# US 2018/0024942 A1 · Using encryption keys to manage data retention > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0024942 A1 - Document ID: US20180024942A1 - Status: Published application - Kind: A1 - Application number: 15/217,863 - Filed: 2016-07-22 - Published: 2018-01-25 - Earliest claimed: 2016-07-22 - Assignees: Seagate Technology LLC - Applicants: Seagate Technology LLC - Inventors: Timothy Canepa; Ramdas Kachare - Web page: https://patentgrep.com/patent/US20180024942A1 ## CPC - H04L 9/088: {Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068)} - G06F 12/1408: {by using cryptography (for digital transmission H04L9/00)} - H04L 9/0838: {Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these (network architectures or network communication protocols for key exchange in a packet data network H04L63/061)} - H04L 9/0897: {involving additional devices, e.g. trusted platform module [TPM], smartcard or USB} - H04L 9/3228: {One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key} - G06F 2212/1052: Security improvement - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Systems and methods for using encryption keys to manage data retention are described. In one embodiment, the systems and methods may include receiving data such as user data from a host of the storage drive, encrypting the data using an encryption key, writing the encrypted data to the storage drive, and retaining the encrypted data on the storage drive based at least in part on a validity of the encryption key. ## Claims ### Claim 1 A storage system comprising: a storage drive; and a controller to: encrypt data using an encryption key; write the encrypted data to the storage drive; and retain the encrypted data on the storage drive based at least in part on a validity of the encryption key. ### Claim 2 (depends on 1) The storage system of claim 1, comprising the controller to: receive the data from a host of the storage drive, the data including user data. ### Claim 3 (depends on 1) The storage system of claim 1, comprising the controller to: assign an encryption identifier to the encryption key, the encryption key being programmed in the controller. ### Claim 4 (depends on 3) The storage system of claim 3, comprising the controller to: store the encryption identifier of the encryption key in metadata associated with the encrypted data; and identify an expiration policy of the encryption key. ### Claim 5 (depends on 3) The storage system of claim 3, comprising the controller to: store the encryption identifier in a mapping table, the mapping table mapping a logical block address (LBA) of the encrypted data with a physical location on the storage drive. ### Claim 6 (depends on 3) The storage system of claim 3, comprising the controller to: receive a command to read the encrypted data from the storage drive. ### Claim 7 (depends on 6) The storage system of claim 6, comprising the controller to: acquire the encryption identifier associated with the encrypted data. ### Claim 8 (depends on 7) The storage system of claim 7, comprising the controller to: verify a validity of the encryption key based at least in part on acquiring the encryption identifier. ### Claim 9 (depends on 8) The storage system of claim 8, comprising the controller to: upon determining the encryption key is valid, decrypt the encrypted data using the encryption key; and transfer the decrypted data to the host. ### Claim 10 (depends on 8) The storage system of claim 8, comprising the controller to: upon determining the encryption key is invalid, remove the LBA of the encrypted data from the mapping table; and discard the encrypted data from the storage drive. ### Claim 11 An apparatus comprising: a controller to: encrypt data using an encryption key; write the encrypted data to the apparatus; and retain the encrypted data on the apparatus based at least in part on a validity of the encryption key. ### Claim 12 (depends on 11) The apparatus of claim 11, comprising the controller to: receive the data from a host of the apparatus, the data including user data. ### Claim 13 (depends on 11) The apparatus of claim 11, comprising the controller to: assign an encryption identifier to the encryption key, the encryption key being programmed in the controller. ### Claim 14 (depends on 13) The apparatus of claim 13, comprising the controller to: store the encryption identifier of the encryption key in metadata associated with the encrypted data; and identify an expiration policy of the encryption key. ### Claim 15 (depends on 13) The apparatus of claim 13, comprising the controller to: store the encryption identifier in a mapping table, the mapping table mapping a logical block address (LBA) of the encrypted data with a physical location on the storage drive. ### Claim 16 (depends on 13) The apparatus of claim 13, comprising the controller to: receive a command to read the encrypted data from the storage drive. ### Claim 17 (depends on 16) The apparatus of claim 16, comprising the controller to: acquire the encryption identifier associated with the encrypted data. ### Claim 18 (depends on 17) The apparatus of claim 17, comprising the controller to: verify a validity of the encryption key based at least in part on acquiring the encryption identifier. ### Claim 19 A method comprising: receiving data from a host of the storage drive, the data including user data; encrypting the data using an encryption key; writing the encrypted data to the storage drive; and retaining the encrypted data on the storage drive based at least in part on a validity of the encryption key. ### Claim 20 (depends on 19) The method of claim 19, comprising: assigning an encryption identifier to the encryption key, the encryption key being programmed in a controller of the storage drive; storing the encryption identifier of the encryption key in metadata associated with the encrypted data; and identifying an expiration policy of the encryption key.