# US 10,372,625 B2 · Secure memory > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,372,625 B2 - Document ID: US10372625B2 - Status: Granted - Kind: B2 - Application number: 15/391,229 - Filed: 2016-12-27 - Published: 2018-06-28 - Granted: 2019-08-06 - Earliest claimed: 2016-12-27 - Assignees: Intel Corporation - Applicants: Intel Corporation - Inventors: Rodrigo R. Branco; Shay Gueron - Web page: https://patentgrep.com/patent/US10372625B2 ## CPC - G06F 12/1408: {by using cryptography (for digital transmission H04L9/00)} - G06F 11/1048: {using arrangements adapted for a specific error detection or correction feature} - G06F 21/78: to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00) - H04L 9/0618: {Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation} - H04L 9/0662: {with particular pseudorandom sequence generator} - G06F 7/588: {Random number generators, i.e. based on natural stochastic processes} - G06F 2212/1052: Security improvement - G06F 2212/402: Encrypted data - G06F 2212/403: Error protection encoding, e.g. using parity or ECC codes - H04L 2209/34: Encoding or coding, e.g. Huffman coding or error correction - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Various examples are directed to systems and methods for securing a data storage device. A storage controller may receive a read request directed to the data storage device. The read request may comprise address data indicating a first address of a first storage location at the data storage device. The storage controller may request from the data storage device a first encrypted data unit stored at the first memory element and a first encrypted set of parity bits, such as Error Correction Code (ECC) bits, associated with the first storage location. An encryption system may decrypt the first encrypted set of parity bits to generate a first set of parity bits based at least in part on an a first location parity key for the first address. ## Claims ### Claim 1 A data storage system with encryption support comprising: a data storage device comprising a plurality of storage locations, the plurality of storage locations comprising a first storage location associated with a first address; a storage controller to receive a read request directed to the data storage device, wherein the read request comprises address data indicating the first address; wherein the storage controller is to request from the data storage device a first encrypted data unit stored at the first storage location and a first encrypted set of parity bits associated with the first storage location; an encryption system to generate a master parity key; wherein the encryption system is to generate a first location parity key for the first storage location based at least in part on the master parity key and the first address; and wherein the encryption system is to decrypt the first encrypted set of parity bits to generate a first set of parity bits based at least in part on first location parity key. ### Claim 2 (depends on 1) The data storage system of claim 1, wherein the encryption system is also to decrypt the first encrypted data unit based at least in part on a data unit encryption key. ### Claim 3 (depends on 1) The data storage system of claim 1, wherein the encryption system is to generate the first location parity key after the storage controller receives the read request. ### Claim 4 (depends on 1) The data storage system of claim 1, wherein the encryption system is to generate the master parity key based at least in part on a data unit encryption key for decrypting the first encrypted data unit and a value generated by a random number generator. ### Claim 5 (depends on 1) The data storage system of claim 1, wherein the encryption system is to decrypt the first encrypted set of parity bits by performing operations comprising: encrypting a block of the first encrypted data unit based at least in part on the first location parity key to generate a ciphertext; truncating the ciphertext to generate a truncated ciphertext; and masking the first encrypted set of parity bits with the truncated ciphertext to generate the first set of parity bits. ### Claim 6 (depends on 1) The data storage system of claim 1: wherein the storage controller is also to receive a write request directed to a second storage location of the data storage device associated with a second address, wherein the write request comprises a second data unit and second address data indicating the second address; and wherein the encryption system is to encrypt a second set of parity bits for the second data unit based at least in part on a second location parity key for the second address. ### Claim 7 (depends on 6) The data storage system of claim 6 wherein the encryption system is to generate the second location parity key based at least in part on the master parity key and the second address. ### Claim 8 (depends on 6) The data storage system of claim 6, wherein the encryption system is to encrypt the second set of parity bits by performing operations comprising: encrypting a block of a second encrypted data unit based at least in part on the second location parity key to generate a ciphertext; truncating the ciphertext to generate a truncated ciphertext; and masking the second set of parity bits with the truncated ciphertext to generate an encrypted second set of parity bits. ### Claim 9 (depends on 1) The data storage system of claim 1, wherein the data storage device comprises a memory device, and wherein the first set of parity bits comprises a set of Error Correction Code (ECC) bits. ### Claim 10 A method for securing a data storage device, comprising: receiving, by a storage controller, a read request directed to the data storage device, wherein the read request comprises address data indicating a first address of a first storage location at the data storage device; requesting, by the storage controller, from the data storage device a first encrypted data unit stored at the first storage location and a first encrypted set of parity bits associated with the first storage location; generating, by an encryption system, a master parity key; generating, by the encryption system, a first location parity key for the first storage location based at least in part on the master parity key and the first address; and decrypting, by the encryption system, the first encrypted set of parity bits to generate a first set of parity bits based at least in part on an the first location parity key. ### Claim 11 (depends on 10) The method of claim 10, further comprising generating the master parity key based at least in part on a data unit encryption key for decrypting the first encrypted data unit and a value generated by a random number generator. ### Claim 12 (depends on 10) The method of claim 10, further comprising: receiving a write request directed to a second storage location of the data storage device associated with a second address, wherein the write request comprises a second data unit and second address data indicating the second address; and encrypting a second set of parity bits for the second data unit based at least in part on a second location parity key for the second address. ### Claim 13 (depends on 12) The method of claim 12, further comprising generating the second location parity key based at least in part on the master parity key and the second address. ### Claim 14 (depends on 12) The method of claim 12, wherein encrypting the second set of parity bits comprises: encrypting a block of a second encrypted data unit based at least in part on the second location parity key to generate a ciphertext; truncating the ciphertext to generate a truncated ciphertext; and masking the second set of parity bits with the truncated ciphertext to generate an encrypted second set of parity bits. ### Claim 15 At least one non-transitory computer readable medium comprising instructions thereon that, when executed by at least one processor, cause the at least one processor to perform operations comprising: receiving a read request directed to a data storage device, wherein the read request comprises address data indicating a first address of a first storage location at the data storage device; requesting from the data storage device a first encrypted data unit stored at the first storage location and a first encrypted set of parity bits associated with the first storage location; generating a master parity key; generating a first location parity key for the first storage location based at least in part on the master parity key and the first address; and decrypting the first encrypted set of parity bits to generate a first set of parity bits based at least in part on an the first location parity key. ### Claim 16 (depends on 15) The at least one computer readable medium of claim 15, further comprising instructions thereon that, when executed by at least one processor, cause the at least one processor to perform operations comprising decrypting the first encrypted data unit based at least in part on a data unit encryption key. ### Claim 17 (depends on 15) The at least one computer readable medium of claim 15, further comprising instructions thereon that, when executed by at least one processor, cause the at least one processor to perform operations comprising generating the first location parity key after receiving the read request. ### Claim 18 (depends on 15) The at least one computer readable medium of claim 15, further comprising instructions thereon that, when executed by at least one processor, cause the at least one processor to perform operations comprising generating the master parity key based at least in part on a data unit encryption key for decrypting the first encrypted data unit and a value generated by a random number generator. ### Claim 19 (depends on 15) The at least one computer readable medium of claim 15, wherein decrypting the first encrypted set of parity bits comprises: encrypting a block of the first encrypted data unit based at least in part on the first location parity key to generate a ciphertext; truncating the ciphertext to generate a truncated ciphertext; and masking the first encrypted set of parity bits with the truncated ciphertext to generate the first set of parity bits. ### Claim 20 (depends on 15) The at least one computer readable medium of claim 15, further comprising instructions thereon that, when executed by at least one processor, cause the at least one processor to perform operations comprising: receiving a write request directed to a second storage location of the data storage device associated with a second address, wherein the write request comprises a second data unit and second address data indicating the second address; and encrypting a second set of parity bits for the second data unit based at least in part on a second location parity key for the second address. ### Claim 21 (depends on 20) The at least one computer readable medium of claim 20, further comprising instructions thereon that, when executed by at least one processor, cause the at least one processor to perform operations comprising generating the second location parity key based at least in part on the master parity key and the second address. ### Claim 22 (depends on 20) The at least one computer readable medium of claim 20, wherein encrypting the second set of parity bits comprises: encrypting a block of a second encrypted data unit based at least in part on the second location parity key to generate a ciphertext; truncating the ciphertext to generate a truncated ciphertext; and masking the second set of parity bits with the truncated ciphertext to generate an encrypted second set of parity bits.