Binding content licenses to portable storage devices

A machine-readable storage medium encoded with machine-readable instructions that, when executed by a machine, cause the machine to perform an authentication protocol comprising:ngenerating a nonce;sending the nonce to a store associated with a host, the store being a portable storage device;receiving a session key from the store to authenticate the store to the host, the session key being generated using the nonce and encrypted using a public key associated with the host; andassociating a license with the store and content contained in the store such that when the store is removed from the host and inserted into a second host, the license is transferred with the store such that the license remains associated with the store and the host does not retain residual rights to render the content, wherein the second host processes the store to determine whether the second host is authorized to render the content based at least in part on whether the store includes one or more tokens.

A machine-readable storage medium encoded with machine-readable instructions that, when executed, cause a machine to perform operations comprising:nreceiving an encrypted nonce from a host associated with a store, the store being a portable storage device that is detachably coupled to the host;generating a session key based at least in part on the encrypted nonce;sending the session key to the host to authenticate the portable storage device;binding to the store one or more licenses associated with content contained in the store such that the one or more licenses are transferable with the store and are maintained in the store subsequent to a transfer of the content, the host determining that the host is authorized to render the content by:ndetermining whether the store contains one or more tokens;parsing the one or more tokens to determine whether the one or more tokens are valid based at least in part on a determination that the store contains the one or more tokens; andrequesting a token from a token granting service based at least in part on a determination that the store does not contain the one or more tokens.