Method and apparatus for authenticated data storage

• US 20080114981A1
• Filed: 11/13/2006
• Published: 05/15/2008
• Est. Priority Date: 11/13/2006
• Status: Active Grant

• Current Assignee: Seagate Technology LLC (Seagate Technology Holdings Plc)
• Original Assignee: Seagate Technology LLC (Seagate Technology Holdings Plc)
• Inventors: Hars, Laszlo
• Granted Patent: US 8,356,178 B2
• Time in Patent Office: Days
• US Class Current: 713/170
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 21/80 in storage media based on magnetic or optical technology, e.g. disks with sectors preventing unauthorised reproduction or copying of disc-type recordable media G11B20/00

Abstract

A method includes: computing a first message authentication code for each of a plurality of sets of data blocks on a data storage medium, and authenticating the sets of data blocks by computing a second message authentication code for each of the sets of data blocks to be authenticated and comparing the first and second message authentication codes. An apparatus that performs the method is also provided.

Claims

1. A method comprising:

computing a first message authentication code for each of a plurality of sets of data blocks on a data storage medium; and

authenticating the sets of data blocks by computing a second message authentication code for each of the sets of data blocks to be authenticated and comparing the first and second message authentication codes.

2. The method of claim 1, wherein each of the sets of data blocks contains data in one track of a disc storage medium.

3. The method of claim 1, wherein the sets 6f data blocks are deemed to have been changed if the first and second message authentication codes are different.

4. The method of claim 1, further comprising:

storing the first message authentication codes in a nonvolatile memory.

5. The method of claim 1, further comprising:

computing additional message authentication codes for groups of the first message authentication codes.

6. The method of claim 5, further comprising:

organizing the first message authentication codes and the additional message authentication codes in a tree structure.

7. The method of claim 1, wherein the first message authentication codes comprise a Galois Message Authentication Code.

8. The method of claim 1, wherein the first message authentication codes comprise hash function-based message authentication codes, one-key message authentication codes, or parallelizable message authentication codes.

9. The method of claim 1, further comprising:

warning a user if an authentication failure occurs.

10. The method of claim 1, wherein the first message authentication codes are computed using a key, input data, and previously stored data blocks in one of the sets of data blocks.

11. The method of claim 1, wherein the authenticating step is performed as a background process when a storage device containing the storage medium is idle.

12. An apparatus comprising:

a processor for computing a first message authentication code for each of a plurality of sets of data blocks on a data storage medium, and for authenticating the sets of data blocks by computing a second message authentication code for each of the sets of data blocks to be authenticated and comparing the first and second message authentication codes.

13. The apparatus of claim 12, wherein each of the sets of data blocks contains data in one track of a disc storage medium.

14. The apparatus of claim 12, wherein the sets of data blocks are deemed to have been changed if the first and second message authentication codes are different.

15. The apparatus of claim 12, further comprising:

a nonvolatile memory for storing the first message authentication codes.

16. The apparatus of claim 12, wherein the processor computes additional message authentication codes for groups of the first message authentication codes.

17. The apparatus of claim 16, wherein:

the first message authentication codes and the additional message authentication codes are organized in a tree structure.

18. The apparatus of claim 12, wherein the first message authentication codes comprise a Galois Message Authentication Code.

19. The apparatus of claim 12, wherein the first message authentication codes comprise hash function-based message authentication codes, one-key message authentication codes, or parallelizable message authentication codes.

20. The apparatus of claim 12, wherein the first message authentication codes are computed using a key, input data, and previously stored data blocks in one of the sets of data blocks.