Memory and controller mutual secure channel association
The disclosure describes methods and systems for a storage device that includes one or more memory devices, where the memory devices store a second challenge question and a first response key. The system also includes an interface and a storage controller coupled to the interface and coupled to the memory devices. The storage controller generates an enable signal for enabling access to the memory devices. The system also includes a security module coupled to the storage controller and configured to send and receive challenge requests and challenge responses, where the security module includes a first challenge question and a second response key corresponding to each of the memory devices.
1. A storage device, comprising:
one or more non-volatile memory devices, wherein each of the one or more non-volatile memory devices is configured to store a second challenge question and a first response key;
an interface;
a storage controller coupled to the interface and coupled to the one or more non-volatile memory devices, wherein the storage controller is configured to:
generate an enable signal to enable access to the one or more non-volatile memory devices;
withdraw the enable signal to disable access to the one or more non-volatile memory devices; and
employ a first challenge question, the second challenge question, a first challenge response, and a second challenge response of mutual authentication of the one or more non-volatile memory devices; and
a security module coupled to the storage controller, wherein the security module includes:
one or more memory locations comprising the first challenge question and a second response key corresponding to each of the one or more non-volatile memory devices; and
a random number generator configured to create a cryptographic nonce alphanumeric value used to generate the second challenge response,
the security module configured to:
send, to the one or more non-volatile memory devices, the first challenge question;
receive, from the one or more non-volatile memory devices, the first challenge response based upon the first response key;
receive, from the one or more non-volatile memory devices, the second challenge question; and
send, to the one or more non-volatile memory devices, the second challenge response based upon the second response key.
2. The storage device of claim 1 , wherein the security module is a hardware device electrically coupled to the storage controller.
3. The storage device of claim 1 , wherein the security module comprises firmware.
4. The storage device of claim 1 , wherein the cryptographic nonce comprises a unique and random alphanumeric value.
5. The storage device of claim 1 , wherein the second challenge response is further generated by a cryptographically-secure hash function.
6. The storage device of claim 1 , wherein the storage controller is further configured to manage access to the one or more non-volatile memory devices by sending the enable signal to the one or more non-volatile memory devices.
7. The storage device of claim 1 , wherein:
each of the one or more non-volatile memory devices comprises the first response key at manufacturing of the storage device; and
the security module comprises the second response key at manufacturing of the storage device.
8. A method of operating a storage device, comprising:
generating, by a security module coupled to a storage controller, a first challenge request and sending the first challenge request to a non-volatile memory device via the storage controller, wherein the non-volatile memory device comprises a first response key, and wherein the security module comprises a second response key;
sending, by the non-volatile memory device, a first challenge response based upon the first response key in response to the first challenge request to the security module via the storage controller;
generating, by the non-volatile memory device, a second challenge request and sending the second challenge request to the security module via the storage controller;
sending, by the security module, a second challenge response based upon the second response key in response to the second challenge request to the non-volatile memory device via the storage controller, wherein the second challenge response is generated by using a random number generator to create a cryptographic nonce alphanumeric value;
generating, by the non-volatile memory device, an acknowledgement signal based on comparing the second challenge response and a second predetermined value; and
generating, by the storage controller, an enable signal and sending the enable signal to the non-volatile memory device based on comparing the first challenge response to a first predetermined value and receiving the acknowledgement signal from the non-volatile memory device, wherein the storage controller disables an enable signal to the non-volatile memory device based on an unsuccessful comparison.
9. The method of claim 8 , wherein the security module generates the first challenge request as part of a power-up sequence for the storage device.
10. The method of claim 8 , wherein the non-volatile memory device generates and sends the second challenge request prior to the security module generating and sending the first challenge request in response to a power-up sequence for the storage device.
11. The method of claim 8 , wherein the security module generates and sends the second challenge request upon receiving the first challenge request and before sending the first challenge response.
12. The method of claim 8 , further comprising:
generating, by the storage controller, a start signal; and
sending the start signal to the non-volatile memory device to generate and send a second challenge request to the security module via the storage controller.
13. A method of operating a storage device, comprising:
generating, by a security module coupled to a storage controller, a first challenge request and sending the first challenge request to a non-volatile memory device via the storage controller, wherein the non-volatile memory device comprises a first response key, and wherein the security module comprises a second response key;
sending, by the non-volatile memory device, a first challenge response based upon the first response key in response to the first challenge request to the security module via the storage controller;
comparing, by the storage controller, the first challenge response to a first predetermined value stored by the security module;
disabling, by the storage controller, an enable signal to the non-volatile memory device based on an unsuccessful comparison of the first challenge response and the first predetermined value;
generating, by the non-volatile memory device, a second challenge request and sending the second challenge request to the security module via the storage controller;
sending, by the security module, a second challenge response based upon the second response key in response to the second challenge request to the non-volatile memory device via the storage controller;
comparing, by the non-volatile memory device, the second challenge response to the second predetermined value stored by the security module; and
disabling, by the storage controller, the enable signal to the non-volatile memory device based on the unsuccessful comparison of the second challenge response and the second predetermined value.
14. The method of claim 13 , further comprising sending a status signal to a host device indicating that the first challenge request was unsuccessful.
15. The method of claim 13 , further comprising sending a status signal to a host device indicating that the second challenge request was unsuccessful.
16. A storage device, comprising:
one or more non-volatile memory devices, wherein the one or more non-volatile memory devices is configured to store a second challenge question and a first response key, the one or more non-volatile memory devices configured to generate a first challenge response based upon the first response key;
an interface;
a storage controller coupled to the interface and coupled to the one or more non-volatile memory devices, wherein the storage controller is configured to:
generate an enable signal sent to the one or more non-volatile memory devices enabling access to the one or more non-volatile memory devices; and
enable and disable access to the one or more non-volatile memory devices by employing multiple challenges and responses of mutual authentication of the one or more non-volatile memory devices; and
a security means for sending and receiving challenge requests and challenge responses, the security means coupled to the storage controller, wherein the security means includes:
one or more memory locations comprising a first challenge question and a second response key; and
a random number generator configured to create a cryptographic nonce alphanumeric value used to generate a second challenge response based upon the second response key.
17. The storage device of claim 16 , wherein the one or more non-volatile memory devices is configured to send an acknowledgement signal to the storage controller indicating that the second challenge response has been accepted.
18. The storage device of claim 16 , wherein the storage controller is further configured to disable the enable signal sent to the one or more non-volatile memory devices in response to a comparison of the first challenge response and a first predetermined value stored in the security means.
19. The storage device of claim 16 , further comprising means for disabling access to the one or more non-volatile memory devices based on a comparison of the second challenge response and a second predetermined value stored in the security means.
20. The storage device of claim 16 , wherein the storage controller is further configured to send a status signal to a host device via the interface indicating that one or more challenge requests were unsuccessful.
21. The storage device of claim 16 , wherein:
each of the one or more non-volatile memory devices comprises the first response key at manufacturing of the storage device; and
the security means comprises the second response key at manufacturing of the storage device.
22. A storage system, comprising:
a host device;
one or more non-volatile memory devices, wherein each of the one or more non-volatile memory devices is configured to store a second challenge question and a first response key;
an interface configured to couple to the host device;
a storage controller coupled to the interface and coupled to the one or more non-volatile memory devices, wherein the storage controller is configured to:
generate an enable signal to enable access to the one or more non-volatile memory devices;
withdraw the enable signal to disable access to the one or more non-volatile memory devices; and
employ a first challenge question, the second challenge question, a first challenge response, and a second challenge response of mutual authentication of the one or more non-volatile memory devices; and
a security module coupled to the storage controller, wherein the security module includes:
one or more memory locations comprising a first challenge question and a second response key corresponding to each of the one or more non-volatile memory devices; and
a random number generator configured to create a cryptographic nonce alphanumeric value used to generate a second challenge response,
wherein the security module is configured to:
send, to the one or more non-volatile memory devices, the first challenge question;
receive, from the one or more non-volatile memory devices, the first challenge response based upon the first response key;
receive, from the one or more non-volatile memory devices, the second challenge question; and
send, to the one or more non-volatile memory devices, the second challenge response based upon the second response key.
23. The system of claim 22 , wherein the storage controller is further configured to send a status signal to the host device via the interface indicating that one or more challenge requests were unsuccessful.
24. The system of claim 22 , wherein the one or more non-volatile memory devices are further configured to send an acknowledgement signal to the storage controller indicating that the second challenge response has been accepted by the one or more non-volatile memory devices.
25. The system of claim 22 , wherein the storage controller is further configured to send a start signal to the one or more non-volatile memory devices to send a second challenge request to the security module via the storage controller.