STORAGE DEVICE ENCRYPTION AND METHOD

• US 20090249081A1
• Filed: 03/31/2008
• Published: 10/01/2009
• Est. Priority Date: 03/31/2008
• Status: Abandoned Application

• Current Assignee: Kabushiki Kaisha Toshiba (Toshiba Corporation)
• Original Assignee: Kabushiki Kaisha Toshiba-1 Shibaura 1-Chomominatoku
• Inventors: Zayas, Fernando A.
• Application Number:
  US12/060,182
• Publication Number:
  US 20090249081A1
• Time in Patent Office: Days
• US Class Current: 713/193
• CPC Class Codes: G06F 21/80 in storage media based on magnetic or optical technology, e.g. disks with sectors preventing unauthorised reproduction or copying of disc-type recordable media G11B20/00
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A hard disk drive, and methods of providing secure access to data on a hard disk drive, are shown. In one example, an access code is sent to a hard disk drive to decipher an encrypted user key stored on the hard disk drive. In one example, at least a portion of the access code is not stored anywhere within the hard disk drive, and is provided from a host.

Claims

1. A method comprising:

opening a communication session with a storage drive;

sending an access code to the hard disk drive to decipher an encrypted user key stored on the storage drive;

wherein the access code is not stored anywhere within the storage drive; and

using the deciphered user key to access data stored on the storage drive.

2. The method of claim 1, wherein sending the access code includes sending two separate parts of a unique identification number.

3. The method of claim 1, wherein sending an access code includes sending the access code key wrapped.

4. The method of claim 1, wherein using the deciphered user key to access data includes using the deciphered user key to decipher one or more encrypted partition keys, and further using the partition keys to access the data.

5. The method of claim 4, wherein using the partition keys to access the data includes using the partition keys to decipher one or more encrypted media keys, and further using the media keys to access the data.

6. The method of claim 1, wherein sending the access code to the storage drive to decipher the encrypted user key stored on the storage drive includes sending an access code to the storage drive, and throwing away the access code after the user key is deciphered.

7. A method comprising:

generating a first session key component at a host and storing the first session key component in a host memory;

sending the first session key component and an access code from the host to a hard drive;

storing the first session key component on the hard drive;

deciphering an encrypted user key stored on the hard drive using the access code;

generating a second session key component and storing the second session key component on the hard drive;

sending the second session key component from the hard drive to the host;

storing the second session key component in the host memory; and

using the first and second session key components stored in the host memory and the first and second session key components stored in the hard drive to encrypt communication between the host and the hard drive.

8. The method of claim 7, wherein sending the first session key component and an access code includes sending the first session key component and a two part access code, including a first access code part and a second access code part.

9. The method of claim 8, wherein sending the first session key component and the two part access code includes sending the first session key component and the two part access code key wrapped.

10. The method of claim 8, wherein sending the first session key component and an access code includes:

mixing the first session key component with the second access code part; and

sending the first access code part along with the mixed first session key component.

11. The method of claim 10, wherein mixing the first session key component with the second access code part includes XOR mixing the first session key component with the second access code part.

12. The method of claim 10, wherein deciphering an encrypted user key stored on the hard drive includes using the first access code part to decipher the user key and a copy of the second access code part, both of which are encrypted together on the hard drive.

13. The method of claim 12, further including deciphering the first session key component using the copy of the second access code part.

14. The method of claim 13, wherein sending the second session key component from the hard drive to the host includes sending a second session key component mixed with the second access code part.

15. The method of claim 14, wherein sending the second session key component mixed with the second access code part includes sending a second session key component XOR mixed with the second access code part.

16. The method of claim 14, further including deciphering the second session key component at the host using a host copy of the second access code part.

17. A hard disk drive, comprising:

encrypted data stored on a disk;

an encrypted user key, the user key operable to decipher the encrypted data, wherein an access code to the encrypted user key is not stored within the hard disk drive; and

instructions stored in a media within the hard drive to accept the access code when supplied from an external host and to decipher the user key.

18. The hard disk drive of claim 17, further including a number of partitions with partition keys that are encrypted using the user key.

19. The hard disk drive of claim 17, wherein the encrypted user key is encrypted with a part of a two part unique identification number.

20. The hard disk drive of claim 17, further including a key encryption key stored within the hard disk drive to decipher the access code when provided from an external host.