Secure data cartridge

• US 20070101442A1
• Filed: 11/03/2005
• Published: 05/03/2007
• Est. Priority Date: 11/03/2005
• Status: Active Grant

• Current Assignee: Tandberg Data Holdings SARL (Sphere 3D Corporation)
• Original Assignee: ProStor Systems, Inc. (Glassbridge Enterprises, Inc.)
• Inventors: Bondurant, Matthew
• Granted Patent: US 7,493,494 B2
• Time in Patent Office: Days
• US Class Current: 726/34
• CPC Class Codes: G06F 21/16 Program or content traceability, e.g. by watermarking
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00

Abstract

According to the invention, an authorization system for authorizing access to a data cartridge is disclosed. The authorization system includes a code, a data cartridge interface, a fingerprint processor, a password generator, and an authorization engine. The code is obtained from outside the data cartridge. The data cartridge interface is used to read data from the data cartridge, where the data includes first information and a fingerprint. The fingerprint generator generates second information using at least the code. The password generator unlocks the data cartridge using the code and the data. The authorizing engine is coupled to at least one of the password generator or the fingerprint processor. At least some of the data or the second information is compared to authorize the data cartridge.

Claims

1. An authorization system for authorizing access to a data cartridge, the authorization system comprising:

a code obtained from outside the data cartridge;

a data cartridge interface used to read data from the data cartridge, wherein the data includes first information and a fingerprint;

a fingerprint processor that generates second information using at least the code;

a password generator that unlocks the data cartridge using the code and the data; and

an authorizing engine coupled to at least one of the password generator or the fingerprint processor, wherein at least some of the data or the second information is compared to authorize the data cartridge.

2. The authorization system for authorizing access to the data cartridge as recited in claim 1, wherein the first information and the second information are compared to authorize the data cartridge.

3. The authorization system for authorizing access to the data cartridge as recited in claim 1, wherein:

the second information includes a second fingerprint, and

the fingerprint and the second fingerprint are compared to authorize the data cartridge.

4. The authorization system for authorizing access to the data cartridge as recited in claim 1, further comprising a code generator that generates a second code from the code and first information, wherein the second code is used in at least one of generating a password with the password generator.

5. The authorization system for authorizing access to the data cartridge as recited in claim 1, further comprising a code generator that generates a second code from the code and first information, wherein the second code is used along with the second information in unlocking the data cartridge.

6. The authorization system for authorizing access to the data cartridge as recited in claim 1, wherein the data cartridge stores data encrypted, wherein the encryption algorithm is affected by the first information.

7. The authorization system for authorizing access to the data cartridge as recited in claim 1, wherein the code is used for generation of a key.

8. The authorization system for authorizing access to the data cartridge as recited in claim 1, wherein the code is a cryptographic key.

9. The authorization system for authorizing access to the data cartridge as recited in claim 8, wherein the key is a function of a root key.

10. The authorization system for authorizing access to the data cartridge as recited in claim 1, wherein:

the first information comprises third information and second information,

the third information is used by the fingerprint generator to generate a first fingerprint,

the second information is used by the password generator to generate a password, and

the third and second information are different.

11. The authorization system for authorizing access to the data cartridge as recited in claim 10, wherein the third information is accessible from the data cartridge before the password is provided to the data cartridge.

12. The authorization system for authorizing access to the data cartridge as recited in claim 10, wherein the first information includes at least one of:

a defect list of the data cartridge, a model number of the data cartridge, a manufacturer identifier of the data cartridge, a RFID-read code of the data cartridge, or head optimization information of the data cartridge.

13. The authorization system for authorizing access to the data cartridge as recited in claim 1, wherein the data cartridge includes a hard disk drive.

14. The authorization system for authorizing access to the data cartridge as recited in claim 1, wherein a value of the code is affected by at least one of:

an identifier unique to a particular data cartridge, a manufacturer of the data cartridge, or a model of the data cartridge.

15. The authorization system for authorizing access to the data cartridge as recited in claim 1, wherein:

the password generator unlocks the data cartridge by supplying a password to the data cartridge, and

the data cartridge holds a stored password and allows access to data storage portions of the data cartridge when the password corresponds to the stored password.

16. The authorization system for authorizing access to the data cartridge as recited in claim 1, wherein the data cartridge interface uses at least one of the following protocols for communication:

SATA, PATA, SAS, SCSI, USB, Ethernet, BlueTooth, Zigbee, or WiFi.

17. An authorization system for authorizing access to a data cartridge, the authorization system comprising:

a first code obtained from outside the data cartridge;

a data cartridge interface used to read first and second information and a second fingerprint from the data cartridge;

a fingerprint generator that generates a first fingerprint using at least the second information;

a password generator that generates a password to unlocks the data cartridge using at least the second information; and

an authorizing engine coupled to at least one of the password generator or the fingerprint generator, wherein the first and second fingerprints are compared to authorize the data cartridge.

18. The authorization system for authorizing access to the data cartridge as recited in claim 17, further comprising a code generator that generates a second code from the first code and first information, wherein the second code is used in generating at least one of the first fingerprint or the password.

19. The authorization system for authorizing access to the data cartridge as recited in claim 17, wherein the first information is accessible from the data cartridge before the password is provided to the data cartridge.

20. The authorization system for authorizing access to the data cartridge as recited in claim 17, wherein the code is a function of a root key.

21. An authorization system for authorizing access to a data cartridge, the authorization system comprising:

a first code obtained from outside the data cartridge;

a data cartridge interface used to read first and second information and a fingerprint from the data cartridge;

a fingerprint decoder that generates the third information from the fingerprint;

a password generator that unlocks the data cartridge using at least the second information; and

an authorizing engine coupled to at least one of the password generator or the fingerprint generator, wherein the second and third information are compared to authorize the data cartridge.

22. The authorization system for authorizing access to the data cartridge as recited in claim 21, a code generator that generates a second code from the first code and first information, wherein:

the second code is used to generate the third information, and

the second code is used along with the second information in unlocking the data cartridge.

23. A method for authorizing use of a data cartridge with a cartridge drive, the method comprising steps of:

reading first information from the data cartridge;

determining a password from at least one of the first information or a code, wherein the code is obtained from outside the data cartridge;

unlocking the data cartridge with the password;

reading an electronic fingerprint from the data cartridge;

generating second information from the electronic fingerprint;

comparing at least some of the first information and the second information; and

authorizing the data cartridge based, at least in part, on an outcome of the comparing step.

24. The method for authorizing use of the data cartridge with the cartridge drive as recited in claim 23, further comprising steps of:

determining a second electronic fingerprint from the information and the code, and

comparing the electronic fingerprint and the second electronic fingerprint to authorize the data cartridge.

25. The method for authorizing use of the data cartridge with the cartridge drive as recited in claim 23, wherein the code is a cryptographic key.

26. The method for authorizing use of the data cartridge with the cartridge drive as recited in claim 23, further comprising steps of:

programming the password into the data cartridge, whereby subsequent use requires password authentication;

writing the first electronic fingerprint to a logical location on the data cartridge.

27. The method for authorizing use of the data cartridge with the cartridge drive as recited in claim 23, further comprising a step of receiving the code from a remote location after the reading step.

28. The method for authorizing use of the data cartridge with the cartridge drive as recited in claim 23, wherein the code is one of a plurality of codes stored in the cartridge drive before the reading step is performed.

29. The method for authorizing use of the data cartridge with the cartridge drive as recited in claim 23, wherein:

the information comprises first information and second information,

the first information is used in the first-listed determining step,

the second information is used in the second-listed determining step, and

the first and second information are different.

30. A computer-readable medium having computer-executable instructions for performing the computer-implementable method for authorizing use of the data cartridge with the cartridge drive of claim 23.

31. A computer system adapted to perform the computer-implementable method for authorizing use of the data cartridge with the cartridge drive of claim 23.

32. A computer data signal embodied in a carrier wave having computer-executable instructions for performing the computer-implementable method for authorizing use of the data cartridge with the cartridge drive of claim 23.

33. A method for authorizing a data cartridge for use with a cartridge drive, the method comprising steps of:

reading information from the data cartridge;

determining a password from the information and a code, wherein the code is obtained from outside the data cartridge;

programming the password into the data cartridge, whereby subsequent use requires password authentication;

determining a first electronic fingerprint from the information and the code; and

writing the first electronic fingerprint to a logical location on the data cartridge, wherein subsequent use of the data cartridge with a cartridge drive requires providing the password and verifying the first electronic fingerprint.

34. The method for authorizing the data cartridge for use with the cartridge drive as recited in claim 33, wherein the logical location is affected by the information.

35. The method for authorizing the data cartridge for use with the cartridge drive as recited in claim 33, further comprising steps of:

unlocking the data cartridge with the password;

reading the first electronic fingerprint from the data cartridge;

determining a second electronic fingerprint from the information and the code;

comparing the first and second electronic fingerprints; and

authorizing the data cartridge based, at least in part, on an outcome of the comparing step.

36. A computer-readable medium having computer-executable instructions for performing the computer-implementable method for authorizing the data cartridge for use with the cartridge drive of claim 33.

37. A computer system adapted to perform the computer-implementable method for authorizing the data cartridge for use with the cartridge drive of claim 33.