Micron Technology Incorporated

Intel Corporation

Lodestar Licensing Group LLC

Lance W Dover

Olivier Duval

Jeffrey Charles Shiner

Aaron Preston Boehm

Steffen Buch

Zhan Liu

Peter Sean Feeley

Tommaso Vali

Steven E Wells

Robert N Hasbun

John Rudelic

Jeremy Binfet

Paul D Ruby

Walter Di Francesco

V Niles Kynett

Jim Cooke

Travis Duane Nelson

William T Reaves

Antonino Mondello

David Aaron Palmer

Shekoufeh Qawami

Yoav Weinberg

Nadav Grosz

Sanjay S Talreja

Robert E Larsen

Andrew H Gafken

Giuseppe Ferrari

Brent Ahlquist

Ramkarthik Ganesan

Michael Tex Burk

Chaitanya S Rajguru

Fabio Indelicato

Giuseppe Vito Portacci

Peter T Larsen

Ramadurai Rajagopal

Methods, systems, and devices for authenticated modification of memory system data are described. A host system may transmit a command to program data to a protection region of a memory system, and the host system may sign the command using a key associated with the protection region. In some examples, the host system may transmit the data associated with the command, or the command may include instructions to move the data from another region of the memory system. Upon receiving the command, the memory system may verify the signature to determine whether the host is authorized to modify the protection region, and may program the data as requested by the host system. In some cases, the protection regions of the memory system may be updated, for example by adjusting the size or address range of the protection regions, in response to a command from the host system.

Authenticated modification of memory system data

In some implementations, a memory device may resolve a set of latches of a NAND page buffer to a set of initialized values. The memory device may obtain a NAND page buffer initialized data set from the set of initialized values of the set of latches. The memory device may generate a security key using the NAND page buffer initialized data set.

NAND page buffer based security operations

The disclosed embodiments are related to securely updating a semiconductor device and in particular to a key management system. In one embodiment, a method is disclosed comprising receiving a request for an activation code database from a remote computing device, the request including at least one parameter; retrieving at least one pair based on the at least one parameter, the pair including a unique ID (UID) and secret key; generating an activation code for the UID; and returning the activation code to the remote computing device.

Cloud-based creation of a customer-specific symmetric key activation database

Methods, systems, and devices for techniques for generating a shared secret for an electronic system are described. A memory system may identify an initial key pair and exchange a public key of the key pair with a public key associated with a server. The memory system and the server may each generate a shared secret. In some cases, the memory system and the server may use the shared secret to generate a device identifier for the memory system, for example by incorporating the device identifier into a cryptographic representation of a software layer of the memory system. The memory system and the server may use the device identifier to generate one or more asymmetric key pairs, which may be used by the server to authenticate the memory system.

Generating a shared secret for an electronic system

Methods, systems, and devices for host verification for a memory device are described. A memory device may receive a first value from a host device that is associated with an identification of the host device after an event. The memory device may transmit a second value to the host device that is based on the first value and comprises a random set of bits. The memory device may receive from the host device data or a command that comprises an encrypted third value that is based at least in part on the second value and a secret shared between the host device and the memory device. The memory device may also enable a functionality of the memory device based on the encrypted third value.

Host verification for a memory device

A security server to provide security services over a computer network based on security features of memory devices connected to host systems. For example, the security features of a memory device can include a unique device secret, a cryptographic engine, and an access controller to implement access privileges represented by cryptographic keys. After receiving identity data that is generated by the memory device and represented by a cryptographic key, the security server can determine authenticity of the memory device based on its copy of the unique device secret of the memory device. The security server can generate a verification code for a command and cause the command and the verification code to be communicated to the memory device, where the access controller of the memory device validates the verification code in determining whether to block execution of the command in the memory device.

Online security services based on security features implemented in memory devices

A system, method and apparatus to control memory devices over computer networks. For example, a server system establishes a secure authenticated connection with a client computer system. Over the connection, the server receives from the client computer system a request identifying a memory device and determine, based on data stored in the server system, that the client computer system is eligible to control the memory device. In response to a request from the client computer system, the server system generates a digital signature for a command using at least a cryptographic key stored in the server system in association with the memory device. The client computer system receives the digital signature from the server system and submits the command with the digital signature to the memory device. The memory device validates the digital signature prior to execution of the command.

Control of memory devices over computer networks using digital signatures generated by a server system for commands to be executed in the memory devices

Methods, systems, and devices for multi-factor authentication for memory systems based on internal asymmetric keys are described. In some examples, host systems and memory systems may be configured to implement techniques for the generation and distribution of asymmetric keys, certificates, or both, which may support evaluating the authenticity of interfacing systems (e.g., by signing and verifying exchanged signaling based on system identities) or protecting the integrity of exchanged signaling (e.g., by encrypting exchanged signaling), or both. Such techniques may include implementing asymmetric cryptographic security functionality directly in a memory system, including techniques where the memory system is configured to generate asymmetric key pairs, certificates, or both based on a combination of unique device secret and content stored at the memory system.

Multi-factor authentication for a memory system based on internal asymmetric keys

Data associated with a memory device may be authenticated before an associated operation is executed. The data may be authenticated before it is executed at a volatile memory. The data may be associated with a hash (e.g., a first hash) and may be communicated from the memory device to a host device. At the host device, the data and the first hash may be written (e.g., stored) to temporary storage, such as a cache. Once stored to the cache, the host device may generate an additional hash (e.g., a second hash) related to the data using a key inaccessible to the memory device. If the first hash and second hash match, the data may be authenticated and one or more operations may be executed.

Safety and security for memory

A server system stores data associating a secret of the memory device configured in an endpoint, a first identification, and device information of the endpoint. After receiving a request to bind a second identification to the endpoint, the server system can tie identity data of the endpoint to the second identification. For example, after receiving a validation request containing identity data generated by the memory device, the server system can verify a verification code in the identity data based at least in part on the secret of the memory device. The verification code is generated from a message presented in the identity data and a cryptographic key derived at least in part from the secret. Based on validating the identity data, the server system can provide a validation response to indicate that the identity data is generated by the endpoint having the second identification.

Management of identifications of an endpoint having a memory device secured for reliable identity validation

A device to secure data storage may include circuitry that switches a communication circuit to a memory from a derived secret generator based on an access command.

Switch to control communication between a memory and a secret generator in a memory device

A security server to validate identity data of computing devices having secure memory devices and track activities of components in the computing devices. The server system is configured to store data representative of a unique device secret sealed in the memory device. The server system can generate a first cryptographic key independently from the memory device generating a second cryptographic key. The memory device uses the second cryptographic key to generate identity data including a message and a verification code generated via cryptographic operations combining the message and the second cryptographic key. The server system can use the first cryptographic key to determine whether the verification code is valid for the message. If so, the security server can generate an activity record associating the activity of the computing device with identifications of respective components of the computing device confirmed via validation of the identity data.

Track activities of components in endpoints having secure memory devices via identity validation

A system, method and apparatus to authenticate an endpoint having a secure memory device. For example, a card profile can be selected, configured, and/or stored into the secure memory device based on endpoint identity data representative of a component configuration of the endpoint, including the device identity representative of the memory device and other components. The card profile can be used by the endpoint to emulate a physical smart card and can be viewed a virtual smart card, such as a virtual subscriber identification module (SIM) card for accessing a cellular connection.

Virtual subscriber identification module and virtual smart card

A server system to onboard an endpoint having a host system connected to a host interface of a memory device for a cloud service without prior customization of the endpoint to identify an account for accessing the cloud service. For example, after receiving a request associated with the service and containing identity data generated by the memory device, the server system determines authenticity of the memory device and the endpoint based on a secret of the memory device and the identity data. In response to the request, the server system further identifies, based on the identity data, a subscriber among a plurality of subscribers based on ownership data of the endpoint. As a result of the identifying of the subscriber based on the identity data, the server system determines an account of the subscriber to provide the service to the endpoint based on the account.

Cloud-service on-boarding without prior customization of endpoints

The disclosed embodiments are related to securely updating a semiconductor device and in particular to a key management system. In one embodiment, a method is disclosed comprising storing a plurality of activation codes, each of the activation codes associated with a respective unique identifier (UID) of semiconductor device; receiving, over a network, a request to generate a new storage root key (SRK), the request including a response code and a requested UID; identifying a selected activation code from the plurality of activation codes based on the requested UID; generating the SHRSRK value using the response code and the selected activation code; associating the SHRSRK value with the requested UID and storing the SHRSRK value; and returning an acknowledgement in response to the request.

Growing community of inventors

Fair Oaks, CA, United States of America

Lance W Dover