System and method for magnetic storage disposal

• US 20050262361A1
• Filed: 05/24/2004
• Published: 11/24/2005
• Est. Priority Date: 05/24/2004
• Status: Abandoned Application

• Current Assignee: Seagate Technology LLC (Seagate Technology Holdings Plc)
• Original Assignee: Seagate Technology LLC (Seagate Technology Holdings Plc)
• Inventors: Thibadeau, Robert Harwell
• Application Number:
  US10/852,710
• Publication Number:
  US 20050262361A1
• Time in Patent Office: Days
• US Class Current: 713/193
• CPC Class Codes: G06F 21/80 in storage media based on magnetic or optical technology, e.g. disks with sectors preventing unauthorised reproduction or copying of disc-type recordable media G11B20/00

Abstract

A storage system has integrated information security features adapted to interact with a host system. The storage system includes a storage media, controller firmware and a controller. The storage media is adapted to store data. Controller firmware stores a secret. The controller controls data transfers between the host system and the storage media, and is adapted encrypt and decrypt data written to or read from the storage media using an encryption key based on the secret.

Claims

1. A storage system with integrated information security features adapted to interact with a host system, the storage system comprising:

a storage media adapted to store data;

a controller adapted to control data transfers between the host system and the storage media, the controller adapted to encrypt and decrypt data written to or read from the storage media using an encryption key based on a secret.

2. The method of claim 1 wherein the storage system comprises a disc drive.

3. The system of claim 1 wherein the controller uses the encryption key indirectly to encrypt and decrypt data, the system further comprising:

a basic secret;

wherein the controller is adapted to retrieve the basic secret and to combine the basic secret and the secret to produce the encryption key.

4. The system of claim 1 wherein the encryption key comprises a secret, the system further comprising:

a network adapted to issue the secret in a cryptographic envelope according to predetermined parameters.

5. The system of claim 1 wherein the encryption key is derived from a removable token.

6. The system of claim 5 wherein data stored on a portion of the storage media is inaccessible when the removable token is revoked.

7. The system of claim 1 and further comprising:

an authority table defined in a hidden partition on the storage media, the authority table adapted to maintain a list of one or more users or user agents authorized to change the encryption key.

8. A storage device adapted to provide integrated encryption security, the storage device comprising:

a storage media adapted to store data received from a host system; and

a controller within the storage device adapted to control data transfers between the host system and the storage media, the controller adapted to encrypt and decrypt data written to or read from the storage media via a removable token.

9. The storage device of claim 8 wherein the storage device comprises a disc drive.

10. The storage device of claim 8 wherein the removable token comprises:

a physical device token attached to the storage device during use; and

wherein removal of the physical device token renders the storage device inaccessible.

11. The storage device of claim 10 wherein the removable token is a smart card or a USB dongle.

12. The storage device of claim 8 wherein the removable token comprises:

a certificate-type token provided to the storage device by a requesting device, the certificate-type token serves as a credential; and

wherein the certificate-type token is required to access data stored on the storage device.

13. The storage device of claim 12 wherein the credential of the certificate-type token corresponds to an authority record stored in a hidden partition on the storage device.

14. The storage device of claim 12, and further comprising:

a certificate authority in communication with a requesting device, the certificate authority adapted to maintain one or more certificate-type tokens securely and to distribute a certificate-type token upon authentication to each authenticated device.

15. The storage device of claim 8 and further comprising:

a second storage device adapted to connect to a port of the storage device during use;

wherein the second storage device acts as a physical key to unlock data stored on the storage device.

16. A method for securing data on a storage device having a controller and a storage media, the method comprising:

configuring the controller to encrypt data written to the storage media with a symmetric key; and

wherein the symmetric key is known in plaintext to the controller.

17. The method of claim 16 and further comprising:

configuring the controller to decrypt with the symmetric key all data read from the storage media.

18. The method of claim 16 and further comprising:

dynamically loading an encrypted secret from a remote location upon powering on the storage device; and

deriving the symmetric key from the encrypted secret using a secret stored within the storage device.

19. The method of claim 16 wherein the symmetric key comprises a removable token attached to the controller.

20. The method of claim 16 and further comprising:

combining a basic secret stored at a remote location with a secret stored in the storage device to form the symmetric key.

21. The method of claim 16 wherein at least a portion of the symmetric key is stored in a predetermined location, the method further comprising:

deleting the portion of the symmetric key from the predetermined location in order to render inaccessible all the data stored on the storage media.

22. The method of claim 16 wherein at least a portion of the symmetric key is stored in a predetermined location, the method further comprising:

removing the portion of the symmetric key from the predetermined location at predetermined intervals in order to render inaccessible all the data stored on the storage media; and

restoring the portion of the symmetric key from a key store upon authentication of an authorized user.

23. The method of claim 16 wherein the symmetric key comprises:

an encrypted key stored in a remote location and loaded at times of desired use;

a root key stored in the storage device; and

wherein the root key unlocks the encrypted key to derive the symmetric key.

24. A storage system comprising:

a storage media;

a data interface element disposed adjacent to the storage media; and

a controller which interacts with the data interface element to read or write data between the storage media and a host system using an encryption key based on a secret.

25. The storage system of claim 24 wherein the storage system comprises a disc drive.

26. The storage system of claim 24 and further comprising:

controller firmware coupled to the controller;

wherein the secret is stored in the controller firmware.

27. The storage system of claim 24 wherein the controller encrypts data written to and decrypts data read from the storage media using the encryption key.

28. The storage system of claim 27 and further comprising:

a basic secret;

wherein the encryption key comprises a combination of the basic secret and the secret.

29. A storage device comprising:

a storage media;

a data interface element disposed adjacent to the storage media; and

a controller which interacts with the data interface element to read or write data between the storage media and a host system using an encryption key based on a removable token.

30. The storage device of claim 29 wherein the removable token comprises a physical token attached to the storage device during operation.

31. The storage device of claim 29 wherein the removable token comprises a smart card or a USB dongle.

32. The storage device of claim 29 wherein the removable token comprises a certificate-type token provided to the storage device by the host system.

33. The storage device of claim 29 wherein the removable token comprises a second storage device coupled to a port of the storage device during operation.

34. The storage device of claim 29 wherein the storage device comprises a disc drive.

35. A storage device comprising:

a storage media;

a data interface element coupled to the storage media; and

a controller coupled to the data interface element, the controller interacting with the data interface element to read or write data between the storage media and a host system using an encryption key.

36. The storage device of claim 35 wherein the storage device comprises a disc drive.

37. The storage device of claim 35 wherein the encryption key is derived from a secret.

38. The storage device of claim 35 wherein the encryption key is based on a removable token.