Self-encryption drive (SED)

A non-transitory computer-readable medium storing instructions for storing a media encryption key (MEK) in a self-encryption drive (SED) and crypto-erasing the self-encryption drive (SED) by deleting all instances of the media encryption key (MEK) stored by the self-encryption drive (SED), wherein the self-encryption drive (SED) comprises (i) a volatile memory and (ii) non-volatile storage media, the instructions when executed by one or more processors, cause the one or more processors to at least:

• send an identifier of the self-encryption drive (SED) to a key management server over a communication session between the self-encryption drive (SED) and the key management server;
• wherein the identifier uniquely identifies a data structure in a database associated with the key management server, wherein the data structure comprises a timestamp and the media encryption key (MEK);
• receive the data structure from the key management server, the data structure being wrapped with a shared session key associated with the communication session;
• unwrap the data structure with the shared session key;
• store the media encryption key (MEK) only in the volatile memory of the self-encryption drive (SED) based on the timestamp;
• encrypt data for storage in the non-volatile storage media of the self-encryption drive (SED) based on the media encryption key (MEK) stored only in the volatile memory of the self-encryption drive (SED);
• erase the media encryption key (MEK) stored only in the volatile memory of the self-encryption drive (SED) to crypto-erase the self-encryption drive (SED);
• and
• determine whether a difference between the timestamp associated with the MEK and a current timestamp is less than a certain duration and wherein the instructions to store the MEK only in the volatile memory of the SED comprises instructions to store the MEK if the difference is less than the certain duration.

A self-encryption drive (SED) arranged to store a media encryption key (MEK) in a self-encryption drive (SED) delete all instances of a media encryption key (MEK) stored by the self-encryption drive (SED) to crypto-erase the self-encryption drive (SED), the self-encryption drive (SED) comprising:

• a volatile memory;
• a non-volatile storage media;
• instructions stored in memory of the self-encryption drive (SED), when executed by one or more processors of the self-encryption drive (SED), cause the self-encryption drive (SED) to at least:
• send an identifier of the self-encryption drive (SED) to a key management server over a communication session between the self-encryption drive (SED) and the key management server;
• wherein the identifier uniquely identifies a data structure in a database associated with the key management server, wherein the data structure comprises a timestamp and the media encryption key (MEK);
• receive the data structure from the key management server, the data structure being wrapped with a shared session key associated with the communication session;
• unwrap the data structure with the shared session key;
• store the media encryption key (MEK) only in the volatile memory of the self-encryption drive (SED) based on the timestamp;
• encrypting data for storage in the non-volatile storage media of the self-encryption drive (SED) based on the media encryption key (MEK) stored only in the volatile memory of the self-encryption drive (SED);
• erase the media encryption key (MEK) stored only in the volatile memory of the self-encryption drive (SED) to crypto-erase the self-encryption drive (SED);
• and
• determine whether a difference between the timestamp associated with the MEK and a current timestamp is less than a certain duration and wherein the instructions to store the MEK only in the volatile memory of the SED comprises instructions to store the MEK if the difference is less than the certain duration.