Removable information storage device that includes a master encryption key and encryption keys

BACKGROUND OF THE INVENTION

0001Personal Data Assistants (PDAs) and cellular phones are designed to act as organizers, note takers and communication devices. PDAs and cellular phones have user interfaces such as touch screens or miniature keyboards which are used to input and store information considered to be private. Cellular telephones are typically used to store confidential information such as address and telephone numbers. PDAs are also used to store address and telephone numbers and can be used to store other business proprietary information such as financial plans, customer lists or product pricing strategies.

0002Memory cards are becoming available which insert into plug-in expansion slots located on the PDAs or cellular phones. These cards are often times used to store the confidential information, and can be used to store other information such as software for applications, content data for travel software, games or copyrighted digital music. It is desirable to protect the information stored on the memory cards in order to prevent unauthorized access.

0003To safeguard this information, manufacturers have used embedded EEPROM or flash memory on the memory cards to provide secure storage because their contents cannot be viewed and they are virtually impossible to probe internally. EEPROM and flash memory can be more expensive to manufacture than other types of memory storage devices which do not provide secure storage, and can increase the cost of the memory cards.

0004Manufacturers have also used encryption algorithms to encrypt confidential information which is stored in non-secure memory which is located on the memory cards. With this approach, the encryption keys used to encrypt and decrypt the confidential information are stored in secure memory such as embedded EEPROM or flash memory which is also located on the memory cards. Because the amount of EEPROM or flash memory storage space required to store the encryption keys can be significant, this approach also can increase the cost of the memory cards.

SUMMARY OF THE INVENTION

0005The present invention provides a removable information storage device suitable for use with a host, that encrypts and decrypts encryption keys and data. One embodiment of the present invention provides a removable information storage device which includes a non-volatile memory which is configured to store a master encryption key. The information storage device includes a non-volatile magnetic memory that is configured to store encryption keys that have been encrypted using the master encryption key and to store data that has been encrypted using the encryption keys.

BRIEF DESCRIPTION OF THE DRAWINGS

0006Embodiments of the invention are better understood with reference to the following drawings. The elements of the drawings are not necessarily to scale relative to each other. Like reference numerals designate corresponding similar parts.

0007<figref idref="DRAWINGS">FIG. 1</figref> is a diagram illustrating one exemplary embodiment of an information storage device according to the present invention.

0008<figref idref="DRAWINGS">FIG. 2</figref> is a diagram illustrating one exemplary embodiment of a magnetic memory according to the present invention.

0009<figref idref="DRAWINGS">FIGS. 3A and 3B</figref> are diagrams illustrating parallel and anti-parallel magnetization of a magnetic memory cell.

0010<figref idref="DRAWINGS">FIG. 4</figref> is a diagram illustrating a magnetic memory cell that has been selected during a write operation.

0011<figref idref="DRAWINGS">FIG. 5</figref> is a side view illustrating one exemplary embodiment of an atomic resolution storage (ARS) memory used in an information storage device according to the present invention.

0012<figref idref="DRAWINGS">FIG. 6</figref> is a simplified schematic diagram illustrating one exemplary embodiment of storing information in the atomic resolution storage memory illustrated in <figref idref="DRAWINGS">FIG. 5</figref>.

0013<figref idref="DRAWINGS">FIG. 7</figref> is a top view illustrating one exemplary embodiment of an atomic resolution storage memory which is taken along line <b>7</b>-<b>7</b> of <figref idref="DRAWINGS">FIG. 5</figref>.

0014<figref idref="DRAWINGS">FIG. 8</figref> is a diagram illustrating one exemplary embodiment of electron emitters reading from storage areas of the atomic resolution storage memory of <figref idref="DRAWINGS">FIG. 6</figref>.

0015<figref idref="DRAWINGS">FIG. 9</figref> is a diagram illustrating another exemplary embodiment of electron emitters reading from storage areas of an atomic resolution storage memory.

0016<figref idref="DRAWINGS">FIG. 10</figref> is a diagram illustrating a first exemplary embodiment of memory allocation.

0017<figref idref="DRAWINGS">FIG. 11</figref> is a diagram illustrating a second exemplary embodiment of memory allocation.

0018<figref idref="DRAWINGS">FIG. 12</figref> is a flowchart illustrating an exemplary embodiment of a method of encrypting encryption keys using a master encryption key in an information storage device.

0019<figref idref="DRAWINGS">FIG. 13</figref> is a flowchart illustrating an exemplary embodiment of a method of decrypting encryption keys in an information storage device.

DETAILED DESCRIPTION

0020<figref idref="DRAWINGS">FIG. 1</figref> is a diagram illustrating one exemplary embodiment of an information storage device <b>14</b> according to the present invention. In the exemplary embodiment illustrated at <b>10</b>, information storage device <b>14</b> is connected to a host computer <b>12</b>. In one embodiment, information storage device <b>14</b> is small and compact in size. In the illustrated embodiment, the host <b>12</b> is a computing device containing a processor and related support electronics such as general purpose computer. In other embodiments, the host <b>12</b> can be a Personal Digital Assistant (PDA), a cellular telephone, or any suitable device that requests stored information. In other embodiments, the host <b>12</b> and the storage device <b>14</b> can be contained within the same physical packaging. In one embodiment, the storage device <b>14</b> is located within the host <b>12</b>. In the illustrated embodiment, the host <b>12</b> includes suitable interface circuitry which supports a memory card interface communication standard used by host <b>12</b> and information storage device <b>14</b>. In one embodiment, the memory card interface standard conforms to the Secure Digital standard. In other embodiments, the memory card interface standard conforms to other suitable standards which include, but are not limited to, the CompactFlash® or MultiMediaCard™ standards.

0021In the illustrated embodiment, the information storage device <b>14</b> includes a controller system <b>16</b> and a memory storage device <b>18</b>. Although a single memory storage device <b>18</b> is illustrated in <figref idref="DRAWINGS">FIG. 1</figref>, in other embodiments, there can be two or more memory storage devices <b>18</b>. Information or data is transferred between the host <b>12</b> and memory storage device <b>18</b> via the controller system <b>16</b>. In the illustrated embodiment, controller system <b>16</b> includes a host interface <b>24</b>, a data path manager <b>28</b>, a memory interface <b>32</b>, a controller processor <b>40</b>, an encryption and decryption engine <b>36</b> and a master key memory <b>46</b>.

0022The host interface <b>24</b> is configured to provide a communication interface between the host <b>12</b> and the controller system <b>16</b>. In one embodiment, the host interface <b>24</b> uses the Secure Digital standard to communicate with the host <b>12</b>. In other embodiments, host interface <b>24</b> uses other suitable interface standards to communicate with the host <b>12</b> which include, but are not limited to, the CompactFlash® or MultiMediaCard™ standards. In the illustrated embodiment, host interface <b>24</b> is coupled to host <b>12</b> via a bus illustrated at <b>20</b> which includes one or more data lines, and a bus illustrated at <b>22</b> which includes one or more address/control lines.

0023A memory interface <b>32</b> is configured to provide a communication interface between the memory storage device <b>18</b> and the controller system <b>16</b>. The memory interface <b>32</b> is coupled to the memory storage device <b>18</b> via a bus illustrated at <b>52</b> which includes one or more data lines <b>52</b> and a bus illustrated at <b>54</b> which includes one or more address/control lines <b>54</b>.

0024Memory storage device <b>18</b> is configured to store encryption keys after the encryption keys have been encrypted using a master encryption key. Memory storage device <b>18</b> is also configured to store encrypted data which has been encrypted using the encryption keys and data that is not encrypted.

0025In one embodiment, the memory storage device <b>18</b> is a Magnetic Random Access Memory (MRAM) or magnetic memory which is illustrated at <b>118</b> in <figref idref="DRAWINGS">FIGS. 2-4</figref>. The magnetic memory provides non-volatile data storage.

0026In one embodiment, the memory storage device <b>18</b> is an atomic resolution storage (ARS) memory which is illustrated at <b>218</b> in <figref idref="DRAWINGS">FIGS. 5-9</figref>. The ARS memory provides non-volatile data storage and is disclosed in U.S. Pat. No. 5,557,596 to Gibson et al., issued Sep. 17, 1996, entitled “Ultra-High Density Storage Device,” which is incorporated herein by reference. In other embodiments, memory storage device <b>18</b> can be any other suitable type of non-volatile memory.

0027In the illustrated embodiment, master key memory <b>46</b> is coupled to controller processor <b>40</b> via line or lines <b>44</b>. In various embodiments, master key memory <b>46</b> is a non-volatile memory which is configured to store the master encryption key. In one embodiment, master key memory <b>46</b> is an MRAM or magnetic memory which is illustrated at <b>146</b> in <figref idref="DRAWINGS">FIGS. 2-4</figref>.

0028In other embodiments, master key memory <b>46</b> is a non-volatile, Read-Only memory. In one embodiment, the memory includes fuse elements which operate as storage elements. In one embodiment, the fuse elements are programmed by applying a suitably large current through selected fuse elements to change the resistance of the selected fuse elements. In one embodiment, the resistance is changed from a low value to a high value. In one embodiment, the resistance is changed from a high value to a low value. In one embodiment, the fuse elements are programmed using laser fuse technology to change the resistance of the fuse elements. In various embodiments, the fuse elements function as anti-fuse storage elements.

0029In other embodiments, master key memory <b>46</b> can be other types of Read-Only memory. In one embodiment, master key memory <b>46</b> is an Erasable Programmable Read-Only Memory (EPROM). In one embodiment, master key memory <b>46</b> is an Electronically Erasable Programmable Read-Only Memory (EEPROM). In one embodiment, master key memory <b>46</b> is a Flash Erasable Programmable Read-Only Memory (FEPROM). In one embodiment, master key memory <b>46</b> is a One Time Programmable Read-Only Memory (OTPROM). In one embodiment, master key memory <b>46</b> is a Nitrided Read-Only Memory (NROM).

0030In the illustrated embodiment, encryption and decryption engine <b>36</b> is coupled to controller processor <b>40</b> via data line or lines <b>48</b> and is coupled to data path manager <b>28</b> via data line or lines <b>34</b>. Encryption and decryption engine <b>36</b> is configured to use encryption algorithms to encrypt and decrypt the encryption keys using the master encryption key. Encryption and decryption engine <b>36</b> is also configured to encrypt and decrypt data using one or more of the encryption keys.

0031In the exemplary embodiment, encryption and decryption engine <b>36</b> stores one or more encryption algorithms and uses the algorithms to encrypt the encryption keys using the master key and encrypt data using the encryption keys. Encryption and decryption engine <b>36</b> decrypts the encryption keys using the master encryption key and decrypts the data using the encryption keys. In one embodiment, encryption and decryption engine <b>36</b> is configured to implement one or more symmetrical encryption algorithms based on the master encryption key and the encryption keys. In various embodiments, encryption and decryption engine <b>36</b> can be implemented in hardware or software.

0032In one embodiment, encryption and decryption engine <b>36</b> uses Content Protection for Recordable Media (CPRM) encryption algorithms. CPRM utilizes secret encryption keys which are known only to authorized users. Controller processor <b>40</b> controls the execution of the CPRM algorithms per the CPRM specification. CPRM provides copy protection for recordable media and uses Cryptioneria Cipher (C2) with 56-bit encryption keys. CPRM uses a unique encryption key for each device having recorded media. The unique encryption key can be used to prevent copying or to provide an identification process which must be performed before data protected by CPRM can be transferred from the recorded media or memory storage device <b>18</b>. Encryption and decryption engine <b>36</b> is configured to use C2 to encrypt the CPRM encryption keys and the data.

0033In one embodiment, encryption and decryption engine <b>36</b> uses the Data Encryption Standard (DES). DES was developed and promulgated by the National Bureau of Standards. With DES, information is encoded in 64-bit blocks using a single 56-bit key, as described in National Bureau of Standards' Federal Information Processing Standards Publication <b>46</b>, “Data Encryption Standard,” National Bureau of Standards (1977). In this embodiment, controller processor <b>40</b> controls the encryption and decryption of data in accordance with DES. With DES, the data is encoded in 64-bit blocks using a 56-bit key, and encryption keys are encoded in 64-bit blocks using a 56-bit master key.

0034In other embodiments, encryption and decryption engine <b>36</b> uses other suitable encryption standards or algorithms. One approach uses two keys, one for encrypting the data, and one for decrypting the data. This approach is termed a public key system because one set of encryption keys can be made public and are used to encrypt the data stored in memory storage device <b>18</b>, and another set of encryption keys which are encrypted using the master encryption key are kept secret and are used to decrypt the data. In one embodiment, the public key system is the RSA algorithm, which is named after the inventors Rivest, Shamer, and Adelman. The RSA approach is described in U.S. Pat. No. 4,405,829. In other embodiments, other suitable encryption algorithms can be used.

0035In the illustrated embodiment, controller processor <b>40</b> is coupled to encryption and decryption engine <b>36</b> via one or more data lines <b>48</b>, and is coupled to data path manager <b>28</b> via one or more data lines <b>38</b>. One or more address/control lines <b>42</b> are coupled between host interface <b>24</b>, data path manager <b>28</b>, memory interface <b>32</b>, encryption and decryption engine <b>36</b> and controller processor <b>40</b>. Controller processor <b>40</b> includes a diagnostic port at <b>50</b> which provides a port for running diagnostic tests on information storage device <b>14</b>. In one embodiment, the master encryption key and encryption keys are written to information storage device <b>14</b> via diagnostic port <b>50</b>.

0036In the illustrated embodiment, controller processor <b>40</b> controls the encryption and decryption of the encryption keys using the master encryption key and controls the encryption and decryption of the data using the encryption keys. In one embodiment, the controller processor <b>40</b> is configured to authenticate communication with the host <b>12</b> by decrypting one or more of the encryption keys and comparing the encryption keys to a password or other token such as a random number provided by the host <b>12</b>. Communication is authenticated with the host <b>12</b> if the decrypted encryption keys and the password or token have a predetermined relationship. In one embodiment, the predetermined relationship is equivalency on a bit-by-bit basis. In one embodiment, controller processor <b>40</b> authenticates communication with host <b>12</b> if predetermined data stored in memory storage device <b>18</b> has a predetermined state. In various embodiments, the host <b>12</b> can authenticate the information storage device <b>14</b>, or the information storage device <b>14</b> can authenticate the host <b>12</b>.

0037In the illustrated embodiment, data path manager <b>28</b> is coupled to the host interface <b>24</b> via one or more data lines <b>26</b>, and is coupled to the memory interface <b>32</b> via one or more data lines <b>30</b>. Data path manager <b>28</b> is coupled to the controller processor <b>40</b> via one or more data lines <b>38</b>, and is coupled to encryption and decryption engine <b>36</b> via one or more data lines <b>34</b>. Data path manager <b>28</b> is configured to manage communication of the unencrypted and encrypted data and the unencrypted and encrypted keys, between the host <b>12</b>, the memory storage device <b>18</b>, the controller processor <b>40</b> and the encryption and decryption engine <b>36</b>.

0038In the illustrated embodiment, the encryption keys are encrypted by the encryption and decryption engine <b>36</b> using the master encryption key. The master encryption key is read from master key memory <b>46</b> by the controller processor <b>40</b> and is transferred to encryption and decryption engine <b>36</b>. The encryption keys are encrypted by encryption and decryption engine <b>36</b> using the master encryption key and are stored in memory storage device <b>18</b>. Encryption and decryption engine <b>36</b> transfers the encrypted encryption keys to memory storage device <b>18</b> via data path manager <b>28</b> and memory interface <b>32</b>. In one embodiment, the encryption keys are provided to encryption and decryption engine <b>36</b> via port <b>50</b> on controller processor <b>40</b>. In one embodiment, the encryption keys are transferred to the encryption and decryption engine <b>36</b> from the host <b>12</b> via host interface <b>24</b>, data path manager <b>28</b> and controller processor <b>40</b>. In one embodiment, the encryption keys are read from memory storage device <b>18</b> and are transferred to encryption and decryption engine <b>36</b> via memory interface <b>32</b>, data path manager <b>28</b> and controller processor <b>40</b>.

0039In the illustrated embodiment, the encrypted encryption keys are decrypted by encryption and decryption engine <b>36</b> using the master encryption key. The master key is read from master key memory <b>46</b> by controller processor <b>40</b> and is transferred to encryption and decryption engine <b>36</b>. The encrypted encryption keys are read from memory storage device <b>18</b> and are transferred to encryption and decryption engine <b>36</b> via memory interface <b>32</b> and data path manager <b>28</b>. Encryption and decryption engine <b>36</b> decrypts the encryption keys using the master key and transfers the decrypted encryption keys to controller processor <b>40</b>.

0040In the illustrated embodiment, data is encrypted by encryption and decryption engine <b>36</b> using the decrypted encryption keys. The encryption keys are transferred from controller processor <b>40</b> to encryption and decryption engine <b>36</b>. The data is encrypted by encryption and decryption engine <b>36</b> and is stored in memory storage device <b>18</b>. Encryption and decryption engine <b>36</b> transfers the encrypted data to memory storage device <b>18</b> via data path manager <b>28</b> and memory interface <b>32</b>. In one embodiment, the data is transferred to encryption and decryption engine <b>36</b> from host <b>12</b> via host interface <b>24</b>, data path manager <b>28</b> and controller processor <b>40</b>. In one embodiment, the data is read from memory storage device <b>18</b> and is transferred to encryption and decryption engine <b>36</b> from memory storage device <b>18</b> via memory interface <b>32</b>, data path manager <b>28</b> and controller processor <b>40</b>.

0041In the illustrated embodiment, the encrypted data is decrypted by encryption and decryption engine <b>36</b> using the encryption keys. The encrypted encryption keys are decrypted as described above and are provided by controller processor <b>40</b> to encryption and decryption engine <b>36</b>. The encrypted data is read from memory storage device <b>18</b> and is transferred to encryption and decryption engine <b>36</b> via memory interface <b>32</b> and data path manager <b>28</b>. Encryption and decryption engine <b>36</b> decrypts the data using the encryption keys and provides the decrypted data to controller processor <b>40</b>. In one embodiment, controller processor <b>40</b> provides the data to host <b>12</b> via data path manager <b>28</b> and host interface <b>24</b>. In one embodiment, controller processor <b>40</b> provides the data to memory storage device <b>18</b> via data path manager <b>28</b> and memory interface <b>32</b>, and stores the data in memory storage device <b>18</b>. In one embodiment, the data includes computer readable instructions which can be executed by controller processor <b>40</b>.

0042<figref idref="DRAWINGS">FIG. 2</figref> is a diagram illustrating exemplary embodiments of a magnetic memory <b>118</b> and a magnetic memory <b>146</b> according to the present invention. The magnetic memory <b>118</b>/<b>146</b> includes an array <b>60</b> of magnetic memory cells <b>62</b> which are arranged in rows and columns, with the rows extending along an x-direction and the columns extending along a y-direction. Only a relatively small number of magnetic memory cells <b>62</b> are shown to simplify the description of the invention. In other embodiments, the array <b>60</b> is any suitable size. In other embodiments, the array <b>60</b> can utilize highly parallel modes of operation, such as 64-bit wide or 128-bit wide operation.

0043In one embodiment, word lines <b>64</b> extend along the x-direction in a plane on one side of array <b>60</b> and bit lines <b>66</b> extend along the y-direction in a plane on an adjacent side of array <b>60</b>. In one embodiment, there is one word line <b>64</b> for each row of array <b>60</b> and one bit line <b>66</b> for each column of array <b>60</b>. In the embodiment illustrated in <figref idref="DRAWINGS">FIG. 2</figref>, each magnetic memory cell <b>62</b> is located at an intersection or cross point of a word line <b>64</b> and a bit line <b>66</b>.

0044The magnetic memory cells <b>62</b> are not limited to any particular type of device. Magnetic memory cells <b>62</b> may be, for example, spin dependent tunneling junction devices, anisotropic magnetoresistance devices, giant magnetoresistance devices, colossal magnetoresistance devices, extraordinary magnetoresistance devices or very large magnetoresistance devices.

0045In the exemplary embodiment, magnetic memory <b>18</b> includes a row decoder <b>68</b>, steering circuits <b>70</b> and a control circuit <b>72</b>. Decoder <b>68</b> and steering circuits <b>70</b> select word lines <b>64</b> and bit lines <b>66</b> during read and write operations. During write operations, control circuit <b>72</b> controls a write circuit which sets the orientation of the magnetization of selected memory cells <b>62</b> (see also, <figref idref="DRAWINGS">FIGS. 3A, 3B</figref> and <b>4</b>). The write circuit is not shown in order to simplify the explanation of the invention.

0046Sense amplifiers <b>74</b> sense the resistance of selected memory cells <b>62</b> during read operations. A memory cell <b>62</b> is selected by supplying a row address Ax to the decode circuit <b>68</b> and a column address Ay to steering circuits <b>70</b>. In response to the row address Ax, the decode circuit <b>68</b> couples one end of a selected word line <b>64</b> to ground. In response to the column address Ay, a steering circuit <b>70</b> couples a bit line <b>66</b> to a sense amplifier <b>74</b>. A selected memory cell <b>62</b> lies at the cross point of the selected word and bit lines <b>64</b> and <b>66</b>.

0047In the exemplary embodiment, each steering circuit <b>70</b> includes a set of switches that connect each bit line <b>66</b> to either a constant voltage source or to a sense amplifier <b>74</b>. Each steering circuit <b>70</b> further includes a column decoder. The column decoder selects only one switch for connecting the selected bit line <b>66</b> to the sense amplifier <b>74</b>. All other unselected bit lines <b>66</b> are typically connected to a constant voltage source.

0048<figref idref="DRAWINGS">FIGS. 3A and 3B</figref> are diagrams illustrating parallel and anti-parallel magnetization of a magnetic memory cell. In one embodiment, magnetic memory cell <b>62</b> is a spin dependent tunneling device. Magnetic memory cell <b>62</b> includes a magnetic layer referred to as data storage layer <b>80</b>, a magnetic layer referred to as reference layer <b>82</b>, and a tunnel barrier <b>84</b> disposed between data storage layer <b>80</b> and reference layer <b>82</b>. Data storage layer <b>80</b> is referred to as a free layer because it has a magnetization orientation that is not pinned and which can be oriented in either of two directions along an easy axis, which lies in a plane. Reference layer <b>82</b> is referred to as a pinned layer because it has a magnetization that is oriented in a plane but is fixed so as not to rotate in the presence of an applied magnetic field within a range of interest. The magnetization orientation assumes one of two stable orientations at any given time, which are the parallel and anti-parallel orientations.

0049<figref idref="DRAWINGS">FIG. 3A</figref> illustrates by arrows the parallel orientation when the magnetization of the free and pinned layers <b>80</b> and <b>82</b> are in the same direction along the easy axis. With parallel orientation, the orientation of magnetization in the data storage layer <b>80</b> is substantially parallel to the magnetization in the reference layer <b>82</b> along the easy axis, and magnetic memory cell <b>62</b> is in a low resistance state which can be represented by the value R. <figref idref="DRAWINGS">FIG. 3B</figref> illustrates by arrows the anti-parallel orientation when the magnetization of the free and pinned layers <b>80</b> and <b>82</b> are in opposite directions. With anti-parallel orientation, the orientation of magnetization in the data storage layer <b>80</b> is substantially anti-parallel to the magnetization in the reference layer <b>82</b> along the easy axis, and magnetic memory cell <b>62</b> is in a high resistance state which can be represented by the value R+ΔR. The insulating tunnel barrier <b>84</b> allows quantum mechanical tunneling to occur between the free and pinned layers <b>80</b> and <b>82</b>. Because the tunneling is electron spin dependent, the resistance of magnetic memory cell <b>62</b> is a function of the relative orientations of the magnetization of the free and pinned layers <b>80</b> and <b>82</b>.

0050Data is stored in magnetic memory cell <b>62</b> by orienting the magnetization along the easy axis of free layer <b>80</b>. In one embodiment, a logic value of “0” is stored in magnetic memory cell <b>62</b> by orienting the magnetization of free layer <b>80</b> such that the magnetization orientation is parallel, and a logic value of “1” is stored in magnetic memory cell <b>62</b> by orienting the magnetization of free layer <b>80</b> such that the magnetization orientation is anti-parallel. In another embodiment, a logic value of “1” is stored in magnetic memory cell <b>62</b> by orienting the magnetization of free layer <b>80</b> such that the magnetization orientation is parallel, and a logic value of “0” is stored in magnetic memory cell <b>62</b> by orienting the magnetization of free layer <b>80</b> such that the magnetization orientation is anti-parallel.

0051<figref idref="DRAWINGS">FIG. 4</figref> is a diagram illustrating a magnetic memory cell <b>62</b> that has been selected. In one embodiment, the magnetization in free layer <b>80</b> of selected magnetic memory cell <b>62</b> is oriented by supplying the currents Ix and Iy to conductors <b>64</b> and <b>66</b>, which cross the selected magnetic memory cell <b>62</b>. Supplying the current Ix to word line <b>64</b> causes a magnetic field Hy to form around conductor <b>64</b>. Supplying the current Iy to bit line <b>66</b> causes a magnetic field Hx to form around bit line <b>66</b>. When sufficiently large currents Ix and Iy are passed through word line <b>64</b> and bit line <b>66</b>, the magnetic fields Hx and Hy in the vicinity of free layer <b>80</b> cause the magnetization of free layer <b>80</b> to rotate from the parallel orientation to the anti-parallel orientation, or to rotate from the anti-parallel orientation to the parallel orientation.

0052In one embodiment, a magnetic memory cell <b>62</b> is read by applying sense currents to word line <b>64</b> and bit line <b>66</b>. Magnetic memory cell <b>62</b> will have either a resistance of R or a resistance of R+ΔR, depending on whether the orientation of magnetization of the free and pinned layers <b>80</b> and <b>82</b> are parallel or anti-parallel, as illustrated in <figref idref="DRAWINGS">FIGS. 3A and 3B</figref>.

0053<figref idref="DRAWINGS">FIG. 5</figref> illustrates at <b>70</b> a side cross-sectional view illustrating exemplary embodiments of an ARS memory <b>218</b> and an ARS memory <b>246</b> used in information storage device <b>14</b>. ARS memory <b>218</b>/<b>246</b> includes a number of electron emitters, such as electron emitters <b>92</b> and <b>96</b>, storage medium <b>98</b> including a number of storage areas, such as storage area <b>100</b>, and micromover <b>102</b>. Micromover <b>102</b> scans storage medium <b>98</b> with respect to the electron emitters or vice versa. Each storage area is responsible for storing one or more bits of information.

0054In one embodiment, the electron emitters are point emitters having very sharp points. Alternatively, other electron emitters having any suitable shape may be used (e.g., flat or planar electron emitters). Each point emitter can have a radius of curvature in the range of approximately one nanometer to hundreds of nanometers. During operation, a pre-selected potential difference is applied between an electron emitter and its corresponding gate, such as between electron emitter <b>92</b> and gate <b>94</b> surrounding it. Due to the sharp point of the emitter, an electron beam current is extracted from the emitter towards the storage area. Depending on the distance between the emitters and the storage medium <b>98</b>, the type of emitters, and the spot size (bit size) required, electron optics may be utilized to focus the electron beams. A voltage may also be applied to the storage medium <b>98</b> to accelerate the emitted electrons and to aid in focusing the emitted electrons.

0055In one embodiment, casing <b>112</b> maintains storage medium <b>98</b> in a partial vacuum, such as at least 10⁻⁵torr. It is known in the art to fabricate such types of microfabricated electron emitters in vacuum cavities using semiconductor processing techniques. See, for example, “Silicon Field Emission Transistors and Diodes,” by Jones, published in IEEE Transactions on Components, Hybrids and Manufacturing Technology, 15, page 1051, 1992.

0056In the embodiment illustrated in <figref idref="DRAWINGS">FIG. 5</figref>, each electron emitter has a corresponding storage area. In another embodiment, each electron emitter is responsible for a number of storage areas. As micromover <b>102</b> scans storage medium <b>98</b> to different locations, each emitter is positioned above different storage areas. With micromover <b>102</b>, an array of electron emitters can scan over storage medium <b>98</b>.

0057In various embodiments, the electron emitters read and write information on the storage areas by means of the electron beams they produce. Thus, electron emitters suitable for use in ARS memory <b>218</b>/<b>246</b> are the type that can produce electron beams that are narrow enough to achieve the desired bit density on the storage medium and which can provide the different power densities of the beams needed for reading from and writing to the medium. A variety of approaches are known in the art that are suitable to make such electron emitters. For example, one method is disclosed in “Physical Properties of Thin-Film Field Emission Cathodes with Molybdenum Cones,” by Spindt et al, published in the Journal of Applied Physics, Vol. 47, No. 12, December 1976. Another method is disclosed in “Fabrication and Characteristics of Si Field Emitter Arrays,” by Betsui, published in Tech. Digest 4^thInt. Vacuum Microelectronics Conf., Nagahama, Japan, page 26, 1991.

0058In one embodiment, there can be a two-dimensional array of emitters, such as 100 by 100 emitters, with an emitter pitch of 5 to 50 micrometers in both the X and the Y directions. Each emitter may access tens of thousands to hundreds of millions of storage areas. For example, the emitters scan over the storage areas with a periodicity of about 1 to 100 nanometers between any two storage areas. Also, the emitters may be addressed simultaneously or sequentially in a multiplexed manner. Such a parallel accessing scheme significantly increases the data rate of the storage device.

0059<figref idref="DRAWINGS">FIG. 6</figref> illustrates a top view of storage medium <b>98</b> which includes a two-dimensional array of storage areas and a two-dimensional array of emitters. Addressing the storage areas requires external circuits. One embodiment to reduce the number of external circuits is to separate the storage medium into rows, such as rows <b>120</b> and <b>122</b>, where each row contains a number of storage areas. Each emitter is responsible for a number of rows. However, in this embodiment, each emitter is not responsible for the entire length of the rows. For example, emitter <b>92</b> is responsible for the storage areas within rows <b>120</b> through <b>122</b>, and within columns <b>124</b> through <b>126</b>. All rows of storage areas accessed by one emitter are connected to one external circuit. To address a storage area, the emitter responsible for the particular storage area is activated and moved by micromover <b>102</b> (illustrated in <figref idref="DRAWINGS">FIG. 5</figref>) to the storage area. The external circuit connected to the rows of storage areas within which the particular storage area lies is activated.

0060In various embodiments, micromover <b>102</b> can also be made in a variety of ways, as long as it has sufficient range and resolution to position the electron emitters over the storage areas. In one embodiment, micromover <b>102</b> is fabricated by standard semiconductor microfabrication processes and scans storage medium <b>98</b> in the X and Y directions with respect to casing <b>112</b>.

0061<figref idref="DRAWINGS">FIG. 7</figref> illustrates a top view of cross section <b>7</b>-<b>7</b> in <figref idref="DRAWINGS">FIG. 5</figref>. <figref idref="DRAWINGS">FIG. 5</figref> illustrates storage medium <b>98</b> being held by two sets of thin-walled microfabricated beams. The faces of the first set of thin-walled beams are in the Y-Z plane as illustrated at <b>104</b> and <b>106</b>. Thin-walled beams <b>104</b> and <b>106</b> may be flexed in the X direction allowing storage medium <b>98</b> to move in the X direction with respect to casing <b>112</b>. The faces of the second set of thin-walled beams are in the X-Z plane as illustrated at <b>108</b> and <b>110</b>. Thin-walled beams <b>108</b> and <b>110</b> allow storage medium <b>98</b> to move in the Y direction with respect to casing <b>112</b>. Storage medium <b>98</b> is held by the first set of beams, which are connected to frame <b>114</b>. Frame <b>114</b> is held by the second set of beams, which are connected to casing <b>112</b>. The electron emitters scan over storage medium <b>98</b>, or storage medium <b>98</b> scans over the electron emitters in the X-Y directions by electrostatic, electromagnetic, piezoelectric, or other means known in the art. In this example, micromover <b>102</b> moves storage medium <b>98</b> relative to the electron emitters. A general discussion of suitable microfabricated micromovers can be found, for example, in “Novel Polysilicon Comb Actuators for XY-Stages,” published in the Proceeding of MicroElectro Mechanical Systems 1992, written by Jaecklin et al.; and in “Silicon Micromechanics: Sensors and Actuators on a Chip”, by Howe et al., published in IEEE Spectrum, page 29, in July 1990.

0062In other embodiments, the electron beam currents are rastered over the surface of storage medium <b>98</b> by either electrostatically or electromagnetically deflecting them, such as by electrostatic deflectors or electrodes <b>116</b> (illustrated in <figref idref="DRAWINGS">FIG. 5</figref>) which are positioned adjacent to emitter <b>96</b>. Many different approaches to deflecting electron beams are known in the art and can be found in literature on Scanning Electron Microscopy.

0063In one embodiment, writing is accomplished by temporarily increasing the power density of the electron beam current to modify the surface state of the storage area. Reading is accomplished by observing the effect of the storage area on the electron beam, or the effect of the electron beam on the storage area. In one embodiment, a storage area that has been modified can represent a logic value of “1”, and a storage area that has not been modified can represent a logic value of “0”. In one embodiment, a storage area that has been modified can represent a logic value of “0”, and a storage area that has not been modified can represent a logic value of “1”. In other embodiments, the storage area can be modified to different degrees to represent more than two bits. In other embodiments, the modifications can be permanent, or can be reversible. The permanently modified storage medium is suitable for write-once-read-many memory (WORM) applications.

0064In one embodiment, the basic approach is to alter the structure of the storage area in such a way as to vary its secondary electron emission coefficient (SEEC), its back-scattered electron coefficient (BEC), or the collection efficiency for secondary or back-scattered electrons emanating from the storage area. The SEEC is defined as the number of secondary electrons generated from the medium for each electron incident onto the surface of the medium. The BEC is defined as the fraction of the incident electrons that are scattered back from the medium. The collection efficiency for secondary/back-scattered electrons is the fraction of the secondary/back-scattered electrons that are collected by an electron collector and typically registered in the form of a current.

0065In various embodiments, reading is accomplished by collecting the secondary and/or back-scattered electrons when an electron beam with a lower power density is applied to storage medium <b>98</b>. During reading, the power density of the electron beam should be kept low enough so that no further writing occurs.

0066One embodiment of storage medium <b>98</b> includes a material whose structural state can be changed from crystalline to amorphous by electron beams. The amorphous state has a different SEEC and BEC than the crystalline state, which leads to a different number of secondary and back-scattered electrons emitted from the storage area. By measuring the number of secondary and back-scattered electrons, the state of the storage area can be determined. To change the storage area from the amorphous to crystalline state, the beam power density is increased and then slowly decreased. This heats up the amorphous storage area material and then slowly cools it so that the area has time to anneal into the crystalline state. To change from the crystalline to the amorphous state, the beam power density is increased to a high level and then rapidly decreased. To read from the storage medium, a lower-energy beam strikes the storage area. In various embodiments, materials such as germanium telluride (GeTe) or ternary alloys based on GeTe can be used. Similar methods to modify states using laser beams as the heating source have been described in “Laser-induced Crystallization of Amorphous GeTe: A Time-Resolved Study,” by Huber and Marinero, published in Physics Review B 36, page 1595, in 1987, and will not be further described here.

0067In various embodiments, there are many approaches to induce a state change in storage medium <b>98</b>. In one embodiment, a change in the topography of the medium, such as a hole or bump, will modify the SEEC and BEC of the storage medium. This modification occurs because the coefficients typically depend on the incident angle of the electron beam onto the storage area. In various embodiments, changes in material properties, band structure, and crystallography may also affect the coefficients. Because the BEC depends on an atomic number, Z, in various embodiments the storage medium has a layer of low Z material on top of a layer of high Z material or vice versa, with writing accomplished through ablating a portion of the top layer by an electron beam.

0068<figref idref="DRAWINGS">FIG. 8</figref> shows schematically the electron emitters reading from storage medium <b>98</b>. In the embodiment illustrated in <figref idref="DRAWINGS">FIG. 8</figref>, the state of storage area <b>128</b> has been altered, while the state of storage area <b>100</b> has not been altered. When electrons bombard a storage area, both secondary electrons and back-scattered electrons will be collected by the electron collectors, such as electron collector <b>130</b>. An area that has been modified will produce a different number of secondary electrons and back-scattered electrons, as compared to an area that has not been modified. The difference may be more or may be less depending on the type of material and the type of modification. By monitoring the magnitude of the signal collected by electron collectors <b>130</b>, the state of the bit stored in the storage area can be identified.

0069<figref idref="DRAWINGS">FIG. 9</figref> illustrates an embodiment wherein a diode structure is used to determine the state of the storage areas. According to this embodiment, the storage medium <b>136</b> is configured as a diode which can, for example, comprise a p-n junction, a schottky barrier, or any other suitable type of electronic valve. <figref idref="DRAWINGS">FIG. 9</figref> illustrates an example configuration of such a storage medium <b>136</b>. In other embodiments, alternative diode arrangements (such as those illustrated in U.S. Pat. No. 5,557,596) can be used. As indicated in this figure, the storage medium <b>136</b> is arranged as a diode having two layers <b>138</b> and <b>140</b>. By way of example, one of the layers is p type and the other is n type. The storage medium <b>136</b> is connected to an external circuit <b>142</b> that reverse-biases the storage medium. With this arrangement, bits are stored by locally modifying the storage medium <b>136</b> in such a way that collection efficiency for minority carriers generated by a modified region <b>148</b> is different from that of an unmodified region <b>144</b>. The collection efficiency for minority carriers can be defined as the fraction of minority carriers generated by the instant electrons that are swept across a diode junction <b>150</b> of the storage medium <b>136</b> when the medium is biased by the external circuit <b>142</b> to cause a current to flow through the external circuit.

0070In use, the electron emitters <b>134</b> emit narrow beams <b>152</b> of electrons onto the surface of the storage medium <b>136</b> that excite electron-hole pairs near the surface of the medium. Because the medium <b>136</b> is reverse-biased by the external circuit <b>142</b>, the minority carriers that are generated by the incident electrons are swept toward the diode junction <b>150</b>. Minority carriers that do not recombine with majority carriers before reaching the junction <b>150</b> are swept across the junction, causing a current flow in the external circuit <b>142</b>.

0071As described above, writing is accomplished by sufficiently increasing the power density of the electron beams to locally alter the physical properties of the storage medium <b>136</b>. When the medium <b>136</b> is configured as illustrated in <figref idref="DRAWINGS">FIG. 9</figref>, this alteration affects the number of minority carriers swept across the junction <b>150</b> when the same area is radiated with a lower power density read electron beam. For instance, the recombination rate in a written (i.e., modified) area <b>148</b> could be increased relative to an unwritten (i.e., unmodified) area <b>144</b> so that the minority carriers generated in the written area have an increased probability of recombining with majority carriers before they have a chance to reach and cross junction <b>150</b>. Hence, a smaller current flows in external circuit <b>142</b> when the read electron beam is incident upon the written area <b>148</b> than when it is incident upon an unwritten area <b>144</b>. Conversely, it is also possible to start with a diode structure having a high recombination rate and then writing the bits by locally reducing the recombination rate. In either case, the magnitude of the current resulting from the minority carriers depends upon the state of the particular storage area.

0072<figref idref="DRAWINGS">FIG. 10</figref> is a diagram illustrating a first exemplary embodiment of memory allocation. The first exemplary embodiment is illustrated at <b>150</b>. Memory storage device <b>18</b> is partitioned into a first address area illustrated at <b>152</b> and a second address area illustrated at <b>154</b>. The first area <b>152</b> is a secure area and the second area <b>154</b> is allocated for user data and other system functions. In one embodiment, the first area <b>152</b> is accessible by the controller processor <b>40</b> and the second area <b>154</b> is accessible by the host <b>12</b>. In one embodiment, the encrypted encryption keys and encrypted data are stored in the first area <b>152</b>. In one embodiment, the encrypted encryption keys are stored in the first area <b>152</b> and the encrypted data and data that is not encrypted is stored in the second area <b>154</b>. In one embodiment, the encrypted encryption keys are stored in the first area <b>152</b> and the encrypted data is stored in the first area <b>152</b> and the second area <b>154</b>. In the exemplary embodiment, the first area <b>152</b> corresponds to a block of memory addresses within memory storage device <b>18</b> which are allocated for the first area <b>152</b>. The second area <b>154</b> corresponds to a block of memory addresses within memory storage device <b>18</b> which are allocated for the second area <b>154</b>.

0073<figref idref="DRAWINGS">FIG. 11</figref> is a diagram illustrating a second exemplary embodiment of memory allocation. The second exemplary embodiment is illustrated at <b>160</b>. The first address areas or secure areas are illustrated at <b>162</b> and the second address areas for user data and other system functions are illustrated at <b>164</b>. In one embodiment, the first areas are accessible by the controller processor <b>40</b> and the second areas are accessible by the host <b>12</b>. In one embodiment, the encrypted encryption keys and encrypted data are stored in the first areas <b>162</b>. In one embodiment, the encrypted encryption keys are stored in the first areas <b>162</b> and the encrypted data is stored in the second areas <b>164</b>; In one embodiment, the encrypted encryption keys are stored in the first areas <b>162</b> and the encrypted data is stored in the first areas <b>162</b> and the second areas <b>164</b>.

0074In one embodiment, the first areas illustrated at <b>162</b><i>a, </i><b>162</b><i>b, </i><b>162</b><i>c, </i><b>162</b><i>d </i>and <b>162</b><i>e </i>are blocks of memory addresses which are located at predetermined address locations within memory storage device <b>18</b>. In this embodiment, there can be any suitable number of predetermined address locations, and the memory address blocks at each location <b>162</b> can be any suitable size. The second areas illustrated at <b>164</b><i>a, </i><b>164</b><i>b, </i><b>164</b><i>c, </i><b>164</b><i>d, </i><b>164</b><i>e </i>and <b>164</b><i>f </i>are blocks of memory addresses which are located between or next to first areas <b>162</b>.

0075In one embodiment, the first areas at <b>162</b> are located at one or more random address locations within memory storage device <b>18</b>. In this embodiment, the address locations at <b>162</b><i>a, </i><b>162</b><i>b, </i><b>162</b><i>c, </i><b>162</b><i>d, </i>and <b>162</b><i>e </i>are chosen randomly. In this embodiment, there can be any suitable number of random address locations, and the memory address blocks at each location <b>162</b> can be any suitable size. The second areas illustrated at <b>164</b><i>a, </i><b>164</b><i>b, </i><b>164</b><i>c, </i><b>164</b><i>d, </i><b>164</b><i>e </i>and <b>164</b><i>f </i>are blocks of memory addresses which are located between or next to the first areas at <b>162</b>.

0076<figref idref="DRAWINGS">FIG. 12</figref> is a flowchart illustrating an exemplary embodiment of a method of encrypting encryption keys using a master encryption key in an information storage device <b>14</b>. The flowchart is illustrated at <b>170</b>. The method at <b>172</b> provides the encryption keys to the information storage device <b>14</b>. In one embodiment, the encryption keys are provided to the information storage device <b>14</b> via diagnostic port <b>50</b>. In other embodiments, the encryption keys are provided to the information storage device <b>14</b> from the memory storage device <b>18</b>, the host <b>12</b> or from other suitable sources. In the exemplary embodiment, the master key memory <b>46</b> is a first non-volatile memory and the memory storage device <b>18</b> is a second non-volatile memory. The method at <b>174</b> reads a master encryption key from the first non-volatile memory. The method at <b>176</b> selects one of the encryption keys to be encrypted. The method at <b>178</b> encrypts the encryption key using the master encryption key. The method at <b>180</b> determines if all of the encryption keys have been encrypted. If all of the encryption keys have not been encrypted, the method at <b>182</b> selects another encryption key to be encrypted and goes back to the method at <b>178</b>. If the method at <b>180</b> determines that all of the encryption keys have been encrypted, the method at <b>184</b> writes the encrypted keys to the memory second non-volatile memory.

0077In various embodiments, the method at <b>170</b> provides a means for encrypting the encryption keys using a master encryption key and storing the encrypted encryption keys in memory storage device <b>18</b>. In one embodiment, the method at <b>170</b> is performed when the information storage device <b>14</b> is manufactured. In one embodiment, the encrypted encryption keys can be written to memory storage device <b>18</b> the first time that memory storage device <b>18</b> is written. In other embodiments, the method at <b>170</b> can be preformed at other suitable times. In other embodiments, the keys are encrypted simultaneously with two or more of the keys being encrypted at a time.

0078<figref idref="DRAWINGS">FIG. 13</figref> is a flowchart illustrating an exemplary embodiment of a method of decrypting encryption keys in an information storage device <b>14</b>. The flowchart is illustrated at <b>190</b>. The method at <b>192</b> reads the encryption keys from memory storage device <b>18</b>. In the exemplary embodiment, memory storage device <b>18</b> is a second non-volatile memory. The method at <b>194</b> reads a master encryption key from master key memory <b>46</b>. In the exemplary embodiment, master key memory <b>46</b> is a first non-volatile memory. The method at <b>196</b> selects one of the encryption keys to be decrypted. The method at <b>198</b> decrypts the encryption key using the master key. The method at <b>200</b> determines if all of the encrypted encryption keys have been decrypted. If all of the encrypted encryption keys have not been decrypted, the method at <b>202</b> selects another encrypted encryption key to be decrypted and goes back to the method at <b>198</b>. If the method at <b>200</b> determines that all of the encrypted encryption keys have been decrypted, the keys are now available for use by controller processor <b>40</b>.

0079In one embodiment, the decrypted encryption keys are used by controller processor <b>40</b> to decrypt the encrypted data. In this embodiment, the encrypted data is read from the second non-volatile memory and decrypted using the keys. In one embodiment, the decrypted encryption keys are used by controller processor <b>40</b> to encrypt the data and write the encrypted data to the second non-volatile memory. In various embodiments, the decrypted encryption keys are used for secure transactions or authentication between information storage device <b>14</b> and host <b>12</b>.

0080In various embodiments, the method at <b>190</b> provides a means for decrypting the encryption keys and for making the decrypted encryption keys available to encrypt or decrypt data. In one embodiment, the method at <b>190</b> is performed each time the information storage device <b>14</b> is powered up or turned on. In one embodiment, the encryption keys are decrypted simultaneously with two or more of the encryption keys being decrypted at a time. In other embodiments, the method at <b>190</b> can be preformed at other suitable times. In one embodiment, once the encrypted encryption keys are decrypted, encrypted data can be read from the second non-volatile memory and decrypted using the encryption keys. In one embodiment, once the encrypted encryption keys are decrypted, data can be encrypted using the encryption keys and written to the second non-volatile memory.