A memory controller for controlling a nonvolatile memory, the memory controller comprising: a security access control module configured to: convert first biometric authentication data received from a biometric module into first security configuration data having a data format according to a security standard protocol; determine, based on the first security configuration data, field values of a feature set according to the security standard protocol; and perform, by using the field values of the feature set and without control of a host device, authority registration of a user authority for an access control of a secure area of the nonvolatile memory, the secure area being configured to store encrypted user data; and a data processing unit configured to, based on an access to the secure area being permitted, encrypt user data received from the host device or decrypt the encrypted user data read from the secure area, wherein the security access control module is further configured to, based on a storage device being connected to the host device: transmit an authentication trigger signal to the biometric module; receive second biometric authentication data from the biometric module, the second biometric authentication data comprising a biometric authentication result and a unique value based on biometric data of a user; convert the unique value of the second biometric authentication data into second security configuration data; and compare a password included in the second security configuration data with a credential value among the field values of the feature set according to the security standard protocol to perform authority authentication of the user authority. convert first biometric authentication data received from a biometric module into first security configuration data having a data format according to a security standard protocol; determine, based on the first security configuration data, field values of a feature set according to the security standard protocol; and perform, by using the field values of the feature set and without control of a host device, authority registration of a user authority for an access control of a secure area of the nonvolatile memory, the secure area being configured to store encrypted user data; and a data processing unit configured to, based on an access to the secure area being permitted, encrypt user data received from the host device or decrypt the encrypted user data read from the secure area, wherein the security access control module is further configured to, based on a storage device being connected to the host device: transmit an authentication trigger signal to the biometric module; receive second biometric authentication data from the biometric module, the second biometric authentication data comprising a biometric authentication result and a unique value based on biometric data of a user; convert the unique value of the second biometric authentication data into second security configuration data; and compare a password included in the second security configuration data with a credential value among the field values of the feature set according to the security standard protocol to perform authority authentication of the user authority. transmit an authentication trigger signal to the biometric module; receive second biometric authentication data from the biometric module, the second biometric authentication data comprising a biometric authentication result and a unique value based on biometric data of a user; convert the unique value of the second biometric authentication data into second security configuration data; and compare a password included in the second security configuration data with a credential value among the field values of the feature set according to the security standard protocol to perform authority authentication of the user authority.