US 11,381,388 B2Granted

Storage device sharing data encryption key as encrypted and operating method of storage device

AssigneeSamsung Electronics Co., Ltd.

InventorsHyunsook Hong, Jintaek Kwon, Myeongjong Lee, Seung-Jae Lee, Seokgi Hong, Byung-Gook Kim, Jisoo Kim

Life of this patent

Estimating the term…

Loading patent…

Abstract

A storage device includes a nonvolatile memory device, and a controller that manages a data encryption key (DEK). The DEK is used to encrypt data to be written in a storage space of the nonvolatile memory device by a first user and to decrypt data read from the storage space. The controller grants a second user authority to access the storage space by encrypting the DEK based on a Diffie-Hellman (DH) algorithm, grants a second user authority to access the encrypted DEK, and decrypts the encrypted DEK based on the DH algorithm.

Claims15

Dependent claims

A storage device, comprising:

a nonvolatile memory device;
and
a controller configured to manage a data encryption key (DEK),
wherein the DEK is used to encrypt data to be written in a storage space of the nonvolatile memory device by a first user and to decrypt data read from the storage space,
wherein the controller is further configured to:
grant a second user authority to access the storage space by encrypting the DEK based on a Diffie-Hellman (DH) algorithm;
grant the second user authority to access the encrypted DEK;
decrypt the encrypted DEK based on the DH algorithm;
receive a first password from the first user;
generate a first public key and a first secret key based on the DH algorithm;
perform the encryption of the DEK by using the first password;
encrypt the first secret key by using the first password;
store the first secret key encrypted with the first password, the DEK encrypted with the first password, and the first public key in a first slot allocated to the first user from among a plurality of slots included in a meta area of the nonvolatile memory device;
receive a first value indicating a number of ranges;
divide a user area into a plurality of ranges based on the received first value;
receive a second value indicating a number of users;
divide the meta area into the plurality of slots based on the received second value;
and
allocate the slots to the users, respectively.

16 more elements

A storage device, comprising:

a nonvolatile memory device;
and
a controller configured to manage a data encryption key (DEK),
wherein the DEK is used to encrypt first data to be written in a first portion of a storage space of the nonvolatile memory device by a first user and to decrypt the first data read from the first portion of the storage space,
wherein the controller is further configured to:
encrypt the DEK in a first manner when the DEK is stored in an area of the nonvolatile memory device associated with the first user;
and
encrypt the DEK in a second manner, different from the first manner, when the DEK is stored in an area of the nonvolatile memory device associated with a second user,
wherein the DEK encrypted in the second manner is used, after decryption, to encrypt second data to be written in a second portion of the storage space of the nonvolatile memory device by a second user and to decrypt the second data read from the second portion of the storage space,
wherein encrypting the DEK in the first manner comprises encrypting the DEK by using a password provided from the first user,
wherein encrypting the DEK in the second manner comprises encrypting the DEK based on a Diffie-Hellman (DH) algorithm,
wherein encrypting the DEK comprises:
generating a first public key and a first secret key of the first user based on the DH algorithm;
encrypting the DEK and the first secret key in the first manner;
storing the DEK encrypted in the first manner, the first secret key encrypted in the first manner, and the first public key in a first slot of a plurality of slots;
generating a second public key and a second secret key of the second user based on the DH algorithm;
encrypting the second secret key in the first manner;
and
storing the second secret key encrypted in the first manner and the second public key in a second slot of the plurality of slots.

16 more elements

An operating method of a storage device comprising a plurality of ranges configured to store data and a plurality of slots respectively corresponding to the ranges, the method comprising:

when a first user accesses the storage device, encrypting a plurality of data encryption keys (DEKs) respectively corresponding to the ranges in a first manner and storing the DEKs encrypted in the first manner in a first slot of the plurality of slots;
when a second user accesses the storage device, allocating a second slot of the plurality of slots to the second user;
and
encrypting a DEK corresponding to one range of the plurality of ranges from among the plurality of DEKs in a second manner, different from the first manner, and storing the DEK encrypted in the second manner in the second slot,
wherein encrypting the DEKs comprises:
generating a first public key and a first secret key of the first user based on a Diffie-Hellman (DH) algorithm;
encrypting the DEKs and the first secret key in the first manner;
and
storing the DEKs encrypted in the first manner, the first secret key encrypted in the first manner, and the first public key in the first slot,
wherein allocating the second slot when the second user accesses the storage device comprises:
generating a second public key and a second secret key of the second user based on the DH algorithm;
encrypting the second secret key in the first manner;
and
storing the second secret key encrypted in the first manner and the second public key in the second slot.

11 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/674,413Filed 5 Nov 2019
Priority: KR 10-2018-014850227 Nov 2018
Published: US 2020/0169395 A128 May 2020
Granted: 5 Jul 2022
Term ends: Not estimatedThe source records don’t support an estimate.

Classification16 codes

H04L 9/0841
Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or…:…
H04L 9/0894
Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords: escrow, recovery or storing of secret…
G06F 12/0238
Free address space management: memory management in non-volatile memory, e.g. resistive RAM or ferroelectric memory
G06F 12/1408
Protection against unauthorised use of memory or access to memory: by using cryptography