# US 2019/0245689 A1 · Key encryption handling

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2019/0245689 A1
- Document ID: US20190245689A1
- Status: Published application
- Kind: A1
- Application number: 16/103,184
- Filed: 2018-08-14
- Published: 2019-08-08
- Earliest claimed: 2018-02-08
- Assignees: Micron Technology, Inc.
- Applicants: Micron Technology, Inc.
- Inventors: Nathan A. Eckel; Steven D. Check
- Web page: https://patentgrep.com/patent/US20190245689A1

## CPC

- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- G06F 12/0804: with main memory updating (G06F12/0806 takes precedence)
- G06F 21/572: {Secure firmware programming, e.g. of basic input output system [BIOS]}
- G06F 21/74: operating in dual or compartmented mode, i.e. at least one secure mode
- H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC}
- H04L 9/0822: {using key encryption key}
- H04L 9/0869: {involving random numbers or seeds}
- H04L 9/14: using a plurality of keys or algorithms
- G06F 2212/1032: Reliability improvement, data loss prevention, degraded operation etc
- H04L 2209/122: Hardware reduction or efficient architectures
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

An apparatus comprises an encryption key generator to generate a media encryption key to encrypt data in number of memory components, where the encryption key generator is configured to wrap the media encryption key to generate an encrypted media encryption key. The encrypted media encryption key is stored in a non-volatile memory. The apparatus comprises firmware having instructions to transition the apparatus to and from a secure state using the encrypted media encryption key.

## Claims

### Claim 1

An apparatus comprising:
a plurality of memory components;
an encryption key generator to generate a media encryption key to encrypt data in the plurality of memory components, the encryption key generator configured to wrap the media encryption key to generate an encrypted media encryption key;
a non-volatile memory to store the encrypted media encryption key; and
firmware having instructions to transition the apparatus to and from a secure state using the encrypted media encryption key.

### Claim 2 (depends on 1)

The apparatus of claim 1, wherein the apparatus is a four state apparatus, the four states being an unowned state, a secure_unlocked state, a secure_locked state, and an unsecure state.

### Claim 3 (depends on 2)

The apparatus of claim 2, wherein the firmware has instructions to perform an operation that transitions from the secure_locked state to the secure_unlocked state using an access key received from a host device, including a successful unwrapping operation on the encrypted media encryption key with respect to the received access key.

### Claim 4 (depends on 2)

The apparatus of claim 2, wherein the encryption key generator is configured to generate an erase key, to wrap the erase key to form a wrapped erase key, and to send the wrapped erase key to the non-volatile memory.

### Claim 5 (depends on 4)

The apparatus of claim 4, wherein the firmware has instructions to perform an operation that transitions from the secure_locked state to the secure_unlocked state to change out an access key using an erase key received from a host device, including a successful unwrapping operation on the wrapped erase key with respect to the received erase key.

### Claim 6 (depends on 1)

The apparatus of claim 1, wherein the encryption key generator includes:
a deterministic random number generator to generate a random number as the media encryption key;
an encryption block to receive the random number and an access key generated by a host device and to generate a media key encryption key by use of a first encryption algorithm; and
a wrapping block to receive the media key encryption key and the media encryption key and to generate the encrypted media encryption key by use of a second encryption algorithm.

### Claim 7

A non-volatile dual in-line memory module comprising:
a plurality of volatile memory components;
a first non-volatile memory in which to dump contents of the volatile memory components upon detection of a power failure;
a non-volatile controller to control the plurality of volatile memory components and the non-volatile memory;
an encryption key generator to generate a media encryption key to encrypt data in the plurality of memory components, the encryption key generator configured to wrap the media encryption key to generate an encrypted media encryption key;
a second non-volatile memory to store the encrypted media encryption key; and
firmware having instructions to transition the non-volatile controller to and from a secure state using the encrypted media encryption key.

### Claim 8 (depends on 7)

The non-volatile dual in-line memory module of claim 7, wherein the non-volatile controller is operated as a four state device, the four states being a unowned state, a secure_unlocked state, a secure_locked state, and a unsecure state.

### Claim 9 (depends on 8)

The non-volatile dual in-line memory module of claim 8, wherein the encryption key generator is configured to generate an erase key, to wrap the erase key to form a wrapped erase key, and to send the wrapped erase key to the second non-volatile memory.

### Claim 10 (depends on 9)

The non-volatile dual in-line memory module of claim 9, wherein the firmware has instructions to perform an operation that transitions from the secure_locked state using an access key or an erase key for the operation, received from a host device, based on a successful unwrapping operation on the encrypted media encryption key or the wrapped erase key with respect to the respective received access key or received erase key for the operation.

### Claim 11 (depends on 7)

The non-volatile dual in-line memory module of claim 7, wherein the firmware has instructions to:
move keys and call an encryption algorithm to generate a media key encryption key for wrapping or unwrapping;
control access to the second non-volatile memory;
execute application program interface calls including setting up datapaths to hardware for the respective application program interface calls;
check, track, and update the state of the non-volatile controller; and
maintain a log status with respect to error handling.

### Claim 12

A system comprising:
a non-volatile dual in-line memory module configured to operatively couple to a host device, the non-volatile dual in-line memory module including:
dynamic random-access memory components;
a NAND flash memory in which to dump contents of the dynamic random-access memory components upon detection of a power failure;
a non-volatile controller to control the dynamic random-access memory components and the NAND flash memory;
an encryption key generator to generate a media encryption key to encrypt data in the dynamic random-access memory components, the encryption key generator configured to wrap the media encryption key to generate an encrypted media encryption key;
a NOR flash memory to store the encrypted media encryption key; and
firmware having instructions to transition the non-volatile controller to and from a secure state using the encrypted media encryption key.

### Claim 13 (depends on 12)

The system of claim 12, wherein the non-volatile controller is operated as a four state device, the four states being a unowned state, a secure_unlocked state, a secure_locked state, and a unsecure state.

### Claim 14 (depends on 13)

The system of claim 13, wherein the encryption key generator is configured to generate an erase key, to wrap the erase key to form a wrapped erase key, and to send the wrapped erase key to the second non-volatile memory.

### Claim 15 (depends on 14)

The system of claim 14, wherein the firmware has instructions to perform an operation that transitions from the secure_locked state using an access key or an erase key for the operation, received from the host device, based on a successful unwrapping operation on the encrypted media encryption key or the wrapped erase key with respect to the respective received access key or received erase key for the operation.

### Claim 16 (depends on 12)

The system of claim 12, wherein the host device provides an access key for use in the generation of the encrypted media encryption key.

### Claim 17 (depends on 12)

The system of claim 12, wherein the firmware has instructions to handle generation and restoration of encryption keys such that generation and restoration of encryption keys is isolated from direct access by the host device.

### Claim 18

A method comprising
generating a media encryption key to encrypt data in a plurality of memory components of an apparatus;
wrapping the media encryption key to generate an encrypted media encryption key;
storing the encrypted media encryption key in a non-volatile memory of the apparatus; and
transitioning the apparatus to and from a secure state using the encrypted media encryption key.

### Claim 19 (depends on 18)

The method of claim 18, wherein the apparatus is a four state apparatus, the four states being an unowned state, a secure._unlocked state, a secure_locked state, and an unsecure state.

### Claim 20 (depends on 19)

The method of claim 19, method includes:
generating an erase key;
wrapping the erase key to form a wrapped erase key; and
sending the wrapped erase key to the non-volatile memor