IN SITU DEVICE AUTHENTICATION AND DIAGNOSTIC REPAIR IN A HOST ENVIRONMENT

• US 20160255063A1
• Filed: 02/26/2015
• Published: 09/01/2016
• Est. Priority Date: 02/26/2015
• Status: Active Grant

• Current Assignee: Seagate Technology LLC (Seagate Technology Holdings Plc)
• Original Assignee: Seagate Technology LLC (Seagate Technology Holdings Plc)
• Inventors: Zhang, YiNan, Kaiser, David R., Ali, Wajahat, Forehand, Monty A.
• Granted Patent: US 9,729,534 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 11/0727 in a storage system, e.g. in a DASD or network based storage system drivers for digital recording or reproducing units G06F3/06; circuits for error detection or correction within digital recording or reproducing units G11B20/18; for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS], H04L67/1097
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 69/40 for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection management of faults, events, alarms or notifications in data switching networks H04L41/06

Abstract

Apparatus and method for in situ authentication and diagnostic repair of a data storage device in a multi-device user environment. In accordance with some embodiments, the method includes detecting an error condition associated with a selected data storage device in the multi-device user environment. A first level of user authentication is established by providing a challenge value generated by the selected data storage device to a remote device over a network associated with the selected data storage device. A first diagnostic tool stored on the selected data storage device is executed responsive to receipt of the first level of user authentication. A second level of user authentication is established by providing a second challenge value generated by the selected data storage device to the remote device. An output from the first diagnostic tool is used to execute a second diagnostic tool stored on the selected data storage device.

Claims

1. A computer-implemented method comprising:

detecting an error condition associated with a selected data storage device in a multi-device user environment comprising a plurality of data storage devices coupled to form a combined memory space;

establishing a first level of user authentication by providing a challenge value generated by the selected data storage device to a remote device over a network associated with the selected data storage device;

executing a first diagnostic tool stored on the selected data storage device responsive to receipt of the first level of user authentication; and

establishing a second level of user authentication using an output from the first diagnostic tool and a second challenge value generated by the selected data storage device; and

executing a second diagnostic tool stored on the selected data storage device responsive to the second level of user authentication.

2. The method of claim 1, wherein the first level of user authentication is further established by requesting a challenge value from the data storage device, forwarding the challenge value to a remote device which encrypts the challenge value to generate an encrypted challenge value, transmitting the encrypted challenge value to the data storage device, applying a cryptographic operation at the data storage device to generate a second encrypted challenge value, and comparing the transmitted encrypted challenge value to the second encrypted challenge value.

3. The method of claim 1, wherein the establishing step further comprises:

combining a plurality of identification (ID) values associated with the data storage device to form a combined ID value;

encrypting the combined ID value using a secret symmetric encryption key and a selected encryption algorithm to generate a unique device credential for the data storage device; and

using the unique device credential as an input to a selected cryptographic function to control access to the first diagnostic tool.

4. The method of claim 3, wherein the plurality of unique ID values include at least a selected one of a model number, a serial number, a data capacity, a component serial number or a performance parameter of the data storage device.

5. The method of claim 1, wherein the challenge value is a multi-bit random sequence generated by the data storage device.

6. The method of claim 5, wherein the challenge value is encrypted by the data storage device.

7. The method of claim 1, wherein first and second diagnostic tools each comprise at least a selected one of a diagnostic routine, specially configured data stored on the device, device firmware, control information, or security information associated with the data storage device.

8. The method of claim 1, wherein a host device connected to the data storage device obtains a plurality of ID values from the data storage device and communicates the same to a remote server over a network along with the requested challenge value, in which the remote server returns a verification value to the host device and the host device forwards the verification value to the data storage device.

9. The method of claim 1, wherein the data storage device is characterized as a hard disc drive (HDD) having a rotatable data recording medium and a moveable data read/write transducer.

10. The method of claim 1, wherein the data storage device is characterized as a solid state drive (SSD) with a solid-state semiconductor memory array.

11. The method of claim 11, further comprising collecting metric data from the multi-device user environment associated with the selected data storage device and transmitting the metric data to a remote server over a network.

12. An apparatus comprising:

a multi-device data storage array comprising a plurality of data storage devices which cooperate to form a combined memory space; and

a host device that directs data transfers with the multi-device data storage array, the host device comprising a controller with associated programming in memory adapted to detect an error condition associated with a selected data storage device in the multi-device data storage array, establish a first level of user authentication by providing a challenge value generated by the data storage device to a remote device over a network associated with the data storage device, execute a first diagnostic tool stored on the data storage device responsive to receipt of the first level of user authentication, and establish a second level of user authentication by providing a second challenge value generated by the storage device to the remote device and an output from the first diagnostic tool to execute a second diagnostic tool stored on the data storage device.

13. The apparatus of claim 12, wherein the multi-device data storage array is characterized as forming a portion of a cloud computing environment.

14. The apparatus of claim 12, wherein the multi-device data storage array is characterized as a RAID may.

15. The apparatus of claim 12, wherein the host device further operates, responsive to the detected error condition in the selected data storage device, to reconstruct and transfer a data content stored in memory of the selected data storage device to an available replacement data storage device, and wherein the authentication and execution of the first and second diagnostic tools are carried out while the selected data storage device remains operably and physically connected in the multi-device data storage array.

16. The apparatus of claim 12, wherein the challenge value is a multi-bit random sequence generated by the data storage device.

17. The apparatus of claim 12, wherein the challenge value is encrypted by the data storage device.

18. The apparatus of claim 12, wherein first and second diagnostic tools each comprise at least a selected one of a diagnostic routine, specially configured data stored on the device, device firmware, control information, or security information associated with the data storage device.

19. The apparatus of claim 12, wherein a host device connected to the data storage device obtains a plurality of ID values from the data storage device and communicates the same to a remote server over a network along with the requested challenge value, in which the remote server returns a verification value to the host device and the host device forwards the verification value to the data storage device.

20. The apparatus of claim 12, wherein the selected data storage device further operates to transmit metric data from the multi-device user environment associated with the selected data storage device to a remote server over a network.