Password protection for removable hard drive

• US 6,012,146 A
• Filed: 09/08/1997
• Issued: 01/04/2000
• Est. Priority Date: 10/27/1995
• Status: Expired due to Term

• Current Assignee: NCR Voyix Corporation
• Original Assignee: NCR Corporation (NCR Voyix Corporation)
• Inventors: Liebenow, Frank W.
• Primary Examiner(s): Beausoliel, Jr., Robert W.
• Assistant Examiner(s): ELISCA, PIERRE E
• Application Number:
  US08/925,429
• Time in Patent Office: 848 Days
• Field of Search: 395/188.01, 395/186, 395/187.01, 380/3, 380/4
• US Class Current: 726/17
• CPC Class Codes: G06F 21/80 in storage media based on magnetic or optical technology, e.g. disks with sectors preventing unauthorised reproduction or copying of disc-type recordable media G11B20/00
• CPC Class Codes: G06F 2211/007 Encryption, En-/decode, En-/decipher, En-/decypher, Scramble, (De-)compress
• CPC Class Codes: G06F 2211/1097 Boot, Start, Initialise, Power
• CPC Class Codes: G11B 19/02 Control of operating function, e.g. switching from recording to reproducing
• CPC Class Codes: G11B 20/00086 Circuits for prevention of unauthorised reproduction or copying, e.g. piracy indicating unauthorised use of record carriers in general G11B23/28; scrambling for television signal recording H04N5/913; network architectures or network protocols for network security H04L63/00; cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
• CPC Class Codes: G11B 20/00152 involving a password
• CPC Class Codes: G11B 20/00695 said measures preventing that data are read from the recording medium

Abstract

A device and method for preventing access to data on a hard drive in which a first password is stored on the hard drive so that it is not accessible from a system in which the hard drive is installed, and in which a second password is provided from the system. A comparison of the two passwords is made in a processor in the hard drive to determine whether the two passwords are the same. If the result of the comparison of the first and second passwords is that the two passwords are not the same, access to the hard drive is denied.

Claims

1. A method of preventing unauthorized access to data on a hard drive that is movable from one system having an access restrictor which permits access to the data on the hard drive only through use of a password to another system in which the data on the hard drive would have been accessible without providing the password, the method comprising the steps of:

(a) providing a movable hard drive which has means for preventing access to the data on the hard drive;

(b) storing a first password on the hard drive so that the first password is not accessible from a system in which the hard drive is installed;

(c) providing a second password from the system in which the hard drive is installed to the hard drive;

(d) making a comparison in the hard drive of the first and second passwords to determine whether the two passwords are the same;

(e) preventing access to the data on the hard drive if the result of the comparison of the first and second passwords is that the two passwords are not the same;

(f) granting access to the data on the hard drive if the comparison indicates that the two passwords are the same, and storing the second password in the system in which the hard drive is installed so that the second password remains stored only so long as the system in which the hard drive is stored remains powered; and

(g) automatically providing said second password to said hard drive for comparison if access to the data on the hard disk is subsequently prevented after having been granted.

2. The method of claim 1 wherein the storing of the second password in step (f) further comprises temporarily storing the second password in random access memory in the system in which the hard drive is installed.

3. The method of claim 1 wherein the step of storing the first password comprises the steps of:

partitioning a storage medium in the hard drive into a hidden area not accessible from the system in which the hard drive is installed and a data storage area; and

storing the first password in the hidden area.

4. The method of claim 1 where the step of making a comparison comprises the steps of:

loading the first password into a RAM in the hard drive under the control of instructions from a ROM in the hard drive;

comparing the first and second passwords in a microprocessor in the hard drive; and

providing an enable signal if the result of the comparison is that the two passwords are the same.

5. The method of claim 4 where the step of preventing access comprises the steps of providing an unlock signal from the system in which the hard drive is installed;

and

preventing access to the data in the absence of one of the unlock signal and the enable signal.

6. The method of claim 1 where the step of preventing access comprises the steps disabling communication of read/write data between a read/write head in the hard drive and hard drive electronics.

7. The method of claim 1 further comprising the steps of:

storing a first fleet password on plural ones of the hard drive so that the fleet password is not accesible from systems in which the plural hard drives are installed;

providing a second fleet password from one of the systems in which the plural hard drives are installed to one or more of the plural ones of the hard drive installed in the providing system;

making a comparison in the one or more of the plural ones of the hard drive installed in the providing system of the first fleet password and the second fleet password to determine whether the two fleet passwords are the same.

8. The method of claim 1 wherein the system in which the hard drive is installed has an interface for communicating with the hard drive, and wherein the method further comprises the steps of:

providing the second password to the interface; and

providing an unlock command to the hard drive from the interface as a necessary prerequisite for step (d).

9. A method of selectively protecting data on a storage medium in a data reader that is in a system, the method comprising the steps of:

(a) determining with the data reader whether a predetermined storage location on the storage medium is blank;

(b) disabling access to the storage medium if the storage location is not blank and in the absence of an enable signal;

(c) sending a password from the system to the data reader;

(d) comparing on the data reader the password to a content of the storage location;

(e) generating on the data reader an enable signal for allowing access to the storage medium if the password favorably compares to the contents;

(f) storing the password in the system only as long as the system remains powered; and

(g) automatically providing the password stored in the system to the data reader for comparison if the enable signal is lost.

10. The method of claim 9 further comprising the step of storing the password in the storage location of the storage medium if the storage location is blank.

11. The method of claim 9 further comprising the step of changing the content of the storage location after the step of generating the enable signal.

12. A method of controlling access to data on a removable data storage device that is useable in any one of plural systems for processing the data accessed from the data storage device, the method comprising the steps of:

(a) storing a first password on the data storage device so that the first password can only be accessed by the data storage device;

(b) providing a second password to the data storage device from a one of the systems which is seeking access to the data on the data storage device;

(c) comparing on the data storage device the first and second passwords;

(d) permitting access to the data on the data storage device from the one of the systems and storing the second password on the one of the systems only as long as the one of the systems remains powered if the first and second passwords are the same; and

(e) automatically providing the second password to the data storage device from the one of the systems if access to the data on the storage device is subsequently denied after having been permitted,

whereby permission to access the data on the data storage device from any of the plural systems for processing the data on the data storage device is granted only by the data storage device.

13. The method of claim 12 wherein the step of storing the first password comprises the step of storing the first password in a predetermined non-volatile storage location on a storage medium in the data storage device.

14. The method of claim 13 wherein the step of comparing the two passwords comprises the steps of providing the first password from the predetermined storage location on the storage medium to a processor in the data storage device, and comparing the two passwords in the processor.

15. The method of claim 14 wherein the step of permitting access comprises the steps of providing from the processor an enable signal if the two passwords are the same, receiving a request for access to the data from the one of the systems, and allowing access to the data in the presence of the enable signal and the request for access.

16. A system for controlling access to data on a data storage device installed in a system,

said data storage device comprising,

a storage medium having a predetermined storage location for storing a first password, said storage location not being accessible from said system,

means for receiving a second password,

a comparator for comparing said first and second passwords, and for providing an enable signal when said first and second passwords are the same,

means for denying access to said storage medium from said system in the absence of said enable signal;

and said system comprising a data request interface for providing a request for access to data on said data storage device, and

means for storing said second password only for so long as said system remains powered and for automatically providing said second password from said means for storing to said means for receiving responsive to an absence of said enable signal, where said enable signal was previously present.

17. The system of claim 16 wherein said system further comprises a volatile memory for storing said second password and a BIOS for automatically providing said second password from said volatile memory to said data storage device for comparison to the first password.

18. The system of claim 16 wherein said storage location further stores a fleet password, said means for receiving receives a second fleet password, and said comparator compares said first and second fleet passwords and provides said enable signal when said first and second fleet passwords are the same.

19. The system of claim 16 wherein said comparator and said means for denying access are implemented in firmware.

20. The system of claim 16 wherein said comparator comprises RAM for storing said first and second passwords, and a processor operatively connected to said RAM for comparing said first and second passwords.

21. The system of claim 16 wherein said means for denying access comprises a circuit between a read/write head of said data storage device and drive electronics for said data storage device, said circuit comprising a logical gate responsive to said enable signal.

22. The system of claim 16 wherein said data storage device comprises a hard drive.