US 11,310,048 B2Granted

Portable storage device with internal secure controller that performs self-verification and self-generates encryption key(s) without using host or memory controller and that securely sends encryption keys(s) via side channel

AssigneeApricorn

InventorsPaul Cameron Brown, Roy Walter Younggren

Life of this patent

Estimating the term…

Loading patent…

Abstract

Highly secure portable storage device may include a security controller, a data transfer controller and a memory controller. The security controller self-verifies, without a host, an access code. After the verification, the security controller may retrieve a concealed encryption key and a transformation key that were previously self-generated by the security controller. The encryption keys are not generated by the host, a user, or the memory controller. The transformation key is sent to the memory controller via a side channel during a first time period. The concealed encryption key is sent to the memory controller via the side channel during a different time period. After extracting an operating encryption key, the memory controller may notify the data transfer controller to initiate an enumeration process with the host. Data transfer from and to the host is performed via interfaces different from the side channel. Other methods and implementations are also described.

Claims20

Dependent claims

A storage device, comprising:

a housing;
a non-volatile memory disposed within the housing and configured to store encrypted data;
a first controller disposed within the housing and configured to receive a security access code;
a second controller disposed within the housing, wherein the second controller is coupled to the first controller and the non-volatile memory, the second controller comprises an encryption engine, and the second controller is configured to communicate with the first controller via a first interface;
a third controller disposed within the housing and coupled to the second controller, wherein the third controller is configured to communicate with the second controller via a second interface and configured to communicate with a host via a third interface;
a first channel for communication between the first controller and the second controller;
a second channel for communication between the second controller and the third controller;
and
a third channel for communication between the second controller and the non-volatile memory,
wherein:
the first controller is configured to cause verifying the security access code, received by the storage device, using an access code;
the first channel is configured to cause providing an encryption key between the first controller and the second controller;
the second controller is configured to cause:
encrypting using the encryption engine, data from the host, based on the encryption key;
providing the encrypted data to the non-volatile memory via the third channel;
receiving data from the non-volatile memory via the third channel;
decrypting the data from the non-volatile memory, based on the encryption key;
and
providing the decrypted data to the third controller;
the third controller is configured to cause:
transferring the decrypted data toward the host via the third interface;
and
transferring, the data from the host, to the second controller via the second interface and the second channel;
the storage device is separate and distinct from the host;
the first controller is separate and distinct from the second controller;
the second controller is separate and distinct from the third controller;
the first interface is of a first type;
the second interface is of a second type;
the third interface is of a third type;
the first type is different from the second type;
and
the second type is different from the third type.

29 more elements

An apparatus, comprising:

a housing;
a non-volatile memory disposed within the housing and configured to store encrypted data;
means for verifying a security access code;
means for encrypting or decrypting information, wherein the means for encrypting or decrypting comprises a first interface for communicating with the means for verifying;
means for transferring information from or to a host, wherein the means for transferring comprises a second interface for communicating with the means for encrypting or decrypting and comprises a third interface for communicating with the host;
a first channel for communication between the means for verifying and the means for encrypting or decrypting;
a second channel for communication between the means for encrypting or decrypting and the means for transferring;
and
a third channel for communication between the means for encrypting or decrypting and the non-volatile memory,
wherein:
the means for verifying comprises means for verifying the security access code, received by the apparatus, using an access code;
the first channel is configured to cause providing an encryption key between the means for verifying and the means for encrypting or decrypting;
the means for encrypting or decrypting comprises:
means for encrypting using an encryption engine, data from the host, based on the encryption key;
means for providing the encrypted data to the non-volatile memory via the third channel;
means for receiving data from the non-volatile memory via the third channel;
means for decrypting the data from the non-volatile memory, based on the encryption key;
and
means for providing the decrypted data to the means for transferring;
the means for transferring comprises:
means for transferring the decrypted data toward the host via the third interface;
and
means for transferring, the data from the host, to the means for encrypting or decrypting via the second interface and the second channel;
the apparatus is separate and distinct from the host;
the means for verifying is separate and distinct from the means for encrypting or decrypting;
the means for encrypting or decrypting is separate and distinct from the means for transferring;
the first interface is of a first type;
the second interface is of a second type;
the third interface is of a third type;
the first type is different from the second type;
and
the second type is different from the third type.

29 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/833,440Filed 27 Mar 2020 · continuation
Priority: 24 Sep 2019
Published: US 2021/0091954 A125 Mar 2021
Granted: 19 Apr 2022
Term ends: Not estimatedThe source records don’t support an estimate.

Classification12 codes

H04L 9/3226
Including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity…: using…
G06F 21/31
Authentication, i.e. establishing the identity or authorisation of security principals: user authentication
G06F 21/74
To assure secure computing or processing of information: operating in dual or compartmented mode, i.e. at least one secure mode
G06F 21/78
Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer: to…

Family

Application16/581,693Parent of this continuation · filed 24 Sep 2019
US 2021/0091954 A1Pre-grant publication · published 25 Mar 2021
US 10,608,819 B1Parent of this continuation
US 11,310,048 B2This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key