Apparatus and method for securing data on a portable storage device

• US 8,694,800 B2
• Filed: 10/19/2010
• Issued: 04/08/2014
• Est. Priority Date: 11/27/2002
• Status: Expired due to Term

• Current Assignee: Western Digital Israel Limited (Western Digital Corporation)
• Original Assignee: SanDisk IL Ltd. (Western Digital Corporation)
• Inventors: Ziv, Aran, Bychkov, Eyal
• Primary Examiner(s): Gergiso, Techane
• Application Number:
  US12/907,290
• Publication Number:
  US 20110035603A1
• Time in Patent Office: 1,267 Days
• Field of Search: 713/193, 713/189
• US Class Current: 713/193
• CPC Class Codes: G06F 12/1466 Key-lock mechanism
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083

Abstract

A portable storage device including a microprocessor and a secure user data area, the microprocessor operable to perform on-the-fly encryption/decryption of secure data stored on the storage device under a user password, the microprocessor also operable to exclude access to the secure user data area unless the user password is provided.

Claims

1. A method for accessing a secure user area of a physical storage device, the method comprising:

performing by a physical storage device that has a physical storage medium including a clear user area and a secure user area, wherein the clear user area is in a first range of physical addresses in the storage medium, wherein the secure user area is in a second range of physical addresses in the storage medium, wherein the clear user area and the secure user area are physically separate areas in the storage medium, and wherein the physical storage device is operative to allow access to the clear user area without requiring a user password and to allow access to the secure user area only upon receiving the user password;

receiving the user password from a host device in communication with the physical storage device; and

performing at least one of (a) and (b);

(a) receiving data from the host device, performing on-the-fly encryption of the data, and storing the encrypted data in the secure user area; and

(b) reading encrypted data from the secure user area, performing on-the-fly decryption of the encrypted data, and sending the decrypted data to the host device.

2. The method of claim 1 further comprising determining that the user password is valid by comparing the user password with a stored password.

3. The method of claim 1 further comprising determining that the user password is valid by hashing the user password and comparing the hashed user password to a stored hashed password.

4. The method of claim 1, wherein the physical storage device stores a key used for at least one of on-the-fly encryption and on-the-fly decryption.

5. The method of claim 4, wherein the key is encrypted with the user password.

6. The method of claim 1, wherein the physical storage device is operative to access the secure user area by offsetting a logical address received from the host device by an offset parameter before transforming the logical address to a physical address.

7. The method of claim 6, wherein the offsetting is performed after the host device remounts the physical storage device.

8. The method of claim 1 further comprising configuring a size of the secure user area based on a request by a user.

9. The method of claim 8, wherein the configuring is performed by a program stored in the physical storage device and executed by the physical storage device.

10. The method of claim 8, wherein the configuring is performed only after determining that the user password is valid.

11. A physical storage device comprising:

an interface to a host device; and

a physical storage medium including a clear user area and a secure user area, wherein the clear user area is in a first range of physical addresses in the storage medium, wherein the secure user area is in a second range of physical addresses in the storage medium, and wherein the clear user area and the secure user area are physically separate areas in the storage medium;

wherein the physical storage device is operative to allow access to the clear user area without requiring a user password and to allow access to the secure user area only upon receiving the user password; and

wherein the physical storage device is further operative to;

receive the user password from the host device via the interface; and

perform at least one of (a) and (b);

(a) receive data from the host device, perform on-the-fly encryption of the data, and store the encrypted data in the secure user area; and

(b) read encrypted data from the secure user area, perform on-the-fly decryption of the encrypted data, and send the decrypted data to the host device.

12. The physical storage device of claim 11, wherein the physical storage device is operative to determine that the user password is valid by comparing the user password with a stored password.

13. The storage device of claim 11, wherein the physical storage device is operative to determine that the user password is valid by hashing the user password and comparing the hashed user password to a stored hashed password.

14. The storage device of claim 11, wherein the physical storage medium stores a key used for at least one of on-the-fly encryption and on-the-fly decryption.

15. The storage device of claim 14, wherein the key is encrypted with the user password.

16. The storage device of claim 11, wherein the physical storage device is operative to access the secure user area by offsetting a logical address received from the host device by an offset parameter before transforming the logical address to a physical address.

17. The storage device of claim 16, wherein the offsetting is performed after the host device remounts the physical storage device.

18. The storage device of claim 11, wherein the physical storage device is operative to configure a size of the secure user area based on a request by a user.

19. The storage device of claim 18, wherein the physical storage device is operative to configure the size of the secure user area by executing a program stored in the physical storage device.

20. The storage device of claim 18, wherein the physical storage device is operative to configure the size of the secure user only after determining that the user password is valid.