Granted Patent B2

US 12,627,638 · App. 17/233,145 · Granted May 12, 2026

Inventors: Gayathiri Venkataraman (Santa Clara, CA); Matthew Shaun Bryson (Los Gatos, CA); Vishwanath Maram (San Jose, CA)

Assignee: SAMSUNG ELECTRONICS CO., LTD.

H04L63/0428G06F3/0604G06F3/0659G06F3/0679G06F21/79H04L9/0825H04L9/0827H04L63/166

Abstract

Claims (62)

1 . A storage device comprising:

a storage memory component configured to store requested data in encrypted format; and

a storage controller connected to the storage memory component, the storage controller configured to:

receive a command and a decryption override indicator from a host device over a host interface to read the requested data from the storage memory component;

retrieve the requested data from the storage memory component in the encrypted format based on the command;

transmit the requested data in the encrypted format to a destination storage device over a direct communication channel and based on the decryption override indicator, wherein the destination storage device comprises a local connection to the storage device for data migration via the direct communication channel; and

transfer a key associated with the requested data for decrypting the requested data from the encrypted format, the transfer of the key from the storage device to the destination storage device over the direct communication channel and based on a request for the key from the destination storage device and a determination that an encryption/decryption algorithm of the destination storage device is compatible with encryption/decryption algorithm of the storage device.

2 . The storage device of claim 1 , wherein the direct communication channel comprises a secure communications channel between the storage device and the destination storage device, and

wherein to transmit the requested data in the encrypted format to the destination storage device, the storage controller is configured to transmit the requested data in the encrypted format to the destination storage device through the secure communications channel.

3 . The storage device of claim 1 , wherein to transfer the key, the storage device is configured to transfer the key associated with the requested data to the destination storage device and the host device.

4 . The storage device of claim 3 , wherein to transfer the key, the storage device is configured to transfer an ownership of the key or information indicative of the ownership of the key.

5 . The storage device of claim 3 , wherein to transfer the key, the storage device is configured to retain a private key associated with the requested data, and to transfer a public key associated with the requested data.

6 . The storage device of claim 3 , wherein to transfer the key, the storage device is configured to transfer the key to the destination storage device and a key server communicably connected to the host device.

7 . The storage device of claim 3 , wherein the storage controller is configured to transfer the key based on a request for the key.

8 . The storage device of claim 1 , wherein the storage device comprises a solid state drive, the storage memory component comprises flash memory, and a storage interface comprises a flash interface layer of the storage device.

9 . A storage system comprising:

a first storage device configured to:

store requested data in an encrypted format;

transmit the requested data in the encrypted format over a direct communication channel to a second storage device based on a read command and a first indicator, wherein the first storage device comprises a local connection to the second storage device for data migration via the direct communication channel; and

transfer, over the direct communication channel, a key associated with the requested data for decrypting the requested data from the encrypted format from the first storage device to the second storage device based on a request for the key from the second storage device and a determination that an encryption/decryption algorithm of the second storage device is compatible with encryption/decryption algorithm of the first storage device; and

the second storage device connected to the first storage device through the direct communication channel, the second storage device being configured to:

receive the requested data in the encrypted format over the direct communication channel; and

store the requested data in the encrypted format based on a write command and a second indicator.

10 . The storage system of claim 9 , wherein the first storage device comprises:

a first storage memory component configured to store the requested data in the encrypted format; and

a first storage controller connected to the first storage memory component over a first storage interface, the first storage controller configured to:

receive the read command and the first indicator to read the requested data from the first storage memory component;

retrieve the requested data from the first storage memory component in the encrypted format based on the read command; and

transmit the requested data in the encrypted format to the second storage device over the direct communication channel based on the first indicator.

11 . The storage system of claim 10 , wherein to transfer the key, the first storage device is configured to push the transfer of the key to the second storage device based on transmitting the requested data.

12 . The storage system of claim 11 , wherein to transfer the key, the first storage device is configured to transfer an ownership of the key or information indicative of the ownership of the key.

13 . The storage system of claim 11 , wherein to transfer the key, the first storage device is configured to retain a private key associated with the requested data, and to transfer a public key associated with the requested data.

14 . The storage system of claim 11 , further comprising a key server communicably connected to the first and second storage devices,

wherein to transfer the key, the first storage device is configured to transfer the key to the key server.

15 . The storage system of claim 11 , wherein the second storage device comprises:

a second storage memory component; and

a second storage controller connected to the second storage memory component over a second storage interface, the second storage controller configured to:

receive the write command and the second indicator to write the requested data in the encrypted format to the second storage memory component;

skip encryption of the requested data based on the second indicator; and

store the requested data in the encrypted format in the second storage memory component.

16 . The storage system of claim 15 , wherein the second storage device is further configured to:

receive a third command to read the requested data from the second storage memory component;

retrieve the requested data in the encrypted format from the second storage memory component;

retrieve the key; and

decrypt the requested data according to the key.

17 . The storage system of claim 15 , wherein:

at least one of the first storage device or the second storage device comprises a solid state drive;

at least one of the first storage memory component or the second storage memory component comprises flash memory; and

at least one of the first storage interface or the second storage interface comprises a flash interface layer.

18 . A method of securely transmitting data between storage devices, the method comprising:

determining that an encryption method configured for a first storage device is operable or inoperable with an encryption method configured for a second storage device;

based on the determining that the encryption method configured for the first storage device is operable with the encryption method configured for the second storage device:

reading requested data in encrypted format at the first storage device;

transmitting the requested data in the encrypted format from the first storage device over a direct communication channel to the second storage device, wherein the first storage device comprises a local connection to the second storage device for data migration via the direct communication channel;

writing the requested data in the encrypted format at the second storage device by skipping encryption of the requested data;

transferring, over the direct communication channel, from the first storage device a key associated with the requested data for decrypting the requested data to the second storage device based on a request for the key from the second storage device;

reading the requested data at the second storage device;

retrieving the key associated with the requested data; and

decrypting the requested data using the key at the second storage device.

19 . The method of claim 18 , further comprising:

based on the determining that the encryption method configured for the first storage device is inoperable with the encryption method configured for the second storage device:

transmitting the requested data in the encrypted format along with decryption information from the first storage device to the second storage device.

Assignments (1)

Continuity (2)

References Cited (46)