Methods for performing key exchange and authorization transfer in storage devices

Abstract

This disclosure provides a method for performing key exchange and authorization transfer in a storage device. One method for performing key exchange for secure operation in a storage device includes: generating a first certificate by a trusted third party (TTP) based on a first user ID and a first public key, and generating a second certificate based on a second user ID and a second public key. When the storage device is accessed by the first user ID, a first verification is performed on the second certificate based on the third certificate. When the first verification is successfully completed, an encryption key is derived based on the first private key and the second public key. When the storage device is accessed by the second user ID, a second verification is performed on the first certificate based on the third certificate. When the second verification is successfully completed, an encryption key is derived based on the second private key and the first public key.

Description

[0001] Cross-reference to related applications

[0002] This application claims priority to Korean Patent Application No. 10-2020-0135849, filed on October 20, 2020 with the Korean Intellectual Property Office (KIPO), the contents of which are incorporated herein by reference in their entirety. Technical Field

[0003] One or more embodiments described herein relate to security measures for semiconductor devices. Background Technology

[0004] Solid-state drives (SSDs) and other types of semiconductor memory outperform hard disk drives (HDDs) by enabling faster data access speeds. In many cases, they also exhibit improved stability and durability, as well as lower power consumption. Recently, hardware-based full-disk encryption (FDE) has been used to improve the security of HDDs and SSDs, and is therefore sometimes referred to as a self-encrypting drive (SED). SEDs can operate based on the OPAL storage specification (or simply OPAL) developed by the Trusted Computing Group (TCG). The OPAL specification is designed to enhance the security of self-encrypting drives. Summary of the Invention

[0005] One or more embodiments described herein provide a method for improving the security of a storage device, which may be, for example, a semiconductor memory.

[0006] One or more embodiments described herein can provide a method for improving security by performing key exchange for secure operations in storage devices such as self-encrypting drives (SEDs).

[0007] One or more embodiments described herein provide a method for performing authorization transfer in a storage device (e.g., a SED) using a key exchange method.

[0008] According to one or more embodiments, a method for performing key exchange for secure operation in a storage device accessed by multiple user identifiers (IDs) includes: generating a first certificate based on a first user ID and a first public key by a trusted third party (TTP) in or coupled to the storage device; and generating a second certificate by the TTP based on a second user ID and a second public key. The method further includes: performing a first verification on the second certificate based on a third certificate in or accessed by the TTP when the storage device is being accessed by the first user ID; and deriving an encryption key based on a first private key obtained from the first verification and the second public key when the first verification is successfully completed. The method further includes: performing a second verification on the first certificate based on the third certificate when the storage device is being accessed by the second user ID; and deriving the encryption key based on a second private key obtained from the second verification and the first public key when the second verification is successfully completed. Successful verification means that the verification result is successful.

[0009] According to one or more embodiments, a method is provided for performing an authorization transfer in a storage device including a first storage area and accessed by a plurality of user identifiers (IDs). The method includes: performing a key exchange between a first user ID having a first access authorization to the first storage area and a second user ID seeking to obtain the first access authorization; and encrypting a first key encryption key (KEK) based on an encryption key corresponding to the first access authorization, the first KEK being obtained through the key exchange, while the storage device is being accessed by the first user ID. The method further includes: decrypting the encrypted first KEK based on the encryption key while the storage device is being accessed by the second user ID.

[0010] Furthermore, performing key exchange includes: generating a first certificate for the first user ID based on the first user ID and a first public key by a trusted third party (TTP) in or coupled to the storage device; generating a second certificate for the second user ID by the TTP based on the second user ID and a second public key; and performing a first verification on the second certificate based on a third certificate in or accessed by the TTP when the storage device is being accessed by the first user ID. The method further includes: deriving the encryption key based on a first private key and a second public key obtained from the first verification when the first verification is successfully completed; and performing a second verification on the first certificate based on the third certificate when the storage device is being accessed by the second user ID. The method further includes: deriving the encryption key based on a second private key and a first public key obtained from the second verification when the second verification is successfully completed.

[0011] According to one or more embodiments, a method is provided for performing a key exchange for secure operation in a storage device accessed by a first user ID and a second user ID, the first user ID having a first private key and a first public key, the second user ID having a second private key and a second public key, the key exchange being performed between the first user ID and the second user ID.

[0012] The method includes: generating a first certificate by a trusted third party (TTP) having a third private key and a third public key, either in or coupled to the storage device, by signing a first user ID and a first public key based on the third private key. The method further includes: generating a second certificate by the TTP by signing a second user ID and a second public key based on the third private key; storing the first certificate, the second certificate, and the third certificate for the TTP in a key slot storing the first private key, the first public key, the second private key, and the second public key; and accessing the storage device based on the first user ID and a first password.

[0013] The method further includes: when the storage device is being accessed by the first user ID, extracting the third public key based on the third certificate, verifying the signature of the second certificate based on the third public key, and extracting the second user ID and the second public key from the second certificate when the verification of the signature of the second certificate is successfully completed, and performing a first verification on the second certificate. The method further includes: obtaining a first key protection key (KPK) based on the first password and a random value, obtaining the first private key based on the first KPK, and deriving an encryption key by performing a key agreement based on the first private key and the second public key; and accessing the storage device based on the second user ID and the second password.

[0014] The method further includes: when the storage device is being accessed by the second user ID, extracting the third public key based on the third certificate, verifying the signature of the first certificate based on the third public key, and extracting the first user ID and the first public key from the first certificate when the verification of the signature of the first certificate is successfully completed, and performing a second verification on the first certificate. The method further includes: obtaining a second KPK based on the second password and the random value, obtaining a second private key based on the second KPK, and deriving the encryption key by performing the key agreement based on the second private key and the first public key. Attached Figure Description

[0015] Illustrative and non-limiting exemplary embodiments will be more clearly understood from the following detailed description taken in conjunction with the accompanying drawings.

[0016] Figure 1 An embodiment of a method for performing key exchange for secure operation in a storage device is illustrated.

[0017] Figure 2 The diagram illustrates the use of Figure 1 An example of information exchange using this method.

[0018] Figure 3 An embodiment of the storage system is illustrated.

[0019] Figure 4 An embodiment of the storage controller is illustrated.

[0020] Figure 5 The illustration shows an example of storage space in a storage device.

[0021] Figure 6 The illustration shows an example of the process of generating the first certificate.

[0022] Figure 7 The illustration shows an example of generating a second certificate.

[0023] Figure 8A and Figure 8B The diagram illustrates the description Figure 6 and Figure 7 Examples of operations.

[0024] Figure 9 The illustration shows an example of performing the first verification operation.

[0025] Figure 10 The illustration shows an example of the operation of exporting an encryption key.

[0026] Figure 11 The diagram illustrates the description Figure 9 and Figure 10 Examples of operations.

[0027] Figure 12 The illustration shows an example of performing the second verification.

[0028] Figure 13 The illustration shows an example of the operation of exporting an encryption key.

[0029] Figure 14 The diagram illustrates the description Figure 12 and Figure 13 Examples of operations.

[0030] Figure 15 An embodiment of a method for performing authorization transfer is illustrated.

[0031] Figure 16 The illustration shows an example of the operation of encrypting the first KEK.

[0032] Figure 17 The diagram illustrates the description Figure 16 Examples of operations.

[0033] Figure 18 The illustration shows an example of the operation of decrypting the encrypted first KEK.

[0034] Figure 19 The illustration shows an example of the operation of storing and decrypting the first KEK.

[0035] Figure 20 The diagram illustrates the description Figure 18 and Figure 19 Examples of operations.

[0036] Figure 21 An embodiment of a method for performing authorization transfer is illustrated.

[0037] Figure 22 and Figure 23 An embodiment of the storage system is illustrated.

[0038] Figure 24 The illustration depicts a data center including a storage system according to an embodiment. Detailed Implementation

[0039] Various exemplary embodiments are described with reference to the accompanying drawings, which illustrate embodiments. However, this disclosure may be implemented in many different forms and should not be construed as limited to the embodiments set forth herein. Throughout this application, the same reference numerals refer to the same elements.

[0040] Figure 1 This is a flowchart illustrating an embodiment of a method for performing key exchange for secure operation in a storage device. Figure 2 It can target Figure 1 This is an example of information exchange performed by a method.

[0041] refer to Figure 1 and Figure 2 This method can be executed or run on a storage device accessed by multiple user identifiers (IDs), which may include a first user ID and a second user ID that are distinct from each other. The storage device includes multiple memories (e.g., non-volatile memory) for storing data and a storage controller for controlling the operation of the non-volatile memory. The storage device may also include a trusted third party (TTP) for performing key exchange. (Reference) Figure 3 Description of embodiments of a storage device and a storage system including the storage device.

[0042] The key exchange method includes, in S100, based on the user ID (ID) of the first user. U1 ) and first user ID U1 First public key PK U1 Generate the first certificate Cert U1 .

[0043] In S200, based on the user ID (ID) of the second user U2 ) and second user ID U2 Second public key PK U2 Generate a second certificate (Cert) U2 Reference is made to embodiments of operations S100 and S200. Figure 6 , Figure 7 , Figure 8A and Figure 8B To describe.

[0044] Operations S100 and S200 can be performed, for example, by a TTP in the storage device. The TTP can be used to securely and / or reliably perform key exchange. For example, the TTP can generate a first certificate (Cert) for user authentication. U1 Second Certificate Cert U2 This can be used to prevent or block the exchange of keys with unauthorized or invalid users.

[0045] In some example embodiments (e.g., as referenced) Figure 3 (As described), the TTP can be included in a storage controller, which may be in or coupled to a storage device. In other example embodiments (e.g., as referenced) Figure 22 As described, the TTP can be set up or located outside the storage controller and coupled to the storage controller. In one embodiment (e.g., as referenced...) Figure 23 As described, the TTP can be set up or located outside the storage device and coupled to the storage device.

[0046] In S300, when the storage device is being processed by the first user ID... U1 During access, the second certificate Cert is compared based on the third certificate in TTP. U2 Perform the first verification.

[0047] In S400, when the first authentication is successfully completed, the first user ID obtained from the first authentication is used. U1 First private key SK U1 Second User ID U2 Second public key PK U2 Export the encryption key CK. See the examples of operations S300 and S400 for details. Figures 9 to 11 To describe.

[0048] A third certificate can be used in conjunction with the first certificate, Cert. U1 Second Certificate Cert U2 Different. In one embodiment, a third certificate can be used to check or verify the second certificate, Cert. U2 Is it a certificate signed by TTP, as in operating an S300? For example, based on the first authentication, it can be based on the second user ID. U2 and the second user ID U2 The check is performed to determine whether the second user is an authorized or legitimate user.

[0049] In S500, when the storage device is being used by a second user ID U2 During access, the first certificate (Cert) is verified based on the third certificate. U1 Perform the second verification.

[0050] In S600, when the second authentication is successfully completed, the second user ID obtained from the second authentication is used. U2 Second private key SK U2 and first user ID U1 First public key PK U1 Export the encryption key CK. See the examples of operating S500 and S600 for details. Figures 12 to 14 To describe.

[0051] A third certificate can be used to verify or confirm the first certificate, Cert. U1 Is it a certificate signed by TTP, such as when operating an S500? Based on secondary authentication, it can be based on the first user ID. U1 and the first user ID U1 The check is performed to determine whether the first user is an authorized or legitimate user.

[0052] refer to Figure 2 During the initial operation, the first user (e.g., first user ID) U1 It can have the first private key SK U1 PK with the first public key U1 Second user (e.g., second user ID) U2 It can have a second private key SK U2 Second public key PK U2 When operations S100 and S200 are performed, the first certificate, Cert, can be obtained. U1 Second Certificate Cert U2When operations S300 and S400 are executed, the first user can obtain the encryption key CK. When operations S500 and S600 are executed, the second user can obtain the encryption key CK. For example, the first private key SK U1 First Public Key PK U1 Second private key SK U2 Second public key PK U2 First Certificate Cert U1 Second Certificate Cert U2 It can be stored in a key slot.

[0053] In some example embodiments, a cryptographic key CK obtained through key exchange can be used to perform secure (or safe) operations. For example, secure operations may include transferring authorization (e.g., access authorization or permissions) to a specific storage area, as illustrated in embodiments thereof. Figure 15 This is used to describe the process. However, the example embodiments are not limited to this, and security operations may include at least one of a variety of other operations.

[0054] In some example embodiments, operation S400 is based on the first private key SK. U1 Second public key PK U2 The exported encryption key CK can be used in operation S600 based on the second private key SK. U2 PK with the first public key U1 The exported encryption key CK is basically the same.

[0055] In some example embodiments, key exchange can be performed based on the Diffie-Hellman (DH) scheme and / or the Elliptic Curve Diffie-Hellman (ECDH) scheme. For example, a first private key SK can be assumed. U1 For "a", the first public key PK U1 For "g a mod p", second private key SK U2 For "b", the second public key PK U2 For "g b "mod p", where "p" is a prime number, "g" is an integer greater than or equal to 1 and less than or equal to "(p-1)", "a" and "b" are both integers greater than or equal to 1 and less than or equal to "(p-2)", and "mod" represents the modulo operation. In this example, the first certificate Cert U1 It can be "ID" U1 |PK U1 |Sign{SK TTP ID U1 |PK U1}”, Second Certificate Cert U2 It can be "ID"U2 |PK U2 |Sign{SK TTP ID U2 |PK U2 The encryption key CK exported in the S400 operation can be "(g b ) a "mod p", the encryption key CK exported in the S600 operation can be "(g a ) b "mod p" means that the same encryption key can be obtained in operations S400 and S600. However, the example embodiment is not limited to this, and key exchange can be performed based on one or more other algorithms.

[0056] Although Figure 2 The diagram illustrates the first certificate, Cert. U1 Second Certificate Cert U2 First user (e.g., first user IDID) U1 ) and the second user (e.g., the second user ID ID) U2 Transfers can occur between users, but variations are possible. For example, in one embodiment, the storage device may not be accessed simultaneously by two or more users (e.g., two or more user IDs), and may be accessed by only one user (e.g., one user ID) at a given time. This occurs when the storage device is being accessed by the first user (e.g., when using the first user ID). U1 While logged into the storage device, operations S100, S300, and S400 can be performed based on the first private key SK stored in the key slot. U1 First Public Key PK U1 Second private key SK U2 Second public key PK U2 Executed sequentially and / or simultaneously. This occurs when the storage device is being accessed by a second user (e.g., when using a second user ID). U2 While logged into the storage device, operations S200, S500, and S600 can be performed based on the first private key SK stored in the key slot. U1 First Public Key PK U1 Second private key SK U2 Second public key PK U2 They are executed sequentially and / or simultaneously.

[0057] It should also be noted that in some implementations, the operations marked in a block may not be performed in the order indicated in the flowchart. For example, two blocks shown consecutively may actually be executed substantially simultaneously, or, for example, the blocks may be executed in reverse order depending on the operations involved.

[0058] In the method for performing key exchange for secure operation in a storage device according to the example embodiment, a TTP can be used to perform key exchange securely and / or reliably. A first certificate (Certificate) is used for user authentication. U1 Second Certificate Cert U2 It can be generated by TTP. First user (e.g., First User ID) U1 It can be based on a second user (e.g., second user ID). U2 The second public key PK U2 Export the encryption key CK, but it can be based on a second certificate Cert signed by TTP for a second user. U2 To authenticate the second public key PK U2 And it can be based on a certified second public key PK. U2 Export the encryption key CK. Therefore, key exchange with unauthorized or invalid users can be prevented or blocked, and can only be performed with authorized or legitimate users, thus enabling the storage device to have improved or enhanced security.

[0059] Figure 3 This is a block diagram illustrating an embodiment of a storage system 100 including a host device 200 and a storage device 300. The host device 200 can control the overall operation of the storage system 100 and may include, for example, a host processor and host memory. The host processor can control the operation of the host device 200, for example, based on the operation of an operating system (OS). The host memory may store instructions and / or data executed and / or processed by the host processor. The operating system running by the host processor may include, for example, a file system for file management and device drivers for controlling peripheral devices including the storage device 300 at the operating system level.

[0060] Storage device 300 is accessed by host device 200 and may include storage controller 310, multiple non-volatile memories (NVMs) 320a, 320b, and 320c, and buffer memory 330. Storage controller 310 can control the operation of storage device 300 and / or the operation of non-volatile memories 320a, 320b, and 320c based on commands and data from host device 200. Storage controller 310 includes TTP 312. (See reference...) Figure 1 The TTP 312 can be used to perform key exchange securely and / or reliably.

[0061] Non-volatile memories 320a, 320b, and 320c can store data, including, for example, metadata, user data, and / or other information. (See reference...) Figure 5 The non-volatile memories 320a, 320b and 320c described herein can be divided into multiple memory regions.

[0062] In some example embodiments, each of the non-volatile memories 320a, 320b, and 320c may include NAND flash memory. In other embodiments, each of the non-volatile memories 320a, 320b, and 320c may include one of the following: electrically erasable programmable read-only memory (EEPROM), phase-change random access memory (PRAM), resistive random access memory (RRAM), nanofloating gate memory (NFGM), polymer random access memory (PoRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), or other types of memory.

[0063] Buffer memory 330 may store instructions and / or data executed and / or processed by memory controller 310, and may temporarily store data that is stored or to be stored in non-volatile memories 320a, 320b and 320c. For example, buffer memory 330 may include at least one of various types of volatile memory (e.g., dynamic random access memory (DRAM)) or another type of memory.

[0064] For reference Figure 1 and Figure 2 As described above, one of the multiple user IDs can access the storage device 300 via the host device 200. For example, when the first user ID is entered via the host device 200... U1 and the first user ID U1 When the corresponding first password is used, storage device 300 can be accessed by the first user ID. U1 and the first user ID U1 The corresponding first user access is 300. When the second user ID is entered via host device 200... U2 and the second user ID U2 When the corresponding second password is used, storage device 300 can be accessed via the second user ID. U2 and the second user ID U2 The corresponding second user access.

[0065] Storage controller 310 and TTP 312 perform according to reference Figure 1 and Figure 2 The described example embodiment describes a method for performing a key exchange. For example, storage controller 310 includes at least one processor for performing security operations, and the processor and TTP 312 can generate a first certificate Cert. U1 Second Certificate Cert U2 When storage device 300 is being processed by the first user ID... U1During access, the processor uses a TTP312-based certificate against the second certificate, Cert. U2 Perform the first verification and export the encryption key CK upon successful completion of the first verification. This is while storage device 300 is being processed by the second user ID. U2 During access, the processor uses a TTP 312-based certificate against the first certificate, Cert. U1 Perform a second verification and export the encryption key CK upon successful completion of the second verification. Furthermore, the storage controller 310 and TTP 312 can execute or operate according to the reference. Figure 15 and Figure 21 The described embodiment describes a method for performing an authorization transfer.

[0066] In one embodiment, storage device 300 may be a solid-state drive (SSD). For example, storage device 300 may be implemented as a self-encrypting drive (SED). In one embodiment, storage device 300 may be universal flash memory (UFS), a multimedia card (MMC), or an embedded multimedia card (eMMC). In one embodiment, storage device 300 may be one of the following: a secure digital card (SD), a micro SD card, a memory stick, a chip card, a universal serial bus (USB) card, a smart card, a compact flash memory (CF) card, or other types of storage devices.

[0067] In some example embodiments, storage device 300 may be connected to host device 200 via a block-accessible interface, which may include, for example, UFS, eMMC, Serial Advanced Technology Attachment (SATA) bus, High Speed ​​Non-Volatile Memory (NVMe) bus, Serial Attached SCSI (SAS) bus, etc. Storage device 300 may provide a block-accessible interface to host device 200 using a block-accessible address space corresponding to the access size of non-volatile memories 320a, 320b, and 320c, and allow access (e.g., on a block-by-block basis) to data stored in non-volatile memories 320a, 320b, and 320c.

[0068] In some example embodiments, storage system 100 can be any type of computing system, such as a personal computer (PC), server computer, data center, workstation, digital television, set-top box, navigation system, etc. In some embodiments, storage system 100 can be any type of mobile system. Examples include mobile phones, smartphones, tablets, laptops, personal digital assistants (PDAs), portable multimedia players (PMPs), digital cameras, portable game consoles, music players, camcorders, video players, navigation devices, wearable devices, Internet of Things (IoT) devices, Internet of Everything (IoE) devices, e-book readers, virtual reality (VR) devices, augmented reality (AR) devices, robotic devices, drones, etc.

[0069] Figure 4 This is a block diagram illustrating an embodiment of a storage controller 400 in or coupled to a storage device.

[0070] refer to Figure 4 The storage controller 400 may include a first processor 410, a memory 420, a second processor 430, a host interface 440, an error correction code (ECC) block 450, and a memory interface 460. The first processor 410 and the second processor 430 may respond to input from a host device (e.g., via the host interface 440). Figure 3 The host device 200 receives commands to control the operation of the storage controller 400. For example, the first processor 410 can control the storage device (e.g., Figure 3 The storage device 300 in the middle can operate normally, and its various components can be controlled by using firmware or other instructions for operating the storage device. For example, the second processor 430 can control the secure operation of the storage device and may include a TTP 432. The second processor 430 and the TTP 432 may correspond to Figure 3 The storage controller 310 or coupled to Figure 3 The storage controller 310 has a processor and a TTP 312.

[0071] The second processor 430 can process and / or store secure data, such as cryptographic keys, sensitive data, sensitive codes, etc.

[0072] The memory 420 can store instructions and data that are run and processed by the first processor 410 and the second processor 430. For example, the memory 420 can be implemented using volatile memory with relatively small capacity and high speed, such as static random access memory (SRAM), buffer memory, etc.

[0073] ECC block (or logic) 450 can use Bose-Chaudhuri-Hocquenghem (BCH) codes, low-density parity-check (LDPC) codes, turbo codes, Reed-Solomon codes, convolutional codes, recursive systematic codes (RSC), trellis-coded modulation (TCM), block-coded modulation (BCM), etc., to perform coding modulation for error correction, or can use the above codes or other error-correcting codes to perform ECC encoding and ECC decoding.

[0074] Host interface 440 provides a physical connection between the host device and the storage device. Host interface 440 provides an interface corresponding to the bus format of the host device for communication between the host device and the storage device. In some example embodiments, the bus format of the host device may be a Small Computer System Interface (SCSI) or a Serial Attached SCSI (SAS) interface. In some example embodiments, the bus format of the host device may be USB, Fast Peripheral Component Interconnect (PCIe), Advanced Technology Attachment (ATA), Parallel ATA (PATA), Serial ATA (SATA), or High Speed ​​Non-Volatile Memory (NVM) (NVMe), etc.

[0075] Memory interface 460 can interface with non-volatile memory (e.g., Figure 3 The memory interface 460 exchanges data with non-volatile memories 320a, 320b, and 320c. The memory interface 460 can transfer data to or receive data read from the non-volatile memory. In some example embodiments, the memory interface 460 may be connected to the non-volatile memory via a single channel. In some example embodiments, the memory interface 460 may be connected to the non-volatile memory via two or more channels.

[0076] Figure 5 The illustration shows a storage device (e.g., Figure 3 A diagram illustrating an example of storage space 500 in a storage device 300. Storage space 500 may include a key slot 510, a user-dedicated storage area 520, and multiple storage areas (RANGE1, RANGE2, ..., RANGEM) 530a, 530b, and 530c.

[0077] In some example embodiments, storage space 500 may include logically partitioned non-volatile memory (e.g., Figure 3 The non-volatile memories 320a, 320b, and 320c in the storage space 500. However, the example embodiment is not limited thereto, and the storage space 500 may also include buffer memory in the storage device (e.g., Figure 3 The storage space of the buffer memory 330 in the memory and / or the memory controller for accessing non-volatile memory (e.g., Figure 4 The processor in the storage controller 400 (e.g., Figure 4 The processing space of processors 410 and 430 in the system.

[0078] Key slot 510 may be an area in which keys and certificates for multiple users and user IDs are allocated and / or stored. For example, user IDs may be able to access the storage device and may include a first user ID to an Nth user ID, where N is a natural number greater than or equal to 2. For example, key slot 510 may include first key slot regions to Nth key slot regions (KSRs) KSR1, KSR2, ..., KSRN, respectively corresponding to and allocated to the first user ID to the Nth user ID. For example, the first key slot region KSR1 may correspond to the first user ID and may be allocated to the first user ID.

[0079] Key slot 510 and key slot areas KSR1, KSR2, ..., KSRN can be accessed by all (or pre-selected) users and all (or pre-selected) user IDs. However, as referenced... Figure 8A and Figure 8B Each key can be stored in an encrypted and / or wrapped state, so the encrypted and / or wrapped key can only be used by authorized users.

[0080] User-specific storage area 520 can be an area used by users and user IDs to perform secure operations and / or computations. For example, user-specific storage area 520 may include first user storage areas to Nth user storage areas (USRs) USR1, USR2, ..., USRN, respectively corresponding to and assigned to first user ID to Nth user ID. For example, first user storage area USR1 may correspond to the first user ID and may be assigned to the first user ID.

[0081] In some embodiments, each of the user storage areas USR1, USR2, ..., USRN can be accessed only by a specific user and user ID. For example, the first user storage area USR1 can be accessed only by a first user ID. In some embodiments, the user-specific storage area 520 may also include an area that is accessed by all (or predetermined) users and all (or predetermined) user IDs.

[0082] Storage areas 530a, 530b, and 530c can store data (e.g., normal data, security data, etc.), and each of storage areas 530a, 530b, and 530c can be referred to as a range, partition, etc. Each of storage areas 530a, 530b, and 530c can only be accessed by users with access authorization and user IDs. For example, when a first user ID has first access authorization to the first storage area 530a and when a second user ID does not have first access authorization, the first storage area 530a can be accessed by the first user ID but not by the second user ID. (See reference...) Figure 15 The first access authorization can be transferred to the second user ID.

[0083] The following sections will describe example embodiments in detail based on the Diffie-Hellman scheme. However, the example embodiments are not limited thereto, and may be implemented based on at least one of various other algorithms.

[0084] Figure 6 It's a diagram. Figure 1 The flowchart illustrates an embodiment of the operation for generating the first certificate. Figure 7 It's a diagram. Figure 1 The flowchart shows an example of generating a second certificate. Figure 8A and Figure 8B The diagram is used to describe Figure 6 and Figure 7 A diagram illustrating an example of the operation.

[0085] like Figure 8A and Figure 8B As shown, the first user and the first user ID U1 It can have the first private key WDHSK U1 and the first public key DHPK U1 Second user and second user ID U2 It can have a second private key, WDHSK. U2 Second public key DHPK U2 TTP 610 can have a third private key SK. TTP Third public key PK TTP and third certificate Cert TTP During the initial operation, the first private key is WDHSK. U1 and the first public key DHPK U1 It can be stored in the ID assigned to the first user. U1 The first key slot area KSR1. The second private key WDHSK. U2 Second public key DHPK U2 It can be stored in the ID assigned to the second user. U2 The third private key is in the second key slot area KSR2. TTP Third public key PK TTP and third certificate Cert TTP It can be stored in TTP 610. The generation of a third public key (PK) can be performed beforehand. TTP Cert Third Certificate TTP The operation.

[0086] refer to Figure 1 , Figure 6 and Figure 8A In S110, when the first certificate DHCert is generated... U1At times (e.g., during operation S100), it can be done via the third private key SK based on TTP 610. TTP Signature First User ID U1 and first user ID U1 First public key DHPK U1 To obtain the first certificate DHCert U1 For example, the first certificate DHCert U1 It can be "ID" U1 |DHPK U1 |Sign{SK TTP ID U1 |DHPK U1}". Figure 8A The certificate generation operation (CERT_GEN) 620 in the code can correspond to... Figure 6 Operation S110 in the middle.

[0087] In S120, the first certificate was DHCert. U1 It can be stored in the first key slot area KSR1. Additionally, the third certificate Cert... TTP It can also be stored in the first key slot area KSR1. Therefore, after operation S100 (including S110 and S120) is completed, the first certificate DHCert U1 Can be used with the first private key WDHSK U1 First public key DHPK U1 and third certificate Cert TTP They are stored together in the first key slot area KSR1.

[0088] refer to Figure 1 , Figure 7 and Figure 8B In S210, when generating the second certificate DHCert U2 (For example, when operating S200), it can be done using the third private key SK included in TTP 610. TTP Signature Second User ID U2 Second User ID U2 Second public key DHPK U2 To obtain a second DHCert certificate U2 Operating S210 can be similar to... Figure 6 Operation S110 in the middle. Figure 8B The certificate generation operation (CERT_GEN) 630 in the code can correspond to... Figure 7 Operation S210 in the middle.

[0089] In S220, the second certificate is DHCert. U2It can be stored in the second key slot area KSR2. Operation S220 can be similar to Figure 6 Operation S120 is performed within this process. Therefore, after operation S200 (including S210 and S220) is completed, the second certificate DHCert... U2 Can be used with the second private key WDHSK U2 Second public key DHPK U2 and third certificate Cert TTP They are stored together in the second key slot area KSR2.

[0090] In some example embodiments, the first private key WDHSK U1 Second private key WDHSK U2 Each of these can be a sealing key. Therefore, even if the first user ID is included... U1 Second User ID U2 All (or pre-selected) user IDs can access the first private key WDHSK U1 Second private key WDHSK U2 Only has the first private key WDHSK U1 The first user ID of the decapsulation authorization U1 The first private key WDHSK can be used U1 Only has the second private key WDHSK U2 The second user ID for decapsulation authorization U2 The second private key WDHSK can be used U2 .

[0091] In some example embodiments, the above operations of generating certificates and storing them in key slots can be performed in the same manner for all (or predetermined) user IDs (or all user accounts).

[0092] Figure 9 It's a diagram. Figure 1 A flowchart of an embodiment of the operation of performing the first verification. Figure 10 It's a diagram. Figure 1 A flowchart illustrating an embodiment of the operation of deriving an encryption key based on a first private key and a second public key. Figure 11 The diagram is used to describe Figure 9 and Figure 10 A diagram illustrating an example of the operation.

[0093] refer to Figure 1 , Figure 9 and Figure 11 In S300, when the storage device is being used by the first user ID... U1 When performing the first authentication during access, the first user can use the first user ID. U1 and the first user IDU1 The corresponding first password is PWD U1 Log in to the storage device and access the second certificate DHCert stored in the second key slot area KSR2. U2 It can be loaded.

[0094] Subsequently, on S310, it is possible to base this on a third-party certificate, Cert. TTP Extract the third public key PK from TTP 610 TTP .

[0095] In S320, it can be based on a third public key PK. TTP To verify the second certificate DHCert U2 The signature. Figure 11 The certificate verification operation (CERT_VFY) 710 in the code can correspond to... Figure 9 Operations S310 and S320 in the process.

[0096] In S330, when applying the second certificate DHCert U2 When the signature verification is successfully completed (step S330: Yes), the signature can be identified as the second user ID. U2 The corresponding second user is an authorized user or a legitimate user.

[0097] In S340, therefore the second certificate DHCert can be extracted. U2 Second user ID U2 Second public key DHPK U2 When applying the second certificate DHCert U2 If the signature verification fails (step S330: No), it can be determined that the signature is different from the second user ID. U2 If the second user is an unauthorized or invalid user, the process can be terminated.

[0098] refer to Figure 1 , Figure 10 and Figure 11 In S400, when the first authentication is successfully completed, it is based on the first private key WDHSK. U1 Second public key DHPK U2 To perform the export of the encryption key CK U1U2 In S410, it can be based on the first user ID. U1 The corresponding first password is PWD U1 The first key protection key (KPK) is obtained by combining the random value Salt1. U1 For example, such as Figure 11 As shown, the first KPK can be derived using the Key Derivation Function (KDF) 720. U1For example, the first user can use the first user ID. U1 And the first password PWD U1 Operation S410 is executed at the time of login to the storage device.

[0099] In S420, it can be based on the first KPK KPK U1 Obtain the first private key DHSK U1 That is, decapsulating the key. For example, such as Figure 11 As shown, the first private key DHSK is decapsulated. U1 It can be based on the first KPK KPK U1 The first private key, WDHSK, is used as the encapsulation key. U1 Decryption operation (DEC) 730 is performed to generate it. For example, decryption operation 730 can be performed based on the Advanced Encryption Standard (AES) algorithm.

[0100] In S430, it can be based on the first user ID obtained through the first authentication. U1 First private key DHSK U1 Second User ID U2 Second public key DHPK U2 Perform a key agreement to obtain the encryption key CK. U1U2 . Figure 11 The key agreement operation (KEY_AGR) 740 in the code can correspond to... Figure 10 Operation S430 in the middle.

[0101] In some example embodiments, the first verification and the first private key DHSK are used. U1 Second public key DHPK U2 Export encryption key CK U1U2 Operations can be performed using only the first user ID. U1 The first user storage area, USR1, is accessed to execute the command.

[0102] Figure 12 It's a diagram. Figure 1 The flowchart shows an embodiment of the operation of performing the second verification. Figure 13 It's a diagram. Figure 1 A flowchart illustrating an embodiment of the operation of deriving an encryption key based on a second private key and a first public key. Figure 14 The diagram is used to describe Figure 12 and Figure 13 A diagram illustrating an example of the operation.

[0103] refer to Figure 1 , Figure 12 and Figure 14 In the S500, the storage device is being managed by a second user ID. U2A second authentication is performed upon access. At this time, the second user can use their second user ID. U2 and the second user ID U2 The corresponding second password is PWD U2 Log in to the storage device and store the first certificate DHCert in the first key slot area KSR1. U1 It can be loaded.

[0104] Subsequently, on S510, it is possible to base this on a third-party certificate, Cert. TTP Extract the third public key PK from TTP 610 TTP .

[0105] In S520, it is possible to use a third public key PK. TTP To verify the first certificate DHCert U1 The signature. Operations on S510 and S520 can be similar to... Figure 9 Operations S310 and S320 in the process. Figure 14 The certificate verification operation (CERT_VFY) 810 in the code can correspond to... Figure 12 Operations S510 and S520 in the process.

[0106] In S530, determine whether the verification was successfully completed.

[0107] In S540, when the first certificate DHCert U1 When the signature verification is successfully completed (S530: Yes), the first certificate DHCert can be retrieved. U1 The first user ID in U1 and the first public key DHPK U1 When applying the first certificate DHCert U1 If signature verification fails (step S530: No), the process can be terminated. Operations S530 and S540 can be similar to... Figure 9 Operations S330 and S340 in the process.

[0108] refer to Figure 1 , Figure 13 and Figure 14 In operation S600, when the second verification is successfully completed, it is based on the second private key WDHSK. U2 and the first public key DHPK U1 Export encryption key CK U1U2 .

[0109] In S610, it can be based on the second user ID. U2 The corresponding second password is PWD U2 Obtain the second KPK with the random value Saltl. U2Operating the S610 can be similar to... Figure 10 Operation S410 in the middle, Figure 14 The operation of using KDF 820 can correspond to Figure 13 Operation S610 in the middle.

[0110] In the S620, it can be based on the second KPK. U2 Obtain the second private key DHSK as the decryption key. U2 Operating the S620 can be similar to... Figure 10 Operation S420 in the middle, Figure 14 The decryption operation (DEC) 830 in the middle can correspond to Figure 13 Operation S620 in the middle.

[0111] In S630, it is possible to use a second user ID obtained through second authentication. U2 Second private key DHSK U2 and first user ID U1 First public key DHPK U1 Perform a key agreement to obtain the encryption key CK. U1U2 Operating the S630 can be similar to... Figure 10 Operation S430 in the middle, Figure 14 The key agreement operation (KEY_AGR) 840 in the code can correspond to... Figure 13 Operation S630 in the middle.

[0112] In some example embodiments, the second verification and the second private key DHSK are used. U2 and the first public key DHPK U1 Export encryption key CK U1U2 Operations can be performed using only the second user ID. U2 The second user storage area, USR2, is accessed to execute the command.

[0113] Based on the above process, the first user ID is... U1 Second User ID U2 The same encryption key CK can be obtained. U1U2 First User ID U1 It can be based on the second user ID. U2 The second public key for authentication, DHPK U2 Export encryption key CK U1U2 And only has the second private key DHSK U2 Second User ID U2 The same encryption key CK can be exported. U1U2 .

[0114] Figure 15This is a flowchart illustrating an embodiment of a method for performing an authorization transfer in a storage device. The method includes: in S1100, performing a key exchange between a first user ID and a second user ID. The first user ID corresponds to a first user having a first access authorization to a first storage region in the storage device. The second user ID corresponds to a second user who wants to obtain the first access authorization.

[0115] Operation of S1100 can be based on reference Figures 1 to 14 The described example embodiment describes a method for performing a key exchange. The TTP can be used to perform key exchanges securely and / or reliably. Each user and user ID can authenticate their public key based on a certificate signed by the TTP, and an encryption key can be derived from the authenticated public key. Therefore, key exchanges with unauthorized or invalid users can be prevented or blocked, and key exchanges can only be performed with authorized or legitimate users. When the key exchange is successfully completed, the first user ID and the second user ID can obtain the same encryption key.

[0116] In S1200, when the storage device is being accessed by a first user ID, a first key encryption key (KEK) is encrypted based on an encryption key. The first KEK corresponds to a first access authorization, and the encryption key is obtained through key exchange. The first KEK may be a key for accessing a first storage area. The first user ID may already have a first access authorization and a first KEK corresponding to the first access authorization. Operation S1200 may be an operation for transferring the first KEK to a second user ID. See the embodiment of operation S1200 for reference. Figure 16 and Figure 18 To describe.

[0117] In S1300, when the storage device is being accessed by the second user ID, the encrypted first KEK is decrypted based on the encryption key. For example, the first KEK may be stored in the second key slot area assigned to the second user ID. When operation S1300 is performed, the second user ID may have the first KEK. See the embodiment of operation S1300 for reference. Figure 18 , Figure 19 and Figure 20 To describe.

[0118] As described above, both the first user ID and the second user ID can own or have the first KEK, and therefore both the first user ID and the second user ID can have the first access authorization to the first storage area.

[0119] In the method for performing authorization transfer in a storage device according to the example embodiment, key exchange can be performed only with authorized or legitimate users based on the TTP, and the first user ID and the second user ID can obtain the same encryption key when the key exchange is performed. The first KEK corresponding to the first access authorization to the first storage area can be securely and / or reliably transferred to the second user ID based on the encryption key. Therefore, the storage device can have improved or enhanced security performance.

[0120] Figure 16 It's a diagram. Figure 15 A flowchart illustrating an embodiment of the operation of the first KEK in encryption. Figure 17 The diagram is used to describe Figure 16 A diagram illustrating an example of the operation.

[0121] refer to Figures 16 to 17 The method includes: in S1210, when the storage device is being accessed by the first user ID... U1 First KEK Encryption During Access R1 At time (S1200), it can be based on the first user ID. U1 The corresponding first password is PWD U1 Obtain the first KPK with the random value Salt1. U1 Operating S1210 can be combined with... Figure 10 The operation in S410 is basically the same. Figure 17 The operation of using KDF910 can correspond to Figure 16 Operation S1210. In some example embodiments, operation S1210 may be omitted when operation S410 has already been performed.

[0122] In S1220, it can be based on the first KPK KPK U1 Get the first KEK KEK R1 For example, by using the first KPKKPK U1 Encryption (or encapsulation) First KEK KEK R1 And encrypt the first KEK WKEK R1 Stored in the first key slot area KSR1, the first user ID ID U1 It can have the first KEK KEK R1 For example, you can load the encrypted first KEK WKEK. R1 And it can be encrypted via the first KEK WKEK. R1 Perform decryption operation (DEC) 920 to generate the first KEK. R1 ,like Figure 17 As shown. For example, decryption operation 920 can be performed based on the AES algorithm.

[0123] In S1230, it can be based on the encryption key CK U1U2 To encrypt the first KEK KEK R1 Furthermore, in S1240, the encrypted first KEK WKEK can be stored. R1 For example, it can be done by setting the first KEK KEK. R1 Perform encryption operation (ENC) 930 to generate the first encrypted KEK / WKEK. R1 ',like Figure 17 As shown. For example, encryption operations 930 can be performed based on the AES algorithm. For example, the first KEK WKEK is encrypted. R1 'Can be stored by a second user ID ID' U2 Accessible areas. For example, the first encrypted KEKWKEK. R1 'Can be different from the first KEK WKEK encrypted R1 .

[0124] like Figure 17 As shown, the first user ID U1 The first storage area can be accessed. For example, when the first user ID is... U1 To access the first storage area, you can do so based on the first KPK. U1 Perform decryption operation 920 to obtain the first KEKKEK R1 It can load the encrypted first media encryption key (MEK) WMEK stored in the first storage area. R1 and the first encrypted data E_DATA R1 It can be based on the first KEK KEK R1 Perform the decryption operation (DEC) 1010 to obtain the first MEKMEK. R1 And it can be based on the first MEK MEK R1 Execute decryption operation (DEC) 1020 to obtain the first data DATA R1 For example, decryption operations 1010 and 1020 can be performed based on the AES algorithm. In some example embodiments, only the first user ID can be used. U1 The first user storage area USR1 is accessed to perform operations S1210, S1220, S1230 and S1240.

[0125] Figure 18 It's a diagram. Figure 15 The flowchart illustrates an embodiment of the operation of decrypting the encrypted first KEK. Figure 19 It's a diagram. Figure 18 A flowchart illustrating an embodiment of the operation of the first KEK in the storage decryption process. Figure 20The diagram is used to describe Figure 18 and Figure 19 A diagram illustrating an example of the operation.

[0126] refer to Figure 15 and Figures 18 to 20 In S1310, when the storage device is being used by the second user ID... U2 Accessing the encrypted first KEK WKEK R1 During decryption (operation S1300), it can be performed based on the encryption key CK. U1U2 The first KEKWKEK encrypted R1 'Decryption can be performed. For example, it can be done by decrypting the first KEK WKEK.' R1 'Execute decryption operation (DEC) 1110 to generate the first KEK KEK R1 ,like Figure 20 As shown. Due to the first user ID ID U1 Second User ID U2 Having the same encryption key CK U1U2 Therefore, it is determined by the second user ID. U2 First KEK obtained R1 It can be basically equal to the first user ID ID U1 The first transfer of KEK KEK R1 .

[0127] In S1320, the first decrypted KEK can be stored. R1 For example, in S1322, it can be based on the second user ID. U2 The corresponding second password is PWD U2 Use the random value Salt1 to obtain the second KPK. U2 Operation S1322 can be used with Figure 13 The operation in S610 is basically the same. Figure 20 The operation using KDF 1120 can correspond to Figure 19 Operation S1322. In some example embodiments, operation S1322 can be omitted when operation S610 has already been executed.

[0128] In S1324, it can be based on the second KPK KPK. U2 Again, the first KEK KEK decrypted R1 Encryption can be performed. For example, it can be done by decrypting the first KEK. R1 Perform encryption operation (ENC) 1130 to generate the first encrypted KEK / WKEK. R1 ",like Figure 20As shown. For example, encryption operation 1130 can be performed based on the AES algorithm. For example, the first KEK WKEK is encrypted. R1 "Can be different from the first KEK WKEK encrypted" R1 'and encrypted first KEK WKEK R1 .

[0129] In S1326, the encrypted first KEK can be stored. For example, the second user ID. U2 By encrypting the first KEK WKEK R1 "Stored in the second key slot area KSR2 and possessing or having the first KEK KEK" R1 .

[0130] like Figure 20 As shown, in the first KEK KEK R1 by second user ID U2 After acquiring it, the second user ID U2 The first storage area can be accessed. For example, when the second user ID ID... U2 To access the first storage area, it can be done via the second KPK. U2 The first KEK WKEK of encryption R1 Perform decryption operation (DEC) 1210 to obtain the first KEK. R1 It can load the encrypted first MEK WMEK stored in the first storage area. R1 and the first encrypted data E_DATA R1 It can be based on the first KEK KEK R1 Perform decryption operation (DEC) 1220 to obtain the first MEK. R1 And it can be based on the first MEK MEK R1 Perform decryption operation (DEC) 1230 to obtain the first data DATA. R1 For example, decryption operations 1210, 1220, and 1230 can be performed based on the AES algorithm.

[0131] Figure 21 This is a flowchart illustrating an embodiment of a method for performing a license transfer in a storage device. (See reference) Figure 21 In this method, operations S1100, S1200, and S1300 can be respectively connected with... Figure 15 The operations S1100, S1200 and S1300 are basically the same.

[0132] After both the first user ID and the second user ID have obtained the first access authorization, at least one of the first user ID or the second user ID can access the first storage area. For example, when the storage device is being accessed by the first user ID, a first KEK can be obtained (step S2100), a first MEK can be obtained based on the first KEK (step S2200), and the first data stored in the first storage area can be obtained based on the first MEK (step S2300). In this example, operations S2100, S2200, and S2300 can respectively correspond to Figure 17 The decryption operations in the code are 920, 1010, and 1020.

[0133] In one example, operations S2100, S2200, and S2300 can be performed when the storage device is being accessed by a second user ID. In this example, operations S2100, S2200, and S2300 can respectively correspond to... Figure 20 The decryption operations are 1210, 1220, and 1230.

[0134] In some example embodiments, Figure 21 The method of performing authorization transfer can be described as a method of operating or driving the storage device.

[0135] As those skilled in the art will understand, the inventive concept can be implemented as a system, method, computer program product, and / or a computer program product embodied thereon in one or more computer-readable media. The computer-readable program code can be provided to a processor of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. A computer-readable storage medium can be any tangible medium that can contain or store a program used by or associated with an instruction execution system, apparatus, or device. For example, a computer-readable medium can be a non-transitory computer-readable medium.

[0136] Figure 22 and 23 This is a block diagram illustrating an embodiment of a storage system including a storage device according to an example embodiment.

[0137] refer to Figure 22 Storage system 100a includes host device 200 and storage device 300a. Storage device 300a includes storage controller 310a, multiple non-volatile memories 320a, 320b and 320c, and buffer memory 330. Storage device 300a may also include a secure element (SE) 340. Except that TTP 342 is not in storage controller 310a but in secure element 340, storage system 100a can be integrated with... Figure 3The storage system 100 is essentially the same. The secure element 340 can process and / or store secure data, such as cryptographic keys, sensitive data, and sensitive codes. For example, the secure element 340 can resist tampering attacks, such as micro-probing, software attacks, eavesdropping, and fault-generating attacks. The secure element 340 can be referred to as secure hardware, a secure component, or a secure module. Because the TTP 342 is within the secure element 340, the storage device 300a can have improved or enhanced security performance.

[0138] refer to Figure 23 Storage system 100b includes host device 200 and storage device 300b. Storage system 100b may also include Certificate Authority (CA) 2000. Except that the TTP 2100 is not located in storage controller 310b but in the Certificate Authority 2000 located outside storage device 300b, storage system 100b can interact with... Figure 3 The storage systems are basically the same as those of 100.

[0139] Although reference Figures 1 to 22 The example embodiment described is that the certificate generation operation is performed inside the storage device, but the example embodiment is not limited thereto. For example, when preparing the infrastructure during or after the manufacturing process, a certificate can be generated through a public key infrastructure (PKI) based on an external certificate authority 2000, and the example embodiment can be performed based on the certificate generated by the external certificate authority 2000. Additionally, the example embodiment can be extended and applied using X.509 standard certificates.

[0140] Figure 24 This is a block diagram illustrating an embodiment of a data center 3000 including a storage system according to any of the example embodiments described herein.

[0141] refer to Figure 24 Data center 3000 can be a facility that collects various types of data and provides various services, and can be referred to as a data storage center. Data center 3000 can be a system for operating search engines and databases, and can be a computing system used by a company (such as a bank or government agency). Data center 3000 can include application servers 3100 to 3100n and storage servers 3200 to 3200m. The number of application servers 3100 to 3100n and the number of storage servers 3200 to 3200m can be selected in various ways according to the example embodiments, and the number of application servers 3100 to 3100n and the number of storage servers 3200 to 3200m can differ from each other.

[0142] Application server 3100 may include at least one processor 3110 and at least one memory 3120, and storage server 3200 may include at least one processor 3210 and at least one memory 3220. The operation of storage server 3200 will be described as an example. Processor 3210 may control the overall operation of storage server 3200 and may access memory 3220 to execute instructions and / or data loaded in memory 3220. Memory 3220 may include at least one of the following: Double Data Rate (DDR) Synchronous Dynamic Random Access Memory (SDRAM), High Bandwidth Memory (HBM), Hybrid Memory Cube (HMC), Dual In-line Memory Module (DIMM), Optane DIMM, or Non-Volatile DIMM (NVDIMM). The number of processors 3210 and the number of memories 3220 in storage server 3200 may be selected differently depending on the example embodiments. In some example embodiments, processors 3210 and memory 3220 may provide processor-memory pairs. In some example embodiments, the number of processors 3210 and the number of memories 3220 may be different from each other. Processor 3210 may include a single-core processor or a multi-core processor. The above description of storage server 3200 can be similarly applied to application server 3100. Application server 3100 may include at least one storage device 3150, and storage server 3200 may include at least one storage device 3250. In some example embodiments, application server 3100 may not include storage device 3150. The number of storage devices 3250 in storage server 3200 may be selected differently depending on the example embodiments.

[0143] Application servers 3100 to 3100n and storage servers 3200 to 3200m can communicate with each other via network 3300. Network 3300 can be implemented using Fibre Channel (FC) or Ethernet. FC can be a medium for relatively high-speed data transmission, and optical switches providing high performance and / or high availability can be used. Depending on the access scheme of network 3300, storage servers 3200 to 3200m can be provided as file storage, block storage, or object storage.

[0144] In some example embodiments, network 3300 may be a storage-only network or a network dedicated to storage, such as a Storage Area Network (SAN). For example, the SAN may be an FC-SAN implemented using an FC network and according to the FC protocol (FCP). As another example, the SAN may be an IP-SAN implemented using a Transmission Control Protocol / Internet Protocol (TCP / IP) network and according to the iSCSI (TCP / IP-based SCSI or Internet SCSI) protocol. In other example embodiments, network 3300 may be a general-purpose or ordinary network, such as a TCP / IP network. For example, network 3300 may be implemented according to at least one of the protocols such as Ethernet-based FC (FCoE), Network Attached Storage (NAS), and Fabrics-based Fast Non-Volatile Memory (NVMe-oF).

[0145] The following description uses application server 3100 and storage server 3200 as examples. The description of application server 3100 can be applied to other application servers 3100n, and the description of storage server 3200 can be applied to other storage servers 3200m.

[0146] Application server 3100 can store data requested by users or clients to one of storage servers 3200 to 3200m via network 3300. Furthermore, application server 3100 can obtain data requested by users or clients to be read from one of storage servers 3200 to 3200m via network 3300. For example, application server 3100 can be implemented as a web server or a database management system (DBMS).

[0147] Application server 3100 can access memory 3120n or storage device 3150n in another application server 3100n via network 3300, and / or can access memory 3220 to 3220m or storage device 3250 to 3250m in storage servers 3200 to 3200m via network 3300. Therefore, application server 3100 can perform various operations on data stored in application servers 3100 to 3100n and / or storage servers 3200 to 3200m. For example, application server 3100 can execute commands for moving or copying data between application servers 3100 to 3100n and / or storage servers 3200 to 3200m. Data can be transferred directly from storage devices 3250 to 3250m of storage servers 3200 to 3200m to storage devices 3220 to 3220m of application servers 3100 to 3100n, or via storage devices 3120 to 3120n. For example, data transmitted over network 3300 may be encrypted for security or privacy purposes.

[0148] In storage server 3200, interface (I / F) 3254 can provide a physical connection between processor 3210 and controller 3251 and / or a physical connection between network interface card (NIC) 3240 and controller 3251. For example, interface 3254 can be implemented based on a Direct Attached Storage (DAS) scheme, in which storage device 3250 is directly connected to a dedicated cable. For example, interface 3254 can be implemented based on at least one of various interface schemes. Examples include Advanced Technology Attachment (ATA), Serial ATA (SATA), External SATA (e-SATA), Small Computer System Interface (SCSI), Serial Attached SCSI (SAS), Peripheral Component Interconnect (PCI), High-Speed ​​PCI (PCIe), NVMe, IEEE 1394, Universal Serial Bus (USB), Secure Digital (SD) card interface, Multimedia Card (MMC) interface, Embedded MMC (eMMC) interface, Universal Flash Memory (UFS) interface, Embedded UFS (eUFS) interface, Compact Flash Memory (CF) card interface, etc.

[0149] Storage server 3200 may also include switch 3230 and NIC 3240. Switch 3230 can selectively connect processor 3210 to storage device 3250 under the control of processor 3210, or selectively connect NIC 3240 to storage device 3250. Application server 3100 may also include switch 3130 and network interface card 3140.

[0150] In some example embodiments, NIC 3240 may include a network interface card, network adapter, etc. NIC 3240 can connect to network 3300 via a wired interface, wireless interface, Bluetooth interface, optical interface, etc. NIC 3240 may also include internal memory, digital signal processor (DSP), host bus interface, etc., and can connect to processor 3210 and / or switch 3230 via the host bus interface. The host bus interface can be implemented as one of the above examples of interface 3254. In some example embodiments, NIC 3240 may be integrated with at least one of processor 3210, switch 3230, or storage device 3250.

[0151] In storage servers 3200 to 3200m and / or application servers 3100 to 3100n, the processor can send commands to storage devices 3150 to 3150n and 3250 to 3250m or memories 3120 to 3120n and 3220 to 3220m to program or read data. For example, the data may be data corrected by an error-correcting code (ECC) engine. For example, the data may be processed via Data Bus Inversion (DBI) or Data Masking (DM) and may include Cyclic Redundancy Check (CRC) information. For example, the data may be encrypted data for security or privacy purposes.

[0152] Storage devices 3150 to 3150n and 3250 to 3250m can send control signals and command / address signals to NAND flash memory devices 3252 to 3252m in response to read commands received from the processor. When reading data from NAND flash memory devices 3252 to 3252m, the read enable (RE) signal can be used as a data output control signal input and can also be used to output data to the DQ bus. The RE signal can be used to generate a data strobe signal (DQS). Command and address signals can be latched in the page buffer based on the rising or falling edge of the write enable (WE) signal.

[0153] Controller 3251 can control the overall operation of storage device 3250. In some example embodiments, controller 3251 may include static random access memory (SRAM). Controller 3251 can write data to NAND flash memory device 3252 in response to a write command, or can read data from NAND flash memory device 3252 in response to a read command. For example, write and / or read commands can be provided from processor 3210 in storage server 3200, processor 3210m in another storage server 3200m, or processors 3110 to 3110n in application servers 3100 to 3100n. DRAM 3253 can temporarily store (e.g., can buffer) data to be written to or read from NAND flash memory device 3252. In addition, DRAM 3253 can store metadata. Metadata can be data generated by controller 3251 for managing user data or NAND flash memory device 3252.

[0154] Storage devices 3150 to 3150n and 3250 to 3250m can be based on references Figures 1 to 23 The storage devices and methods described in the example embodiments are implemented. For example, storage devices 3150 to 3150n and 3250 to 3250m can perform methods for performing key exchange and methods for performing authorization transfer according to the example embodiments.

[0155] This invention concept can be applied to a wide range of electronic devices and systems, including storage devices and storage systems. For example, it can be applied to systems such as: personal computers (PCs), server computers, data centers, workstations, mobile phones, smartphones, tablet computers, laptop computers, personal digital assistants (PDAs), portable multimedia players (PMPs), digital cameras, portable game consoles, music players, camcorders, video players, navigation devices, wearable devices, Internet of Things (IoT) devices, Internet of Everything (IoE) devices, e-book readers, virtual reality (VR) devices, augmented reality (AR) devices, robotic devices, drones, etc.

[0156] The methods, processes, and / or operations described herein can be performed by code or instructions to be executed by a computer, processor, controller, or other signal processing device. The computer, processor, controller, or other signal processing device can be those described herein or those other than those described herein. Because the algorithms underlying the methods (or the operation of the computer, processor, controller, or other signal processing device) are described in detail, the code or instructions used to implement the operations of the method embodiments can convert a computer, processor, controller, or other signal processing device into a dedicated processor for executing the methods herein.

[0157] Furthermore, another embodiment may include a computer-readable medium for storing the aforementioned code or instructions, such as a non-transitory computer-readable medium. The computer-readable medium may be volatile or non-volatile memory or other storage devices that may be removably or permanently coupled to a computer, processor, controller, or other signal processing device, and will execute code or instructions for performing the operations of the method or apparatus embodiments described herein.

[0158] The controllers, processors, devices, modules, units, multiplexers, generators, logic, interfaces, decoders, drivers, generators, and other signal generation and signal processing features disclosed herein can be implemented, for example, with non-temporary logic comprising hardware, software, or both. When implemented at least partially in hardware, the controllers, processors, devices, modules, units, multiplexers, generators, logic, interfaces, decoders, drivers, generators, and other signal generation and signal processing features can be, for example, any of a variety of integrated circuits, including but not limited to, application-specific integrated circuits, field-programmable gate arrays, combinations of logic gates, systems-on-a-chip, microprocessors, or other types of processing or control circuitry.

[0159] When implemented at least partially in software, controllers, processors, devices, modules, units, multiplexers, generators, logic, interfaces, decoders, drivers, generators, and other signal generation and signal processing features may include, for example, memory or other storage devices for storing code or instructions to be executed by, for example, a computer, processor, microprocessor, controller, or other signal processing device. The computer, processor, microprocessor, controller, or other signal processing device may be those described herein or those other than those described herein. Because the algorithms underlying the methods (or the operation of the computer, processor, microprocessor, controller, or other signal processing device) are described in detail, the code or instructions for implementing the operations of the method embodiments can transform the computer, processor, controller, or other signal processing device into a dedicated processor for performing the methods described herein.

[0160] The foregoing is an illustrative description of exemplary embodiments and should not be construed as limiting them. Although some exemplary embodiments have been described, those skilled in the art will readily understand that many modifications can be made to the exemplary embodiments without substantially departing from the novel teachings and advantages of the exemplary embodiments. Therefore, all such modifications are intended to be included within the scope of the exemplary embodiments defined in the appended claims. Accordingly, it should be understood that the foregoing is an illustrative description of various exemplary embodiments and should not be construed as limiting oneself to the specific exemplary embodiments disclosed, and modifications to the disclosed exemplary embodiments and other exemplary embodiments are intended to be included within the scope of the appended claims. Embodiments may be combined to form additional embodiments.

Claims

1. A method for performing key exchange for secure operation in a storage device to be accessed by a plurality of user identifiers, including a first user identifier and a second user identifier that are distinct from each other, the first user identifier having a first private key and a first public key, the second user identifier having a second private key and a second public key, the method comprising: A trusted third party, either in or coupled to the storage device, generates a first certificate based on the first user identifier and the first public key. The trusted third party is the TTP. A second certificate is generated from the TTP based on the second user identifier and the second public key; When the storage device is being accessed by the first user ID, the second certificate is first verified based on the third certificate in or accessed by the TTP; When the first verification is successfully completed, the encryption key is derived based on the first private key and the second public key obtained from the first verification. When the storage device is being accessed by the second user ID, a second verification is performed on the first certificate based on the third certificate; as well as When the second verification is successfully completed, the encryption key is derived based on the second private key obtained from the second verification and the first public key.

2. The method according to claim 1, wherein, The generation of the first certificate includes: The first certificate is obtained by signing the first user identifier and the first public key of the first user identifier using a third private key based on or accessed by the TTP; and The first certificate is stored in a first key slot area, which is in a key slot and assigned to the first user identifier.

3. The method according to claim 2, wherein, The first certificate, along with the first private key, the first public key, and the third certificate, is stored in the first key slot area.

4. The method according to claim 3, wherein, The first private key is the encapsulation key.

5. The method according to claim 2, wherein, The generation of the second certificate includes: The second certificate is obtained by signing the second user identifier and the second public key of the second user identifier based on the third private key; and The second certificate is stored in the second key slot area, which is in the key slot and assigned to the second user identifier.

6. The method according to claim 5, wherein, The second certificate, along with the second private key, the second public key, and the third certificate, is stored in the second key slot area.

7. The method according to claim 2, wherein, The execution of the first verification includes: Extract the third public key from the TTP based on the third certificate; Verify the signature of the second certificate based on the third public key; and When the verification of the signature of the second certificate is successfully completed, the second user identifier and the second public key are extracted from the second certificate.

8. The method according to claim 7, wherein, Derivation of the encryption key based on the first private key and the second public key includes: A first key protection key is obtained based on a first password and a random value corresponding to the first user identifier, and the key protection key is KPK; The first private key is obtained based on the first KPK; and The encryption key is obtained by performing a key agreement based on the first private key and the second public key.

9. The method according to claim 8, wherein, The first verification and the operation of deriving the encryption key based on the first private key and the second public key are performed using a first user storage area in the storage device and accessed by the first user ID.

10. The method according to claim 2, wherein, The execution of the second verification includes: Extract the third public key from the TTP based on the third certificate; Verify the signature of the first certificate based on the third public key; and When the verification of the signature of the first certificate is successfully completed, the first user identifier and the first public key are extracted from the first certificate.

11. The method according to claim 10, wherein, Derivation of the encryption key based on the second private key and the first public key includes: A second key protection key is obtained based on a second password and a random value corresponding to the second user identifier, and the key protection key is KPK; Obtain the second private key based on the second KPK; and The encryption key is obtained by performing a key agreement based on the second private key and the first public key.

12. The method according to claim 11, wherein, The second verification and the operation of deriving the encryption key based on the second private key and the first public key are performed using a second user storage area in the storage device and accessed only by the second user ID.

13. The method according to claim 1, wherein, The encryption key derived from the first private key and the second public key is equal to the encryption key derived from the second private key and the first public key.

14. The method according to claim 1, wherein: The storage device includes a storage controller configured to control the operation of the storage device. The storage controller includes a first processor configured to control the normal operation of the storage device and a second processor configured to control the security operation of the storage device. The TTP is in or coupled to the second processor.

15. A method for performing authorization transfer in a storage device including a first storage area and accessed by a plurality of user identifiers including a first user identifier and a second user identifier that are different from each other, the first user identifier having a first private key and a first public key, the second user identifier having a second private key and a second public key, the method comprising: A key exchange is performed between the first user identifier who has a first access authorization to the first storage area and the second user identifier who wants to obtain the first access authorization; When the storage device is being accessed by the first user ID, a first key encryption key is encrypted based on an encryption key, the first key encryption key being a KEK, the first KEK corresponding to the first access authorization, and the encryption key being obtained through the key exchange; as well as When the storage device is being accessed by the second user ID, the encrypted first KEK is decrypted based on the encryption key. The execution key exchange includes: A trusted third party, either in or coupled to the storage device, generates a first certificate for the first user identifier based on the first user identifier and the first public key. The trusted third party is the TTP. The TTP generates a second certificate for the second user identifier based on the second user identifier and the second public key; When the storage device is being accessed by the first user ID, the second certificate is first verified based on the third certificate in or accessed by the TTP; When the first verification is successfully completed, the encryption key is derived based on the first private key and the second public key obtained from the first verification. When the storage device is being accessed by the second user ID, a second verification is performed on the first certificate based on the third certificate; and When the second verification is successfully completed, the encryption key is derived based on the second private key obtained from the second verification and the first public key.

16. The method according to claim 15, wherein, Encrypting the first KEK includes: A first key protection key is obtained based on a first password and a random value corresponding to the first user identifier, and the key protection key is KPK; The first KEK is obtained based on the first KPK; Encrypt the first KEK based on the encryption key; and The first KEK is stored and encrypted.

17. The method of claim 15, wherein, Decrypting the encrypted first KEK includes: Decrypt the encrypted first KEK based on the encryption key; and The first KEK that has been decrypted is stored.

18. The method according to claim 17, wherein, The first KEK decrypted from the storage includes: The second KPK is obtained based on the second password corresponding to the second user identifier and a random value; The first KEK, decrypted based on the second KPK, is re-encrypted; and The first KEK is re-encrypted by the storage.

19. The method of claim 18, further comprising: The first KEK is obtained based on the second KPK; A first media encryption key is obtained based on the first KEK, and the media encryption key is MEK; as well as The first data stored in the first storage area is obtained based on the first MEK.

20. A method for performing a key exchange for secure operation in a storage device accessed by a first user identifier and a second user identifier, the first user identifier having a first private key and a first public key, the second user identifier having a second private key and a second public key, the key exchange being performed between the first user identifier and the second user identifier, the method comprising: A trusted third party, which is located in or coupled to the storage device and has a third private key and a third public key, generates a first certificate by signing the first user identifier and the first public key based on the third private key. The trusted third party is TTP. The TTP generates a second certificate by signing the second user identifier and the second public key based on the third private key; The first certificate, the second certificate, and the third certificate for the TTP are stored in a key slot that stores the first private key, the first public key, the second private key, and the second public key; Access the storage device based on the first user identifier and the first password; When the storage device is being accessed by the first user ID, the second certificate is subjected to a first verification by extracting the third public key based on the third certificate, verifying the signature of the second certificate based on the third public key, and extracting the second user ID and the second public key from the second certificate when the verification of the signature of the second certificate is successfully completed. The encryption key is derived by obtaining the first key protection key (KPK) based on the first password and the random value, obtaining the first private key based on the first KPK, and executing a key agreement based on the first private key and the second public key. Access the storage device based on the second user identifier and the second password; When the storage device is being accessed by the second user ID, a second verification is performed on the first certificate by extracting the third public key based on the third certificate, verifying the signature of the first certificate based on the third public key, and extracting the first user ID and the first public key from the first certificate when the verification of the signature of the first certificate is successfully completed. as well as The encryption key is derived by obtaining the second KPK based on the second password and the random value, obtaining the second private key based on the second KPK, and executing the key agreement based on the second private key and the first public key.

Images