MEMORY DEVICE WHICH PROTECTS SECURE DATA, METHOD OF OPERATING THE MEMORY DEVICE, AND METHOD OF GENERATING AUTHENTICATION INFORMATION

• US 20130159733A1
• Filed: 11/15/2012
• Published: 06/20/2013
• Est. Priority Date: 12/16/2011
• Status: Active Grant

• Current Assignee: Samsung Electronics Co. Ltd.
• Original Assignee: Hyoung-Suk Jang, Jae-Bum Lee, Min-Kwon Kim, Seok-Heon Lee
• Inventors: LEE, Jae-Bum, JANG, Hyoung-Suk, KIM, Min-Kwon, LEE, Seok-Heon
• Granted Patent: US 9,258,111 B2
• Time in Patent Office: Days
• US Class Current: 713/193
• CPC Class Codes: H04L 2209/605 Copy protection
• CPC Class Codes: H04L 9/08 Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords network architectures or network communication protocols for supporting key management in a packet data network H04L63/06
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0877 using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB

Abstract

In one embodiment, the memory device includes a first memory area and a second memory area. The first memory area stores secure data. The first memory area is inaccessible by an external device. The second memory area is configured to store encrypted secure data. The second memory area is accessible by the external device, and the encrypted secure data is an encrypted version of the secure data in the first memory area.

Claims

1. A memory device, comprising:

a first memory area storing secure data, the first memory area being inaccessible by an external device; and

a second memory area configured to store encrypted secure data, the second memory area being accessible by the external device, the encrypted secure data being an encrypted version of the secure data in the first memory area.

2. The memory device of claim 1, wherein the external device is a host device.

3. The memory device of claim 1, wherein the external device is a memory controller.

4. The memory device of claim 1, further comprising:

input/output logic configured to interface the memory device with the external device.

5. The memory device of claim 1, further comprising:

secure logic configured to access the secure data from the first memory area, generate the encrypted secure data from the accessed secure data, and store the encrypted secure data in the second memory area.

6. The memory device of claim 1, wherein the second area is configured to store the encrypted secure data received from a manufacturer of the memory device.

7. The memory device of claim 1, wherein the second area is configured to store the encrypted secure data during the manufacture of the memory device.

8. The memory device of claim 1, wherein the secure data includes a main key for authenticating the memory device, and the encrypted secure data includes an encrypted main key.

9. The memory device of claim 8, wherein the first memory area is further configured to store at least one spare key, the spare key for generating authentication information of the memory device.

10. The memory device of claim 9, wherein the second memory area is further configured to store at least one spare key index, the spare key index being linked to the spare key.

11. The memory device of claim 10, wherein the spare key corresponds to a vendor of the memory device.

12. The memory device of claim 10, further comprising:

a third memory area configured to store at least one encrypted decryption key, the third memory area being accessible by the external device, the encrypted decryption key being an encrypted version of a decryption key, and the decryption key for decrypting the encrypted main key.

13. The memory device of claim 12, wherein the third memory area is further configured to store a plurality of encrypted decryption keys, at least one of the plurality of encrypted decryption keys corresponding to a vendor of the external device.

14. The memory device of claim 8, wherein

the first memory area is further configured to store a plurality of spare keys, the plurality of spare keys for generating authentication information of the memory device;

and

the second memory area is further configured to store a plurality of spare key indexes, the plurality of spare key indexes being linked to the plurality of spare keys.

15. The memory device of claim 14, wherein each of the plurality of spare keys corresponds to a vendor of the memory device.

16. The memory device of claim 1, further comprising:

a third memory area configured to store at least one encrypted decryption key, the third memory area being accessible by the external device, the encrypted decryption key being an encrypted version of a decryption key, and the decryption key for decrypting the encrypted main key.

17. The memory device of claim 16, wherein the third memory area is further configured to store a plurality of encrypted decryption keys, at least one of the plurality of encrypted decryption keys corresponding to a vendor of the external device.

18. The memory device of claim 1, wherein the second memory area is only readable by the external device.

19. A memory device, comprising:

a first memory area storing a main key and at least one spare key, the first memory area being inaccessible by external devices; and

a second memory area configured to store an encrypted main key and at least one spare key index, the second memory area being accessible by the external devices, the encrypted secure data being an encrypted version of the secure data in the first memory area, the spare key index being linked to the spare key, and the spare key being associated with a vendor of the memory device.

20. The memory device of claim 19, wherein the spare key index is linked to the spare key by a spare key number.

21. The memory device of claim 19, wherein

the first memory area stores a plurality of spare keys;

and

the second memory area is configured to store a plurality of spare key indexes, the plurality of spare key indexes being linked to the plurality of spare keys.

22. The memory device of claim 21, wherein the plurality of spare key indexes are linked to the plurality of spare keys by spare key numbers.

23. The memory device of claim 19, further comprising:

a third memory area storing a plurality of encrypted decryption keys, the third memory area being accessible by the external device, the encrypted decryption keys being encrypted versions of a respective plurality of decryption keys, the plurality of decryption keys being for decrypting the encrypted main key, and the plurality of decryption keys being associated with vendors of the external devices.

24. A memory device, comprising:

a first memory area storing secure data;

a second memory area configured to store encrypted secure data, the encrypted secure data being an encrypted version of the secure data in the first memory area; and

the memory device configured such that output of the secure data cannot occur, and output of the encrypted secure data can occur.

25. A method of operating a memory device, comprising:

storing secure data in a first memory area of the memory device, the first memory area being inaccessible by an external device; and

storing encrypted secure data in a second memory area of the memory device, the second memory area being accessible by the external device, the encrypted secure data being an encrypted version of the secure data in the first memory area.

26. The method of claim 25, further comprising:

accessing the secure data from the first memory area using logic resident on the memory device; and

generating the encrypted secure data from the accessed secure data using the logic.

27. The method of claim 25, wherein the secure data includes a main key for authenticating the memory device, and the encrypted secure data includes an encrypted main key.

28. The method of claim 27, further comprising:

storing at least one spare key in the first memory area, the spare key for generating authentication information of the memory device; and

storing at least one spare key index in the second memory area, the spare key index being linked to the spare key.

29. The method of claim 28, wherein the spare key corresponds to a vendor of the memory device.

30. The method of claim 28, wherein the spare key index is linked to the spare key by a spare key number.

31. The method of claim 28, further comprising:

storing at least one encrypted decryption key in a third memory area of the memory device, the third memory area being accessible by the external device, the encrypted decryption key being an encrypted version of a decryption key, and the decryption key for decrypting the encrypted main key.

32. The method of claim 31, wherein the encrypted decryption keys corresponds to vendors of external devices.

33. A method for a memory device to generate authentication information, comprising:

generating, by the memory device, a session key based on a spare key and input received from an external device;

generating, by the memory device, the authentication information based on the session key and a main key, the main key and the spare key being stored in an area of the memory device inaccessible to the external device; and

outputting the authentication information to the external device.

34. The method of claim 33, wherein the generating a session key comprises:

receiving a target spare key number, a spare key variant number, and a random number from the external device as the input from the external device;

obtaining the spare key based on the received target spare key number;

encrypting the spare key based on the received spare key variant number to produce a spare key variant; and

encrypting the spare key variant based on the received random number to generate the session key.

35. The method of claim 34, wherein the generating the authentication information comprises:

encrypting the main key using the session key to generate the authentication information.

36. The method of claim 35, wherein the encrypting encrypts the main key according to a one-way function using the session key to generate the authentication information.

37. The method of claim 33, wherein the generating the session key comprises:

receiving a target spare key number, a spare key variant number, and a random number from the external device as the input from the external device;

selecting one of a plurality of spare keys stored in the area of the memory device based on the received target spare key number;

encrypting the selected spare key based on the received spare key variant number to produce a spare key variant; and

encrypting the spare key variant based on the received random number to generate the session key.

38. The method of claim 37, wherein the generating authentication information comprises:

encrypting the main key using the session key to generate the authentication information.

39. The method of claim 38, wherein the encrypting encrypts the main key according to a one-way function using the session key to generate the authentication information.

40. A method for a memory device to generate authentication information, comprising:

receiving a target spare key number, a spare key variant number, and a random number from an external device;

encrypting a spare key based on the received spare key variant number to produce a spare key variant;

encrypting the spare key variant based on the received random number to generate the session key;

encrypting a main key stored at the memory device using the session key to generate the authentication information; and

outputting the authentication information.

41. A memory device, comprising:

a first memory area storing a main key and a spare key, the first memory area being inaccessible to an external device;

a first encrypter configured to generate a session key based on the spare key and input received from the external device; and

a second encrypter configured to generate authentication information based on the session key and a main key, the second encrypter configured to output the authentication information to the external device.

42. The memory device of claim 41, wherein the second encrypter is configured to encrypt the main key according to a one-way function using the session key to generate the authentication information.

43. The memory device of claim 41, further comprising:

a third encrypter configured to encrypt the spare key based on a spare key variant number received from the external device to produce a spare key variant; and

wherein

the first encrypter is configured to encrypt the spare key variant based on a random number received from the external device to generate the session key.

44. The memory device of claim 43, wherein the second encrypter is configured to encrypt the main key using the session key to generate the authentication information.

45. The memory device of claim 43, further comprising:

a selector configured to obtain the spare key based on a target spare key number received from the external device.

46. The memory device of claim 41, further comprising:

a selector configured to receive a target spare key number from the external device and select one of a plurality of spare keys stored in the first memory area based on the target spare key number;

a third encrypter configured to encrypt the selected spare key based on a spare key variant number received from the external device to produce a spare key variant; and

wherein

the first encrypter is configured to encrypt the spare key variant based on a random number received from the external device to generate the session key.

47. The memory device of claim 46, wherein the second encrypter is configured to encrypt the main key using the session key to generate the authentication information.