# US 10,503,934 B2 · Secure subsystem > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,503,934 B2 - Document ID: US10503934B2 - Status: Granted - Kind: B2 - Application number: 16/105,640 - Filed: 2018-08-20 - Published: 2018-12-13 - Granted: 2019-12-10 - Earliest claimed: 2015-10-06 - Assignees: Micron Technology, Inc. - Applicants: Micron Technology, Inc. - Inventors: Kenny T. Coker; David A. Pohm; Stephen P. Van Aken; Michael B. Danielson - Web page: https://patentgrep.com/patent/US10503934B2 ## CPC - G06F 21/78: to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00) - G06F 21/60: Protecting data - G06F 21/602: {Providing cryptographic facilities or services} - G06F 21/72: in cryptographic circuits - G06F 21/76: in application-specific integrated circuits [ASIC] or field-programmable devices, e.g. field-programmable gate arrays [FPGA] or programmable logic devices [PLD] - G09C 1/00: Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system (cryptographic typewriters G09C3/00) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G09C: CIPHERING OR DECIPHERING APPARATUS FOR CRYPTOGRAPHIC OR OTHER PURPOSES INVOLVING THE NEED FOR SECRECY ## Abstract An apparatus for performing secure operations with a dedicated secure processor is described in one embodiment. The apparatus includes security firmware defining secure operations, a processor configured to execute the security firmware and perform a set of operations limited to the secure operations, and a plurality of secure hardware registers, accessible by the processor and configured to receive instructions to perform the secure operations, An apparatus for performing secure operations with a plurality of security assist hardware circuits is described in another embodiment. The apparatus comprises one or more secure hardware registers configured to receive a command to perform secure operations and one or more security assist hardware circuits configured to perform discrete secure operations using one or more secret data objects. ## Claims ### Claim 1 An apparatus comprising: a secure subsystem located within a secure boundary and including: a memory device configured to receive, from outside the secure boundary, one or more secret data objects not accessible by any systems or components external to the secure subsystem, the memory device further configured to store the received one or more secret data objects; a processor configured to execute security firmware and perform a set of operations limited to a plurality of secure operations for manipulating the one or more secret data objects received from outside the secure boundary; a plurality of secure hardware registers, accessible by the processor and configured to receive instructions to perform the plurality of secure operations; and one or more security assist hardware circuits configured to perform discrete operations on data using the one or more secret data objects, wherein the one or more secret data objects are keys for secure operations. ### Claim 2 (depends on 1) The apparatus of claim 1, wherein the one or more secret data objects include at least one encryption key inaccessible to devices outside the apparatus. ### Claim 3 (depends on 1) The apparatus of claim 1, wherein the secure subsystem further includes an encryption circuit configured to encrypt the data using the one or more secret data objects. ### Claim 4 (depends on 1) The apparatus of claim 1, wherein the processor is a security processor, and wherein the security firmware is stored on an external memory and defines a limited number of secure operations performed by the security processor. ### Claim 5 (depends on 1) The apparatus of claim 1, wherein the secure subsystem further includes a decryption circuit configured to decrypt the data using the one or more secret data objects. ### Claim 6 (depends on 1) The apparatus of claim 1, wherein the secure subsystem further includes: an encrypt circuit coupled between the processor and a media interface; a decrypt circuit coupled to the media interface; and a transfer control circuit coupled to at least one security assist hardware circuit of the one or more security assist hardware circuits. ### Claim 7 (depends on 1) The apparatus of claim 1, wherein the one or more security assist hardware circuits are configured to perform at least one of client authentication, encryption key generation, key identification, key selection, and retrieval operations. ### Claim 8 (depends on 1) The apparatus of claim 1, wherein the secure subsystem is configured to encrypt secret information for storage external to the secure subsystem in in at least one of dynamic memory and nonvolatile memory. ### Claim 9 (depends on 1) The apparatus of claim 1, wherein the one or more secret data objects include an encryption key, and wherein the secure subsystem further includes an encryption circuit configured to encrypt the data using the encryption key and provide the encrypted data to a media interface to be stored in a storage media. ### Claim 10 (depends on 1) The apparatus of claim 1, wherein the one or more secret data objects include a decryption key stored in the memory device to remain within the secure subsystem, and wherein the secure subsystem further includes a decrypt circuit configured to decrypt the data using the decryption key inaccessible to components outside of the secure boundary, and the decrypt circuit is further configured to provide the decrypted data to a storage controller circuitry. ### Claim 11 An apparatus comprising: an internal memory device configured to receive, from outside the secure boundary, one or more secret data objects, the internal memory device further configured to store the one or more secret data objects not accessible by any systems or components external to the secure subsystem; one or more secure hardware registers located within a secure boundary and configured to receive a command to perform an operation using the one or more secret data objects received from outside the secure boundary; and one or more security assist hardware circuits coupled to the one or more secure hardware registers, respectively, the one or more security assist hardware circuits configured to perform discrete operations to access data using the one or more secret data objects, wherein the data accessed using the one or more secret data objects is provided to or by the one or more security assist hardware circuits and is not accessible from outside the secure boundary, and wherein the one or more secret data objects are keys for secure operations. ### Claim 12 (depends on 11) The apparatus of claim 11, further comprising: an encryption circuit configured to encrypt the data using the one or more secret data objects: and a decryption circuit configured to decrypt the data using the one or more secret data objects. ### Claim 13 (depends on 11) The apparatus of claim 11, wherein the one or more secret data objects encrypt secret information for storage external to a secure subsystem. ### Claim 14 (depends on 11) The apparatus of claim 11, wherein at least one secret data object of the one or more secret data objects is encrypted by a secret encryption key and then stored external to a secure subsystem. ### Claim 15 (depends on 11) The apparatus of claim 11, further comprising: a memory configured to store the one or more secret data objects; and a processor configured to execute security firmware and perform a set of operations including a plurality of secure operations used to manipulate the one or more secret data objects. ### Claim 16 (depends on 11) The apparatus of claim 11, wherein the one or more secret data objects include at least one encryption key. ### Claim 17 A method comprising: receiving, by one or more secure hardware registers of a plurality of secure hardware registers located in a secure subsystem within a secure boundary of an integrated circuit, a request to execute a secure operation involving one or more secret data objects encrypted by the secure subsystem, wherein the encrypted one or more secret data objects are stored outside the secure subsystem and inaccessible by any systems or components external to the secure subsystem; accessing, via or more security assist hardware circuits of a plurality of security assist hardware circuits, the one or more encrypted secret data objects with a key stored in the secure subsystem; and executing, via the one or more security assist hardware circuits, the secure operation on data using the one or more accessed secret data objects, wherein the one or more secret data objects are keys for secure operations. ### Claim 18 (depends on 17) The method of claim 17, further comprising: executing, by a memory system processor, security firmware responsive to a notification from the one or more secure hardware registers, the notification provided by the one or more secure hardware registers based on the received request. ### Claim 19 (depends on 17) The method of claim 17, further comprising: transmitting, to an unsecure hardware register, a value responsive to executing the secure operation. ### Claim 20 (depends on 17) The method of claim 17, wherein the secure operation is executed based on dedicated security firmware stored on a memory within the secure boundary.