Abstract: Methods, systems, and devices for double wrapping for verification are described. In some cases, a memory subsystem can receive a firmware image for the memory subsystem where the firmware image is signed with a first signature according to a first signing procedure. The memory subsystem can then verify an integrity of the firmware image based on the first signing procedure. After verifying the integrity of the firmware image, the memory subsystem can then generate a second signature for the firmware image based on a second signing procedure different from the first signing procedure. The memory subsystem can then write the second signature to the firmware image. The memory subsystem can then perform a verification process to verify the integrity of the firmware image based on one or both of the first signing procedure or the second signing procedure.

Abstract: A key delegation request is received from a host system. The key delegation request includes a new public key. A challenge is generated based on the new public key and a root public key, and the challenge is provided to the host system responsive to the request. A first and second digital signature are received from the host system. The first digital signature is generated by cryptographically signing the challenge using a new private key corresponding to the new public key and the second digital signature is generated by cryptographically signing the challenge using a root private key corresponding to the root public key. The first digital signature is validated using the new public key and the second digital signature is validated using the root public key. Based on successful validation of both signatures, the new public key is utilized in one or more cryptographic operations.

Abstract: A request for password generation is received from a host system. In response to receiving the request, a password derivation key is generated based on a key derivation seed. A password is derived from the password derivation key, and a wrapping key is derived from the password. The wrapping key is used to wrap an authorization state indication, which is stored in local memory. Encrypted data is generated based on an encryption of the key derivation seed using an asymmetric encryption key. The encrypted data is provided in response to the request.

Abstract: A variety of applications can include apparatus and/or methods of controlling a secure boot mode for a memory system. In an embodiment, a system includes a memory component and a processing device, where the processing device is configured to control a boot process for the system to operate the memory component and perform a cryptographic verification with a host to conduct an authentication of the host. The processing device can interact with the host, in response to the authentication, to receive a setting to control the boot process in a secure boot mode. The processing can interact with another processing device of the system to store the setting and to receive a secure boot signal from the other processing device, where the secure boot signal is a signal to assert or de-assert the secure boot mode depending on a value of the setting. Additional apparatus, systems, and methods are disclosed.

Abstract: A variety of applications can include apparatus and/or methods of controlling a secure boot mode for a memory system. In an embodiment, a system includes a memory component and a processing device, where the processing device is configured to control a boot process for the system to operate the memory component and perform a cryptographic verification with a host to conduct an authentication of the host. The processing device can interact with the host, in response to the authentication, to receive a setting to control the boot process in a secure boot mode. The processing can interact with another processing device of the system to store the setting and to receive a secure boot signal from the other processing device, where the secure boot signal is a signal to assert or de-assert the secure boot mode depending on a value of the setting. Additional apparatus, systems, and methods are disclosed.

Abstract: The present disclosure includes apparatuses and methods for directed sanitization of memory. One example method comprises, responsive to receiving a sanitization command, performing a deterministic garbage collection operation on a memory, wherein performing the deterministic garbage collection operation results in physical erasure of all invalid data stored on the memory without losing valid data stored on the memory.

Abstract: An example method can include, responsive to receiving a sanitization command, performing a deterministic garbage collection operation on a memory. The deterministic garbage collection operation performed on the memory can result in physical erasure of all invalid data stored on the memory without losing valid data stored on the memory.

Abstract: A processing device receives, from a host system, a key manifest and a digital signature generated based on the key manifest using a private key corresponding to a public/private key pair. The key manifest comprises one or more verification keys. The digital signature is verified using the public key and the processing device stores the key manifest in a persistent storage component in response to successful verification of the digital signature. The one or more verification keys are utilized in one or more verification operations based on the key manifest being stored in the persistent memory component.

Abstract: A data storage device is provided. The data storage device includes a storage medium having a first subset configured to store user data and a second subset configured to store snapshot data. The data storage device further includes a controller configured to (i) receive, from a host operably coupled to the data storage device, a command to configure the second subset, to (ii) verify an authenticity of the command, and to (iii) execute the command in response to the verification of the authenticity of the command.

Abstract: A memory device implements a method of communication over a wireless medium utilizing an antenna embedded in the memory device. The memory device includes a wireless component that authenticates an external device by verifying a credential structure received from the external device over the wireless medium, responds to a request for a secure communication channel from the external device with a symmetric key, and establishes the secure communication channel with the debugging device over the wireless medium, and servicing requests from the external device to access debugging, testing, and diagnostics data of the memory device.

Abstract: A request for memory sub-system log data is received from a host system. In response to receiving the request, a symmetric encryption key for encrypting the requested memory-sub-system log data is generated. The requested memory sub-system log data is encrypted using the symmetric encryption key. The symmetric encryption key is encrypted using an asymmetric encryption key. An encrypted data payload is generated and sent to the host system in response to the request. The encrypted data payload comprises the encrypted encryption key and the encrypted memory sub-system log data.

Abstract: A data storage device is provided. The data storage device includes a storage medium having a first subset configured to store user data and a second subset configured to store snapshot data. The data storage device further includes a controller configured to (i) receive, from a host operably coupled to the data storage device, a command to configure the second subset, to (ii) verify an authenticity of the command, and to (iii) execute the command in response to the verification of the authenticity of the command.

Abstract: A variety of applications can include apparatus and/or methods of controlling a secure boot mode for a memory system. In an embodiment, a system includes a memory component and a processing device, where the processing device is configured to control a boot process for the system to operate the memory component and perform a cryptographic verification with a host to conduct an authentication of the host. The processing device can interact with the host, in response to the authentication, to receive a setting to control the boot process in a secure boot mode. The processing can interact with another processing device of the system to store the setting and to receive a secure boot signal from the other processing device, where the secure boot signal is a signal to assert or de-assert the secure boot mode depending on a value of the setting. Additional apparatus, systems, and methods are disclosed.

Abstract: Several embodiments of memory devices and systems with command and control access are described herein. In one embodiment, a memory device includes a controller having a processor and a memory component operably coupled to the processor. The controller is configured to receive at least one command and control (C2) packet from a remote computer associated with a device vendor. The C2 packet includes a request for the controller to perform a restricted command, and a vendor signature. The memory component stores instructions executable by the processor to determine if the vendor signature is valid and to direct the controller to perform the restricted command if the vendor signature is determined to be valid.

Abstract: The present disclosure includes apparatuses and methods for directed sanitization of memory. One example method comprises, responsive to receiving a sanitization command, performing a deterministic garbage collection operation on a memory, wherein performing the deterministic garbage collection operation results in physical erasure of all invalid data stored on the memory without losing valid data stored on the memory.

Abstract: The present disclosure includes apparatuses and methods for directed sanitization of memory. One example method comprises, responsive to receiving a sanitization command, performing a deterministic garbage collection operation on a memory, wherein performing the deterministic garbage collection operation results in physical erasure of all invalid data stored on the memory without losing valid data stored on the memory.

Abstract: Several embodiments of memory devices and systems with command and control access are described herein. In one embodiment, a memory device includes a controller having a processor and a memory component operably coupled to the processor. The controller is configured to receive at least one command and control (C2) packet from a remote computer associated with a device vendor. The C2 packet includes a request for the controller to perform a restricted command, and a vendor signature. The memory component stores instructions executable by the processor to determine if the vendor signature is valid and to direct the controller to perform the restricted command if the vendor signature is determined to be valid.

Abstract: A data storage device is provided. The data storage device includes a storage medium having a first subset configured to store user data and a second subset configured to store snapshot data. The data storage device further includes a controller configured to (i) receive, from a host operably coupled to the data storage device, a command to configure the second subset, to (ii) verify an authenticity of the command, and to (iii) execute the command in response to the verification of the authenticity of the command.

Abstract: Several embodiments of memory devices and systems with command and control access are described herein. In one embodiment, a memory device includes a controller having a processor and a memory component operably coupled to the processor. The controller is configured to receive at least one command and control (C2) packet from a remote computer associated with a device vendor. The C2 packet includes a request for the controller to perform a restricted command, and a vendor signature. The memory component stores instructions executable by the processor to determine if the vendor signature is valid and to direct the controller to perform the restricted command if the vendor signature is determined to be valid.

Abstract: The present disclosure includes apparatuses and methods for directed sanitization of memory. One example method comprises, responsive to receiving a sanitization command, performing a deterministic garbage collection operation on a memory, wherein performing the deterministic garbage collection operation results in physical erasure of all invalid data stored on the memory without losing valid data stored on the memory.