Apparatus and method capable of restricting access to a data storage device

• US 6,487,646 B1
• Filed: 02/29/2000
• Issued: 11/26/2002
• Est. Priority Date: 02/29/2000
• Status: Expired due to Term

• Current Assignee: Seagate Technology LLC (Seagate Technology Holdings Plc)
• Original Assignee: TiVo Inc. (Adeia Inc.), Maxtor Corporation (Seagate Technology Holdings Plc)
• Inventors: Lee, Tain-Shain, Adams, Donald, Lacey, Stephen, Platt, David Chandler
• Primary Examiner(s): Elmore, Reba I.
• Application Number:
  US09/515,408
• Time in Patent Office: 1,001 Days
• Field of Search: 711/163, 713/202
• US Class Current: 711/163
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database

Abstract

The present invention is related to a data storage device capable of restricting access to data storage or retrieval when a first code is incompatible with a second code. The data storage device comprises (a) a data storage media having a data storage region; and (b) a controller adapted to compare a first code with a second code and to restrict access to a portion of the data storage region of the data storage device if the first code is incompatible with the second code.

Claims

1. A data storage device comprising:

(a) a data storage media having a data storage region; and

(b) a controller adapted to provide a first code to an external system and to compare a comparison value derived from the first code by the external system with a second code and to restrict access to a portion of the data storage region of the data storage device if the comparison value is incompatible with the second code.

2. A data storage device according to claim 1 further comprising a key storage area adapted to store at least one of the first code or the second code, and wherein at least one the first code or the second code is retrieved from the key storage area.

3. A data storage device according to claim 2 comprising program code to perform the retrieve and comparison steps.

4. A data storage device according to claim 1 wherein the first code comprises a first array of first values and the second code comprises a second array of second values, wherein each first value has a one-to-one correspondence with a single second value, and wherein the comparison value is incompatible with the second code if a portion of the comparison value derived from any particular first value is incompatible with the second value that corresponds with the particular first value.

5. A data storage device according to claim 1 wherein the comparison value is incompatible with the second code if the comparison value is not substantially similar to the second code.

6. A data storage device according to claim 1 wherein the portion of the data storage region of the data storage device comprises substantially all of the data storage region of the data storage device.

7. A data storage device according to claim 1 wherein if the comparison value is incompatible with the second code, the controller is further adapted to deny existence of the portion of the data storage region of the data storage device.

8. A data storage device according to claim 1 wherein the controller is further adapted to count the number of times the controller compares the comparison value with the second code, and to restrict access to the portion of the data storage region of the data storage device if the count exceeds a preset limit.

9. A data storage device according to claim 1 wherein the controller is further adapted to restrict access to the portion of the data storage region upon disconnection of the device from the external system.

10. A data storage device according to claim 1 wherein the data storage device comprises a disk drive.

11. A data storage device according to claim 10 wherein the disk drive is adapted to operate on a specific computer, and wherein the controller is adapted to restrict access to the portion of the data storage region of the data storage device upon removal of the disk drive from the specific computer.

12. A computer system comprising:

(a) a data storage device having a key storage area adapted to store a first code and a second code, a data storage region to receive and store data, and a controller; and

(b) a master module comprising program code to retrieve the first code from the data storage device and program code to generate a comparison value from the first code;

wherein the controller is adapted to receive the comparison value from the master module and to compare the comparison value to the second code and to restrict access to a portion of the data storage region of the data storage device if the comparison value is incompatible with the second code.

13. A computer system according to claim 12 wherein the key storage area, the master module or both is inaccessible to an unauthorized operator.

14. A computer system according to claim 12 wherein the master module comprises an identifier code that is used in a one-way function adapted to generate the comparison value from the first code.

15. A computer system according to claim 12 wherein the data storage device comprises a disk drive.

16. A computer system according to claim 12 wherein the first code comprises a first array of first values and the second code comprises a second array of second values, wherein each first value has a one-to-one correspondence with a single second value, and wherein the comparison value is incompatible with the second code if a portion of the comparison value derived from any particular first value is incompatible with the second value that corresponds with the particular first value.

17. A computer system according to claim 12 wherein the portion of the data storage region of the data storage device comprises substantially all of the data storage region of the data storage device.

18. A method of restricting the access of a computer to a portion of a data storage region of a data storage device, the method comprising the steps of:

(a) transferring a first code and a second code to the data storage device;

(b) transferring the first code from the data storage device to the computer;

(c) processing the first code in the computer to generate a comparison value;

(d) transferring the comparison value from the computer to the data storage device;

(e) comparing the comparison value with the second code in the data storage device; and

(f) restricting access of the computer to the portion of the data storage region of the data storage device if the comparison value and the second code are incompatible.

19. A method according to claim 18 wherein the first code is processed to generate the second code using a one-way function, and optionally an identifier code.

20. A method according to claim 18 wherein the first code is processed to generate the comparison value using a one-way function, and optionally an identifier code.

21. A method according to claim 20 wherein either one or both of the one-way function or the identifier code is maintained inaccessible to an unauthorized operator.

22. A method according to claim 18 wherein the first code comprises a first array of first values and the second code comprises a second array of second values, wherein each first value has a one-to-one correspondence with a single second value, and wherein the comparison value is incompatible with the second code if a portion of the comparison value derived from any particular first value is incompatible with the second value that corresponds with the particular first value.

23. A method according to claim 18 wherein the first code is processed to generate the second code using a one-way function, and the first code is processed to generate the comparison value using the one-way function.

24. A method according to claim 18 wherein the comparison value is incompatible with the second code if the comparison value is not substantially alike to the second code.

25. A method according to claim 18 wherein the portion of the data storage region of the data storage device comprises substantially all of the data storage region of the data storage device.

26. A method of restricting access to a portion of a data storage region of a data storage device, the method comprising the steps of:

(a) generating a second code from a first code and storing the first and second codes in the data storage device;

(b) comparing a comparison value, generated by an external system in response to retrieving the first code from the data storage device, with the second code; and

(c) restricting access to the portion of the data storage region of the data storage device if the comparison value is incompatible with the second code.

27. A method according to claim 26 wherein the second code is generated from the first code by a one-way function, and optionally an identifier code.

28. A method according to claim 27 wherein one or more of the one-way function and identifier code is maintained inaccessible to an unauthorized operator.

29. A method according to claim 26 wherein one or more of the first and second codes is encrypted.

30. A method according to claim 26 wherein the data storage device comprises a disk drive.

31. A method according to claim 26 wherein at least one of the first code or second code is maintained unreadable by an unauthorized operator.

32. A method according to claim 26 wherein the first code is generated by a random number generator.

33. A method according to claim 26 wherein comparing the comparison value with the second code is performed when the data storage device is started.

34. A method according to claim 26 further comprising denying the existence of the inaccessible portion of the data storage region of the data storage device.

35. A method according to claim 26 wherein comparing the comparison value with the second code is performed when the data storage device is disconnected from the external system and connected to another external system.

36. In a computer system including a computer and a data storage device, wherein the computer includes a master module, and the data storage device includes a controller, a data storage region and a key storage area, a method of restricting access of the computer to a portion of the data storage region, the method comprising the steps of:

providing a first code and a second code in the key storage area;

sending the first code from the key storage area to the master module;

computing a comparison value in the master module in response to the first code;

sending the comparison value from the master module to the controller; and

comparing the comparison value to the second code in the controller, wherein the controller restricts access of the computer to the portion of the data storage region if the comparing indicates that the comparison value and the second code are incompatible, and the controller permits access of the computer to the portion of the data storage region if the comparing indicates that the comparison value and the second code are compatible.

37. A method according to claim 36, wherein providing the first code and the second codes includes generating the first code and the second code in the computer, and sending the first code and the second code from the computer to the key storage area.

38. A method according to claim 37, wherein providing the first code includes creating the first code using a random number generator.

39. A method according to claim 37, wherein generating the second code includes computing the second code in response to the first code.

40. A method according to claim 39, wherein computing the second code includes processing the first code using a one-way function, and computing the comparison value includes processing the first code using the one-way function.

41. A method according to claim 40, wherein the one-way function is specifically assigned to and unique to the computer.

42. A method according to claim 40, wherein computing the second code includes processing the first code using the one-way function and an identifier code, and computing the comparison value includes processing the first code using the one-way function and the identifier code.

43. A method according to claim 42, wherein the identifier code is specifically assigned to and unique to the computer.

44. A method according to claim 42, wherein the identifier code is specifically assigned to and unique to an owner of the computer.

45. A method according to claim 42, wherein the identifier code is specifically assigned to and unique to an OEM.

46. A method according to claim 42, wherein the identifier code is created using a random number generator in the computer.

47. A method according to claim 36, wherein providing the first code and the second code includes providing a plurality of first codes and a corresponding plurality of second codes as matched pairs in the key storage region, sending the first code includes selecting the first code from the plurality of first codes, and comparing the comparison value includes selecting the second code from the plurality of second codes.

48. A method according to claim 47, wherein selecting the first code includes randomly selecting the first code from the plurality of first codes.

49. A method according to claim 36, wherein sending the first code occurs upon start-up of the data storage device.

50. A method according to claim 36, wherein computing the comparison value includes processing the first code using a one-way function.

51. A method according to claim 50, wherein the one-way function is specifically assigned to and unique to the computer.

52. A method according to claim 50, wherein computing the comparison value includes processing the first code using the one-way function and an identifier code.

53. A method according to claim 52, wherein the identifier code is specifically assigned to and unique to the computer.

54. A method according to claim 52, wherein the identifier code is specifically assigned to and unique to an owner of the computer.

55. A method according to claim 52, wherein the identifier code is specifically assigned to and unique to an OEM.

56. A method according to claim 52, wherein the identifier code is created using a random number generator in the computer.

57. A method according to claim 36, wherein the controller permits access to the portion of the data storage region by the computer if the key storage area does not include the first code and the second code.

58. A method according to claim 36, wherein the controller permits access of the computer to a remaining portion of the data storage region if the controller restricts access of the computer to the portion of the data storage region by the computer.

59. A method according to claim 36, wherein the controller denies the existence of the portion of the data storage region to the computer if the controller restricts access of the computer to the portion of the data storage region.

60. A method according to claim 36, wherein the controller disables the data storage device until the data storage device is reset if the comparing is performed more times than a preset limit.

61. A method according to claim 36, wherein the controller restricts access of the computer to the key storage area.

62. A method according to claim 36, wherein the controller restricts access of an unauthorized user to the key storage area.

63. A method according to claim 36, wherein the computer restricts access of the data storage device to the master module.

64. A method according to claim 36, wherein the computer restricts access of an unauthorized user to the master module.

65. A method according to claim 36, wherein the data storage device includes a disk, and the disk includes the data storage region and the key storage area.

66. A method according to claim 36, wherein the data storage device includes a disk and a chip, the disk includes the data storage region and the chip includes the key storage area.

67. A method according to claim 36, wherein the portion of the data storage region is substantially all of the data storage region.

68. A method according to claim 36, wherein the data storage region is larger than the key storage area.

69. A method according to claim 36, wherein the first code is 8 to 16 bytes and the second code is 8 to 16 bytes.

70. A method according to claim 36, wherein the first code is among a plurality of at least 64 first codes, the second code is among a corresponding plurality of at least 64 second codes, and the first codes and the second codes are matched pairs.

71. A method according to claim 36, wherein the computer includes a CPU, a RAM and an I/O controller card.

72. A method according to claim 71, wherein the computer includes a monitor, a keyboard and a mouse.

73. A method according to claim 36, wherein the data storage device is a disk drive, a tape drive or a flash card.

74. A method according to claim 73, wherein the data storage device is a disk drive.

75. A method according to claim 73, wherein the data storage device is a tape drive.

76. A method according to claim 73, wherein the data storage device is a flash card.

77. A method according to claim 36, wherein the computer and the data storage device are coupled together by an industry standard communications bus.

78. A method according to claim 77, wherein the communications bus is a SCSI bus.

79. A method according to claim 77, wherein the communications bus is an IDE/ATA bus.

80. A method according to claim 77, wherein the communications bus is a FireWire bus.

81. In a computer system including a computer, a disk drive and an industry standard communications bus, wherein the computer includes a master module, the disk drive includes a controller, a data storage region on a disk and a key storage area, and the communications bus provides a pathway through which the computer and the disk drive communicate with one another, a method of restricting access of the computer to a portion of the data storage region, the method comprising the steps of:

providing a first code and a second code in the key storage area;

sending the first code from the key storage area to the master module;

computing a comparison value in the master module using a one-way function in response to the first code;

sending the comparison value from the master module to the controller; and

comparing the comparison value to the second code in the controller, wherein the controller restricts access of the computer to the portion of the data storage region if the comparing indicates that the comparison value and the second code are incompatible, and the controller permits access of the computer to the portion of the data storage region if the comparing indicates that the comparison value and the second code are compatible.

82. A method according to claim 81, wherein providing the first code and the second codes includes generating the first code in the computer, computing the second code in the computer using the one-way function in response to the first code, and sending the first code and the second code from the computer to the key storage area.

83. A method according to claim 82, wherein generating the first code includes creating the first code using a random number generator.

84. A method according to claim 81, wherein providing the first code and the second code includes providing a plurality of first codes and a corresponding plurality of second codes as matched pairs in the key storage region, sending the first code includes selecting the first code from the plurality of first codes, and comparing the comparison value includes selecting the second code from the plurality of second codes.

85. A method according to claim 84, wherein selecting the first code includes randomly selecting the first code from the plurality of first codes.

86. A method according to claim 81, wherein the data storage region is larger than the key storage area, and the portion of the data storage region is substantially all of the data storage region.

87. A method according to claim 81, wherein the controller permits access to the portion of the data storage region by the computer if the key storage area does not include the first code and the second code.

88. A method according to claim 81, wherein the controller permits access of the computer to a remaining portion of the data storage region if the controller restricts access of the computer to the portion of the data storage region by the computer.

89. A method according to claim 81, wherein the controller denies the existence of the portion of the data storage region to the computer if the controller restricts access of the computer to the portion of the data storage region.

90. A method according to claim 81, wherein the controller disables the data storage device until the data storage device is reset if the comparing is performed more times than a preset limit.