In a limited-copy protection scheme, a check-out/check-in system is
configured to a) verify that the receiving device is a certified
conforming device, and b) verify that the device that checks-in content
material is the same device that checked-out the content material. The
verification of the receiving device is effected via a conventional
certification process. The verification that the same device is used for
check-in and check-out is effected via a secure challenge-response
protocol. As contrast to a conventional contemporaneous
challenge-response protocol, the system provides a challenge that is
specific to the receiving device when the content material is
checked-out, and verifies the appropriate response when the content
material is checked-in. Because the challenge-response is specific to the
receiving device, only the device that receives the challenge when the
content material is checked-out can provide the appropriate response when
the content material is checked-in.