# US 11,030,119 B2 · Storage data encryption and decryption apparatus and method

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,030,119 B2
- Document ID: US11030119B2
- Status: Granted
- Kind: B2
- Application number: 16/175,732
- Filed: 2018-10-30
- Published: 2019-03-07
- Granted: 2021-06-08
- Earliest claimed: 2017-08-08
- Assignees: C-SKY Microsystems Co., Ltd.
- Applicants: C-SKY Microsystems Co., Ltd.
- Inventors: Jun Yang; Jie Wang
- Web page: https://patentgrep.com/patent/US11030119B2

## CPC

- G06F 12/1408: {by using cryptography (for digital transmission H04L9/00)}
- G06F 7/588: {Random number generators, i.e. based on natural stochastic processes}
- G06F 21/602: {Providing cryptographic facilities or services}
- G06F 21/79: in semiconductor storage media, e.g. directly-addressable memories
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L 9/14: using a plurality of keys or algorithms
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

The present disclosure provides a storage data encryption and decryption method, including: providing a true random number generator configured to generate a plurality of keys; providing a data memory configured to store data and a key memory configured to store keys, and writing the keys into the key memory; and providing a data reading and writing interface module configured to read and write data, and providing a data encryption and decryption module configured to read the keys and perform encryption and decryption operations. The data written by the data reading and writing interface module is encrypted by the data encryption and decryption module and written into the data memory. The data read from the data memory is decrypted by the data encryption and decryption module and read to the data reading and writing interface module.

## Claims

### Claim 1

A method for encrypting and decrypting data, the method performed by an embedded system and comprising:
generating, by a true random number generator of the embedded system, a plurality of keys, wherein:
the plurality of keys comprise a first key and a second key,
the first key is used to encrypt acquired data to be written to a first chip of the embedded system and to decrypt encrypted data read from the first chip, and
the second key is used to encrypt acquired data to be written to a second chip of the embedded system and to decrypt encrypted data read from the second chip;
writing the plurality of keys into a key memory of the embedded system; and
performing, using the first key of the plurality of keys from the key memory, encryption operation on data to be written into a data memory of the first chip and decryption operation on data read from the data memory of the first chip.

### Claim 2 (depends on 1)

The method according to claim 1, wherein generating the plurality of keys further comprises:
determining whether data in the data memory is to be divided; and
performing encryption and decryption operations in response to the determination.

### Claim 3 (depends on 2)

The method of claim 2, wherein performing encryption and decryption operations in response to the determination comprises:
in response to determining that the data in the data memory is to be divided:
partitioning the data memory into a plurality of logical data storage areas; and
performing encryption and decryption operations selectively on data of the plurality of logical data storage areas.

### Claim 4 (depends on 3)

The method of claim 3, wherein performing the encryption and decryption operations selectively on data of the plurality of logical data storage areas use a third key for a first logical data storage area of the plurality of logical data storage areas and a fourth key for a second logical data storage of the plurality of logical data storage areas.

### Claim 5 (depends on 4)

The method of claim 4, wherein the third key is different from the fourth key.

### Claim 6 (depends on 4)

The method of claim 4, wherein the third key and the fourth key are different from another key associated with another data memory.

### Claim 7 (depends on 2)

The method of claim 2, wherein performing encryption and decryption operations in response to the determination comprises:
in response to determining that the data in the data memory is not to be divided, performing encryption and decryption operations on data of an entire data storage area.

### Claim 8 (depends on 7)

The method according to claim 7, wherein performing the encryption and decryption operations on data of the entire data storage area uses a unified key for the entire data storage area.

### Claim 9 (depends on 8)

The method according to claim 8, wherein the unified key for the entire data storage area is different from another key associated with another data memory.

### Claim 10 (depends on 1)

The method according to claim 1, wherein performing the encryption and decryption operations uses a single-cycle encryption and decryption algorithm.

### Claim 11 (depends on 10)

The method according to claim 10, wherein the encryption and decryption algorithm comprises one of exclusive OR encryption or sequence rearrangement.

### Claim 12 (depends on 1)

The method according to claim 1, wherein the at least one key of the plurality of keys is acquired automatically by the key memory when the embedded system is started.

### Claim 13 (depends on 1)

The method according to claim 1, wherein the data memory and the key memory are located on a same physical medium of the embedded system.

### Claim 14 (depends on 1)

The method according to claim 1, further comprising clearing the plurality of keys stored in the key memory in response to a determination that the embedded system is being attacked.

### Claim 15

An embedded system for encrypting and decrypting data, comprising:
a true random number generator configured to generate a plurality of keys, wherein:
the plurality of keys comprise a first key and a second key,
the first key is used to encrypt acquired data to be written to a first chip of the embedded system and to decrypt encrypted data read from the first chip, and
the second key is used to encrypt acquired data to be written to a second chip of the embedded system and to decrypt encrypted data read from the second chip;
a memory bank comprising a key memory configured to store the plurality of keys; and
a memory module configured to use the first key of the plurality of keys from the key memory to perform encryption operation on data to be written into a data memory of the first chip and decryption operations on data to be read from the data memory the first chip.

### Claim 16 (depends on 15)

The system according to claim 15, wherein the memory module is further configured to:
determine whether data in the data memory is to be divided; and
perform encryption and decryption operations in response to the determination.

### Claim 17 (depends on 16)

The system according to claim 16, wherein the memory module is further configured to:
in response to determining that the data in the data memory is to be divided:
partition the data memory into a plurality of logical data storage areas; and
perform encryption and decryption operations selectively on data of the plurality of logical data storage areas.

### Claim 18 (depends on 17)

The system according to claim 17, wherein the memory module is further configured to use a third key for a first logical data storage area of the plurality of logical data storage areas and a fourth key for a second logical data storage of the plurality of logical data storage areas.

### Claim 19 (depends on 18)

The system according to claim 18, wherein the third key is different from the fourth key.

### Claim 20 (depends on 18)

The system according to claim 18, wherein the third key and the fourth key are different from another key associated with another data memory.

### Claim 21 (depends on 16)

The system according to claim 16, wherein the memory module is further configured to:
in response to determining that the data in the data memory is not to be divided, perform encryption and decryption operations on data of an entire data storage area.

### Claim 22 (depends on 21)

The system according to claim 21, wherein the memory module is further configured to use a unified key for the entire data storage area.

### Claim 23 (depends on 22)

The system according to claim 22, wherein the memory module is configured to use a single-cycle encryption and decryption algorithm for performing the encryption and decryption operations.

### Claim 24 (depends on 23)

The system according to claim 23, wherein the encryption and decryption algorithm comprises one of exclusive OR encryption or sequence rearrangement.

### Claim 25 (depends on 1)

The system according to claim 1, wherein the at least one key of the plurality of keys is acquired automatically by the key memory when the embedded system is started.

### Claim 26 (depends on 1)

The system according to claim 1, wherein the data memory and the key memory are located on a same physical medium of the embedded system.

### Claim 27 (depends on 1)

The system according to claim 1, wherein the memory module is further configured to clear the plurality of keys stored in the key memory in response to a determination that the embedded system is being attacked.