Data storage device and method of operation using multiple security protocols
View Patent ↗A data storage device includes a memory and a controller that is coupled to the memory. The controller includes an authentication engine, an interface, and an encryption engine. The authentication engine is configured to authenticate an accessing device based on a message received from the accessing device. The interface is configured to receive data from the accessing device. The message is associated with a first security protocol that does not specify that the data is to be encrypted. The encryption engine is configured to encrypt the data in accordance with a second security protocol, and the controller is configured to receive, after encrypting the data, a request from the accessing device to operate according to the second security protocol.
1. A data storage device comprising:
a memory; and
a controller coupled to the memory, wherein the controller includes:
an authentication engine configured to authenticate an accessing device based on a message received from the accessing device, the message associated with a first security protocol;
an interface configured to receive data from the accessing device, wherein the first security protocol specifies that the data is not to be encrypted; and
an encryption engine configured to encrypt the data in accordance with a second security protocol with a first key in response to receiving the message associated with the first security protocol, wherein the second security protocol uses a global locking range of encrypted data and wherein the controller is configured to receive, after encrypting the data, a request from the accessing device to operate according to the second security protocol, and wherein the encrypted data is stored at the memory before the request is received from the accessing device and wherein the controller has a hard coded root key that is used to generate a second key used to encrypt the first key to create an encrypted key, wherein encrypting the data while operating according to the first security protocol enables the controller to transition from operating according to the first security protocol to operating according to the second security protocol without reformatting the memory and wherein the first key corresponds to a user data key, and wherein the second key corresponds to a system key.
2. The data storage device of claim 1 , wherein the controller further includes a key derivation engine configured to generate, during operation according to the first security protocol, the second key based on the root key stored at the data storage device.
3. The data storage device of claim 1 , wherein the first security protocol is a Trusted Computing Group (TCG) Pyrite security protocol, and wherein the second security protocol is a TCG Opal security protocol.
4. The data storage device of claim 1 , wherein the data storage device is embedded within the accessing device, and wherein the interface is further configured to receive the data from the accessing device in accordance with a non-volatile memory express (NVMe) interface protocol.
5. The data storage device of claim 1 , wherein the message indicates a representation of a password associated with the first security protocol.
6. The data storage device of claim 1 , wherein the memory includes a memory die having a three-dimensional (3D) memory configuration that is monolithically formed in one or more physical levels of arrays of memory cells having an active area above a silicon substrate, and further comprising circuitry associated with operation of the memory cells.
7. A method comprising:
in a data storage device that includes a controller and a memory, performing by the controller:
retrieving a hard coded root key in the controller;
generating a second key from the hard coded root key in a key derivation engine within a multi-mode security engine that further has a separate authentication engine and encryption engine;
creating an encrypted key from a first key based upon the second key;
performing an authentication process with an accessing device based on a message received from the accessing device, the message associated with a first security protocol;
receiving data from the accessing device, wherein the first security protocol specifies that the data is not to be encrypted;
based on the data, generating encrypted data in accordance with a second security protocol in response to receiving the message associated with the first security protocol;
receiving a request from the accessing device to operate according to the second security protocol, wherein the second security protocol uses a global locking range of encrypted data and wherein the encrypted data is stored at the memory before the request is received from the accessing device; and
after generating the encrypted data, transitioning from operating according to the first security protocol to operating according to the second security protocol.
8. The method of claim 7 , wherein generating the encrypted data includes encrypting the data using a first key to generate the encrypted data, and further comprising storing the encrypted data at the memory.
9. The method of claim 7 , wherein transitioning from operating according to the first security protocol to operating according to the second security protocol is performed in response to receiving the request and without reformatting of the memory.
10. The method of claim 8 , further comprising:
sensing a representation of the encrypted data from the memory; and
decrypting the representation of the encrypted data using the first key.
11. The method of claim 7 , wherein generating the encrypted data is transparent to the accessing device during operation based on the first security protocol.
12. The method of claim 7 , further comprising reporting use of the second security protocol to the accessing device in response to transitioning from operating according to the first security protocol to operating according to the second security protocol.
13. The method of claim 12 , wherein reporting use of the second security protocol includes sending one or more Trusted Computing Group (TCG) messages to the accessing device.
14. The method of claim 13 , wherein the one or more TCG messages include a response that includes one or more of an IDENTIFY descriptor or a TCG descriptor.
15. The method of claim 7 , wherein the second security protocol specifies that the data is to be encrypted.
16. The method of claim 7 , wherein the data storage device is embedded within the accessing device, and wherein the data is received from the accessing device in accordance with a non-volatile memory express (NVMe) interface protocol.
17. The method of claim 7 , wherein the message indicates a representation of a password that is compliant with the first security protocol.
18. The method of claim 17 , wherein a first key used to generate the encrypted data is independent of the password.
19. The method of claim 18 , further comprising:
encrypting the first key to generate an encrypted key; and
storing the encrypted key at the memory.
20. The method of claim 19 , wherein the encrypted key is stored at protected internal storage of the memory.
21. The method of claim 7 , further comprising generating one or more additional keys to encrypt the data in response to one or more commands received from the accessing device.
22. The method of claim 7 , wherein the memory has a three-dimensional (3D) memory configuration that is monolithically formed in one or more physical levels of arrays of memory cells having an active area above a silicon substrate.
23. A device comprising:
a memory; and
a controller coupled to the memory, wherein the controller includes:
a multi-mode security engine configured to perform an authentication process with an accessing device based on a message received from the accessing device, the message associated with a first security protocol; and
an interface configured to receive data from the accessing device, wherein the first security protocol specifies that the data is not to be encrypted, wherein the multi-mode security engine is further configured to generate encrypted data based on the data in accordance with a second security protocol with a first key in response to receiving the message associated with the first security protocol and wherein the second security protocol uses a global locking range of encrypted data, wherein the multi-mode security engine is further configured to receive a request from the accessing device to operate according to the second security protocol, wherein the multi-mode security engine is further configured to store the encrypted data at the memory before the request is received from the accessing device, and wherein the controller is further configured to transition from operating according to the first security protocol to operating according to the second security protocol after generating the encrypted data and wherein the controller has a hard coded root key that is used to generate a second key that is used to encrypt and decrypt the first key to create an encrypted key.
24. The device of claim 23 , wherein the memory has a three-dimensional (3D) memory configuration that is monolithically formed in one or more physical levels of arrays of memory cells having an active area above a silicon substrate, and further comprising circuitry associated with operation of the memory cells.