Managing host application privileges

A method of managing host application privileges to access a hardware or software feature provided by a host, comprising:

• obtaining by a host application in a host a first encrypted credential from a non-volatile storage device configured for communication with the host, where the host application comprises a first application key associated with a first index and a second application key associated with a second index, wherein the first index and the second index are associated with an authorization to access the hardware or software feature, and wherein the first encrypted credential is associated with the first index;
• decrypting by the host application the first encrypted credential using the first application key to yield a first credential;
• transmitting the first credential and the first index from the host application to a host agent in the host;
• obtaining by the host application the second encrypted credential from the non-volatile storage device, wherein the second encrypted credential is associated with the second index;
• decrypting by the host application the second encrypted credential using the second application key to yield a second credential;
• transmitting the second credential and the second index from the host application to the host agent;
• and
• receiving at the host application one of a plurality of authorizations from the host agent if at least one of the first credential or the second credential is valid.

A method for managing host application privileges to a hardware or software feature provided by a host, comprising:

• receiving at a non-volatile storage device an instruction from a third party to store an encrypted valid credential in a storage location in the non-volatile storage device corresponding to an index, the instruction comprising the encrypted valid credential and the index, wherein the index is associated with a hardware or software feature provided by a host;
• storing the encrypted valid credential in the storage location in the non-volatile storage device corresponding to the index, wherein the storing enables a host application to access the hardware or software feature associated with the index;
• receiving from the host application a request to read the storage location associated with the index;
• returning the encrypted valid credential to the host application in response to the request, wherein returning the encrypted valid credential permits the host application to calculate a valid credential by decrypting the encrypted valid credential and receive from a host agent an authorization to access the hardware or software feature after presenting the valid credential and the index to the host agent;
• receiving at the non-volatile storage device an additional instruction from the third party to replace the encrypted valid credential with an encrypted invalid credential, the instruction comprising the encrypted invalid credential;
• and
• the non-volatile storage device replacing the encrypted valid credential in the storage location corresponding to the index with the encrypted invalid credential, wherein the non-volatile storage device is configured to return the encrypted invalid credential in response to a subsequent request from the host application to read the storage location, thereby preventing the host application from accessing the hardware or software feature associated with the index.

A host device comprising:

• an input/output port configured to place the host in communication with a non-volatile storage device, comprising a storage location associated with an index value;
• and
• a host agent configured for communication with the input/output port and configured to:
• receive an authorization request from a host application, wherein the authorization request comprises a credential and the index value, and wherein the index value is associated with the hardware or software feature;
• obtain credential validation data from the storage location in the non-volatile storage device corresponding to the index value;
• determine if the credential is valid based on the credential validation data;
• transmit an authorization from the host agent to the host application if the credential is a valid credential;
• receive from a third party an instruction to replace the credential validation data stored in the non-volatile storage device, the instruction comprising an invalid credential validation data;
• and
• instruct the non-volatile storage device to replace the credential validation data stored in the non-volatile storage device with the invalid credential validation data, wherein future authorization requests by the host application to access the hardware or software feature are denied.