Secure memory arrangements

• US 10,560,263 B2
• Filed: 08/31/2017
• Issued: 02/11/2020
• Est. Priority Date: 03/24/2017
• Status: Active Grant

• Current Assignee: Micron Technology, Inc.
• Original Assignee: Micron Technology, Inc.
• Inventors: Dover, Lance W.
• Primary Examiner(s): Gergiso, Techane
• Application Number:
  US15/692,802
• Publication Number:
  US 20180278413A1
• Time in Patent Office: 894 Days
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

Various examples are directed to secure memory arrangements and methods of using the same. A gateway device of the secure computing system may receiving a first message from an external system. The first message may comprise a first message payload data and first asymmetric access data. The gateway device may determine that the first asymmetric access data matches the first message payload data based at least in part on an external system public key. The gateway device may access a first system controller symmetric key associated with a first system controller in communication with the gateway device and generate a first symmetric access data based at least in part on the first system controller symmetric key and the first message payload data. The gateway device may send the first message payload data and the first symmetric access data to the first system controller.

Claims

1. A system, comprising:

a first system controller; and

a gateway device in communication with the first system controller, the gateway device comprising a gateway device memory device, the gateway device memory device comprising;

a gateway device storage;

a gateway device asymmetric engine; and

a gateway device symmetric engine, wherein the gateway device is configured to perform operations comprising;

receiving from an external system, a first message comprising a first message payload data and first asymmetric access data;

determining, with the gateway device asymmetric engine, that the first asymmetric access data matches the first message payload data based at least in part on an external system public key;

retrieving from the gateway device storage a first system controller symmetric key associated with the first system controller in communication with the gateway device;

generating, with the gateway device symmetric engine, first symmetric access data based at least in part on the first system controller symmetric key and the first message payload data; and

sending the first message payload data and the first symmetric access data to the first system controller.

2. The system of claim 1, wherein the gateway device is further configured to perform operations comprising:

receiving from the first system controller a second message, the second message comprising a second message payload data, second symmetric access data, and an indication of the external system;

determining, with the gateway device symmetric engine, that the second message payload data matches the second symmetric access data based at least in part on the first system controller symmetric key;

generating, with the gateway device asymmetric engine, second asymmetric access data based at least in part on a gateway device private key; and

sending the second message payload data and the second asymmetric access data to the external system.

3. The system of claim 1, wherein the first system controller comprises a first system controller memory device, the first system controller memory device comprising:

a first system controller storage, and

a communications bus coupled to the first system controller and to the gateway device.

4. The system of claim 3, wherein the first system controller is configured to perform operations comprising:

receiving the first message payload data and the first symmetric access data; and

determining, with a first system controller symmetric engine, that the first message payload data matches the first symmetric access data based at least in part on the first system controller symmetric key; and

writing at least a portion of the first message payload data to the first system controller storage.

5. The system of claim 4, wherein the first system controller is configured to perform operations comprising:

generating, with the first system controller symmetric engine, second symmetric access data;

generating a second message comprising a second message payload data, the second symmetric access data, and an indication of the external system; and

sending the second message to the gateway device.

6. The system of claim 3, wherein the first system controller is configured to perform operations comprising:

receiving a provisioning signal indicating a provisioning of the first system controller symmetric key; and

sending the first system controller symmetric key to the gateway device via the communications bus.

7. The system of claim 6, wherein the provisioning signal indicates that power has been provided to the system.

8. The system of claim 1, wherein the gateway device is further configured to perform operations comprising:

sending a symmetric key request to an external database; and

receiving from the external database a symmetric key message comprising the first system controller symmetric key.

9. The system of claim 1, wherein the gateway device is further configured to perform operations comprising:

receiving, from a second external system, a second message comprising a second message payload data, second asymmetric access data, and an indication of a second system controller;

determining, with the gateway device asymmetric engine, that the second asymmetric access data matches the second message payload data based at least in part on a second external system public key;

receiving from the gateway device storage a second system controller symmetric key associated with the second system controller;

generating, with the gateway device symmetric engine, second symmetric access data based at least in part on the second system controller symmetric key and the second message payload data; and

sending the second message payload data and the second symmetric access data to the second system controller.

10. A method, comprising:

receiving, by a gateway device of a secure processing system, a first message from an external system, wherein the first message comprises a first message payload data and first asymmetric access data;

determining, by the gateway device, that the first asymmetric access data matches the first message payload data based at least in part on an external system public key;

accessing, by the gateway device, a first system controller symmetric key associated with a first system controller in communication with the gateway device;

generating, by the gateway device, first symmetric access data based at least in part on the first system controller symmetric key and the first message payload data; and

sending, by the gateway device, the first message payload data and the first symmetric access data to the first system controller.

11. The method of claim 10, further comprising:

receiving, by the gateway device, a second message from the first system controller, the second message comprising a second message payload data, second symmetric access data, and an indication of the external system;

determining, by the gateway device with a gateway device symmetric engine, that the second message payload data matches the second symmetric access data based at least in part on the first system controller symmetric key;

generating, by the gateway device, second asymmetric access data based at least in part on a gateway device private key; and

sending the second message payload data and the second asymmetric access data to the external system.

12. The method of claim 10, further comprising:

receiving, by the first system controller, the first message payload data and the first symmetric access data; and

determining, by the first system controller with a first system controller symmetric engine, that the first message payload data matches the first symmetric access data based at least in part on the first system controller symmetric key; and

writing, by the first system controller, at least a portion of the first message payload data to a first system controller storage.

13. The method of claim 12, further comprising:

generating, by the first system controller with the first system controller symmetric engine, second symmetric access data;

generating, by the first system controller, a second message comprising a second message payload data, the second symmetric access data, and an indication of the external system; and

sending, by the first system controller, the second message to the gateway device.

14. The method of claim 10, further comprising:

receiving, by the first system controller, a provisioning signal indicating a provisioning of the first system controller symmetric key; and

sending, by the first system controller, the first system controller symmetric key to the gateway device.

15. The method of claim 14, wherein the provisioning signal indicates that power has been provided to the system.

16. The method of claim 10, further comprising:

sending, by the gateway device, a symmetric key request to an external database; and

receiving, by the gateway device and from the external database a symmetric key message comprising the first system controller symmetric key.

17. The method of claim 10, further comprising:

receiving, by the gateway device, a second message from a second external system, the second message comprising a second message payload data, second asymmetric access data, and an indication of a second system controller;

determining, by the gateway device and with a gateway device asymmetric engine, that the second asymmetric access data matches the second message payload data based at least in part on a second external system public key;

receiving, by the gateway device and from a gateway device storage a second system controller symmetric key associated with the second system controller;

generating, with a gateway device symmetric engine, second symmetric access data based at least in part on the second system controller symmetric key and the second message payload data; and

sending the second message payload data and the second symmetric access data to the second system controller.

18. At least one non-transitory computer-readable medium comprising instructions thereon that, when executed by a computing device, cause the computing device to perform operations comprising:

receiving, by a gateway device of a secure computing system, a first message from an external system, wherein the first message comprises a first message payload data and first asymmetric access data;

determining, by the gateway device with a gateway device asymmetric engine, that the first asymmetric access data matches the first message payload data based at least in part on an external system public key;

accessing, by the gateway device, a first system controller symmetric key associated with a first system controller in communication with the gateway device;

generating, by the gateway device with a gateway device symmetric engine, first symmetric access data based at least in part on the first system controller symmetric key and the first message payload data; and

sending, by the gateway device, the first message payload data and the first symmetric access data to the first system controller.

19. The at least one non-transitory computer readable medium of claim 18, further comprising:

receiving, by the first system controller, the first message payload data and the first symmetric access data; and

determining, by the first system controller with the first system controller symmetric engine, that the first message payload data matches the first symmetric a the gateway device asymmetric engine access data based at least in part on the first system controller symmetric key; and

writing, by the first system controller, at least a portion of the first message payload data to a first system controller storage.

20. The at least one non-transitory computer readable medium of claim 18, further comprising:

receiving, by the first system controller, a provisioning signal indicating a provisioning of the first system controller symmetric key; and

sending, by the first system controller, the first system controller symmetric key to the gateway device.