Patent ID: 11863664
Assignee: SAMSUNG ELECTRONICS CO., LTD.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 19:
20. A method of performing key exchange for security operation in a storage device that is accessed by a first user identification (ID) and a second user ID, the first user ID having a first private key and a first public key, the second user ID having a second private key and a second public key, the key exchange being performed between the first user ID and the second user ID, the method comprising:
generating, by a trusted third party (TTP) in or coupled to the storage device and having a third private key and a third public key, a first certificate by signing the first user ID and the first public key based on the third private key;
generating, by the TTP, a second certificate by signing the second user ID and the second public key based on the third private key;
storing the first certificate, the second certificate and a third certificate for the TTP in a key slot in which the first private key, the first public key, the second private key and the second public key are stored;
accessing the storage device based on the first user ID and a first password;
while the storage device is accessed by the first user ID, performing a first verification on the second certificate by extracting the third public key based on the third certificate, by verifying a signature for the second certificate based on the third public key, and by extracting the second user ID and the second public key in the second certificate when a verification on the signature for the second certificate is successfully completed;
deriving a ciphering key by obtaining a first key-protection-key (KPK) based on the first password and a random value, by obtaining the first private key based on the first KPK, and by performing a key agreement based on the first private key and the second public key;
accessing the storage device based on the second user ID and a second password;
while the storage device is accessed by the second user ID, performing a second verification on the first certificate by extracting the third public key based on the third certificate, by verifying a signature for the first certificate based on the third public key, and by extracting the first user ID and the first public key in the first certificate when a verification on the signature for the first certificate is successfully completed; and
deriving the ciphering key by obtaining a second KPK based on the second password and the random value, by obtaining the second private key based on the second KPK, and by performing the key agreement based on the second private key and the first public key.