DATA MANAGEMENT METHOD

• US 20180145829A1
• Filed: 10/30/2017
• Published: 05/24/2018
• Est. Priority Date: 11/24/2016
• Status: Active Grant

• Current Assignee: Samsung Electronics Co. Ltd.
• Original Assignee: Samsung Electronics Co. Ltd.
• Inventors: Choi, Hye Hyun, KANG, Bo Gyeong
• Granted Patent: US 10,728,026 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 2209/12 Details relating to cryptographic hardware or logic circuitry
• CPC Class Codes: H04L 2463/062 applying encryption of the keys cryptographic mechanisms or cryptographic arrangements for key distribution using key encryption key H04L9/0822
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 9/0631 Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms
• CPC Class Codes: H04L 9/0637 Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC

Abstract

A data management method includes decrypting the first encryption key using the second encryption in response to receiving the first encryption key, decrypting the data by using the first encryption key in response to receiving the data encrypted with the first encryption key, and encrypting the data with the third encryption key and transmitting the data externally.

Claims

1. A data management method comprising:

storing a second encryption key for encrypting a first encryption key, and a third encryption key for encrypting data when the data is transmitted;

decrypting the first encryption key by using the second encryption key, in response to receiving the first encryption key;

decrypting data by using the first encryption key, in response to receiving the data encrypted with the first encryption key;

encrypting the data with the third encryption key; and

transmitting the data encrypted with the third encryption key externally.

2. The data management method of claim 1, wherein the method is executed by a Hardware Security Module (HSM).

3. The data management method of claim 1, wherein the data encrypted with the third encryption key is stored in an electronic device.

4. The data management method of claim 3, wherein the electronic device includes,

a processor having the third encryption key stored in a manufacturing operation, and

a memory configured to store the data.

5. The data management method of claim 4 further comprising:

decrypting the data by using the third encryption key by the processor; and

storing the decrypted data in the memory.

6. The data management method of claim 3 further comprising:

receiving and storing the third encryption key, the third encryption key being directly received from a manufacturer of the electronic device and stored.

7. The data management method of claim 3 further comprising:

receiving and storing the second encryption key, the second encryption key being directly received from a buyer of the electronic device.

8. The data management method of claim 3, wherein the data includes information required to allow the electronic device to provide an Internet of Things (IoT) service.

9. The data management method of claim 3, wherein the data is encrypted with the third encryption key using an Advanced Encryption Standard in Cipher Block Chaining (AES-CBC) algorithm.

10. A data management method comprising:

receiving an encryption key and data, the encryption key being encrypted with a first transmission key, the data being encrypted with the encryption key;

decrypting the encryption key using the first transmission key which is input directly;

decrypting the data with the encryption key;

encrypting the data by using a second transmission key, different from the first transmission key; and

inputting the data to an electronic device after encoding the data encrypted with the second transmission key in a transmission format.

11. The data management method of claim 10, wherein the transmission format includes verification information for verifying the inputting.

12. The data management method of claim 11, wherein the verification information includes at least one of a data format, an initialization vector, a length of the second transmission key, and Hash-based Message Authentication Code (HMAC) information.

13. The data management method of claim 11, further comprising:

extracting the verification information as the data is decoded by the electronic device, in response to the data encoded in the transmission format being input to the electronic device;

confirming the inputting, using the verification information, by the electronic device; and

decrypting the data encrypted with the second transmission key by the electronic device in response to a determination that the inputting has been performed normally.

14. The data management method of claim 10, wherein the method is executed by an HSM.

15. The data management method of claim 14, wherein the encryption key and the first transmission key are input directly to the HSM by a buyer of the electronic device, and

the second transmission key is input directly to the HSM by a manufacturer of the electronic device.

16. A data management method comprising:

receiving, via direct input, a first key and a second key;

receiving a third key encrypted with the first key;

decrypting the third key using the first key;

receiving data encrypted with the third key;

decrypting the data with the third key;

encrypting the data with the second key; and

inputting the data to an electronic device.

17. The data management method of claim 16 further comprising:

encoding the data encrypted with the second key into a transmission format.

18. The data management method of claim 17, wherein the transmission format includes verification information for verifying the inputting.

19. The data management method of claim 18, wherein the verification information includes at least one of a data format, an initialization vector, a length of the second key, and Hash-based Message Authentication Code (HMAC) information.

20. The data management method of claim 18, further comprising:

extracting the verification information as the data is decoded by the electronic device, in response to the data encoded in the transmission format being input to the electronic device;

confirming the inputting, using the verification information by the electronic device; and

decrypting the data encrypted with the second key by the electronic device in response to a determination that the inputting has been performed normally.