Encryption key storage and modification in a data storage device

Patent metadata

Field	Value
Publication number	US-10218503-B2
Application number	US-201715499464-A
Country	US
Kind code	B2
Filing date	Apr 27, 2017
Priority date	Apr 9, 2014
Publication date	Feb 26, 2019
Grant date	Feb 26, 2019

Abstract

Methods, systems, and devices are described for encryption key storage and modification in a data storage device. A portion of an encryption key may be stored in a first storage medium, and one or more bits of the encryption key may be stored in a one-time writable storage location. Data received at the data storage device may be encrypted using the encryption key, and may be stored in a storage medium. In the event that it is no longer desired to allow users to access the encrypted data stored in the storage medium, the one or more bits of the encryption key stored in a one-time writable storage location may be modified. Such modification thereby prevents decryption of the encrypted data and effectively precludes access to the encrypted data.

First claim

What is claimed is:

1. A method of operating a storage device, comprising:
generating a hidden root key;
generating a zeroizable root key unique to a particular die of the storage device among a plurality of dies on the storage device, wherein the hidden root key is encrypted using the zeroizable root key;
combining the hidden root key with the zeroizable root key to generate an encryption key;
blowing at least one of one or more electronic fuses of the storage device to render the encryption key unusable;
storing at least one bit of the hidden root key in a one-time writable storage location, the one-time writable storage location including the one or more electronic fuses;
determining that stored encrypted data is to be deleted; and
modifying the at least one bit of the encryption key stored in the one-time writable storage location.

2. The method of claim 1 , further comprising:
storing a first portion of the hidden root key to a re-writable storage location of the storage device.

3. The method of claim 1 , wherein at least one bit of the encryption key is stored in an electronic fuse.

4. The method of claim 1 , further comprising:
receiving data to be stored in storage device;
encrypting the data using the encryption key; and
storing the encrypted data in the storage device.

5. The method of claim 1 , wherein the modifying prevents decryption of data that is encrypted using the encryption key.

6. The method of claim 1 , wherein the encryption key is stored in an electronically erasable programmable read only memory (EEPROM).

7. The method of claim 6 , wherein the encryption key is stored in two or more locations in the EEPROM due to wear leveling functions performed on the EEPROM.

8. The method of claim 7 , further comprising:
modifying the at least one bit of the encryption key stored in the one-time writable storage location,
wherein the modifying prevents decryption of data that is encrypted using the encryption key.

9. A storage device, comprising:
a first storage medium;
a one-time writable storage medium; and
a processor configured to:
generate a hidden root key;
generate a zeroizable root key unique to a particular die of the storage device among a plurality of dies on the storage device, wherein the hidden root key is encrypted using the zeroizable root key;
combine the hidden root key with the zeroizable root key to generate an encryption key;
blow at least one of one or more electronic fuses of the storage device to render the encryption key unusable;
store at least one bit of the hidden root key in a one-time writable storage location, the one-time writable storage location including the one or more electronic fuses;
determining that stored encrypted data is to be deleted; and
modify the at least one bit of the encryption key stored in the one-time writable storage location.

10. The storage device of claim 9 , wherein the processor is further configured to:
store a first portion of the hidden root key to a re-writable storage location of the storage device.

11. The storage device of claim 9 , wherein at least one bit of the encryption key is stored in an electronic fuse.

12. The storage device of claim 9 , wherein the processor is further configured to:
receive data to be stored in the storage device;
encrypt the data using the encryption key; and
store the encrypted data in the storage device.

13. The storage device of claim 9 , wherein the modifying prevents decryption of data that is encrypted using the encryption key.

14. The storage device of claim 9 , wherein the encryption key is stored in an electronically erasable programmable read only memory (EEPROM).

15. A storage device, comprising:
a first storage medium comprising a first portion of a hidden root key of an encryption key, the encryption key including the hidden root key combined with a zeroizable root key;
a one-time writable storage medium comprising at least one bit of the hidden root key, the one-time writable storage location including one or more electronic fuses; and
a processor configured to:
generate the hidden root key;
generate the zeroizable root key unique to a particular die of the storage device among a plurality of dies on the storage device, wherein the hidden root key is encrypted using the zeroizable root key;
combine the hidden root key with the zeroizable root key to generate the encryption key;
blow at least one of the one or more electronic fuses of the storage device to render the encryption key unusable;
store at least one bit of the hidden root key in a one-time writable storage location, the one-time writable storage location including the one or more electronic fuses;
determining that stored encrypted data is to be deleted; and
modify the at least one bit of the encryption key stored in the one-time writable storage location.

16. The storage device of claim 15 , wherein the processor is further configured to:
store a first portion of the hidden root key to a re-writable storage location of the storage device.

Assignees

• Seagate Techology LLC
• Seagate Technology Llc

Inventors

• Cope George Christian

Classifications

• G06F21/79 Primary

  in semiconductor storage media, e.g. directly-addressable memories · CPC title

• H04L9/0894 Primary

  Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage · CPC title

• H04L9/0861

  Generation of secret information including derivation or calculation of cryptographic keys or passwords · CPC title

• G06F2221/2143

  Clearing memory, e.g. to prevent the data from being stolen · CPC title

• G06F3/0679

  Non-volatile semiconductor memory device, e.g. flash memory, one time programmable memory [OTP] · CPC title