# US 11,310,048 B2 · Portable storage device with internal secure controller that performs self-verification and self-generates encryption key(s) without using host or memory controller and that securely sends encryption keys(s) via side channel > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,310,048 B2 - Document ID: US11310048B2 - Status: Granted - Kind: B2 - Application number: 16/833,440 - Filed: 2020-03-27 - Published: 2021-03-25 - Granted: 2022-04-19 - Earliest claimed: 2019-09-24 - Assignees: Apricorn - Applicants: Apricorn - Inventors: Paul Cameron Brown; Roy Walter Younggren - Web page: https://patentgrep.com/patent/US11310048B2 ## CPC - H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)} - G06F 21/31: User authentication - G06F 21/74: operating in dual or compartmented mode, i.e. at least one secure mode - G06F 21/78: to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00) - H04L 9/0662: {with particular pseudorandom sequence generator} - H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords} - H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying} - H04L 9/0897: {involving additional devices, e.g. trusted platform module [TPM], smartcard or USB} - H04L 9/3215: {using a plurality of channels (network architectures or network communication protocols using different networks H04L63/18)} - H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Highly secure portable storage device may include a security controller, a data transfer controller and a memory controller. The security controller self-verifies, without a host, an access code. After the verification, the security controller may retrieve a concealed encryption key and a transformation key that were previously self-generated by the security controller. The encryption keys are not generated by the host, a user, or the memory controller. The transformation key is sent to the memory controller via a side channel during a first time period. The concealed encryption key is sent to the memory controller via the side channel during a different time period. After extracting an operating encryption key, the memory controller may notify the data transfer controller to initiate an enumeration process with the host. Data transfer from and to the host is performed via interfaces different from the side channel. Other methods and implementations are also described. ## Claims ### Claim 1 A storage device, comprising: a housing; a non-volatile memory disposed within the housing and configured to store encrypted data; a first controller disposed within the housing and configured to receive a security access code; a second controller disposed within the housing, wherein the second controller is coupled to the first controller and the non-volatile memory, the second controller comprises an encryption engine, and the second controller is configured to communicate with the first controller via a first interface; a third controller disposed within the housing and coupled to the second controller, wherein the third controller is configured to communicate with the second controller via a second interface and configured to communicate with a host via a third interface; a first channel for communication between the first controller and the second controller; a second channel for communication between the second controller and the third controller; and a third channel for communication between the second controller and the non-volatile memory, wherein: the first controller is configured to cause verifying the security access code, received by the storage device, using an access code; the first channel is configured to cause providing an encryption key between the first controller and the second controller; the second controller is configured to cause: encrypting using the encryption engine, data from the host, based on the encryption key; providing the encrypted data to the non-volatile memory via the third channel; receiving data from the non-volatile memory via the third channel; decrypting the data from the non-volatile memory, based on the encryption key; and providing the decrypted data to the third controller; the third controller is configured to cause: transferring the decrypted data toward the host via the third interface; and transferring, the data from the host, to the second controller via the second interface and the second channel; the storage device is separate and distinct from the host; the first controller is separate and distinct from the second controller; the second controller is separate and distinct from the third controller; the first interface is of a first type; the second interface is of a second type; the third interface is of a third type; the first type is different from the second type; and the second type is different from the third type. ### Claim 2 (depends on 1) The storage device of claim 1, wherein: the second controller is directly coupled to the non-volatile memory using the third channel; the first controller is indirectly coupled to the non-volatile memory via the first channel, the second controller and the third channel, and is not directly coupled to the non-volatile memory; and the third controller is indirectly coupled to the non-volatile memory via the second channel, the second controller and the third channel, and is not directly coupled to the non-volatile memory. ### Claim 3 (depends on 1) The storage device of claim 1, wherein: the storage device is external to the host; and the third type of the third interface is a universal serial bus (USB) type. ### Claim 4 (depends on 1) The storage device of claim 1, wherein the first channel is configured to be more secure than the second channel and configured to be more secure than a fourth channel for communication between the third controller and the host. ### Claim 5 (depends on 1) The storage device of claim 1, wherein each of the first channel, the second channel and the third channel is bi-directional. ### Claim 6 (depends on 1) The storage device of claim 1, further comprising an input device configured to receive the security access code. ### Claim 7 (depends on 6) The storage device of claim 6, wherein the input device comprises a keypad or a biometric sensor. ### Claim 8 (depends on 6) The storage device of claim 6, wherein: the input device is coupled to the first controller; and the input device is not directly coupled to the second controller or the third controller. ### Claim 9 (depends on 1) The storage device of claim 1, wherein: the first interface, the second interface, the third interface, the first channel, the second channel and the third channel are disposed within the housing; and the first controller is configured to authenticate a user using the security access code. ### Claim 10 (depends on 1) The storage device of claim 1, wherein the encryption engine is an advanced encryption standard (AES) 256 encryption engine. ### Claim 11 (depends on 1) The storage device of claim 1, wherein the storage device is configured not to share the access code or the encryption key with the host, and is configured to perform authentication without using the host. ### Claim 12 (depends on 1) The storage device of claim 1, wherein the storage device is configured to generate the encryption key internally prior to receipt of the security access code and without using the host. ### Claim 13 (depends on 1) The storage device of claim 1, wherein when the storage device is caused to be locked, the encryption key is retained only in the first controller. ### Claim 14 (depends on 1) The storage device of claim 1, wherein when the storage device is caused to be locked, the encryption key is deleted from the second controller. ### Claim 15 (depends on 1) The storage device of claim 1, wherein: the encryption key is generated internally within the storage device; the encryption key is not generated by the host; and when the storage device is caused to be locked: the encryption key is retained only in the first controller; and the encryption key is not present in the second controller. ### Claim 16 An apparatus, comprising: a housing; a non-volatile memory disposed within the housing and configured to store encrypted data; means for verifying a security access code; means for encrypting or decrypting information, wherein the means for encrypting or decrypting comprises a first interface for communicating with the means for verifying; means for transferring information from or to a host, wherein the means for transferring comprises a second interface for communicating with the means for encrypting or decrypting and comprises a third interface for communicating with the host; a first channel for communication between the means for verifying and the means for encrypting or decrypting; a second channel for communication between the means for encrypting or decrypting and the means for transferring; and a third channel for communication between the means for encrypting or decrypting and the non-volatile memory, wherein: the means for verifying comprises means for verifying the security access code, received by the apparatus, using an access code; the first channel is configured to cause providing an encryption key between the means for verifying and the means for encrypting or decrypting; the means for encrypting or decrypting comprises: means for encrypting using an encryption engine, data from the host, based on the encryption key; means for providing the encrypted data to the non-volatile memory via the third channel; means for receiving data from the non-volatile memory via the third channel; means for decrypting the data from the non-volatile memory, based on the encryption key; and means for providing the decrypted data to the means for transferring; the means for transferring comprises: means for transferring the decrypted data toward the host via the third interface; and means for transferring, the data from the host, to the means for encrypting or decrypting via the second interface and the second channel; the apparatus is separate and distinct from the host; the means for verifying is separate and distinct from the means for encrypting or decrypting; the means for encrypting or decrypting is separate and distinct from the means for transferring; the first interface is of a first type; the second interface is of a second type; the third interface is of a third type; the first type is different from the second type; and the second type is different from the third type. ### Claim 17 (depends on 16) The apparatus of claim 16, wherein the first interface is configured to be more secure than the second interface and the third interface. ### Claim 18 (depends on 16) The apparatus of claim 16, wherein each of the first channel, the second channel and the third channel is bi-directional. ### Claim 19 (depends on 16) The apparatus of claim 16, further comprising means for receiving the security access code, wherein the means for receiving is directly coupled to the means for verifying. ### Claim 20 (depends on 19) The apparatus of claim 19, wherein the means for receiving comprises a keypad or a biometric sensor.