Kioxia Corporation

Kabushiki Kaisha Toshiba

Kenichi Numata

Yoshiyuki Kudoh

Hiroshi Isozaki

Teruji Yamakawa

Takashi Kuzuhara

Sachi Tarui

Masahiro Kusaka

A storage device includes a storage and a controller. The storage includes a plurality of sections. The controller executes control of the storage. The control includes writing data to the storage and reading data from the storage, in response to a command from a host. The controller includes a security control unit that applies a data protection processing method compliant with a first specification or a second specification, to protect data in the storage. The security control unit applies a first data protection processing method compliant with the first specification to a first section of the plurality of sections and a second data protection processing method compliant with the second specification to a second section of the plurality of sections.

Storage device

According to one embodiment, a key management device includes a storage and a server. The storage includes a first nonvolatile memory, and a first controller configured to encrypt, using a first media encryption key, data from a host, and store the encrypted data in the first nonvolatile memory. The server includes a second nonvolatile memory storing a first key, and a second controller configured to transmit the first key from the second nonvolatile memory to the storage without passing through the host. The first controller is configured to generate the first media encryption key using the first key.

Key management device and storage system

According to one embodiment, a storage device includes a first storage region assigned to a first user and a second storage region assigned to a second user. A first controller is capable of providing a data protection function to the first and second storage regions, and a second controller is capable of providing the data protection function to the second storage region. The first controller stores a table with information about the data protection function. The second controller can refer to the table. The first controller has a authority to execute a user authentication for the first storage region and the second storage region to determine whether the data protection function can be provided for the first or second storage regions.

According to one embodiment, a storage device includes a nonvolatile storage medium and a controller. The controller encrypts data with an encryption key, writes encrypted data into the storage medium, and manages a first and second encryption keys. The first encryption key encrypts data to be written into a first area and a second encryption key encrypts data to be written into a second area. The controller updates, if the first area is write protected and the second area is not write protected, the second encryption key without updating the first encryption key when receiving an initialization command from a host.

Storage device and control method

A memory system includes a nonvolatile memory including user areas, a volatile memory, a battery, and a controller configured to, when the volatile memory maintains first information indicating an access to a user area is permitted and a verification value upon startup of the system, determine whether the information is validated by the value, and upon determining that the information is validated, permit an access to the user area and prohibit the access to any other area, and when the volatile memory does not maintain the information and value, or the information is not validated, prohibit an access to any user area, and thereafter, upon receipt of a command and authentication information from the host, permit an access to the user area requested by the command, and generate and store in the volatile memory the information and the value for validating the generated information.

Memory system

According to one embodiment, a memory device includes a third partial key write module, an encryption key write module, and a decryption module. The third partial key write module is configured to combine a second partial key received from the current host device with the first partial key in the partial key memory device and to write a generated third partial key into the volatile memory after the device authentication. The encryption key write module is configured to combine the third partial key with the second user authentication information and to write a generated encryption key into the volatile memory after the user authentication. The decryption module is configured to decrypt the encrypted data based on the encryption key in the volatile memory based on a read request received from the current host device and to output obtained data to the current host device when the user authentication has succeeded.

Growing community of inventors

Ome, Japan

Kenichi Numata