# US 12,015,706 B2 · Combined cryptographic key management services for access control and proof of space

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,015,706 B2
- Document ID: US12015706B2
- Status: Granted
- Kind: B2
- Application number: 17/550,828
- Filed: 2021-12-14
- Published: 2023-06-15
- Granted: 2024-06-18
- Earliest claimed: 2021-12-14
- Assignees: Micron Technology, Inc.
- Applicants: Micron Technology, Inc.
- Inventors: Luca Bert; Joseph Harold Steinmetz
- Web page: https://patentgrep.com/patent/US12015706B2

## CPC

- H04L 9/088: {Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068)}
- G06F 3/0622: {in relation to access}
- G06F 3/0659: {Command handling arrangements, e.g. command buffers, queues, command scheduling}
- G06F 3/0679: {Non-volatile semiconductor memory device, e.g. flash memory, one time programmable memory [OTP]}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L 9/14: using a plurality of keys or algorithms
- H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
- H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)}
- H04L 63/10: {for controlling access to devices or network resources}
- H04L 63/126: {the source of the received data}
- G06F 3/0604: {Improving or facilitating administration, e.g. storage management}
- G06F 3/0631: {by allocating resources to storage systems}
- G06F 3/0644: {Management of space entities, e.g. partitions, extents, pools}
- G06F 21/602: {Providing cryptographic facilities or services}
- G06F 21/79: in semiconductor storage media, e.g. directly-addressable memories
- H04L 9/00: {Cryptographic mechanisms or cryptographic} arrangements for secret or secure communications; Network security protocols
- H04L 9/3218: {using proof of knowledge, e.g. Fiat-Shamir, GQ, Schnorr, ornon-interactive zero-knowledge proofs}
- H04L 9/3247: {involving digital signatures}
- H04L 9/50: {using hash chains, e.g. blockchains or hash trees}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A security server storing a plurality of cryptographic keys to support device authentication, access control and proof of space plot farming. The cryptographic keys can include a first cryptographic key representative of an identity of a memory device, a second cryptographic key representative of a privilege to access a memory region in the memory device, and a third cryptographic key representative of a pool of proof of space plots. The security server can sign blocks in a blockchain created via plots in the pool, sign commands to access the memory region, and secure transfer of the second and/or third cryptographic key to the computer operated by an owner of the memory device.

## Claims

### Claim 1

A method, comprising:
storing, in a security server, a plurality of cryptographic keys, including a first cryptographic key representative of an identity of a memory device, a second cryptographic key representative of a privilege to access a memory region in the memory device, and a third cryptographic key representative of a pool of proof of space plots;
communicating, by the security server, with a memory sub-system containing the memory device to generate a proof of space plot in the pool;
receiving, in the security server, a request to sign a block, in a blockchain, created via the proof of space plot;
computing, by the security server using the third cryptographic key, a digital signature for the block; and
providing, by the security server in a response to the request, the digital signature to facilitate recording of the block in the blockchain.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
generating, by the security server, an asymmetric cryptographic key pair including the third cryptographic key as a private key and a fourth cryptographic key as a public key; and
providing, by the security server, the public key for public identification of the pool.

### Claim 3 (depends on 2)

The method of claim 2, further comprising:
receiving, in the security server, a communication from the memory sub-system to initiate generation of the proof of space plot;
determining, by the security server, an identifier of an owner of the memory sub-system based on the first cryptographic key; and
identifying, by the security server, the pool based on the identifier of the owner.

### Claim 4 (depends on 3)

The method of claim 3, wherein the owner is a manufacturer of the memory device, a manufacturer of the memory sub-system containing the memory device, or a manufacturer of an endpoint containing the memory sub-system.

### Claim 5 (depends on 3)

The method of claim 3, further comprising:
storing, in the security server during manufacture of the memory device, a unique device secret of the memory device, wherein the first cryptographic key representative of the identity of the memory device, the second cryptographic key representative of the privilege to access the memory region in the memory device, and the third cryptographic key representative of the pool of proof of space plots are stored in association with the unique device secret.

### Claim 6 (depends on 5)

The method of claim 5, wherein the third cryptographic key is generated at least in part based on the unique device secret.

### Claim 7 (depends on 5)

The method of claim 5, wherein the generating of the asymmetric cryptographic key pair is in response to a determination that the identifier of the owner of the memory sub-system has no associated cryptographic key representative of a pool of proof of space plot.

### Claim 8 (depends on 5)

The method of claim 5, further comprising:
generating, by the security server in response to the communication to initiate generation of the proof of space plot, an asymmetric cryptographic key pair including a fifth cryptographic key as a private key representative of the proof of space plot and a sixth cryptographic key as a public key; and
providing, from the security server, the fifth cryptographic key to the memory sub-system for generation of the proof of space plot.

### Claim 9 (depends on 8)

The method of claim 8, wherein the fifth cryptographic key is generated based at least in part on the unique device secret.

### Claim 10 (depends on 2)

The method of claim 2, further comprising:
receiving, in the security server, a communication from the memory sub-system to initiate generation of the proof of space plot;
wherein the generating of the asymmetric cryptographic key pair is in response to the communication; and
wherein the pool is configured to contain the proof of space plot.

### Claim 11

A computing system, comprising:
a security server having a network interface, memory and at least one processor configured to:
store a plurality of cryptographic keys, including a first cryptographic key representative of an identity of a memory device, a second cryptographic key representative of a privilege to access a memory region in the memory device, and a third cryptographic key representative of a pool of proof of space plots;
communicate with a memory sub-system containing the memory device to generate a proof of space plot in the pool;
determine a change of ownership of the memory device from a manufacturer of the memory device to an entity; and
transfer the second cryptographic key and the third cryptographic key to a computer of the entity.

### Claim 12 (depends on 11)

The computing system of claim 11, wherein the at least one processor is further configured to, before the transfer of ownership:
receive a request to sign a block, in a blockchain, created via the proof of space plot;
generate, using the third cryptographic key, a digital signature for the block; and
provide, in a response to the request, the digital signature to facilitate recording of the block in the blockchain.

### Claim 13 (depends on 11)

The computing system of claim 11, wherein the at least one processor is further configured to:
generate an asymmetric cryptographic key pair including the third cryptographic key as a private key and a fourth cryptographic key as a public key; and
providing, by the security server, the public key for public identification of the pool.

### Claim 14 (depends on 13)

The computing system of claim 13, wherein the at least one processor is further configured to:
store, in the security server during manufacture of the memory device, a unique device secret of the memory device, wherein the first cryptographic key representative of the identity of the memory device, the second cryptographic key representative of the privilege to access the memory region in the memory device, and the third cryptographic key representative of the pool of proof of space plots are stored in association with the unique device secret.

### Claim 15 (depends on 14)

The computing system of claim 14, wherein the at least one processor is further configured to:
receive a communication from the memory sub-system to initiate generation of the proof of space plot.

### Claim 16 (depends on 15)

The computing system of claim 15, wherein the third cryptographic key is generated at least in part based on the unique device secret in response to the first cryptographic key having no associated cryptographic key representative of a pool of proof of space plots.

### Claim 17 (depends on 15)

The computing system of claim 15, wherein the asymmetric cryptographic key pair generated is, in response to the communication, to represent the pool; and the security server is configured to add, to the pool, no plot other than the proof of space plot.

### Claim 18

An apparatus, comprising:
a solid state drive, having:
a memory device, wherein a unique device secret is configured in the memory device during manufacture of the memory device;
a host interface configured to receive at least read commands and write commands from a host system;
a storage medium; and
a processing device configured to control executions of the read commands to retrieve data from the storage medium and executions of the write commands to store data into the storage medium; and
a network interface operable to communicate, over a computer network, with a security server configured to store a plurality of cryptographic keys, including a first cryptographic key representative of an identity of the memory device, a second cryptographic key representative of a privilege to access a memory region in the memory device, and a third cryptographic key representative of a pool of proof of space plots;
wherein the solid state drive is configured to communicate with the security server to generate, in the storage medium, a proof of space plot in the pool represented by the third cryptographic key.

### Claim 19 (depends on 18)

The apparatus of claim 18, wherein the solid state drive is configured to request the security server to generate the third cryptographic key representative of the pool.

### Claim 20 (depends on 19)

The apparatus of claim 19, wherein the solid state drive is further configured to generate a fourth cryptographic representative of the proof of space plot.