# US 12,182,318 B2 · Cryptographic key management

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,182,318 B2
- Document ID: US12182318B2
- Status: Granted
- Kind: B2
- Application number: 18/112,834
- Filed: 2023-02-22
- Published: 2023-08-03
- Granted: 2024-12-31
- Earliest claimed: 2019-07-15
- Assignees: Micron Technology, Inc.
- Applicants: Micron Technology, Inc.
- Inventors: Juane Li; Jiangli Zhu; Ying Yu Tai
- Web page: https://patentgrep.com/patent/US12182318B2

## CPC

- G06F 21/79: in semiconductor storage media, e.g. directly-addressable memories
- G06F 21/575: {Secure boot}
- G06F 21/602: {Providing cryptographic facilities or services}
- G11C 7/24: Memory cell safety or protection circuits, e.g. arrangements for preventing inadvertent reading or writing; Status cells; Test cells
- G11C 29/42: using error correcting codes [ECC] or parity check
- G11C 29/44: Indication or identification of errors, e.g. for repair
- H04L 9/0662: {with particular pseudorandom sequence generator}
- H04L 9/0866: {involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics}
- H04L 9/0869: {involving random numbers or seeds}
- H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- G11C 2029/0411: {Online error correction}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G11C: STATIC STORES (semiconductor memory devices H10B)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Methods, systems, and devices for cryptographic key management are described. A memory device can issue, by a firmware component, a command to generate a first cryptographic key for encrypting or decrypting user data stored on a memory device. The memory device can generate, by a hardware component, the first cryptographic key based on the command. The memory device can encrypt, by the hardware component, the first cryptographic key using a second cryptographic key and an initialization vector. The memory device can store the encrypted first cryptographic key in a nonvolatile memory device separate from the hardware component.

## Claims

### Claim 1

A method at a memory sub-system, comprising:
receiving, by a firmware component of the memory sub-system and from a nonvolatile memory device separate from the memory sub-system, an encrypted first cryptographic key and a second cryptographic key, wherein the encrypted first cryptographic key is for encrypting or decrypting data stored on a memory device of the memory sub-system and different from the nonvolatile memory device;
generating, by a hardware component of the memory sub-system, an initialization vector based at least in part on the first cryptographic key, the data, or both;
decrypting, by the hardware component, the encrypted first cryptographic key using the second cryptographic key and the initialization vector; and
storing the first cryptographic key in a volatile memory device on the hardware component based at least in part on decrypting the encrypted first cryptographic key.

### Claim 2 (depends on 1)

The method of claim 1, wherein the initialization vector is for encrypting or decrypting the first cryptographic key using the second cryptographic key.

### Claim 3 (depends on 1)

The method of claim 1, further comprising:
receiving, by the firmware component from the nonvolatile memory device, error correction information associated with the encrypted first cryptographic key; and
performing, by the hardware component, an error correction operation on the encrypted first cryptographic key using the error correction information.

### Claim 4 (depends on 3)

The method of claim 3, further comprising:
determining that a quantity of errors detected during the error correction operation satisfies a threshold of errors; and
issuing, by the firmware component, a command to update the first cryptographic key.

### Claim 5 (depends on 1)

The method of claim 1, further comprising:
receiving, from a host device, an access command associated with the data stored on the memory device; and
encrypting or decrypting the data using the first cryptographic key based at least in part on receiving the access command.

### Claim 6 (depends on 1)

The method of claim 1, further comprising:
receiving, by the firmware component from the nonvolatile memory device, an encrypted third cryptographic key;
decrypting, by the hardware component, the encrypted third cryptographic key using the second cryptographic key; and
storing the third cryptographic key in a second volatile memory device on the hardware component based at least in part on decrypting the encrypted third cryptographic key.

### Claim 7 (depends on 6)

The method of claim 6, wherein the first cryptographic key comprises an encryption key for encrypting the data stored on the memory device and the second cryptographic key comprises a decryption key for decrypting the data stored on the memory device.

### Claim 8 (depends on 1)

The method of claim 1, further comprising:
transmitting, by the firmware component, the encrypted first cryptographic key and the second cryptographic key to the hardware component based at least in part on receiving the encrypted first cryptographic key and the second cryptographic key from the nonvolatile memory device.

### Claim 9 (depends on 1)

The method of claim 1, wherein the encrypted first cryptographic key and the second cryptographic key are received by the firmware component based at least in part on a boot up of the hardware component.

### Claim 10 (depends on 1)

The method of claim 1, wherein the second cryptographic key is stored at a register of the hardware component.

### Claim 11

A system, comprising:
a memory sub-system operable to couple with a nonvolatile memory device that is separate from the memory sub-system via a firmware component of the memory sub-system, the memory sub-system configured to:
receive, by the firmware component and from the nonvolatile memory device, an encrypted first cryptographic key and a second cryptographic key, wherein the encrypted first cryptographic key is for encrypting or decrypting data stored on a memory device of the memory sub-system and different from the nonvolatile memory device;
generate, by a hardware component of the memory sub-system, an initialization vector based at least in part on the first cryptographic key;
decrypt, by the hardware component, the encrypted first cryptographic key using the second cryptographic key and the initialization vector; and
store the first cryptographic key in a volatile memory device on the hardware component based at least in part on decrypting the encrypted first cryptographic key.

### Claim 12 (depends on 11)

The system of claim 11, wherein the initialization vector is for encrypting or decrypting the first cryptographic key using the second cryptographic key.

### Claim 13 (depends on 11)

The system of claim 11, wherein the memory sub-system is further configured to:
receive, by the firmware component from the nonvolatile memory device, error correction information associated with the encrypted first cryptographic key; and
perform, by the hardware component, an error correction operation on the encrypted first cryptographic key using the error correction information.

### Claim 14 (depends on 13)

The system of claim 13, wherein the memory sub-system is further configured to:
determine that a quantity of errors detected during the error correction operation satisfies a threshold of errors; and
issue, by the firmware component, a command to update the first cryptographic key.

### Claim 15 (depends on 11)

The system of claim 11, wherein the memory sub-system is further configured to:
receive, from a host device, an access command associated with the data stored on the memory device; and
encrypt or decrypt the data using the first cryptographic key based at least in part on receiving the access command.

### Claim 16 (depends on 11)

The system of claim 11, wherein the memory sub-system is further configured to:
decrypt, by the hardware component, an encrypted third cryptographic key using the second cryptographic key; and
store the third cryptographic key in a second volatile memory device on the hardware component based at least in part on decrypting the encrypted third cryptographic key.

### Claim 17 (depends on 11)

The system of claim 11, wherein the memory sub-system is further configured to:
transmit, by the firmware component, the encrypted first cryptographic key and the second cryptographic key to the hardware component based at least in part on receiving the encrypted first cryptographic key and the second cryptographic key from the nonvolatile memory device.

### Claim 18 (depends on 11)

The system of claim 11, wherein the encrypted first cryptographic key and the second cryptographic key are received by the firmware component based at least in part on a boot up of the hardware component.

### Claim 19 (depends on 11)

The system of claim 11, wherein the second cryptographic key is stored at a register of the hardware component.

### Claim 20

A non-transitory computer-readable medium storing code, the code comprising instructions executable by processing logic to:
receive, by a firmware component of a memory sub-system and from a nonvolatile memory device separate from the memory sub-system, an encrypted first cryptographic key and a second cryptographic key, wherein the encrypted first cryptographic key is for encrypting or decrypting data stored on a memory device of the memory sub-system and different from the nonvolatile memory device;
generate, by a hardware component of the memory sub-system, an initialization vector based at least in part on the first cryptographic key;
decrypt, by the hardware component, the encrypted first cryptographic key using the second cryptographic key and the initialization vector; and
store the first cryptographic key in a volatile memory device on the hardware component based at least in part on decrypting the encrypted first cryptographic key.