Back to results
US 10,855,451 B1Granted
Removable circuit for unlocking self-encrypting data storage devices
AssigneeSeagate Technology LLC
InventorChristopher Nicholas Allo
Life of this patent
Estimating the term…
Abstract
Security of data storage devices and servers can be improved by the system and methods described herein. In some embodiments, a key management server may be locally or externally located. An encryption key may be used for locking a portion or the entirety of a storage device. The key management server may communicate with data storage devices regarding encryption keys using secure protocols. For example, the key management server may generate a communication key that may be used to securely encrypt messages between the server and a data storage device.
Claims19
An apparatus comprising:
- a data storage device configured to:
- connect to be removable from a first server;
- load a key management system stored locally in the data storage device into a memory of the first server, the key management system configured to:
- unlock a secure storage area of the data storage device and retrieve a drive information table and an authentication certificate stored within the secure storage area, the drive information table including information to identify data storage devices having corresponding encryption keys registered with a second server;
- transmit, from the first server to the second server, a request for an encrypted key corresponding to an encrypted storage device (“ESD”) when the ESD is listed in the drive information table, the request including the authentication certificate;
- retrieve a communication key corresponding to the ESD from the secure storage area;
- receive the encrypted key from the second server in response to sending the authentication certificate;
- and
- unlock a secure storage area of the ESD with the encrypted key, the key management system configured to use the communication key to secure communication between the key management system and the ESD while performing the unlock of the secure storage area of the ESD.
6 more elements
A system comprising:
- a data storage device configured to be connectable and removable from a first server, the data storage device including:
- an interface circuit;
- a secure nonvolatile data storage area;
- a secure storage information table stored within the secure nonvolatile data storage area, the secure storage information table identifying whether encrypted data storage memories or devices connected to the first server have encryption keys registered with a second server;
- a memory storing a key management system;
- a controller configured to:
- load the key management system into the memory of the first server, the key management system configured to:
- access a hardware encryption circuit of the first server;
- obtain access to the secure nonvolatile data storage area of the data storage device via the hardware encryption circuit;
- retrieve the secure storage information table and an authentication certificate from the secure nonvolatile data storage area when access is granted to the key management system;
- transmit, from the first server to a second server, a request for an encryption key corresponding to an encrypted data storage memory connected to the first server, the request including the authentication certificate;
- retrieve a communication key corresponding to the encrypted data storage memory from the secure nonvolatile data storage;
- receive the encryption key from the second server;
- and
- unlock the encrypted data storage memory with the encryption key, the key management system configured to use the communication key to secure communication between the key management system and the encrypted data storage memory while performing the unlock of the encrypted data storage memory.
12 more elements
A memory device storing instructions that when executed cause a processor to perform a method comprising:
- accessing a hardware encryption circuit of a first server;
- obtaining access to a secure nonvolatile data storage area of a first data storage device via the hardware encryption circuit;
- retrieving an authentication certificate from the secure nonvolatile data storage area when access is granted;
- transmitting, from the first server to a second server, a request for an encryption key corresponding to a second data storage device connected to the first server, the request including the authentication certificate;
- retrieving a communication key from the secure nonvolatile data storage area;
- receiving the encryption key from the second server;
- and
- unlocking the second data storage device with the encryption key while, during the unlocking, securing communication with the second data storage device via the communication key;
- and
- retrieving a secure storage information table stored within the secure nonvolatile data storage area, the secure storage information table identifying data storage devices and corresponding encryption keys registered with the second server.
7 more elements
Dependencies are inferred from the claim text.