Apparatus for controlling embedded security on a storage platform

A computerized system, comprising:

• a processor;
• a first memory;
• interface circuitry providing first and second input/output interfaces;
• and
• one or more system buses coupling the processor, first memory and interface circuitry together,
• wherein the processor is operative to execute instructions from the first memory to perform a method of securely operating a computerized system, including:
• forming a connection, via the first input/output interface of the interface circuitry, to a user-removable physical security device being uniquely paired with the computerized system and storing cryptographically secured data required for performing a protected function on the computerized system;
• authenticating a user having an established association with the physical security device, the authenticating resulting in activation of the physical security device on the computerized system;
• and
• only upon the activation of the physical security device on the computerized system, engaging in a security operation using the cryptographically secured data on the physical security device to enable the protected function to be performed under control of the user on the computerized system,
• the computerized system being a storage array of a storage system and the protected function being encrypted data storage operations provided by the storage array using external storage devices accessed via the second input/output interface of the interface circuitry;
• the storage array including a security structure which contains keys and data needed by the storage array to protect and unprotect user data during the encrypted data storage operations, the security structure residing in the first memory and being encrypted wholly or in part;
• the cryptographically secured data being stored in a second memory of the physical security device and including one or more encryption keys needed to decrypt the security structure to permit use of a resulting cleartext security structure for use in protecting and unprotecting the user data;
• and
• the security operation including obtaining the encryption keys from the second memory of the physical security device and using the encryption keys to decrypt the security structure to obtain the keys and data for use in the encrypted data storage operations.