Apparatus and Method for Securing Data on a Portable Storage Device

• US 20110167489A1
• Filed: 03/14/2011
• Published: 07/07/2011
• Est. Priority Date: 11/27/2002
• Status: Active Grant

• Current Assignee: Western Digital Israel Limited (Western Digital Corporation)
• Original Assignee: Aran Ziv, Eyal Bychkov
• Inventors: Ziv, Aran, Bychkov, Eyal
• Granted Patent: US 8,893,263 B2
• Time in Patent Office: Days
• US Class Current: 726/19
• CPC Class Codes: G06F 12/1466 Key-lock mechanism
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083

Abstract

A portable storage device including a microprocessor and a secure user data area, the microprocessor operable to perform on-the-fly encryption/decryption of secure data stored on the storage device under a user password, the microprocessor also operable to exclude access to the secure user data area unless the user password is provided.

Claims

1. A storage device comprising:

an interface to a host device; and

a storage medium including a first storage area associated with a first range of logical addresses and a second storage area associated with a second range of logical addresses;

wherein the storage device is operative to;

offset a logical address received from the host device by an offset parameter to produce an offset logical address if the storage device is operating in a first mode of operation, wherein the logical address is outside of the second range of logical addresses and wherein the offset logical address is in the second range of logical addresses; and

transform the offset logical address to a physical address.

2. The storage device of claim 1, wherein the storage device is in the first mode of operation only after receiving a valid user password.

3. The storage device of claim 1, wherein the storage device is operative to:

offset the logical address by a second offset parameter if the storage device is operating in a second mode of operation, wherein the logical address offset by the second offset parameter is in the first range of logical addresses.

4. The storage device of claim 3, wherein the second offset parameter is 0.

5. The storage device of claim 3, wherein the storage device is in the first mode of operation if the storage device receives a valid user password and is in the second mode of operation if the storage device does not receive a valid user password.

6. The storage device of claim 1, wherein the first storage area and second storage area comprise different attributes.

7. The storage device of claim 6, wherein the first storage area comprises a clear user area and the second storage area comprises a secure storage area.

8. The storage device of claim 6, wherein the storage device is operative to perform on-the-fly encryption/decryption to data transferred between the host device and the second storage area but not to data transferred between the host device and the first storage area.

9. The storage device of claim 1, wherein the first storage area and the second storage area each comprise a respective sector 0.

10. The storage device of claim 1, wherein the first storage area and the second storage area each comprise a respective file allocation table.

11. The storage device of claim 1, wherein the first storage area and the second storage area each comprise a respective root directory.

12. The storage device of claim 1, wherein the offset represents a difference between a total user memory area in the storage medium and a user-specified allocation for the second storage area.

13. The storage device of claim 1, wherein the storage device is further operative to prompt the host device to remount the storage device to the host device before offsetting the logical address by the offset parameter.

14. A method for offsetting a logical address by an offset parameter, the method comprising:

performing by a storage device comprising a storage medium including a first storage area associated with a first range of logical addresses and a second storage area associated with a second range of logical addresses;

offsetting a logical address received from a host device by an offset parameter to produce an offset logical address if the storage device is operating in a first mode of operation, wherein the logical address is outside of the second range of logical addresses and wherein the offset logical address is in the second range of logical addresses; and

transforming the offset logical address to a physical address.

15. The method of claim 14, wherein the storage device is in the first mode of operation only after receiving a valid user password.

16. The method of claim 14 further comprising:

offsetting the logical address by a second offset parameter if the storage device is operating in a second mode of operation, wherein the logical address offset by the second offset parameter is in the first range of logical addresses.

17. The method of claim 16, wherein the second offset parameter is 0.

18. The method of claim 16, wherein the storage device is in the first mode of operation if the storage device receives a valid user password and is in the second mode of operation if the storage device does not receive a valid user password.

19. The method of claim 14, wherein the first storage area and second storage area comprise different attributes.

20. The method of claim 19, wherein the first storage area comprises a clear user area and the second storage area comprises a secure storage area.

21. The method of claim 19 further comprising:

performing on-the-fly encryption/decryption to data transferred between the host device and the second storage area but not to data transferred between the host device and the first storage area.

22. The method of claim 14, wherein the first storage area and the second storage area each comprise a respective sector 0.

23. The method of claim 14, wherein the first storage area and the second storage area each comprise a respective file allocation table.

24. The method of claim 14, wherein the first storage area and the second storage area each comprise a respective root directory.

25. The method of claim 14, wherein the offset represents a difference between a total user memory area in the storage medium and a user-specified allocation for the second storage area.

26. The method of claim 14 further comprising

remounting the storage device to the host device before offsetting the logical address by the offset parameter.