# US 12,504,894 B2 · Methods and systems for secure data storage

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,504,894 B2
- Document ID: US12504894B2
- Status: Granted
- Kind: B2
- Application number: 18/705,348
- Filed: 2022-10-27
- Published: 2025-01-02
- Granted: 2025-12-23
- Earliest claimed: 2021-10-27
- Assignees: Ncipher Security Limited
- Applicants: Ncipher Security Limited
- Inventors: David O'Doherty
- Web page: https://patentgrep.com/patent/US12504894B2

## CPC

- G06F 3/0622: {in relation to access}
- H04L 9/0897: {involving additional devices, e.g. trusted platform module [TPM], smartcard or USB}
- G06F 3/0655: {Vertical data movement, i.e. input-output transfer; data movement between one or more hosts and one or more storage devices}
- G06F 3/0679: {Non-volatile semiconductor memory device, e.g. flash memory, one time programmable memory [OTP]}
- G06F 21/602: {Providing cryptographic facilities or services}
- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- H04L 2209/08: Randomization, e.g. dummy operations or using noise
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A computer-implemented method of storing data from a second storage component in a first storage component includes: storing information relating to a first sequence of values in the first storage component; storing a second sequence of values from the second storage component into the first storage component in a plurality of steps, deleting or overwriting one or more values from the second sequence of values which were stored in the first storage component in a previous step; and storing an encrypted third sequence of values in the first storage component. The third sequence of values is derivable from the first sequence of values and the second sequence of values.

## Claims

### Claim 1

A method of storing data from a second storage component in a first storage component, the method comprising:
storing information relating to a first sequence of values in the first storage component;
storing a second sequence of values from the second storage component into the first storage component in a plurality of steps, deleting or overwriting one or more values from the second sequence of values which were stored in the first storage component in a previous step; and
storing an encrypted third sequence of values in the first storage component, wherein the third sequence of values is derivable from the first sequence of values and the second sequence of values,
wherein for each of the plurality of steps, a value from the second sequence of values is read from the second storage component into the first storage component according to a random order, and an encrypted version of the value is written to the first storage component in a position of a portion of memory in the first storage component to be used to store the third sequence of values, the position being determined according to the first sequence of values.

### Claim 2 (depends on 1)

The method of claim 1, wherein storing information relating to the first sequence of values comprises reading a first encrypted version of the first sequence of values from the second storage component, and writing a second encrypted version of the first sequence of values to the first storage component.

### Claim 3 (depends on 1)

The method of claim 1, wherein each step comprises reading a group of memory cells in the second storage component comprising a portion of the second sequence of values.

### Claim 4 (depends on 3)

The method of claim 3, wherein the group of memory cells comprises at most one value of the second sequence.

### Claim 5 (depends on 1)

The method of claim 1, further comprising:
prior to storing the encrypted version of the third sequence of values, storing an encryption sequence in a portion of memory to be used to store the encrypted version of the third sequence.

### Claim 6 (depends on 1)

The method of claim 1, further comprising repeatedly re-encrypting the third sequence of values with a further encryption sequence at pre-determined time intervals.

### Claim 7 (depends on 1)

The method of claim 1, further comprising decrypting the third sequence of values and using the third sequence of values for a cryptographic operation.

### Claim 8

A device, comprising:
a first storage component;
a second storage component; and
one or more processors, the one or more processors configured to:
store information relating to a first sequence of values in the first storage component;
store a second sequence of values from the second storage component into the first storage component in a plurality of steps, deleting or overwriting one or more values from the second sequence of values which were stored in the first storage component in a previous step; and
store an encrypted third sequence of values in the first storage component, wherein the third sequence of values is derivable from the first sequence of values and the second sequence of values,
wherein for each of the plurality of steps, a value from the second sequence of values is read from the second storage component into the first storage component according to a random order, and an encrypted version of the value is written to the first storage component in a position of a portion of memory in the first storage component to be used to store the third sequence of values, the position being determined according to the first sequence of values.

### Claim 9 (depends on 8)

The device of claim 8, wherein the device is a hardware security module device, the second storage component is a non-volatile storage component of the hardware security module device and the first storage component is a main memory component of the hardware security module device.

### Claim 10

A non-transitory computer readable storage medium comprising program instructions stored thereon that are executable by a computer processor to perform a method comprising:
storing information relating to a first sequence of values in the first storage component;
storing a second sequence of values from the second storage component into the first storage component in a plurality of steps, deleting or overwriting one or more values from the second sequence of values which were stored in the first storage component in a previous step; and
storing an encrypted third sequence of values in the first storage component, wherein the third sequence of values is derivable from the first sequence of values and the second sequence of values,
wherein for each of the plurality of steps, a value from the second sequence of values is read from the second storage component into the first storage component according to a random order, and an encrypted version of the value is written to the first storage component in a position of a portion of memory in the first storage component to be used to store the third sequence of values, the position being determined according to the first sequence of values.