Combined cryptographic key management services for access control and proof of space
A security server storing a plurality of cryptographic keys to support device authentication, access control and proof of space plot farming. The cryptographic keys can include a first cryptographic key representative of an identity of a memory device, a second cryptographic key representative of a privilege to access a memory region in the memory device, and a third cryptographic key representative of a pool of proof of space plots. The security server can sign blocks in a blockchain created via plots in the pool, sign commands to access the memory region, and secure transfer of the second and/or third cryptographic key to the computer operated by an owner of the memory device.
1. An apparatus, comprising:
a storage medium including a memory device configured with a device secret during manufacture of the memory device;
a host interface configured to communicate with a host system to provide the host system with data storage services using a storage capacity of the storage medium; and
a logic circuit configured to:
generate, based on the device secret, a cryptographic key pair including a private key and a public key;
determine an identification of a proof of space plot, wherein the identification is based at least in part on the public key; and
generate, in the storage medium, a plurality of look up tables of the proof of space plot having the identification.
2. The apparatus of claim 1 , further comprising:
a network interface operable to communicate, over a computer network, with a security server to initiate generation of the proof of space plot.
3. The apparatus of claim 2 , wherein the security server is configured to store a plurality of cryptographic keys, including a first cryptographic key representative of an identity of the memory device, a second cryptographic key representative of a privilege to access a memory region in the memory device, and a third cryptographic key representative of a pool of proof of space plots.
4. The apparatus of claim 3 , wherein the identification of the proof of space plot is further based on the third cryptographic key.
5. The apparatus of claim 4 , wherein the logic circuit is configured to request, via the network interface, the security server to generate the third cryptographic key representative of the pool.
6. The apparatus of claim 5 , wherein the logic circuit is further configured to generate a fourth cryptographic key representative of the proof of space plot.
7. The apparatus of claim 6 , wherein the device secret is unique for the memory device among memory devices manufactured in a facility.
8. The apparatus of claim 7 , wherein the fourth cryptographic key is generated based at least in part on the device secret.
9. The apparatus of claim 7 , wherein the third cryptographic key is generated based at least in part on the device secret.
10. The apparatus of claim 7 , wherein the fourth cryptographic key is a private key in a first asymmetric cryptographic key pair; and the third cryptographic key is a private key in a second asymmetric cryptographic key pair; and the identification of the proof of space plot is based on public keys in the first asymmetric cryptographic key pair and the second asymmetric cryptographic key pair.
11. A method, comprising:
storing, in a memory device of an apparatus, a device secret configured in the memory device during manufacture of the memory device;
communicating with, via a host interface of the apparatus, a host system to provide the host system with data storage services using a storage capacity of the apparatus; and
generating, by the apparatus based on the device secret, a cryptographic key pair including a private key and a public key;
determining, by the apparatus, an identification of a proof of space plot, wherein the identification is based at least in part on the public key; and
generating, in a storage medium of the apparatus, a plurality of look up tables of the proof of space plot having the identification.
12. The method of claim 11 , further comprising:
communicating, via a network interface of the apparatus and over a computer network, with a security server to initiate generation of the proof of space plot.
13. The method of claim 12 , wherein the security server is configured to store a plurality of cryptographic keys, including a first cryptographic key representative of an identity of the memory device, a second cryptographic key representative of a privilege to access a memory region in the memory device, and a third cryptographic key representative of a pool of proof of space plots.
14. The method of claim 13 , wherein the identification of the proof of space plot is further based on the third cryptographic key.
15. The method of claim 14 , further comprising:
requesting, by the apparatus via the network interface, the security server to generate the third cryptographic key representative of the pool.
16. The method of claim 15 , further comprising:
generating, by the apparatus, a fourth cryptographic key representative of the proof of space plot.
17. The method of claim 16 , wherein the fourth cryptographic key is a private key in a first asymmetric cryptographic key pair; and the third cryptographic key is a private key in a second asymmetric cryptographic key pair; and the identification of the proof of space plot is based on public keys in the first asymmetric cryptographic key pair and the second asymmetric cryptographic key pair.
18. A non-transitory computer storage medium storing instructions which, when executed by an apparatus, cause the apparatus to perform a method, comprising:
communicating with, via a host interface of the apparatus, a host system to provide the host system with data storage services using a storage capacity of the apparatus; and
generating, by the apparatus based on a device secret configured in a memory device during manufacture of the memory device, a cryptographic key pair including a private key and a public key;
determining, by the apparatus, an identification of a proof of space plot, wherein the identification is based at least in part on the public key; and
generating, in the storage capacity of the apparatus, a plurality of look up tables of the proof of space plot having the identification.
19. The non-transitory computer storage medium of claim 18 , wherein the method further comprises:
communicating, via a network interface of the apparatus and over a computer network, with a security server to initiate generation of the proof of space plot;
wherein the security server is configured to store a plurality of cryptographic keys, including a first cryptographic key representative of an identity of the memory device, a second cryptographic key representative of a privilege to access a memory region in the memory device, and a third cryptographic key representative of a pool of proof of space plots.
20. The non-transitory computer storage medium of claim 19 , wherein the cryptographic key pair is a first asymmetric cryptographic key pair; the third cryptographic key is a private key in a second asymmetric cryptographic key pair; and the identification is further based on a public key in the second asymmetric cryptographic key pair.