Method And System For Generating Host Keys For Storage Devices
Abstract:
A method of generating one or more host key sets for one or more host devices is described. The method comprises generating one or more node key sets for one or more ancestor nodes in a data structure, identifying one or more common ancestor nodes for one or more leaf nodes, and storing one or more node key sets corresponding to one or more common ancestor nodes in a temporary storage medium and generating one or more node key sets for one or more leaf nodes in the data structure by using the one or more node key sets of the ancestor nodes.
Figure 4
Get Free WhatsApp Updates!
Notices, Deadlines & Correspondence
# 2870, ORION Building, Bagmane Constellation Business Park, Outer Ring Road, Doddanakundi Circle, Marathahalli Post, Bangalore -560037, Karnataka, India
Inventors
1. SINGH, Banmeet
Employed at Samsung R&D Institute India – Bangalore Private Limited, having its office at, # 2870, ORION Building, Bagmane Constellation Business Park, Outer Ring Road, Doddanakundi Circle, Marathahalli Post, Bangalore -560037, Karnataka, India
Specification
DESC:RELATED APPLICATION
Benefit is claimed to Indian Provisional Application No. 3480/CHE/2013 titled "METHOD AND SYSTEM FOR ASSIGNMENT OF HOST KEYS FOR STORAGE DEVICES" filed on 1st August 2013, which is herein incorporated in its entirety by reference for all purposes.
FIELD OF THE INVENTION
The present invention relates to storage device, and more particularly relates to generation and assignment of host keys corresponding to storage device.
BACKGROUND OF THE INVENTION
Flash memory is used as a storage medium for a variety of computer applications. Flash memory uses electrically-erasable programmable read-only memory (EEPROM) as a non-volatile storage. Secure Flash (SF) is a Digital Rights Management (DRM) technology applicableto flash memory, aimed at the protection of digital content from unauthorized, pirated usage. The content is stored on to the media in an encrypted fashion in the secure flash device.
EMID (Enhanced Media Identifier) and Gamma are two authentication protocols used in the SF technology. Both EMID and Gamma authentication protocols must be successfully passed when media is plugged into the host device for content to be successfully decrypted. Typically, on inserting a Secure Flash memory card into a Secure Flash host device, EMID authentication protocol is executed using sets of cryptographic keys assigned to host device and memory card respectively. The EMID authentication protocol passes only if the keys assigned to the host device and the memory card are valid.
Generally, cryptographic keys are assigned to a host device and a memory card respectively using a key management system. The key management is performed by a host key generation device. The key management system may receive a request for generation of host keys in bulk amounts. At the core the key management system of the EMID technology is a tree data structure called the Key Management Tree (KMT) having a plurality of layers. Each layer of the KMT constitutes one or more nodes. The nodes present at the last layer of the KMT represent real-world EMID host devices.
Currently, in the key management system, a brute force approach is used to generate host key sets. Key sets for all nodes are generated individually. An existing approach may require many additional operations to be performed per node for generating host key sets. This may require enormous amount of time, thereby affecting the throughput of the host key generation device.
SUMMARY
The objective of present invention is to design a method of system for generating host set keys with higher speed and lesser calculation.
An embodiment of present invention describes a method of generating one or more host key sets for one or more host devices. The method comprises generating one or more node key sets for one or more ancestor nodes in a data structure, generating one or more node key sets for one or more leaf nodes in the data structure by using the one or more node key sets of the ancestor nodes and generating at least one host key set for at least one leaf node by reusing the generated node key set of one or more ancestor nodes and node key sets of one or more leaf nodes.
Another embodiment of the present invention describes a method of generating host key sets for one or more host devices. The method comprises generating one or more seed keys for one or more nodes in a tree data structure, storing the one or more generated seed keys in a temporary storage medium andgenerating one or more node key sets for one or more nodes in the tree data structure using the stored seed keys.
Yet another embodiment of the present invention describes a method of generating host key sets for one or more host devices. The method comprises generating one or more seed keys for one or more nodes in a tree data structure, generating node key set for at least one node based on the generated one or more seed key, wherein the node key set comprises one or more seed keys and one or more intermediate keys derived from the seed keys, storing the generated seed keys and intermediate key in a temporary storage medium and generating one or more node key sets for one or more nodes in the tree data structure by reusing the stored seed keys and intermediate key.
Further embodiment of the present invention describes a system for generating one or more host key sets for one or more host devices. The system comprises
a node selection module configured for selecting one or more nodes based on a request, a seed key generation module connected with the node selection module for generating one or more seed keys for selected one or more nodes, an intermediate value generation module for generating one or more intermediate values from one ormore seed keys, a temporary storage module 905 for storing the generated seed keys and intermediate values, a node key set generation module generates one or more node key set from the stored one or more intermediate values and one or more seed keys and a host key generation module coupled with the node key set generation module.
BRIEF DESCRIPTION OF THE ACCOMPANYING DRAWINGS
The aforementioned aspects and other features of the present invention will be explained in the following description, taken in conjunction with the accompanying drawings, wherein:
Figure 1A illustrates a schematic representation of key management tree structure.
Figure 1B illustrates a schematic representation of each node in a circular group and seed value key assignment.
Figure 2A illustrates a schematic representation depicting the ancestor nodes and leaf nodes.
Figure 2B illustrates a node key set for t-1 nodes present in a KMT.
Figure 3 illustrates a schematic representation depicting the common ancestor nodes and leaf nodes under consideration according to one embodiment of present invention.
Figure 4 illustrates a method of generating host key sets for one or more host devices, according to one embodiment of present invention.
Figure 5 illustratesmethod of generating host key sets for one or more host devices, according to another embodiment of present invention.
Figure 6 illustrates a schematic representation of distribution of seed keys for each node, according to one embodiment of present invention.
Figure 7 illustrates method of generating host key sets for one or more host devices, according to another embodiment of present invention.
Figure 8 illustrates a schematic representation of distribution of seed keys and intermediate key values for each node, according to another embodiment of present invention.
Figure 9illustrates a block diagram of system for generating host key sets for one or more host devices, according to oneembodiment of present invention.
DETAILED DESCRIPTION OF THE INVENTION
The embodiments of the present invention will now be described in detail with reference to the accompanying drawings. However, the present invention is not limited to the embodiments. The present invention can be modified in various forms. Thus, the embodiments of the present invention are only provided to explain more clearly the present invention to the ordinarily skilled in the art of the present invention. In the accompanying drawings, like reference numerals are used to indicate like components.
The specification may refer to “an”, “one” or “some” embodiment(s) in several locations. This does not necessarily imply that each such reference is to the same embodiment(s), or that the feature only applies to a single embodiment. Single features of different embodiments may also be combined to provide other embodiments.
As used herein, the singular forms “a”, “an” and “the” are intended to include the plural forms as well, unless expressly stated otherwise. It will be further understood that the terms “includes”, “comprises”, “including” and/or “comprising” when used in this specification, specify the presence of stated features, integers, steps, operations, elements and/or components, but do not preclude the presence or addition of one or more other features integers, steps, operations, elements, components, and/or groups thereof. As used herein, the term “and/or” includes any and all combinations and arrangements of one or more of the associated listed items.
Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure pertains. It will be further understood that terms, such as those defined in commonly used dictionaries, should be interpreted as having a meaning that is consistent with their meaning in the context of the relevant art and will not be interpreted in an idealized or overly formal sense unless expressly so defined herein.
The present invention discloses a method for generating node key sets for each node in a key management tree structure. According to present invention, keys are generated using less number of encryption operations. In one embodiment of present invention, the node key sets for common ancestor nodes of various nodesin the tree data structure are saved and reused for increasing throughput. Whereas in another embodiment, in addition to reusing node key sets of common ancestors, the seed keys used for generating node key set for each node are saved and reused for generating nodekey set for all nodes. In another embodiment of present invention, all the generated seed keys as well as intermediate keys are stored in a temporary storage medium and reused for generating node key sets of all nodes.
Figure 1 illustrates a schematic representation of key management tree structure. At the core of the key management system of the EMID technology is the tree data structure called the Key Management Tree (KMT). The node 101 is the root node in the key management tree (KMT) 100. The node that generates from any node is called a child node of that node and the original node is called a parent node of corresponding child node.
The KMT has the following properties:
1. It is a t-array tree having ‘d’ levels (excluding the root node 101). The levels are numbered from Layer 0 to Layer d-1.
2. The leaf nodes of the KMT represent real-world EMID host devices. Further, KMTsupports td host devicesfor ‘d’ number of levels (excluding the root node 101).
3. All the t nodes belonging to the same parent form a circular ‘Group’.
4. The t nodes in a circular group are assigned ID’s from 0 to t-1.
5. A 16-byte random seed value key is assigned to each node according to its ID. The seed value for Node ‘i’ in the group is denoted by Ki for 0 = i = (t-1).
Figure 1A explains the generalized structure of the KMT. Typically, the implementation of KMT for EMID technology uses parameters t=16 and d=10.This indicates that each node has 16 children and there exist 10 layers. Therefore, the number of nodes in each layer of KMT is t, t2, t3 etc.The number of real-world EMID hosts supported according to above mentioned implementation is 1610 = 1.1 trillion (approximate) leaf nodes at layer 9 of the key management tree.
Figure 1B illustrates a schematic representation of each node in a circular group and seed value key assignment.Each node in a circular group is associated with a set of t (=16) keys (each of 16-byte length) and its own seed key value.
Figure 2A illustrates a schematic representation depicting the ancestor nodes and leaf nodes. According to one embodiment of present invention, first layer of the KMT comprises 16 nodes generated from the root node. All the nodes in layer 1 are ancestor nodes, since there exist another eight layers under each node of layer 1. All the nodes in layer 9 are considered as leaf nodes. Likewise, all the nodes till 8th layer are considered as the ancestor nodes of leaf nodes in 9th layer. For instance, consider leaf nodes 0 to 15, then all the first nodes from layer 0 to layer 8 are ancestor nodes for leaf nodes 0 to 15.
Figure 2B illustrates a node key set for t-1 nodes present in a KMT. The node key set represents the identity of a node. In order togenerate node key set values two types of operations are performed such asAdvanced Encryption Standard (AES) encryption operation and Hashing operation. Implementation of the key management system for EMID authentication protocol uses seed value keys for each node. The seed keys are generated using AES operation. The number of AES encryption operation depends on the number of nodes present in a layer. Further, hashing operation is required to be performed for each of the seed keys. Further, in order to generate one complete node key set, hashing operation is required. For instance, the number of hashing operations performed to generate node key sets for 16 nodes is stated as follows:
The key set for Node i (0=i= t-1), is a sequence of key values ki, n (0= n = t-1),
ki, n =.h((i+t-n)mod t)(Kn)
The function ‘h’ in the above equation is the SHA-1 hash function with the slight modification that it returns the 128 most significant bits of the 160-bit generated SHA-1 hash. The exponent of the function ‘h’ denotes the number of times the modified SHA-1 hash function is to be iteratively applied. The equation generates key sets as shown in Figure 2B (each column is the key set for the corresponding node).
Each leaf node of the KMT corresponds to a unique real world EMID host and each host device stores a unique set of keys called host key set. These host key set is a collection of the corresponding node key set of leaf node and the key sets of all its ancestor nodes of the leaf node for the lower 8 layers, viz., Layer 2, 3,…,9 in KMT for EMID.
Figure 3 illustrates a schematic representation depicting the common ancestor nodes and leaf nodes under consideration according to one embodiment of present invention.
The host key generation according to present invention supports higher throughput in case of bulk requests. Typically, the leaf nodes are allocated sequentially. Consider that the leaf nodes of the KMT are numbered sequentially from 0 at the leftmost node to 1610-1 to the rightmost node. The leaf node allocation is performed sequentially. If the key management system receives a bulk request for the generation of ‘N’ number of host key sets starting from leaf node number ‘X’, the leaf nodes for which host key sets are generated are leaf nodes X to X+N-1.
Consider a request of N host key sets and the requested N leaf nodes are not available in a single sequence, then the request for ‘N’ host key sets is split into a maximum of two sequential leaf node chains. Then M number of nodes from the N number of leaf nodes is allocated starting from leaf node X while the rest (N-M) nodes maybe allocated starting from some other leaf node Y. In this embodiment, M is less than N (i.e. M
Documents
Orders
Section
Controller
Decision Date
Application Documents
#
Name
Date
1
3480-CHE-2013-IntimationOfGrant20-09-2022.pdf
2022-09-20
1
Executed and Stamped GPoA_SRI-B.pdf
2013-08-05
2
3480-CHE-2013-PatentCertificate20-09-2022.pdf
2022-09-20
2
485_4823690_Provisional Specification.pdf
2013-08-05
3
485_4823690_Drawings.pdf
2013-08-05
3
3480-CHE-2013-PETITION UNDER RULE 137 [30-08-2022(online)]-1.pdf
2022-08-30
4
3480-CHE-2013-PETITION UNDER RULE 137 [30-08-2022(online)].pdf