are disabled in certain other of the states thus closing potential back doors to secure data and cryptographic keys. Controlled availability and generation of the keys required for encryption and decryption of data is such that even if back doors are accessed that previously encrypted data is impossible to decrypt and thus worthless even if a back door is found and maliciously pried open.

Abstract: Methods for transmitting application specific or extended commands between a host and a memory card are disclosed. Commands for an extended card protocol are embedded in messages, along with a marker, in the data or command portion of a base card transmission protocol that is used to communicate between the host and the memory card. This allows for the transmission of application specific commands that lack a corresponding command in the base card protocol. The method can be implemented on the host side at the device driver level or the file level. In order to implement a read command in the extended card protocol, a write command in the base card protocol with an encapsulated read command in the extended protocol is first sent to a logical address, followed by a read command to the same logical address. Message set identifiers associate embedded commands and data received in separate transmissions.

Abstract: A secure memory card with encryption capabilities comprises various life cycle states that allow for testing of the hardware and software of the card in certain of the states. The testing mechanisms are disabled in certain other of the states thus closing potential back doors to secure data and cryptographic keys. Controlled availability and generation of the keys required for encryption and decryption of data is such that even if back doors are accessed that previously encrypted data is impossible to decrypt and thus worthless even if a back door is found and maliciously pried open.

Abstract: These embodiments relate to authentication and securing of write-once, read-many (WORM) memory devices. In one embodiment, a memory device comprises a controller operable in first and second modes of operation after stored security information is validated, wherein in the first mode of operation, the memory device operates in a read-only mode, and wherein in the second mode of operation, the memory device operates in a write-once, read-many (WORM) mode. In another embodiment, the controller is operative to perform security methods.

Abstract: A memory storing public and confidential information is removably connected to a host device. General information on data stored in memory devices is accessible to the host device without authentication. Only a portion of confidential information stored in the memory device is accessible through the host device to an authenticated entity, where the entity has access rights to such portion. The entity is not able to access other portions of confidential information to which it has no rights. The public and confidential information is stored in a non-volatile storage medium, and a controller controls the supply of information. Preferably, the non-volatile storage medium and the controller are enclosed in a housing.