Micron Technology Incorporated

Intel Corporation

Robert W Strong

James Ruane

Michael B Danielson

Eric N Lee

Jeremy Binfet

William Richard Akin

Daniel J Hubbard

Jeffrey L McVay

Jonathan Tanguy

Hemaprabhu Jayanna

Ned M Smith

Steven E Wells

Adam J Hieb

Dustin James Carter

Neil Levine

Tim Markey

Hormuzd M Khosravi

Ohad Falik

Eliezer Tamir

Men Long

Daniel Nemiroff

Michael N Derr

Rajeev K Nalawadi

Lokpraveen B Mosur

James T Doyle

Nimrod Diamant

Paritosh Saxena

Nicholas D Triantafillou

Amber D Huffman

Simoni Ben-Michael

Paul J Thadikaran

Jeffrey L Rabe

Geetani R Edirisooriya

Steve Grobman

Akshay Ramesh Kadam

John P Lee

Craig T Owen

Itay Franko

Paul S Schmitz

Edward J Pullin

Jasper Balraj

Richard J Heiler

Brad W Stewart

Carol L Barrett

Gary M Hess

Jeffrey T Brown

A processing device receives, from a host system, a key manifest and a digital signature generated based on the key manifest using a private key corresponding to a public/private key pair. The key manifest comprises one or more verification keys. The digital signature is verified using the public key and the processing device stores the key manifest in a persistent storage component in response to successful verification of the digital signature. The one or more verification keys are utilized in one or more verification operations based on the key manifest being stored in the persistent memory component.

Secure replaceable verification key architecture in a memory sub-system

A processing device initializes a memory device in an unauthenticated state in which the memory device is unable to execute one or more restricted commands. The processing device accesses a security capsule that is digitally signed using a private key. The processing device transitions the memory device to an authenticated state based on verifying that the security capsule is validly signed. The processing device uses a public key corresponding to the private key to verify the security capsule is validly signed. While in the authenticated state, the memory device is able to execute the one or more restricted commands.

Security capsule for enabling restricted features of a memory device

A processing device is configured to process an initial set of command types. A command extension module and a digital signature are received. The digital signature is generated based on the command extension module using a private key of a key pair. The command extension module, once installed by the processing device, enables the processing device to process a new command type that is not included in the initial set of command types. The digital signature is verified using a public key of the key pair. Based on a successful verification of the digital signature, the command extension module is temporarily installed by loading the command extension module in a volatile memory device.

Dynamic command extension for a memory sub-system

A request for password generation is received from a host system. In response to receiving the request, a password derivation key is generated based on a key derivation seed. A password is derived from the password derivation key, and a wrapping key is derived from the password. The wrapping key is used to wrap an authorization state indication, which is stored in local memory. Encrypted data is generated based on an encryption of the key derivation seed using an asymmetric encryption key. The encrypted data is provided in response to the request.

Single-use password generation

A method includes receiving signaling indicative of performance of a sanitization operation to a processing device coupled to a memory device and applying a sanitization voltage to a plurality of memory blocks of the memory device. The sanitization voltage can be greater than an erase voltage of the plurality of memory blocks.

Memory sub-system sanitization

A system includes a memory component and a processing device, operatively coupled with the memory component, to generate a physical presence security identification (PSID) for the memory component using a statistically random number generator. The processing device, operatively coupled with the memory component, can securely retrieve the PSID and revert the memory component to an original state using the PSID.

Memory physical presence security identification

A processing device receives a command to arm a memory device for self-destruction. In response to the command, a self-destruction countdown timer is commenced. An expiry of the self-destruction countdown timer and based on detecting the expiry of the self-destruction countdown timer, data stored by the memory device is destructed.

Securely arming a memory device for self-destruction by implementing a self-destruction countdown timer using a battery backed real-time clock

A method includes identifying a target plane in respective planes of a memory die in a non-volatile memory array and identifying, from blocks of non-volatile memory cells coupled to a common bit line in the target plane, at least one target block in the target plane. The method further includes performing an operation to disable at least one gate associated with the at least one target block to prevent access to the blocks of non-volatile memory cells coupled to the common bit line in the target plane.

Memory plane access management

A key delegation request is received from a host system. The key delegation request includes a new public key. A challenge is generated based on the new public key and a root public key, and the challenge is provided to the host system responsive to the request. A first and second digital signature are received from the host system. The first digital signature is generated by cryptographically signing the challenge using a new private key corresponding to the new public key and the second digital signature is generated by cryptographically signing the challenge using a root private key corresponding to the root public key. The first digital signature is validated using the new public key and the second digital signature is validated using the root public key. Based on successful validation of both signatures, the new public key is utilized in one or more cryptographic operations.

Delegation of cryptographic key to a memory sub-system

Methods, systems, and devices for double wrapping for verification are described. In some cases, a memory subsystem can receive a firmware image for the memory subsystem where the firmware image is signed with a first signature according to a first signing procedure. The memory subsystem can then verify an integrity of the firmware image based on the first signing procedure. After verifying the integrity of the firmware image, the memory subsystem can then generate a second signature for the firmware image based on a second signing procedure different from the first signing procedure. The memory subsystem can then write the second signature to the firmware image. The memory subsystem can then perform a verification process to verify the integrity of the firmware image based on one or both of the first signing procedure or the second signing procedure. In this case, a first verification time is associated with the first signing procedure and is greater than a second verification time associated with the second signing procedure.

Double wrapping for verification

The present disclosure includes apparatuses and methods for directed sanitization of memory. One example method comprises, responsive to receiving a sanitization command, performing a deterministic garbage collection operation on a memory, wherein performing the deterministic garbage collection operation results in physical erasure of all invalid data stored on the memory without losing valid data stored on the memory.

Directed sanitization of memory

Growing community of inventors

Folsom, CA, United States of America

Robert W Strong