Batch transfer of control of memory devices over computer networks
A system, method and apparatus to control memory devices over computer networks. For example, a server system establishes a secure authenticated connection with a client computer system to receive a request having a batch identification that is configured in the server system to identify a batch of multiple memory devices. After determining that the client computer system is eligible to control the multiple memory devices in the batch, the server system transmits to the client computer system a response. The response contains control data for each respective memory device in the batch. The control data is based on at least a cryptographic key stored in the server system in association with the respective memory device. Using the control data the client computer system submits a command with a digital signature to the respective memory device, which validates the digital signature prior to execution of the command.
1. A system, comprising:
memory; and
at least one processor configured to:
store data representative of an identification of a batch of memory devices, wherein each respective memory device in the batch of memory devices is manufactured to perform validation of a digital signature signed for a command prior to execution of the command;
receive, via a secure authenticated connection from a computer, a request having the identification;
verify a privilege of the computer to control the batch of memory devices; and
transmit, via the secure authenticated connection to the computer and responsive to the request, a response for the respective memory device in the batch of memory devices.
2. The system of claim 1 , configured to include a key management server and an access control server, wherein the key management server is configured to store data associating the identification of the batch of memory devices with identifications of individual memory devices in the batch but no data associating the identification of the batch of memory devices with any identification of the computer.
3. The system of claim 2 , wherein the access control server is configured to store data associating the identification of the batch of memory devices with an identification of the computer to indicate the privilege of the computer to control the batch of memory devices, but no data associating the identification of the batch of memory devices with the identifications of individual memory devices in the batch.
4. The system of claim 3 , wherein the command is configured to, when executed in the respective memory device, cause the respective memory device to activate a security feature of the respective memory device.
5. The system of claim 3 , wherein the command is configured to, when executed in the respective memory device, cause the respective memory device to replace a first cryptographic key, used by the respective memory device to control access, with a second cryptographic key.
6. The system of claim 3 , wherein the digital signature is based on a message including the command and a cryptographic nonce.
7. The system of claim 6 , wherein the digital signature includes a hash-based message authentication code (HMAC) generated from the message and a respective cryptographic key.
8. A method, comprising:
storing, in a system, data representative of an identification of a batch of memory devices, wherein each respective memory device in the batch of memory devices is manufactured to perform validation of a digital signature signed for a command prior to execution of the command;
receiving, in the system via a secure authenticated connection from a computer, a request having the identification;
verifying, by the system, a privilege of the computer to control the batch of memory devices; and
transmitting, from the system via the secure authenticated connection to the computer and responsive to the request, a response for the respective memory device in the batch of memory devices.
9. The method of claim 8 , wherein the system includes a key management server configured to store data associating the identification of the batch of memory devices with identifications of individual memory devices in the batch but no data associating the identification of the batch of memory devices with any identification of the computer.
10. The method of claim 9 , wherein the system further includes an access control server configured to store data associating the identification of the batch of memory devices with an identification of the computer to indicate the privilege of the computer to control the batch of memory devices, but no data associating the identification of the batch of memory devices with the identifications of individual memory devices in the batch.
11. The method of claim 10 , wherein the command is configured to, when executed in the respective memory device, cause the respective memory device to activate a security feature of the respective memory device.
12. The method of claim 10 , wherein the command is configured to, when executed in the respective memory device, cause the respective memory device to replace a first cryptographic key, used by the respective memory device to control access, with a second cryptographic key.
13. The method of claim 10 , wherein the digital signature is based on a message including the command and a cryptographic nonce.
14. The method of claim 13 , wherein the digital signature includes a hash-based message authentication code (HMAC) generated from the message and a respective cryptographic key.
15. A non-transitory computer storage medium storing instructions which, when executed by a system, cause the system to perform a method, the method comprising:
storing, in the system, data representative of an identification of a batch of memory devices, wherein each respective memory device in the batch of memory devices is manufactured to perform validation of a digital signature signed for a command prior to execution of the command;
receiving, in the system via a secure authenticated connection from a computer, a request having the identification;
verifying, by the system, a privilege of the computer to control the batch of memory devices; and
transmitting, from the system via the secure authenticated connection to the computer and responsive to the request, a response for the respective memory device in the batch of memory devices.
16. The non-transitory computer storage medium of claim 15 , wherein the system includes a key management server configured to store data associating the identification of the batch of memory devices with identifications of individual memory devices in the batch but no data associating the identification of the batch of memory devices with any identification of the computer.
17. The non-transitory computer storage medium of claim 16 , wherein the system further includes an access control server configured to store data associating the identification of the batch of memory devices with an identification of the computer to indicate the privilege of the computer to control the batch of memory devices, but no data associating the identification of the batch of memory devices with the identifications of individual memory devices in the batch.
18. The non-transitory computer storage medium of claim 17 , wherein the command is configured to, when executed in the respective memory device, cause the respective memory device to activate a security feature of the respective memory device.
19. The non-transitory computer storage medium of claim 17 , wherein the command is configured to, when executed in the respective memory device, cause the respective memory device to replace a first cryptographic key, used by the respective memory device to control access, with a second cryptographic key.
20. The non-transitory computer storage medium of claim 17 , wherein the digital signature is based on a message including the command and a cryptographic nonce; and wherein the digital signature includes a hash-based message authentication code (HMAC) generated from the message and a respective cryptographic key.