Cloud storage with enhanced data privacy
AssigneeMicron Technology, Inc.
InventorZhan Liu
Life of this patent
Estimating the term…
Abstract
In some aspects, the techniques described herein relate to a method including: generating a digital certificate using a public key of a secure environment; storing the digital certificate in a storage device of a cloud service; generating, by the secure environment, a signed command to access the storage device, the signed command signed using a private key corresponding to the public key of the secure environment; and issuing the signed command to the storage device to access data stored by the storage device.
Claims20
A method comprising:
- generating a digital certificate using a public key of a secure environment;
- storing the digital certificate in a storage device of a cloud service, wherein storing the digital certificate comprises validating, by the storage device, the digital certificate using a Key Management Server (KMS) public key stored in a write-protected region of the storage device, and writing the public key of the secure environment to the write-protected region based on the validating;
- generating, by the secure environment, a signed command to access the storage device, the signed command signed using a private key corresponding to the public key of the secure environment, wherein the private key is derived from a physically unclonable function of the secure environment;
- and
- issuing the signed command to the storage device to access data stored by the storage device, wherein the storage device validates the signed command by validating a digital signature included in the signed command using the public key of the secure environment stored in the write-protected region.
A non-transitory computer-readable storage medium for tangibly storing computer program instructions capable of being executed by a computer processor, the computer program instructions defining steps of:
- generating a digital certificate using a public key of a secure environment;
- storing the digital certificate in a storage device of a cloud service, wherein storing the digital certificate comprises validating, by the storage device, the digital certificate using a Key Management Server (KMS) public key stored in a write-protected region of the storage device, and writing the public key of the secure environment to the write-protected region based on the validating;
- generating, by the secure environment, a signed command to access the storage device, the signed command signed using a private key corresponding to the public key of the secure environment, wherein the private key is derived from a physically unclonable function of the secure environment;
- and
- issuing the signed command to the storage device to access data stored by the storage device, wherein the storage device validates the signed command by validating a digital signature included in the signed command using the public key of the secure environment stored in the write-protected region.
A system comprising:
- a secure environment communicatively coupled to a storage device;
- and
- a key management server (KMS) configured to generate a digital certificate using a public key of a secure environment,
- wherein the secure environment is configured to:
- store the digital certificate in the storage device, wherein storing the digital certificate comprises validating, by the storage device, the digital certificate using a Key Management Server (KMS) public key stored in a write-protected region of the storage device, and writing the public key of the secure environment to the write-protected region based on the validating,
- generate a signed command to access the storage device, the signed command signed using a private key corresponding to the public key of the secure environment, wherein the private key is derived from a physically unclonable function of the secure environment, and
- issue the signed command to the storage device to access data stored by the storage device, wherein the storage device validates the signed command by validating a digital signature included in the signed command using the public key of the secure environment stored in the write-protected region.
Dependencies are inferred from the claim text.