STORAGE MEDIUM INCLUDING COMPUTING CAPABILITY FOR AUTHENTICATION

• US 20200136837A1
• Filed: 10/29/2018
• Published: 04/30/2020
• Est. Priority Date: 10/29/2018
• Status: Active Grant

• Current Assignee: Seagate Technology LLC (Seagate Technology Holdings Plc)
• Original Assignee: Seagate Technology LLC (Seagate Technology Holdings Plc)
• Inventors: PHATIGARAPHONG, Simon Thavatchai, ROY, Rupasree, OFFENBERG, Manuel Alexander
• Granted Patent: US 11,296,894 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: H04L 9/3239 involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees

Abstract

A method includes generating a private key associated with a distributed ledger. The private key is stored on a secure memory. A storage device is manufactured and includes an onboard computing device having the secure memory integrated therein. The onboard computing device is configured to sign one or more ledger operations with the private key.

Claims

1. A method comprising:

receiving a first private key and associated certificate from an issuing authority associated with a distributed ledger;

storing the first private key on a secure memory of a storage device;

accessing the first private key to enable the storage device to participate in a distributed ledger; and

signing a block of a blockchain associated with the distributed ledger with a second private key, wherein the block is associated with an operation of the distributed ledger, and the second private key having been stored on the secure memory at a time of manufacturing the storage device, and the signing being performed by an onboard computing device of the storage device having the secure memory integrated therein.

2. The method of claim 1, wherein the second private key is generated by the storage device and its associated public key certificate is issued by a certificate issuing authority.

3. The method of claim 1, wherein the onboard computing device is configured to validate the storage device when the storage device is installed to a system, wherein the onboard computing device operates independently from a process of the system and the secure memory is isolated from the system.

4. The method of claim 3, wherein validating the storage device comprises:

generating a request to the distributed ledger for first device information associated with the storage device stored on the distributed ledger, wherein the request is cryptographically signed using the second private key;

obtaining second device information from the storage device; and

comparing the first device information to the second device information, wherein the storage device is validated when the first device information and the second device information is identical.

5. The method of claim 1, wherein the onboard computing device is configured to generate a request to update a device state information stored on the distributed ledger.

6. The method of claim 5, wherein the onboard computing device is configured to verify the device state information stored on the distributed ledger after installation.

7. The method of claim 1, wherein the onboard computing device is configured to generate a request to authorize a storage device configuration operation, wherein the request is provided to the distributed ledger.

8. The method of claim 1, wherein the onboard computing device is configured as a client of the distributed ledger.

9. The method of claim 1, wherein the onboard computing device is configured as a peer of the distributed ledger.

10. A storage device comprising:

a storage portion; and

an onboard computing device, comprising;

a processor;

a memory module in signal communication with the processor, wherein the memory module includes a first private key associated with a distributed ledger, the memory module including a second private key associated with the storage device, the second private key being unique to the storage device and the second private key being stored on the memory module at a time of manufacturing the storage device; and

a communication module in signal communication with the processor and a network from which the distributed ledger is accessed, the first private key being used to enable the storage device to participate in the distributed ledger and the second private key being used to sign a block of a blockchain associated with the distributed ledger.

11. The storage device of claim 10, wherein the memory module comprises a secure memory that is isolated from system in which the storage device is installed, and wherein the second private key is maintained by the secure memory.

12. The storage device of claim 10, wherein the first private is generated by an issuing system, and wherein the issuing system is configured to generate a certificate with the first private key and further configured to securely transmit the certificate and private key to the storage device via the communication module.

13. The storage device of claim 10, wherein the onboard computing device is configured to validate the storage device when the storage device is connected to a system.

14. The storage device of claim 13, wherein onboard computing device is configured to:

generate a request to the distributed ledger for first device information associated with the storage device stored on the distributed ledger, wherein the request is cryptographically signed using the second private key;

obtain second device information from the storage device; and

compare the first device information to the second device information, wherein the storage device is validated when the first device information and the second device information is identical.

15. The storage device of claim 10, wherein the onboard computing device is configured to generate a request to update device state information stored on the distributed ledger.

16. The storage device of claim 15, wherein the onboard computing device is configured to verify the device state information stored on the distributed ledger after installation.

17. The storage device of claim 10, wherein the onboard computing device is configured to generate a request to authorize a storage device configuration operation, wherein the request is provided to the distributed ledger.

18. The storage device of claim 10, wherein the onboard computing device is configured as a client of the distributed ledger.

19. The storage device of claim 10, wherein a smart contract is stored in the storage portion of the storage device and is executable by the processor.

20. A method comprising:

generating a first private key and associated certificate from an issuing authority associated with a distributed ledger, the first private key being generated by an issuing system;

storing the first private key on a secure memory; and

signing one or more ledger operations using a second private key that is unique to a storage device, the signing being performed by an onboard computing device of the storage device, the second private key being different from the first private key and generated by the storage device; and

updating the distributed ledger to include first device information related to the storage device.

21. The method of claim 20, wherein the onboard computing device is configured to validate the storage device when the storage device is connected to a system, wherein validating the storage device comprises:

generating a request to the distributed ledger for the first device information, wherein the request is cryptographically signed using the second private key;

obtaining second device information from the storage device; and

comparing the first device information to the second device information, wherein the storage device is validated when the first device information and the second device information is identical.