Secure disposal of storage data

• US 20090196417A1
• Filed: 02/01/2008
• Published: 08/06/2009
• Est. Priority Date: 02/01/2008
• Status: Abandoned Application

• Current Assignee: Seagate Technology LLC (Seagate Technology Holdings Plc)
• Original Assignee: Seagate Technology LLC (Seagate Technology Holdings Plc)
• Inventors: Thibadeau, Robert Harwell, Beaver, Donald Rozinak
• Application Number:
  US12/012,260
• Publication Number:
  US 20090196417A1
• Time in Patent Office: Days
• US Class Current: 380/45
• CPC Class Codes: G06F 21/80 in storage media based on magnetic or optical technology, e.g. disks with sectors preventing unauthorised reproduction or copying of disc-type recordable media G11B20/00
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen

Abstract

A data storage device (such as a magnetic disk drive), which has a built-in encryption function using a self generated cipher key. The data storage device uses the cipher key to routinely encrypt the incoming data without instruction and/or control by the host system or other components that are external to the device and its dedicated controls (e.g., a disk drive controller card). The encryption function is a built-in function or self-contained function of the drive and/or it dedicated controller. To permanently delete the entire content of the drive, the cipher key is located and erased to render the ciphertext that is stored in the storage device unusable. In another embodiment of the present invention, the data disposal is managed on a file basis through the use of a plurality of internally generated file-specific cipher keys, which are managed through the aid of an internal key library.

Claims

1. A method of protecting data stored on a data storage device, comprising:

providing a cryptographic module in the data storage device;

receiving incoming data to be stored in the data storage device;

generating an encryption key by the cryptographic module for encrypting the incoming data;

encrypting the incoming data by the cryptographic module using the encryption key to generate ciphertext corresponding to the incoming data; and

storing the ciphertext in the data storage device.

2. The method of claim 1, wherein the encryption key is saved in a location in the data storage device.

3. The method of claim 1, further comprising receiving a data delete command by the data storage device with respect to stored ciphertext, and deleting the encryption key to render it permanently unavailable for decryption of the stored ciphertext.

4. The method of claim 1,

wherein different encryption keys specific to different data files stored in the data storage device are generated by the cryptographic module and stored in a key library in the data storage device, and

wherein the receiving step determines whether the incoming data is part of an existing data file already stored in data storage device, and (a) if the incoming data is part of an existing data file stored in the data storage device, the corresponding encryption key previously stored in the key library in the data storage device is retrieved from the key library, and the incoming data is encrypted using the retrieved encryption key, or (b) if the incoming data is not part of an existing data file stored in the data storage device, a new encryption key is generated by the cryptographic module for encrypting the incoming data.

5. The method of claim 1, wherein the cryptographic module routinely encrypts incoming data regardless of its type, nature and/or source, without requiring external confirmation.

6. The method of claim 1, wherein the cryptographic module encrypts incoming data of a particular file type, nature and/or source.

7. The method of claim 1, further comprising:

reading the ciphertext;

retrieving the encryption key; and

decrypting the ciphertext using the encryption key to generate plaintext corresponding to the prior stored incoming data.

8. The method of claim 7,

wherein different encryption keys corresponding to different data files stored in the data storage device are generated by the cryptographic module and stored in a key library in the data storage device, and

wherein the encryption key corresponding to a particular data file is retrieved from the key library.

9. The method of claim 7, wherein the encryption key is saved in a location in the data storage device, and the encryption is retrieved from the data storage device.

10. The method of claim 7, wherein the ciphertext is decrypted by the cryptographic module to provide corresponding plaintext to be output from the data storage device.

11. The method of claim 7, wherein upon receiving a data delete command by the data storage device with respect to stored ciphertext, deleting the encryption key to permanently prevent decryption of the stored ciphertext.

12. The method as in claim 1, wherein the data storage device comprises a magnetic data storage device.

13. A data storage system, comprising:

a data storage medium;

a transducer reading and writing data with respect to the data storage medium;

a cryptographic module protecting data stored on a data storage device, wherein the cryptographic module generates an encryption key to encrypt incoming data to generate corresponding ciphertext.

14. The data storage system of claim 13, wherein the encryption key is saved on the data storage medium.

15. The data storage system of claim 13, wherein the cryptographic module further decrypts the ciphertext using the encryption key to generate plaintext corresponding to the prior stored incoming data.

16. The data storage system of claim 15, wherein upon receiving a data delete command with respect to stored ciphertext, the encryption key is deleted to permanently prevent decryption of the stored ciphertext.

17. The data storage system of claim 15, further comprising a key library, wherein different encryption keys specific to different data files are generated by the cryptographic module and stored in the key library, wherein the encryption key specific to a data file is retrieved to decrypt ciphertext corresponding the data file.

18. The data storage system of claim 13, wherein the cryptographic module routinely encrypts incoming data regardless of its type, nature and/or source, without requiring external confirmation.

19. The data storage system of claim 13, wherein the data storage system comprises a magnetic disk drive including a magnetic data storage medium.

20. A data processing system, comprising:

a data storage system as in claim 13; and

a host system operatively coupled to the data storage system, said host system comprising a processor and an operating system, wherein the processor transfers data to and from the data storage system for read and write operations.