# US 10,484,371 B2 · Device controller security system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,484,371 B2 - Document ID: US10484371B2 - Status: Granted - Kind: B2 - Application number: 15/601,234 - Filed: 2017-05-22 - Published: 2018-11-22 - Granted: 2019-11-19 - Earliest claimed: 2017-05-22 - Assignees: Seagate Technology LLC - Applicants: Seagate Technology LLC - Inventors: Jackson Ellis - Web page: https://patentgrep.com/patent/US10484371B2 ## CPC - H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)} - G06F 21/44: Program or device authentication - G06F 21/554: {involving event detection and direct action} - H04L 9/0866: {involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics} - H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)} - H04L 9/3278: {using physically unclonable functions [PUF]} - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - G06F 2221/2129: Authenticate client device independently of the user - H04L 63/126: {the source of the received data} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A computing device may accumulate behavior parameters of a controller or media with an authentication module of the controller prior to generating a unique signature with the authentication module. The unique signature can then be verified responsive to an initialization command from a host device before data is transferred by the controller between the host device and the media in response to the controller issuing at least one data access command. ## Claims ### Claim 1 A method comprising: accumulating at least one behavior parameter of a controller of a data storage device with an authentication module of the controller during data access operation of the controller; generating a unique signature of the controller with the authentication module of the controller based on the at least one behavior parameter; connecting a first host device to the controller; providing a first signature to the controller from the first host device; rejecting a first data access command from the first host in response to the first signature not matching the unique signature; connecting a second host device to the controller; providing a second signature to the controller from the second host device; verifying the second signature matches the unique signature responsive to an initialization command from the second host device to confirm the second host device is trusted; and transferring data between the second host device and the non-volatile memory with the controller in response to the controller issuing a second data access command. ### Claim 2 (depends on 1) The method of claim 1, wherein the behavior parameter consists of at least one fixed parameter and at least one dynamic parameter pertaining to the controller. ### Claim 3 (depends on 2) The method of claim 2, wherein the at least one dynamic parameter is power consumption of the controller. ### Claim 4 (depends on 2) The method of claim 2, wherein the at least one dynamic parameter is a number of data accesses conducted by the controller. ### Claim 5 (depends on 2) The method of claim 2, wherein the at least one dynamic parameter is a number of input output operations per second of the controller. ### Claim 6 (depends on 2) The method of claim 2, wherein the authentication module further utilizes at least one environmental condition around the controller to generate the unique signature. ### Claim 7 (depends on 1) The method of claim 1, wherein the authentication module processes the accumulated behavior parameters with at least one algorithm to generate the unique signature. ### Claim 8 (depends on 1) The method of claim 1, wherein the unique signature is encrypted by an encryption module of the controller. ### Claim 9 (depends on 1) The method of claim 1, wherein the unique signature comprises at least one value. ### Claim 10 A method comprising: accumulating at least one behavior parameter of a media by an authentication module of a system controller during data access operation of the media; generating a unique signature of the media with the authentication module based on the at least one behavior parameter; connecting a first host device to the controller; providing a first signature to the controller from the first host device; rejecting a first data access command from the first host in response to the first signature not matching the unique signature; connecting a second host device to the controller; providing a second signature to the controller from the second host device; verifying the unique signature responsive to an initialization command from the second host device connected to the system controller and data storage device to confirm the second host device is trusted; and transferring data between the second host device and the media with the system controller in response to the system controller issuing a second data access command. ### Claim 11 (depends on 10) The method of claim 10, wherein the unique signature is generated upon startup of a computing system of which the system controller is a part. ### Claim 12 (depends on 10) The method of claim 10, wherein the authentication module characterizes the first signature as an attack on the system controller. ### Claim 13 (depends on 10) The method of claim 10, wherein the unique signature is divided into multiple values stored in different memory locations within a computing system. ### Claim 14 (depends on 13) The method of claim 13, wherein the different memory locations are each remote from the system controller. ### Claim 15 (depends on 10) The method of claim 10, wherein the at least one behavior parameter consists of data access operations conducted by the system controller. ### Claim 16 (depends on 10) The method of claim 10, wherein the system controller is resident in a data storage device. ### Claim 17 (depends on 16) The method of claim 16, wherein the data storage device is one of many different data storage devices that collectively comprises a computing system. ### Claim 18 (depends on 10) The method of claim 10, wherein the unique signature is generated upon system controller startup and again in response to connection with the host device. ### Claim 19 (depends on 10) The apparatus of claim 10, wherein the media comprises a non-volatile memory.